INCIDENT 2026-09-07 04:48:42 trigger: php_procs=27 php_rss=1742MB mysql_conn=24 ================================================================== load: 2.93 1.85 1.85 25/716 1402131 ncpu:10 mem_avail: 8801MB/13777MB (63.9%) swap_used:2772MB swapout:376/s blocked(D):1 running:27 iowait:7.0% steal:0.0% php: 27 procs / 1742MB heaviest user: tubesupplies (22 procs, 1663MB) apache: 35 procs tcp_estab: 97 --- RSS by user (all processes) --- USER PROCS RSS_MB tubesupplies 22 1848 mysql 1 1598 root 252 1093 nobody 34 589 netdata 8 247 mailman 20 101 evolution 12 65 wp-toolkit 3 56 dovenull 6 55 kurri 3 37 candyfabcom 2 28 lowrange 2 27 mailnull 2 24 dovecot 3 23 cpanellogin 1 23 aaa 1 15 infinium 1 14 zabbix 1 10 named 1 9 polkitd 1 6 --- php workers by user --- USER PROCS RSS_MB tubesupplies 22 1868 evolution 4 55 root 1 23 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 8514 MB Active(file): 5057 MB Inactive(file): 2710 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 663 MB CommitLimit: 10984 MB Committed_AS: 11372 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-02:26:17 4804 /usr/bin/imunify-agent-proxy 4109079 root 2-00:03:55 1752 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-00:03:55 172140 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 1637372 2.9 Ssl 1-09:12:12 /usr/sbin/mariadbd 166870 1 netdata 185968 2.6 Ssl 1-02:26:23 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 4109105 4109079 root 172140 1.5 Sl 2-00:03:55 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 904997 1 root 146056 0.0 Ss 02:25:46 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1402084 1401957 tubesupplies 143348 58.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 923652 904997 root 143220 0.0 S 02:18:59 spamd child 167871 1 root 135816 0.0 Ss 1-02:26:16 /usr/lib/systemd/systemd-journald 1402091 1401949 tubesupplies 120580 50.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402082 1401976 tubesupplies 117464 48.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402093 1401977 tubesupplies 112704 46.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402089 1400736 tubesupplies 109368 44.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402075 1384808 tubesupplies 104768 41.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402092 1400701 tubesupplies 103864 41.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402079 1401978 tubesupplies 99848 37.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402094 1401959 tubesupplies 93100 32.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402088 1367109 tubesupplies 92192 31.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402087 1402030 tubesupplies 92048 31.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402081 1367108 tubesupplies 91828 32.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402076 1401979 tubesupplies 91392 30.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402080 1400702 tubesupplies 90164 29.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402090 1401973 tubesupplies 89804 28.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402078 1400737 tubesupplies 89004 29.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402086 1385362 tubesupplies 87168 27.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402083 1400738 tubesupplies 85304 26.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402077 1401956 tubesupplies 85272 25.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402095 1401950 tubesupplies 81824 25.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402085 1401975 tubesupplies 81492 24.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1402110 1402099 tubesupplies 79472 50.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 923653 904997 root 76964 0.0 S 02:18:58 spamd child 1402100 1384054 evolution 57080 9.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1469 1 root 42060 0.1 Ss 69-18:38:58 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 42008 0.1 Ss 47-02:07:29 cpsrvd (SSL) - waiting for connections 167562 166914 netdata 37540 0.1 Sl 1-02:26:18 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 34748 0.0 Sl 10-02:29:03 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166645 1 wp-toolkit 31968 0.0 Ss 1-02:26:27 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1401852 1353308 root 31892 0.0 S 00:26 whostmgrd - serving 66.132.172.198 1402034 1353308 root 31892 0.0 S 00:08 whostmgrd - serving 66.132.172.198 904447 1 root 29796 0.0 Ss 02:26:18 lfd - sleeping 1367108 506832 nobody 24652 0.0 S 11:00 /usr/sbin/httpd -k start 1315751 1353308 cpanellogin 24492 0.0 S 26:24 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 167896 1 root 23896 0.0 Ss 1-02:26:15 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1367109 506832 nobody 22708 0.0 S 11:00 /usr/sbin/httpd -k start 1463 1 root 22692 0.0 Ss 69-18:38:58 tailwatchd 1400701 506832 nobody 21904 0.0 S 02:32 /usr/sbin/httpd -k start 1400737 506832 nobody 21088 0.1 S 02:31 /usr/sbin/httpd -k start 1383233 506832 nobody 21056 0.0 S 08:05 /usr/sbin/httpd -k start 1385362 506832 nobody 21032 0.0 S 04:40 /usr/sbin/httpd -k start 1400702 506832 nobody 20908 0.0 S 02:32 /usr/sbin/httpd -k start 1400738 506832 nobody 20780 0.1 S 02:31 /usr/sbin/httpd -k start 1384808 506832 nobody 20316 0.0 S 05:21 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19760 0.0 Ss 1-02:26:16 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1384054 506832 nobody 19536 0.0 S 06:35 /usr/sbin/httpd -k start 1401956 506832 nobody 19420 0.2 S 00:13 /usr/sbin/httpd -k start 1401949 506832 nobody 19380 0.2 S 00:14 /usr/sbin/httpd -k start 1401957 506832 nobody 19264 0.2 S 00:13 /usr/sbin/httpd -k start 1401959 506832 nobody 19120 0.2 S 00:13 /usr/sbin/httpd -k start 1401950 506832 nobody 19112 0.2 S 00:14 /usr/sbin/httpd -k start 1384574 506832 nobody 19072 0.0 S 05:42 /usr/sbin/httpd -k start 1384893 506832 nobody 18964 0.0 S 05:18 /usr/sbin/httpd -k start 1401978 506832 nobody 18224 0.1 S 00:12 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 942404 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 105 evolution/my.evolutionerp.com.au-ssl_log 79 tubesupplies/tubesupplies.com.au-ssl_log 45 madalice/madalice.com.au-ssl_log 5 aaa/aaadownunder.com.au-ssl_log 4 customc/customcentral.com.au-ssl_log 4 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 105 40.115.94.245 64 103.104.165.99 43 213.209.159.84 20 192.145.125.92 4 103.177.150.93 3 52.167.144.166 2 52.167.144.167 2 209.141.55.190 2 207.46.13.155 2 118.127.40.55 2 114.119.131.88 2 114.119.130.40 1 2001:4ca0:108:42::24 1 185.208.164.193 --- top request paths across all vhosts (last 3 min) --- 53 GET /api/getItem/LWPB2001KG 17 GET /app/ajax.php 17 GET / 16 POST /functions.php 14 GET /index.php 7 POST /plugins/csvexporter/plugin.php 5 GET /wp-login.php 4 GET /store/af1-richmond9/ 3 POST /app/ajax/selectFilterSingle.php 3 POST /app/ajax.php 2 POST /wp-cron.php 2 POST /print.php 2 POST /clienteditsave.php 2 POST /app/ajax/selectFilter.php 2 GET /shop/ 2 GET /services/steel-fabrication/ 2 GET /services/rural/ 2 GET /services/resellers/ 2 GET /request-a-quote/ 2 GET /product-list/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 53 GET /api/getItem/LWPB2001KG 2 GET /api/getItem/DT120HS4 1 GET /api/getItem/SPHDG15040 1 GET /api/getItem/PT75M 1 GET /api/getItem/PT65M 1 GET /api/getItem/PT50M 1 GET /api/getItem/PT100M 1 GET /api/getItem/PC19BL 1 GET /api/getItem/ML3VPA 1 GET /api/getItem/ML3TPLA 1 GET /api/getItem/LOCKING_EYE%28DG%29 1 GET /api/getItem/KEB-8MM-CHAIN -- last 10 requests -- 40.115.94.245 - - [07/Sep/2026:04:47:40 +1000] "GET /api/getItem/K50MSGB HTTP/1.1" 200 1704 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:47:40 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:47:40 +1000] "GET /api/getItem/K60MSGB HTTP/1.1" 404 109 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:47:40 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:47:41 +1000] "GET /api/getItem/K65MSGB HTTP/1.1" 200 1710 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:47:41 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:47:41 +1000] "GET /api/getItem/K75MSGB HTTP/1.1" 200 1794 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:47:41 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:47:41 +1000] "GET /api/getItem/K90MSGB HTTP/1.1" 200 1428 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:47:42 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 17 GET /app/ajax.php 16 POST /functions.php 14 GET /index.php 7 POST /plugins/csvexporter/plugin.php 3 POST /app/ajax/selectFilterSingle.php 3 POST /app/ajax.php 2 POST /print.php 2 POST /clienteditsave.php 2 POST /app/ajax/selectFilter.php 2 GET /app/templates/ajax.php 2 GET / 1 POST /plugins/fencecosting/plugin.php -- last 10 requests -- 52.167.144.166 - - [07/Sep/2026:04:48:17 +1000] "GET /index.php?page=pickingedit&pickingid=16038 HTTP/1.1" 200 5378 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bi 103.104.165.99 - - [07/Sep/2026:04:48:19 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=11288" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 52.167.144.167 - - [07/Sep/2026:04:48:21 +1000] "GET /index.php?page=jobedit&id=27807 HTTP/1.1" 200 5366 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) 103.104.165.99 - - [07/Sep/2026:04:48:32 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=11288" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 103.104.165.99 - - [07/Sep/2026:04:48:39 +1000] "GET /index.php?modules=projects&page=deliveries&runsheet_date=2026-09-08&branch=1 HTTP/1.1" 200 21871 "https://my.evolutionerp.com.au/index.php?modules=projects&page=deliv 103.104.165.99 - - [07/Sep/2026:04:48:39 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?modules=projects&page=deliveries&runsheet_date=2026-09-08&branch=1" "Mozill 103.104.165.99 - - [07/Sep/2026:04:48:40 +1000] "GET /app/ajax.php?cn=&furi=true&uri=modules%3Dprojects%26page%3Ddeliveries%26runsheet_date%3D2026-09-08%26branch%3D1&call=getUserSetting&caller=ajaxSubmitLocal&seq=1676647 103.104.165.99 - - [07/Sep/2026:04:48:41 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?modules=projects&page=deliveries&runsheet_date=2026-09-08&branch=1" "Mozilla 103.104.165.99 - - [07/Sep/2026:04:48:42 +1000] "GET /index.php?modules=projects&page=deliveries&runsheet_date=2026-09-07&branch=1 HTTP/1.1" 200 22379 "https://my.evolutionerp.com.au/index.php?modules=projects&page=deliv 103.104.165.99 - - [07/Sep/2026:04:48:43 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?modules=projects&page=deliveries&runsheet_date=2026-09-07&branch=1" "Mozill == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 16 GET / 5 GET /portfolio/sydney-fish-market/ 4 GET /product-list/ 4 GET /portfolio/randwick-hospital/ 3 GET /services/sheds/ 3 GET /portfolio/hunter-expressway/ 3 GET /about-us/ 2 GET /shop/ 2 GET /services/trailer-manufacturing/ 2 GET /services/steel-fabrication/ 2 GET /services/rural/ 2 GET /services/resellers/ -- last 10 requests -- 213.209.159.84 - - [07/Sep/2026:04:48:41 +1000] "GET /projects/ HTTP/1.1" 200 20277 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 [ip:93.41.125.186]" 213.209.159.84 - - [07/Sep/2026:04:48:41 +1000] "GET /portfolio/randwick-hospital/ HTTP/1.1" 200 24838 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 213.209.159.84 - - [07/Sep/2026:04:48:41 +1000] "GET /portfolio/randwick-hospital/ HTTP/1.1" 200 24845 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 213.209.159.84 - - [07/Sep/2026:04:48:41 +1000] "GET /portfolio/sydney-fish-market/ HTTP/1.1" 200 24729 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 213.209.159.84 - - [07/Sep/2026:04:48:41 +1000] "GET /product-list/ HTTP/1.1" 200 24784 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 [ip:93.41.125.1 213.209.159.84 - - [07/Sep/2026:04:48:41 +1000] "GET /portfolio/hunter-expressway/ HTTP/1.1" 200 24605 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 213.209.159.84 - - [07/Sep/2026:04:48:41 +1000] "GET /portfolio/sydney-fish-market/ HTTP/1.1" 200 24726 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 213.209.159.84 - - [07/Sep/2026:04:48:41 +1000] "GET /services/sheds/ HTTP/1.1" 200 27891 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 [ip:93.41.125 213.209.159.84 - - [07/Sep/2026:04:48:41 +1000] "GET /portfolio/randwick-hospital/ HTTP/1.1" 200 24840 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 213.209.159.84 - - [07/Sep/2026:04:48:41 +1000] "GET /portfolio/sydney-fish-market/ HTTP/1.1" 200 24728 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 --- last 30 samples (run-up to this incident) --- 2026-09-07 04:46:14 L1=1.44 run=2 blk=1 avail=9766 (70.9%) swpO=0 conn=3 myRSS=1617 php=5 phpRSS=79 ap=42 tcp=55 topuser=evolution 2026-09-07 04:46:21 L1=1.45 run=1 blk=1 avail=9685 (70.3%) swpO=0 conn=1 myRSS=1618 php=5 phpRSS=154 ap=40 tcp=47 topuser=madalice 2026-09-07 04:46:24 L1=1.45 run=1 blk=1 avail=9707 (70.5%) swpO=0 conn=3 myRSS=1618 php=6 phpRSS=179 ap=36 tcp=47 topuser=madalice 2026-09-07 04:46:31 L1=1.46 run=2 blk=1 avail=9497 (68.9%) swpO=0 conn=1 myRSS=1618 php=7 phpRSS=432 ap=33 tcp=51 topuser=olympic 2026-09-07 04:46:34 L1=1.46 run=2 blk=1 avail=9695 (70.4%) swpO=0 conn=3 myRSS=1618 php=5 phpRSS=177 ap=33 tcp=48 topuser=madalice 2026-09-07 04:46:41 L1=1.39 run=2 blk=1 avail=9715 (70.5%) swpO=0 conn=1 myRSS=1618 php=5 phpRSS=177 ap=30 tcp=45 topuser=madalice 2026-09-07 04:46:44 L1=1.39 run=1 blk=1 avail=9717 (70.5%) swpO=0 conn=1 myRSS=1618 php=5 phpRSS=177 ap=30 tcp=46 topuser=madalice 2026-09-07 04:46:51 L1=1.33 run=2 blk=1 avail=9778 (71.0%) swpO=0 conn=1 myRSS=1618 php=4 phpRSS=23 ap=30 tcp=45 topuser=root 2026-09-07 04:46:55 L1=1.33 run=5 blk=1 avail=9755 (70.8%) swpO=0 conn=1 myRSS=1618 php=5 phpRSS=148 ap=30 tcp=42 topuser=madalice 2026-09-07 04:47:01 L1=1.28 run=1 blk=1 avail=9751 (70.8%) swpO=0 conn=1 myRSS=1618 php=5 phpRSS=155 ap=29 tcp=45 topuser=madalice 2026-09-07 04:47:05 L1=1.28 run=1 blk=1 avail=9749 (70.8%) swpO=0 conn=1 myRSS=1618 php=5 phpRSS=155 ap=29 tcp=43 topuser=madalice 2026-09-07 04:47:11 L1=1.23 run=1 blk=1 avail=9761 (70.9%) swpO=85 conn=1 myRSS=1616 php=5 phpRSS=155 ap=29 tcp=42 topuser=madalice 2026-09-07 04:47:15 L1=1.23 run=1 blk=1 avail=9761 (70.9%) swpO=85 conn=1 myRSS=1616 php=5 phpRSS=155 ap=28 tcp=40 topuser=madalice 2026-09-07 04:47:21 L1=1.20 run=3 blk=1 avail=9746 (70.7%) swpO=0 conn=1 myRSS=1616 php=5 phpRSS=191 ap=26 tcp=39 topuser=madalice 2026-09-07 04:47:25 L1=1.20 run=1 blk=1 avail=9781 (71.0%) swpO=0 conn=1 myRSS=1616 php=6 phpRSS=176 ap=26 tcp=41 topuser=madalice 2026-09-07 04:47:31 L1=1.24 run=1 blk=1 avail=9784 (71.0%) swpO=1 conn=1 myRSS=1616 php=5 phpRSS=155 ap=26 tcp=44 topuser=madalice 2026-09-07 04:47:35 L1=1.24 run=4 blk=1 avail=9781 (71.0%) swpO=1 conn=1 myRSS=1616 php=5 phpRSS=155 ap=26 tcp=44 topuser=madalice 2026-09-07 04:47:41 L1=1.36 run=1 blk=1 avail=9782 (71.0%) swpO=0 conn=1 myRSS=1616 php=5 phpRSS=155 ap=26 tcp=44 topuser=madalice 2026-09-07 04:47:45 L1=1.36 run=1 blk=1 avail=9893 (71.8%) swpO=0 conn=1 myRSS=1616 php=4 phpRSS=23 ap=26 tcp=43 topuser=root 2026-09-07 04:47:51 L1=1.30 run=1 blk=1 avail=9891 (71.8%) swpO=0 conn=1 myRSS=1616 php=4 phpRSS=23 ap=26 tcp=41 topuser=root 2026-09-07 04:47:55 L1=1.30 run=1 blk=1 avail=9902 (71.9%) swpO=0 conn=1 myRSS=1616 php=4 phpRSS=23 ap=25 tcp=39 topuser=root 2026-09-07 04:48:01 L1=1.25 run=1 blk=1 avail=9858 (71.6%) swpO=0 conn=2 myRSS=1616 php=5 phpRSS=80 ap=24 tcp=48 topuser=evolution 2026-09-07 04:48:05 L1=1.25 run=1 blk=1 avail=9897 (71.8%) swpO=0 conn=1 myRSS=1616 php=4 phpRSS=23 ap=24 tcp=40 topuser=root 2026-09-07 04:48:12 L1=1.29 run=2 blk=1 avail=9787 (71.0%) swpO=0 conn=2 myRSS=1616 php=5 phpRSS=155 ap=24 tcp=39 topuser=madalice 2026-09-07 04:48:15 L1=1.29 run=2 blk=1 avail=9788 (71.0%) swpO=0 conn=1 myRSS=1616 php=5 phpRSS=155 ap=24 tcp=41 topuser=madalice 2026-09-07 04:48:22 L1=1.33 run=1 blk=1 avail=9756 (70.8%) swpO=0 conn=2 myRSS=1616 php=5 phpRSS=177 ap=24 tcp=44 topuser=madalice 2026-09-07 04:48:25 L1=1.33 run=1 blk=1 avail=9757 (70.8%) swpO=0 conn=1 myRSS=1616 php=5 phpRSS=177 ap=24 tcp=40 topuser=madalice 2026-09-07 04:48:32 L1=3.20 run=10 blk=1 avail=8988 (65.2%) swpO=412 conn=2 myRSS=1606 php=12 phpRSS=1051 ap=39 tcp=68 topuser=tubesupplies 2026-09-07 04:48:35 L1=3.20 run=4 blk=1 avail=9418 (68.4%) swpO=789 conn=1 myRSS=1598 php=7 phpRSS=468 ap=40 tcp=57 topuser=tubesupplies 2026-09-07 04:48:42 L1=2.93 run=27 blk=1 avail=8801 (63.9%) swpO=376 conn=24 myRSS=1598 php=27 phpRSS=1742 ap=35 tcp=97 topuser=tubesupplies