INCIDENT 2026-09-07 12:37:18 trigger: php_rss=1940MB ================================================================== load: 4.12 3.77 3.52 9/730 3121163 ncpu:10 mem_avail: 7173MB/13777MB (52.1%) swap_used:2510MB swapout:0/s blocked(D):1 running:7 iowait:5.8% steal:0.0% php: 17 procs / 1940MB heaviest user: madalice (10 procs, 1615MB) apache: 57 procs tcp_estab: 73 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2388 madalice 10 1624 root 255 1088 nobody 56 998 netdata 8 247 speedlin 1 147 tubesupplies 1 128 mailman 20 98 alison 5 69 wp-toolkit 3 56 dovenull 6 55 evolution 12 49 mailnull 4 32 dovecot 3 22 cpanellogin 1 22 zabbix 1 10 kurri 1 9 named 1 8 polkitd 1 6 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB mysql 1 2388 madalice 10 1624 root 251 1079 nobody 56 998 netdata 8 247 speedlin 1 147 tubesupplies 1 128 mailman 20 98 alison 5 69 wp-toolkit 3 56 dovenull 6 55 evolution 12 49 mailnull 4 32 dovecot 3 22 cpanellogin 1 22 zabbix 1 10 kurri 1 9 named 1 8 polkitd 1 6 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1625 speedlin 1 152 tubesupplies 1 129 evolution 4 39 root 1 23 --- vm tuning / memory pressure --- vm.swappiness 30 madalice 10 1625 speedlin 1 152 tubesupplies 1 129 evolution 4 39 root 1 23 --- vm tuning / memory pressure --- vm.vfs_cache_pressure 100 vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_memory 0 vm.overcommit_ratio 50 vm.overcommit_ratio 50 Cached: 6630 MB Active(file): 3443 MB Inactive(file): 3156 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 586 MB CommitLimit: 10984 MB Committed_AS: 10429 MB Cached: 6630 MB Active(file): 3443 MB Inactive(file): 3156 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 586 MB CommitLimit: 10984 MB Committed_AS: 10429 MB --- backup / dump / scan processes (page-cache evictors) --- --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-10:14:53 5196 /usr/bin/imunify-agent-proxy 4109079 root 2-07:52:31 1960 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-07:52:31 78112 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-10:14:53 5196 /usr/bin/imunify-agent-proxy 4109079 root 2-07:52:31 1960 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-07:52:31 78112 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 2445960 6.7 Ssl 1-17:00:48 /usr/sbin/mariadbd 3082876 167896 madalice 242816 15.8 R 07:56 php-fpm: pool madalice_com_au 166870 1 netdata 187800 2.6 Ssl 1-10:14:59 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 167871 1 root 162464 0.0 Ss 1-10:14:52 /usr/lib/systemd/systemd-journald 3082701 167896 madalice 161708 15.5 S 08:04 php-fpm: pool madalice_com_au 3099837 167896 madalice 161148 9.8 S 05:06 php-fpm: pool madalice_com_au 3099833 167896 madalice 160044 9.8 R 05:07 php-fpm: pool madalice_com_au 3099826 167896 madalice 159908 9.6 S 05:07 php-fpm: pool madalice_com_au 923652 904997 root 159216 0.1 S 10:07:35 spamd child 3059435 167896 madalice 158688 21.6 S 16:18 php-fpm: pool madalice_com_au 3099828 167896 madalice 158612 9.9 S 05:07 php-fpm: pool madalice_com_au 3100181 167896 madalice 158484 9.3 S 05:02 php-fpm: pool madalice_com_au 3100180 167896 madalice 158408 9.2 S 05:02 php-fpm: pool madalice_com_au 3099827 167896 madalice 158176 9.5 S 05:07 php-fpm: pool madalice_com_au 923653 904997 root 142048 0.0 S 10:07:34 spamd child 904997 1 root 130724 0.0 Ss 10:14:22 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4109105 4109079 root 78112 1.4 Sl 2-07:52:31 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1353308 1 root 42424 0.1 Ss 47-09:56:05 cpsrvd (SSL) - waiting for connections 1469 1 root 40708 0.1 Ss 70-02:27:34 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3121093 3103763 evolution 40680 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 167562 166914 netdata 35432 0.1 Sl 1-10:14:54 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 35056 0.0 Sl 10-10:17:39 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166645 1 wp-toolkit 31504 0.0 Ss 1-10:15:03 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29832 0.0 Ss 10:14:54 lfd - sleeping 1466 1 root 25792 0.0 Ss 70-02:27:34 dnsadmin - server mode 1463 1 root 23872 0.0 Ss 70-02:27:34 tailwatchd 167896 1 root 23688 0.0 Ss 1-10:14:51 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3041041 1353308 cpanellogin 22556 0.0 S 21:05 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 3080389 506832 nobody 22016 0.1 S 10:09 /usr/sbin/httpd -k start 3100219 506832 nobody 21808 0.0 S 05:02 /usr/sbin/httpd -k start 3100893 506832 nobody 21688 0.1 S 04:21 /usr/sbin/httpd -k start 3100919 506832 nobody 21648 0.0 S 04:20 /usr/sbin/httpd -k start 3098243 506832 nobody 21228 0.0 S 06:44 /usr/sbin/httpd -k start 3100965 506832 nobody 21168 0.0 S 04:19 /usr/sbin/httpd -k start 3100942 506832 nobody 21164 0.0 S 04:20 /usr/sbin/httpd -k start 3119635 506832 nobody 21032 0.2 S 01:08 /usr/sbin/httpd -k start 3103762 506832 nobody 20936 0.1 S 02:31 /usr/sbin/httpd -k start 3100892 506832 nobody 20696 0.0 S 04:21 /usr/sbin/httpd -k start 3118831 506832 nobody 20656 0.0 S 01:52 /usr/sbin/httpd -k start 3100089 506832 nobody 20576 0.1 S 05:03 /usr/sbin/httpd -k start 3119619 506832 nobody 20480 0.2 S 01:09 /usr/sbin/httpd -k start 3120054 506832 nobody 20432 0.1 S 01:00 /usr/sbin/httpd -k start 3100977 506832 nobody 20300 0.0 S 04:19 /usr/sbin/httpd -k start 3100913 506832 nobody 20264 0.0 S 04:20 /usr/sbin/httpd -k start 3100940 506832 nobody 19952 0.0 S 04:20 /usr/sbin/httpd -k start 3111993 506832 nobody 19908 0.0 S 02:11 /usr/sbin/httpd -k start 3119630 506832 nobody 19908 0.1 S 01:08 /usr/sbin/httpd -k start 3118758 506832 nobody 19764 0.0 S 01:57 /usr/sbin/httpd -k start 3119618 506832 nobody 19700 0.0 S 01:09 /usr/sbin/httpd -k start 3120092 506832 nobody 19680 0.1 S 00:58 /usr/sbin/httpd -k start 3118816 506832 nobody 19656 0.3 S 01:53 /usr/sbin/httpd -k start 3118834 506832 nobody 19636 0.0 S 01:52 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19568 0.0 Ss 1-10:14:52 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3100917 506832 nobody 19524 0.0 S 04:20 /usr/sbin/httpd -k start 3111988 506832 nobody 19508 0.0 S 02:11 /usr/sbin/httpd -k start 3120088 506832 nobody 19292 0.0 S 00:58 /usr/sbin/httpd -k start 3118830 506832 nobody 19268 0.0 S 01:52 /usr/sbin/httpd -k start 3120090 506832 nobody 19260 0.0 S 00:58 /usr/sbin/httpd -k start 3119601 506832 nobody 19228 0.0 S 01:10 /usr/sbin/httpd -k start 3099888 506832 nobody 19008 0.0 S 05:04 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 2445960 6.7 Ssl 1-17:00:48 /usr/sbin/mariadbd 3082876 167896 madalice 243344 15.8 R 07:56 php-fpm: pool madalice_com_au 166870 1 netdata 187800 2.6 Ssl 1-10:14:59 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 167871 1 root 162464 0.0 Ss 1-10:14:52 /usr/lib/systemd/systemd-journald 3082701 167896 madalice 161708 15.5 S 08:04 php-fpm: pool madalice_com_au 3099837 167896 madalice 161148 9.8 S 05:06 php-fpm: pool madalice_com_au 3099833 167896 madalice 160044 9.8 R 05:07 php-fpm: pool madalice_com_au 3099826 167896 madalice 159908 9.6 S 05:07 php-fpm: pool madalice_com_au 923652 904997 root 159216 0.1 S 10:07:35 spamd child 3059435 167896 madalice 158688 21.6 S 16:18 php-fpm: pool madalice_com_au 3099828 167896 madalice 158612 9.9 S 05:07 php-fpm: pool madalice_com_au 3100181 167896 madalice 158484 9.3 S 05:02 php-fpm: pool madalice_com_au 3100180 167896 madalice 158408 9.2 S 05:02 php-fpm: pool madalice_com_au 3099827 167896 madalice 158176 9.5 S 05:07 php-fpm: pool madalice_com_au 923653 904997 root 142048 0.0 S 10:07:34 spamd child 904997 1 root 130724 0.0 Ss 10:14:22 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4109105 4109079 root 78112 1.4 Sl 2-07:52:31 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1353308 1 root 42424 0.1 Ss 47-09:56:05 cpsrvd (SSL) - waiting for connections 1469 1 root 40708 0.1 Ss 70-02:27:34 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3121093 3103763 evolution 40680 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 167562 166914 netdata 35432 0.1 Sl 1-10:14:54 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 35056 0.0 Sl 10-10:17:39 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166645 1 wp-toolkit 31504 0.0 Ss 1-10:15:03 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29832 0.0 Ss 10:14:54 lfd - sleeping 1466 1 root 25792 0.0 Ss 70-02:27:34 dnsadmin - server mode 1463 1 root 23872 0.0 Ss 70-02:27:34 tailwatchd 167896 1 root 23688 0.0 Ss 1-10:14:51 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3041041 1353308 cpanellogin 22556 0.0 S 21:05 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 3080389 506832 nobody 22016 0.1 S 10:09 /usr/sbin/httpd -k start 3100219 506832 nobody 21808 0.0 S 05:02 /usr/sbin/httpd -k start 3100893 506832 nobody 21688 0.1 S 04:21 /usr/sbin/httpd -k start 3100919 506832 nobody 21648 0.0 S 04:20 /usr/sbin/httpd -k start 3098243 506832 nobody 21228 0.0 S 06:44 /usr/sbin/httpd -k start 3100965 506832 nobody 21168 0.0 S 04:19 /usr/sbin/httpd -k start 3100942 506832 nobody 21164 0.0 S 04:20 /usr/sbin/httpd -k start 3119635 506832 nobody 21032 0.2 S 01:08 /usr/sbin/httpd -k start 3103762 506832 nobody 20936 0.1 S 02:31 /usr/sbin/httpd -k start 3100892 506832 nobody 20696 0.0 S 04:21 /usr/sbin/httpd -k start 3118831 506832 nobody 20656 0.0 S 01:52 /usr/sbin/httpd -k start 3100089 506832 nobody 20576 0.1 S 05:03 /usr/sbin/httpd -k start 3119619 506832 nobody 20480 0.2 S 01:09 /usr/sbin/httpd -k start 3120054 506832 nobody 20432 0.1 S 01:00 /usr/sbin/httpd -k start 3100977 506832 nobody 20300 0.0 S 04:19 /usr/sbin/httpd -k start 3100913 506832 nobody 20264 0.0 S 04:20 /usr/sbin/httpd -k start 3100940 506832 nobody 19952 0.0 S 04:20 /usr/sbin/httpd -k start 3111993 506832 nobody 19908 0.0 S 02:11 /usr/sbin/httpd -k start 3119630 506832 nobody 19908 0.1 S 01:08 /usr/sbin/httpd -k start 3118758 506832 nobody 19764 0.0 S 01:57 /usr/sbin/httpd -k start 3119618 506832 nobody 19700 0.0 S 01:09 /usr/sbin/httpd -k start 3120092 506832 nobody 19680 0.1 S 00:58 /usr/sbin/httpd -k start 3118816 506832 nobody 19656 0.3 S 01:53 /usr/sbin/httpd -k start 3118834 506832 nobody 19636 0.0 S 01:52 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19568 0.0 Ss 1-10:14:52 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3100917 506832 nobody 19524 0.0 S 04:20 /usr/sbin/httpd -k start 3111988 506832 nobody 19508 0.0 S 02:11 /usr/sbin/httpd -k start 3120088 506832 nobody 19292 0.0 S 00:58 /usr/sbin/httpd -k start 3118830 506832 nobody 19268 0.0 S 01:52 /usr/sbin/httpd -k start 3120090 506832 nobody 19260 0.0 S 00:58 /usr/sbin/httpd -k start 3119601 506832 nobody 19228 0.0 S 01:10 /usr/sbin/httpd -k start 3099888 506832 nobody 19008 0.0 S 05:04 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3441326 | root | NULL | Query | 0 | Optimizing | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 3441325 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3441326 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 3441325 | root | NULL | Killed | 0 | | NULL | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 737 speedlin/speedlinefencing.com.au-ssl_log 261 evolution/my.evolutionerp.com.au-ssl_log 737 evolution/portal.evolutionerp.com.au-ssl_log 226 speedlin/speedlinefencing.com.au-ssl_log 261 aaa/aaadownunder.com.au-ssl_log 128 evolution/portal.evolutionerp.com.au-ssl_log 226 tubesupplies/tubesupplies.com.au 121 tubesupplies/tubesupplies.com.au-ssl_log 117 aaa/aaadownunder.com.au-ssl_log 128 madalice/madalice.com.au-ssl_log 94 tubesupplies/tubesupplies.com.au 121 tubesupplies/tubesupplies.com.au-ssl_log 117 evolution/app.evolutionerp.com.au-ssl_log 79 kurri/kurrimotorinn.com.au-ssl_log 64 madalice/madalice.com.au-ssl_log 94 alison/alisonarts.com.au-ssl_log 1 evolution/app.evolutionerp.com.au-ssl_log 79 kurri/kurrimotorinn.com.au-ssl_log 64 alison/alisonarts.com.au-ssl_log 1 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 438 203.54.180.238 261 34.26.229.119 236 84.17.60.251 126 116.91.221.245 106 101.166.96.210 92 185.177.72.24 89 45.148.10.12 80 1.152.23.77 79 40.115.94.245 64 35.197.254.17 59 1.145.70.156 58 103.104.165.99 42 182.239.240.254 32 103.104.164.114 18 203.166.236.147 --- top request paths across all vhosts (last 3 min) --- 438 203.54.180.238 261 34.26.229.119 236 84.17.60.251 126 116.91.221.245 106 101.166.96.210 92 185.177.72.24 89 45.148.10.12 80 1.152.23.77 79 40.115.94.245 64 35.197.254.17 59 1.145.70.156 58 103.104.165.99 42 182.239.240.254 32 103.104.164.114 18 203.166.236.147 --- top request paths across all vhosts (last 3 min) --- 260 POST /functions.php 143 GET /app/ajax.php 101 GET /index.php 81 GET /factory_session_checker.php 57 POST /plugins/csvexporter/plugin.php 41 GET /factory_session_processed_qty.php 41 GET /factory_session_joiner.php 40 GET /heartbeat.php 39 POST / 20 GET /logoff.php 19 POST /inveditsave.php 17 POST /app/ajax/selectFilterSingle.php 17 POST /app/ajax.php 15 POST /quoteditsave.php 14 POST /index.php 12 POST /plugins/fencecosting/plugin.php 12 POST /app/ajax/selectFilter.php 10 POST /clienteditsave.php 10 GET / 8 POST /portal/register --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 260 POST /functions.php 143 GET /app/ajax.php 101 GET /index.php 81 GET /factory_session_checker.php 57 POST /plugins/csvexporter/plugin.php 41 GET /factory_session_processed_qty.php 41 GET /factory_session_joiner.php 40 GET /heartbeat.php 39 POST / 20 GET /logoff.php 19 POST /inveditsave.php 17 POST /app/ajax/selectFilterSingle.php 17 POST /app/ajax.php 15 POST /quoteditsave.php 14 POST /index.php 12 POST /plugins/fencecosting/plugin.php 12 POST /app/ajax/selectFilter.php 10 POST /clienteditsave.php 10 GET / 8 POST /portal/register --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 260 POST /functions.php 143 GET /app/ajax.php 90 GET /index.php 57 POST /plugins/csvexporter/plugin.php 19 POST /inveditsave.php 19 GET /logoff.php 17 POST /app/ajax/selectFilterSingle.php 17 POST /app/ajax.php 15 POST /quoteditsave.php 12 POST /plugins/fencecosting/plugin.php 12 POST /app/ajax/selectFilter.php 10 POST /clienteditsave.php -- last 10 requests -- 260 POST /functions.php 143 GET /app/ajax.php 90 GET /index.php 57 POST /plugins/csvexporter/plugin.php 19 POST /inveditsave.php 19 GET /logoff.php 17 POST /app/ajax/selectFilterSingle.php 17 POST /app/ajax.php 15 POST /quoteditsave.php 12 POST /plugins/fencecosting/plugin.php 12 POST /app/ajax/selectFilter.php 10 POST /clienteditsave.php 203.54.180.238 - - [07/Sep/2026:12:37:16 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29491&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [07/Sep/2026:12:37:16 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29297" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 1.152.23.77 - - [07/Sep/2026:12:37:17 +1000] "GET /index.php?page=register HTTP/1.1" 200 5613 "https://my.evolutionerp.com.au/index.php?page=register" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/6 203.54.180.238 - - [07/Sep/2026:12:37:14 +1000] "GET /index.php?page=jobedit&id=29680 HTTP/1.1" 200 187616 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 203.54.180.238 - - [07/Sep/2026:12:37:16 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29680" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 203.54.180.238 - - [07/Sep/2026:12:37:16 +1000] "POST /clienteditsave.php?clientid=21010&call=getCategoryDiscounts HTTP/1.1" 200 25 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29680" "Mozilla/5.0 (Windows N 182.239.240.254 - - [07/Sep/2026:12:37:17 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=inveditupload&id=319&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 203.54.180.238 - - [07/Sep/2026:12:37:17 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29680" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 203.54.180.238 - - [07/Sep/2026:12:37:16 +1000] "POST /logsave.php?call=getHistory&id=29680&module=job HTTP/1.1" 200 555 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29680" "Mozilla/5.0 (Windows NT 10.0; Win 203.54.180.238 - - [07/Sep/2026:12:37:17 +1000] "GET /app/ajax.php?cn=&furi=true&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=18245716848 HTTP/1.1" 200 75 "https://my.evolutionerp.com.au/index.php?page=jobedit&id= -- last 10 requests -- == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env -- last 10 requests -- 203.54.180.238 - - [07/Sep/2026:12:37:16 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29491&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [07/Sep/2026:12:37:16 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29297" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 1.152.23.77 - - [07/Sep/2026:12:37:17 +1000] "GET /index.php?page=register HTTP/1.1" 200 5613 "https://my.evolutionerp.com.au/index.php?page=register" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/6 203.54.180.238 - - [07/Sep/2026:12:37:14 +1000] "GET /index.php?page=jobedit&id=29680 HTTP/1.1" 200 187616 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 203.54.180.238 - - [07/Sep/2026:12:37:16 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29680" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 203.54.180.238 - - [07/Sep/2026:12:37:16 +1000] "POST /clienteditsave.php?clientid=21010&call=getCategoryDiscounts HTTP/1.1" 200 25 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29680" "Mozilla/5.0 (Windows N 182.239.240.254 - - [07/Sep/2026:12:37:17 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=inveditupload&id=319&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 203.54.180.238 - - [07/Sep/2026:12:37:17 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29680" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 203.54.180.238 - - [07/Sep/2026:12:37:16 +1000] "POST /logsave.php?call=getHistory&id=29680&module=job HTTP/1.1" 200 555 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29680" "Mozilla/5.0 (Windows NT 10.0; Win 203.54.180.238 - - [07/Sep/2026:12:37:17 +1000] "GET /app/ajax.php?cn=&furi=true&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=18245716848 HTTP/1.1" 200 75 "https://my.evolutionerp.com.au/index.php?page=jobedit&id= == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 34.26.229.119 - - [07/Sep/2026:12:36:51 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:51 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:52 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:52 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:52 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:52 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:52 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:53 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:53 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:53 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env -- last 10 requests -- 81 GET /factory_session_checker.php 41 GET /factory_session_processed_qty.php 41 GET /factory_session_joiner.php 40 GET /heartbeat.php 10 GET /index.php 8 POST /portal/register 2 POST /factory_functions.php 1 POST /login.php 1 GET /userlogin.php 1 GET /logoff.php -- last 10 requests -- 34.26.229.119 - - [07/Sep/2026:12:36:51 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:51 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:52 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:52 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:52 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:52 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:52 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:53 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:53 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:53 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 203.54.180.238 - - [07/Sep/2026:12:37:14 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=12" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:12:37:14 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:12:37:13 +1000] "GET /heartbeat.php?sentAt=1788748627&bytes=106,158,35,83&_=1788747731864 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:12:37:14 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:12:37:15 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [07/Sep/2026:12:37:15 +1000] "GET /factory_session_joiner.php?id=35165 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [07/Sep/2026:12:37:15 +1000] "GET /index.php HTTP/1.1" 200 4963 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=12" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 203.54.180.238 - - [07/Sep/2026:12:37:16 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152. 203.54.180.238 - - [07/Sep/2026:12:37:17 +1000] "GET /index.php?page=processes HTTP/1.1" 200 4979 "https://portal.evolutionerp.com.au/index.php" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) 203.54.180.238 - - [07/Sep/2026:12:37:17 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php?page=processes" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gec --- last 30 samples (run-up to this incident) --- 81 GET /factory_session_checker.php 41 GET /factory_session_processed_qty.php 41 GET /factory_session_joiner.php 40 GET /heartbeat.php 10 GET /index.php 8 POST /portal/register 2 POST /factory_functions.php 1 POST /login.php 1 GET /userlogin.php 1 GET /logoff.php -- last 10 requests -- 203.54.180.238 - - [07/Sep/2026:12:37:14 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=12" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:12:37:14 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:12:37:13 +1000] "GET /heartbeat.php?sentAt=1788748627&bytes=106,158,35,83&_=1788747731864 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:12:37:14 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:12:37:15 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [07/Sep/2026:12:37:15 +1000] "GET /factory_session_joiner.php?id=35165 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [07/Sep/2026:12:37:15 +1000] "GET /index.php HTTP/1.1" 200 4963 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=12" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 203.54.180.238 - - [07/Sep/2026:12:37:16 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152. 203.54.180.238 - - [07/Sep/2026:12:37:17 +1000] "GET /index.php?page=processes HTTP/1.1" 200 4979 "https://portal.evolutionerp.com.au/index.php" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) 203.54.180.238 - - [07/Sep/2026:12:37:17 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php?page=processes" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gec --- last 30 samples (run-up to this incident) --- 2026-09-07 12:34:56 L1=3.66 run=2 blk=1 avail=7479 (54.3%) swpO=0 conn=2 myRSS=2386 php=14 phpRSS=1652 ap=57 tcp=58 topuser=madalice 2026-09-07 12:34:57 L1=3.66 run=2 blk=1 avail=7536 (54.7%) swpO=0 conn=3 myRSS=2386 php=15 phpRSS=1614 ap=57 tcp=60 topuser=madalice 2026-09-07 12:35:06 L1=3.96 run=4 blk=1 avail=7342 (53.3%) swpO=0 conn=3 myRSS=2386 php=18 phpRSS=1943 ap=52 tcp=76 topuser=madalice 2026-09-07 12:35:07 L1=3.96 run=4 blk=1 avail=7541 (54.7%) swpO=0 conn=3 myRSS=2386 php=15 phpRSS=1630 ap=52 tcp=73 topuser=madalice 2026-09-07 12:35:16 L1=4.27 run=8 blk=1 avail=7374 (53.5%) swpO=0 conn=5 myRSS=2386 php=16 phpRSS=1800 ap=57 tcp=70 topuser=madalice 2026-09-07 12:35:17 L1=4.27 run=5 blk=1 avail=7352 (53.4%) swpO=0 conn=3 myRSS=2386 php=15 phpRSS=1795 ap=57 tcp=65 topuser=madalice 2026-09-07 12:35:27 L1=4.29 run=7 blk=1 avail=7295 (53.0%) swpO=0 conn=4 myRSS=2387 php=19 phpRSS=1851 ap=70 tcp=81 topuser=madalice 2026-09-07 12:35:27 L1=4.29 run=6 blk=1 avail=7318 (53.1%) swpO=0 conn=3 myRSS=2387 php=16 phpRSS=1751 ap=70 tcp=81 topuser=madalice 2026-09-07 12:35:37 L1=4.24 run=3 blk=1 avail=7417 (53.8%) swpO=0 conn=2 myRSS=2387 php=14 phpRSS=1600 ap=71 tcp=70 topuser=madalice 2026-09-07 12:35:37 L1=4.24 run=2 blk=1 avail=7377 (53.5%) swpO=0 conn=4 myRSS=2387 php=14 phpRSS=1650 ap=70 tcp=68 topuser=madalice 2026-09-07 12:35:47 L1=3.90 run=2 blk=1 avail=7506 (54.5%) swpO=0 conn=2 myRSS=2387 php=14 phpRSS=1570 ap=63 tcp=55 topuser=madalice 2026-09-07 12:35:47 L1=3.90 run=3 blk=1 avail=7498 (54.4%) swpO=0 conn=3 myRSS=2387 php=15 phpRSS=1615 ap=62 tcp=55 topuser=madalice 2026-09-07 12:35:57 L1=3.52 run=4 blk=1 avail=7548 (54.8%) swpO=0 conn=3 myRSS=2387 php=15 phpRSS=1630 ap=53 tcp=63 topuser=madalice 2026-09-07 12:35:57 L1=3.52 run=9 blk=1 avail=7446 (54.0%) swpO=0 conn=5 myRSS=2387 php=18 phpRSS=1825 ap=52 tcp=64 topuser=madalice 2026-09-07 12:36:07 L1=3.37 run=3 blk=1 avail=7540 (54.7%) swpO=0 conn=3 myRSS=2387 php=15 phpRSS=1687 ap=45 tcp=62 topuser=madalice 2026-09-07 12:36:07 L1=3.37 run=3 blk=1 avail=7447 (54.1%) swpO=0 conn=4 myRSS=2387 php=16 phpRSS=1800 ap=46 tcp=62 topuser=madalice 2026-09-07 12:36:17 L1=3.55 run=4 blk=1 avail=7436 (54.0%) swpO=0 conn=4 myRSS=2387 php=19 phpRSS=1796 ap=58 tcp=76 topuser=madalice 2026-09-07 12:36:18 L1=3.55 run=13 blk=1 avail=7384 (53.6%) swpO=0 conn=5 myRSS=2387 php=21 phpRSS=1907 ap=59 tcp=79 topuser=madalice 2026-09-07 12:36:28 L1=3.69 run=3 blk=1 avail=7437 (54.0%) swpO=0 conn=3 myRSS=2388 php=16 phpRSS=1617 ap=68 tcp=70 topuser=madalice 2026-09-07 12:36:28 L1=3.69 run=4 blk=1 avail=7436 (54.0%) swpO=0 conn=3 myRSS=2388 php=16 phpRSS=1657 ap=68 tcp=70 topuser=madalice 2026-09-07 12:36:38 L1=3.66 run=3 blk=1 avail=7460 (54.1%) swpO=0 conn=3 myRSS=2388 php=17 phpRSS=1719 ap=61 tcp=66 topuser=madalice 2026-09-07 12:36:38 L1=3.66 run=4 blk=1 avail=7457 (54.1%) swpO=0 conn=3 myRSS=2388 php=17 phpRSS=1687 ap=61 tcp=65 topuser=madalice 2026-09-07 12:36:48 L1=3.70 run=4 blk=1 avail=7394 (53.7%) swpO=0 conn=4 myRSS=2388 php=16 phpRSS=1812 ap=53 tcp=55 topuser=madalice 2026-09-07 12:36:48 L1=3.70 run=5 blk=1 avail=7391 (53.6%) swpO=0 conn=4 myRSS=2388 php=16 phpRSS=1816 ap=53 tcp=54 topuser=madalice 2026-09-07 12:36:58 L1=3.44 run=9 blk=1 avail=7441 (54.0%) swpO=0 conn=8 myRSS=2388 php=19 phpRSS=1889 ap=49 tcp=60 topuser=madalice 2026-09-07 12:36:58 L1=3.44 run=11 blk=1 avail=7447 (54.1%) swpO=0 conn=8 myRSS=2388 php=19 phpRSS=1878 ap=49 tcp=60 topuser=madalice 2026-09-07 12:37:08 L1=4.04 run=3 blk=1 avail=7532 (54.7%) swpO=0 conn=4 myRSS=2388 php=16 phpRSS=1685 ap=50 tcp=55 topuser=madalice 2026-09-07 12:37:08 L1=4.04 run=5 blk=1 avail=7530 (54.7%) swpO=0 conn=4 myRSS=2388 php=16 phpRSS=1685 ap=50 tcp=55 topuser=madalice 2026-09-07 12:37:18 L1=4.12 run=6 blk=1 avail=7182 (52.1%) swpO=0 conn=6 myRSS=2388 php=17 phpRSS=1943 ap=57 tcp=73 topuser=madalice 2026-09-07 12:37:18 L1=4.12 run=7 blk=1 avail=7173 (52.1%) swpO=0 conn=6 myRSS=2388 php=17 phpRSS=1940 ap=57 tcp=73 topuser=madalice 2026-09-07 12:34:56 L1=3.66 run=2 blk=1 avail=7479 (54.3%) swpO=0 conn=2 myRSS=2386 php=14 phpRSS=1652 ap=57 tcp=58 topuser=madalice 2026-09-07 12:34:57 L1=3.66 run=2 blk=1 avail=7536 (54.7%) swpO=0 conn=3 myRSS=2386 php=15 phpRSS=1614 ap=57 tcp=60 topuser=madalice 2026-09-07 12:35:06 L1=3.96 run=4 blk=1 avail=7342 (53.3%) swpO=0 conn=3 myRSS=2386 php=18 phpRSS=1943 ap=52 tcp=76 topuser=madalice 2026-09-07 12:35:07 L1=3.96 run=4 blk=1 avail=7541 (54.7%) swpO=0 conn=3 myRSS=2386 php=15 phpRSS=1630 ap=52 tcp=73 topuser=madalice 2026-09-07 12:35:16 L1=4.27 run=8 blk=1 avail=7374 (53.5%) swpO=0 conn=5 myRSS=2386 php=16 phpRSS=1800 ap=57 tcp=70 topuser=madalice 2026-09-07 12:35:17 L1=4.27 run=5 blk=1 avail=7352 (53.4%) swpO=0 conn=3 myRSS=2386 php=15 phpRSS=1795 ap=57 tcp=65 topuser=madalice 2026-09-07 12:35:27 L1=4.29 run=7 blk=1 avail=7295 (53.0%) swpO=0 conn=4 myRSS=2387 php=19 phpRSS=1851 ap=70 tcp=81 topuser=madalice 2026-09-07 12:35:27 L1=4.29 run=6 blk=1 avail=7318 (53.1%) swpO=0 conn=3 myRSS=2387 php=16 phpRSS=1751 ap=70 tcp=81 topuser=madalice 2026-09-07 12:35:37 L1=4.24 run=3 blk=1 avail=7417 (53.8%) swpO=0 conn=2 myRSS=2387 php=14 phpRSS=1600 ap=71 tcp=70 topuser=madalice 2026-09-07 12:35:37 L1=4.24 run=2 blk=1 avail=7377 (53.5%) swpO=0 conn=4 myRSS=2387 php=14 phpRSS=1650 ap=70 tcp=68 topuser=madalice 2026-09-07 12:35:47 L1=3.90 run=2 blk=1 avail=7506 (54.5%) swpO=0 conn=2 myRSS=2387 php=14 phpRSS=1570 ap=63 tcp=55 topuser=madalice 2026-09-07 12:35:47 L1=3.90 run=3 blk=1 avail=7498 (54.4%) swpO=0 conn=3 myRSS=2387 php=15 phpRSS=1615 ap=62 tcp=55 topuser=madalice 2026-09-07 12:35:57 L1=3.52 run=4 blk=1 avail=7548 (54.8%) swpO=0 conn=3 myRSS=2387 php=15 phpRSS=1630 ap=53 tcp=63 topuser=madalice 2026-09-07 12:35:57 L1=3.52 run=9 blk=1 avail=7446 (54.0%) swpO=0 conn=5 myRSS=2387 php=18 phpRSS=1825 ap=52 tcp=64 topuser=madalice 2026-09-07 12:36:07 L1=3.37 run=3 blk=1 avail=7540 (54.7%) swpO=0 conn=3 myRSS=2387 php=15 phpRSS=1687 ap=45 tcp=62 topuser=madalice 2026-09-07 12:36:07 L1=3.37 run=3 blk=1 avail=7447 (54.1%) swpO=0 conn=4 myRSS=2387 php=16 phpRSS=1800 ap=46 tcp=62 topuser=madalice 2026-09-07 12:36:17 L1=3.55 run=4 blk=1 avail=7436 (54.0%) swpO=0 conn=4 myRSS=2387 php=19 phpRSS=1796 ap=58 tcp=76 topuser=madalice 2026-09-07 12:36:18 L1=3.55 run=13 blk=1 avail=7384 (53.6%) swpO=0 conn=5 myRSS=2387 php=21 phpRSS=1907 ap=59 tcp=79 topuser=madalice 2026-09-07 12:36:28 L1=3.69 run=3 blk=1 avail=7437 (54.0%) swpO=0 conn=3 myRSS=2388 php=16 phpRSS=1617 ap=68 tcp=70 topuser=madalice 2026-09-07 12:36:28 L1=3.69 run=4 blk=1 avail=7436 (54.0%) swpO=0 conn=3 myRSS=2388 php=16 phpRSS=1657 ap=68 tcp=70 topuser=madalice 2026-09-07 12:36:38 L1=3.66 run=3 blk=1 avail=7460 (54.1%) swpO=0 conn=3 myRSS=2388 php=17 phpRSS=1719 ap=61 tcp=66 topuser=madalice 2026-09-07 12:36:38 L1=3.66 run=4 blk=1 avail=7457 (54.1%) swpO=0 conn=3 myRSS=2388 php=17 phpRSS=1687 ap=61 tcp=65 topuser=madalice 2026-09-07 12:36:48 L1=3.70 run=4 blk=1 avail=7394 (53.7%) swpO=0 conn=4 myRSS=2388 php=16 phpRSS=1812 ap=53 tcp=55 topuser=madalice 2026-09-07 12:36:48 L1=3.70 run=5 blk=1 avail=7391 (53.6%) swpO=0 conn=4 myRSS=2388 php=16 phpRSS=1816 ap=53 tcp=54 topuser=madalice 2026-09-07 12:36:58 L1=3.44 run=9 blk=1 avail=7441 (54.0%) swpO=0 conn=8 myRSS=2388 php=19 phpRSS=1889 ap=49 tcp=60 topuser=madalice 2026-09-07 12:36:58 L1=3.44 run=11 blk=1 avail=7447 (54.1%) swpO=0 conn=8 myRSS=2388 php=19 phpRSS=1878 ap=49 tcp=60 topuser=madalice 2026-09-07 12:37:08 L1=4.04 run=3 blk=1 avail=7532 (54.7%) swpO=0 conn=4 myRSS=2388 php=16 phpRSS=1685 ap=50 tcp=55 topuser=madalice 2026-09-07 12:37:08 L1=4.04 run=5 blk=1 avail=7530 (54.7%) swpO=0 conn=4 myRSS=2388 php=16 phpRSS=1685 ap=50 tcp=55 topuser=madalice 2026-09-07 12:37:18 L1=4.12 run=6 blk=1 avail=7182 (52.1%) swpO=0 conn=6 myRSS=2388 php=17 phpRSS=1943 ap=57 tcp=73 topuser=madalice 2026-09-07 12:37:18 L1=4.12 run=7 blk=1 avail=7173 (52.1%) swpO=0 conn=6 myRSS=2388 php=17 phpRSS=1940 ap=57 tcp=73 topuser=madalice