INCIDENT 2026-09-07 11:30:45 trigger: php_rss=1646MB ================================================================== load: 3.32 2.67 2.59 6/735 2868402 ncpu:10 mem_avail: 7420MB/13777MB (53.9%) swap_used:2532MB swapout:285/s blocked(D):1 running:6 iowait:6.5% steal:0.0% php: 16 procs / 1646MB heaviest user: madalice (9 procs, 1443MB) apache: 65 procs tcp_estab: 82 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2407 madalice 9 1450 nobody 64 1078 root 251 1018 netdata 8 246 evolution 15 159 speedlin 1 122 mailman 20 98 cpanellogin 1 70 alison 5 70 wp-toolkit 3 55 dovenull 6 55 dovecot 3 22 aaa 1 15 lowrange 1 13 zabbix 1 11 mailnull 1 10 kurri 1 9 named 1 8 polkitd 1 6 --- php workers by user --- USER PROCS RSS_MB madalice 9 1455 speedlin 1 124 evolution 6 102 root 1 23 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6829 MB Active(file): 3511 MB Inactive(file): 3394 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 581 MB CommitLimit: 10984 MB Committed_AS: 10120 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-09:08:19 5160 /usr/bin/imunify-agent-proxy 4109079 root 2-06:45:57 1968 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-06:45:57 87968 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 2465372 5.9 Ssl 1-15:54:14 /usr/sbin/mariadbd 2868308 167896 madalice 247848 38.6 R 00:08 php-fpm: pool madalice_com_au 166870 1 netdata 188356 2.6 Ssl 1-09:08:25 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2868294 167896 madalice 162008 34.8 S 00:08 php-fpm: pool madalice_com_au 923652 904997 root 160676 0.1 S 09:01:01 spamd child 2868209 167896 madalice 160160 27.2 S 00:15 php-fpm: pool madalice_com_au 2868295 167896 madalice 159276 38.1 S 00:08 php-fpm: pool madalice_com_au 2868297 167896 madalice 158888 39.3 S 00:08 php-fpm: pool madalice_com_au 2868298 167896 madalice 158640 36.5 S 00:08 php-fpm: pool madalice_com_au 2868299 167896 madalice 158576 35.7 S 00:08 php-fpm: pool madalice_com_au 2868306 167896 madalice 157856 38.8 S 00:08 php-fpm: pool madalice_com_au 167871 1 root 147140 0.0 Ss 1-09:08:18 /usr/lib/systemd/systemd-journald 923653 904997 root 141924 0.0 S 09:01:00 spamd child 2868312 167896 madalice 136012 22.8 S 00:07 php-fpm: pool madalice_com_au 2868358 2860327 speedlin 134224 113 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 904997 1 root 130728 0.0 Ss 09:07:48 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4109105 4109079 root 87968 1.4 Sl 2-06:45:57 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2442021 1353308 cpanellogin 71972 0.0 S 01:51:19 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 1469 1 root 40976 0.1 Ss 70-01:21:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2868366 2868307 evolution 40680 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 37796 0.1 Ss 47-08:49:31 cpsrvd (SSL) - waiting for connections 2868450 2851576 evolution 37312 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 509236 509098 root 34764 0.0 Sl 10-09:11:05 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 167562 166914 netdata 34480 0.1 Sl 1-09:08:20 /usr/libexec/netdata/plugins.d/go.d.plugin 1 166645 1 wp-toolkit 31480 0.0 Ss 1-09:08:29 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29812 0.0 Ss 09:08:20 lfd - sleeping 1463 1 root 24060 0.0 Ss 70-01:21:00 tailwatchd 167896 1 root 23684 0.0 Ss 1-09:08:17 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 2831273 506832 nobody 21720 0.0 S 09:34 /usr/sbin/httpd -k start 2851557 506832 nobody 21688 0.1 S 02:46 /usr/sbin/httpd -k start 2850568 506832 nobody 21220 0.0 S 03:32 /usr/sbin/httpd -k start 2851594 506832 nobody 21184 0.0 S 02:44 /usr/sbin/httpd -k start 2851509 506832 nobody 20700 0.0 S 02:48 /usr/sbin/httpd -k start 2850019 506832 nobody 20680 0.1 S 04:06 /usr/sbin/httpd -k start 2849996 506832 nobody 20668 0.0 S 04:07 /usr/sbin/httpd -k start 2852279 506832 nobody 20412 0.0 S 02:05 /usr/sbin/httpd -k start 2852644 506832 nobody 20396 0.1 S 01:41 /usr/sbin/httpd -k start 2832700 506832 nobody 19876 0.0 S 07:43 /usr/sbin/httpd -k start 2851527 506832 nobody 19832 0.0 S 02:47 /usr/sbin/httpd -k start 2853186 506832 nobody 19596 0.1 S 01:08 /usr/sbin/httpd -k start 2852778 506832 nobody 19592 0.0 S 01:35 /usr/sbin/httpd -k start 2852625 506832 nobody 19576 0.0 S 01:42 /usr/sbin/httpd -k start 2832748 506832 nobody 19516 0.0 S 07:42 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19508 0.0 Ss 1-09:08:18 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2853374 506832 nobody 19484 0.0 S 00:52 /usr/sbin/httpd -k start 2851576 506832 nobody 19400 0.0 S 02:45 /usr/sbin/httpd -k start 2851596 506832 nobody 19316 0.0 S 02:44 /usr/sbin/httpd -k start 2852260 506832 nobody 19296 0.0 S 02:06 /usr/sbin/httpd -k start 2853371 506832 nobody 18960 0.0 S 00:52 /usr/sbin/httpd -k start 2852796 506832 nobody 18936 0.0 S 01:33 /usr/sbin/httpd -k start 2833806 506832 nobody 18816 0.0 S 06:26 /usr/sbin/httpd -k start 2853361 506832 nobody 18700 0.1 S 00:53 /usr/sbin/httpd -k start 2850552 506832 nobody 18688 0.0 S 03:34 /usr/sbin/httpd -k start 2833252 506832 nobody 18592 0.0 S 07:07 /usr/sbin/httpd -k start 2850559 506832 nobody 18480 0.0 S 03:33 /usr/sbin/httpd -k start 2851598 506832 nobody 18412 0.0 S 02:44 /usr/sbin/httpd -k start 2853372 506832 nobody 18260 0.0 S 00:52 /usr/sbin/httpd -k start 2868307 506832 nobody 18052 0.3 S 00:08 /usr/sbin/httpd -k start 2834307 506832 nobody 18044 0.0 S 05:47 /usr/sbin/httpd -k start 2855824 506832 nobody 17992 0.0 S 00:41 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 2867805 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 2867632 | madalice_wp | madalice_wp | Query | 0 | Writing to net | SELECT post_id, meta_key, meta_value FROM AMuqf6qZ_postmeta WHERE post_id IN (8811,33647,28292,20717,30757,30681,30743,15842,15423,15904,30626,130,33108,120) ORDER BY meta_id ASC | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 849 customc/customcentral.com.au-ssl_log 137 evolution/portal.evolutionerp.com.au-ssl_log 115 evolution/app.evolutionerp.com.au-ssl_log 110 madalice/madalice.com.au-ssl_log 28 speedlin/speedlinefencing.com.au-ssl_log 14 corpkicks/corporatekicks.com.au-ssl_log 1 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 565 203.54.180.238 195 103.104.165.99 137 45.148.10.9 110 40.115.94.245 89 116.91.221.245 65 182.239.240.254 17 180.181.236.49 15 1.144.107.82 14 34.187.199.90 14 161.33.202.176 9 103.104.164.114 4 2405:6e00:2430:5a64:506f:a7bd:73d4:1590 3 114.119.146.16 2 52.167.144.206 2 1.145.70.156 --- top request paths across all vhosts (last 3 min) --- 257 POST /functions.php 187 GET /app/ajax.php 80 GET /index.php 58 POST /plugins/csvexporter/plugin.php 56 GET /api/getItem/LWFBW2001KG 45 GET /heartbeat.php 40 GET /api/getItem/LWHG2001KG 38 POST /clienteditsave.php 35 POST /app/ajax.php 32 POST /app/ajax/selectFilterSingle.php 30 GET /factory_session_checker.php 21 POST /blog/ 17 POST /jobeditsave.php 16 GET /factory_session_processed_qty.php 15 POST /logsave.php 15 POST /app/ajax/selectFilter.php 15 GET /factory_session_joiner.php 14 POST /blog/index.php 14 GET /api/getItem/LWPB2001KG 12 POST /plugins/fencecosting/plugin.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 257 POST /functions.php 187 GET /app/ajax.php 72 GET /index.php 58 POST /plugins/csvexporter/plugin.php 38 POST /clienteditsave.php 35 POST /app/ajax.php 32 POST /app/ajax/selectFilterSingle.php 17 POST /jobeditsave.php 15 POST /logsave.php 15 POST /app/ajax/selectFilter.php 12 POST /plugins/fencecosting/plugin.php 12 POST /itemModify.php -- last 10 requests -- 180.181.236.49 - - [07/Sep/2026:11:30:39 +1000] "POST /quoteditsave.php?call=saveNote HTTP/1.1" 200 44 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=6953§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 116.91.221.245 - - [07/Sep/2026:11:30:43 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 116.91.221.245 - - [07/Sep/2026:11:30:43 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2035§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win64 180.181.236.49 - - [07/Sep/2026:11:30:43 +1000] "POST /quoteditsave.php?call=saveNote HTTP/1.1" 200 44 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=6953§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 203.54.180.238 - - [07/Sep/2026:11:30:41 +1000] "GET /index.php?page=jobedit&id=29032 HTTP/1.1" 200 210349 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 203.54.180.238 - - [07/Sep/2026:11:30:42 +1000] "POST /logsave.php?call=getHistory&id=29032&module=job HTTP/1.1" 200 1636 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29032" "Mozilla/5.0 (Windows NT 10.0; Wi 203.54.180.238 - - [07/Sep/2026:11:30:43 +1000] "POST /clienteditsave.php?clientid=20357&call=getCategoryDiscounts HTTP/1.1" 200 25 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29032" "Mozilla/5.0 (Windows N 203.54.180.238 - - [07/Sep/2026:11:30:44 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29032&tab=jobeditmf" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [07/Sep/2026:11:30:43 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29032" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 203.54.180.238 - - [07/Sep/2026:11:30:45 +1000] "GET /app/ajax.php?cn=&furi=true&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=14977943207 HTTP/1.1" 200 202 "https://my.evolutionerp.com.au/index.php?page=jobedit&id == customc/customcentral.com.au-ssl_log == -- top paths -- 21 POST /blog/ 14 POST /blog/index.php 9 POST /wordpress/ 9 GET /wordpress/ 7 POST /blog/wp-json/Batch/v1 7 POST /blog/wp-json/batch/v1/ 7 POST /blog/wp-json/batch/v1 7 POST /blog//wp-json/batch/v1 7 POST /blog/wordpress/wp-json/batch/v1 7 POST /blog/blog/wp-json/batch/v1 5 POST /wordpress/index.php 5 GET /blog/ -- last 10 requests -- 45.148.10.9 - - [07/Sep/2026:11:28:42 +1000] "GET /blog/wp/v2/posts/999999 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.9 - - [07/Sep/2026:11:28:43 +1000] "GET /blog/?rest_route=/wp/v2/posts/999999 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 45.148.10.9 - - [07/Sep/2026:11:28:43 +1000] "GET /blog/wp/v2/pages HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.9 - - [07/Sep/2026:11:28:43 +1000] "GET /blog/?rest_route=/wp/v2/pages HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.9 - - [07/Sep/2026:11:28:44 +1000] "GET /blog/wp/v2/media HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.9 - - [07/Sep/2026:11:28:44 +1000] "GET /blog/?rest_route=/wp/v2/media HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.9 - - [07/Sep/2026:11:28:44 +1000] "GET /blog/wp/v2/categories HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.9 - - [07/Sep/2026:11:28:45 +1000] "GET /blog/?rest_route=/wp/v2/categories HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.9 - - [07/Sep/2026:11:28:45 +1000] "GET /blog/wp/v2/tags HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.9 - - [07/Sep/2026:11:28:45 +1000] "GET /blog/?rest_route=/wp/v2/tags HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 45 GET /heartbeat.php 30 GET /factory_session_checker.php 16 GET /factory_session_processed_qty.php 15 GET /factory_session_joiner.php 8 GET /index.php 1 POST /factory_functions.php -- last 10 requests -- 203.54.180.238 - - [07/Sep/2026:11:30:18 +1000] "GET /heartbeat.php?sentAt=1788744619&bytes=106,158,19,171&_=1788744363737 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:11:30:22 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:11:30:24 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 122 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [07/Sep/2026:11:30:24 +1000] "GET /factory_session_joiner.php?id=35154 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [07/Sep/2026:11:30:24 +1000] "GET /heartbeat.php?sentAt=1788744624&bytes=106,158,19,176&_=1788743594695 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=10 203.54.180.238 - - [07/Sep/2026:11:30:27 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:11:30:27 +1000] "GET /heartbeat.php?sentAt=1788744621&bytes=106,158,19,173&_=1788739087028 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:11:30:28 +1000] "GET /heartbeat.php?sentAt=1788744629&bytes=106,158,19,181&_=1788744363738 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:11:30:32 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:11:30:34 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 122 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb --- last 30 samples (run-up to this incident) --- 2026-09-07 11:28:24 L1=2.25 run=4 blk=1 avail=8637 (62.7%) swpO=0 conn=3 myRSS=2402 php=6 phpRSS=234 ap=61 tcp=73 topuser=madalice 2026-09-07 11:28:24 L1=2.25 run=6 blk=1 avail=8637 (62.7%) swpO=0 conn=2 myRSS=2402 php=6 phpRSS=234 ap=61 tcp=71 topuser=madalice 2026-09-07 11:28:34 L1=2.06 run=3 blk=1 avail=8700 (63.1%) swpO=12 conn=3 myRSS=2402 php=6 phpRSS=216 ap=57 tcp=59 topuser=madalice 2026-09-07 11:28:34 L1=2.06 run=4 blk=1 avail=8693 (63.1%) swpO=12 conn=2 myRSS=2402 php=5 phpRSS=178 ap=57 tcp=59 topuser=madalice 2026-09-07 11:28:44 L1=2.04 run=2 blk=1 avail=8679 (63.0%) swpO=0 conn=3 myRSS=2402 php=5 phpRSS=177 ap=59 tcp=64 topuser=madalice 2026-09-07 11:28:44 L1=2.04 run=2 blk=1 avail=8688 (63.1%) swpO=0 conn=1 myRSS=2402 php=5 phpRSS=177 ap=59 tcp=64 topuser=madalice 2026-09-07 11:28:54 L1=2.10 run=1 blk=1 avail=8747 (63.5%) swpO=0 conn=3 myRSS=2402 php=5 phpRSS=178 ap=51 tcp=63 topuser=madalice 2026-09-07 11:28:54 L1=2.10 run=1 blk=1 avail=8747 (63.5%) swpO=0 conn=1 myRSS=2402 php=5 phpRSS=178 ap=51 tcp=63 topuser=madalice 2026-09-07 11:29:04 L1=2.01 run=5 blk=1 avail=8588 (62.3%) swpO=0 conn=3 myRSS=2402 php=7 phpRSS=342 ap=57 tcp=78 topuser=madalice 2026-09-07 11:29:04 L1=2.01 run=7 blk=1 avail=8582 (62.3%) swpO=0 conn=1 myRSS=2402 php=7 phpRSS=350 ap=57 tcp=80 topuser=madalice 2026-09-07 11:29:14 L1=2.16 run=3 blk=1 avail=8619 (62.6%) swpO=91 conn=3 myRSS=2400 php=7 phpRSS=288 ap=60 tcp=66 topuser=madalice 2026-09-07 11:29:14 L1=2.16 run=4 blk=1 avail=8618 (62.6%) swpO=91 conn=1 myRSS=2400 php=7 phpRSS=288 ap=60 tcp=66 topuser=madalice 2026-09-07 11:29:24 L1=2.60 run=2 blk=1 avail=8620 (62.6%) swpO=0 conn=3 myRSS=2417 php=6 phpRSS=233 ap=59 tcp=69 topuser=madalice 2026-09-07 11:29:24 L1=2.60 run=4 blk=1 avail=8620 (62.6%) swpO=0 conn=1 myRSS=2417 php=6 phpRSS=233 ap=59 tcp=69 topuser=madalice 2026-09-07 11:29:34 L1=2.74 run=8 blk=1 avail=8623 (62.6%) swpO=48 conn=3 myRSS=2416 php=8 phpRSS=343 ap=54 tcp=74 topuser=evolution 2026-09-07 11:29:34 L1=2.74 run=5 blk=1 avail=8600 (62.4%) swpO=48 conn=1 myRSS=2416 php=8 phpRSS=345 ap=54 tcp=74 topuser=evolution 2026-09-07 11:29:44 L1=2.70 run=1 blk=1 avail=8688 (63.1%) swpO=0 conn=3 myRSS=2416 php=5 phpRSS=178 ap=56 tcp=54 topuser=madalice 2026-09-07 11:29:44 L1=2.70 run=2 blk=1 avail=8688 (63.1%) swpO=0 conn=1 myRSS=2416 php=5 phpRSS=178 ap=56 tcp=54 topuser=madalice 2026-09-07 11:29:54 L1=2.52 run=8 blk=1 avail=8640 (62.7%) swpO=0 conn=3 myRSS=2417 php=10 phpRSS=388 ap=57 tcp=64 topuser=evolution 2026-09-07 11:29:54 L1=2.52 run=7 blk=1 avail=8618 (62.6%) swpO=0 conn=1 myRSS=2417 php=9 phpRSS=364 ap=57 tcp=63 topuser=evolution 2026-09-07 11:30:04 L1=2.74 run=6 blk=1 avail=8564 (62.2%) swpO=0 conn=4 myRSS=2417 php=9 phpRSS=391 ap=57 tcp=76 topuser=evolution 2026-09-07 11:30:04 L1=2.74 run=5 blk=1 avail=8552 (62.1%) swpO=0 conn=1 myRSS=2417 php=11 phpRSS=443 ap=57 tcp=76 topuser=evolution 2026-09-07 11:30:14 L1=2.93 run=6 blk=1 avail=8457 (61.4%) swpO=0 conn=4 myRSS=2417 php=10 phpRSS=533 ap=59 tcp=63 topuser=evolution 2026-09-07 11:30:14 L1=2.93 run=10 blk=1 avail=8431 (61.2%) swpO=48 conn=1 myRSS=2416 php=11 phpRSS=517 ap=59 tcp=64 topuser=madalice 2026-09-07 11:30:24 L1=3.01 run=1 blk=1 avail=8696 (63.1%) swpO=48 conn=4 myRSS=2416 php=8 phpRSS=298 ap=53 tcp=59 topuser=madalice 2026-09-07 11:30:24 L1=3.01 run=2 blk=1 avail=8681 (63.0%) swpO=0 conn=1 myRSS=2416 php=8 phpRSS=322 ap=53 tcp=59 topuser=madalice 2026-09-07 11:30:34 L1=3.02 run=3 blk=1 avail=8710 (63.2%) swpO=0 conn=4 myRSS=2416 php=8 phpRSS=354 ap=45 tcp=50 topuser=madalice 2026-09-07 11:30:35 L1=3.02 run=4 blk=1 avail=8702 (63.2%) swpO=0 conn=1 myRSS=2416 php=8 phpRSS=359 ap=45 tcp=49 topuser=madalice 2026-09-07 11:30:45 L1=3.32 run=6 blk=1 avail=7420 (53.9%) swpO=285 conn=5 myRSS=2407 php=16 phpRSS=1646 ap=65 tcp=82 topuser=madalice 2026-09-07 11:30:45 L1=3.32 run=6 blk=1 avail=7382 (53.6%) swpO=285 conn=4 myRSS=2407 php=15 phpRSS=1649 ap=65 tcp=82 topuser=madalice