INCIDENT 2026-09-07 13:47:59 trigger: php_rss=1540MB ================================================================== load: 4.14 3.30 3.27 2/710 3406825 ncpu:10 mem_avail: 7850MB/13777MB (57.0%) swap_used:2641MB swapout:195/s blocked(D):1 running:2 iowait:8.2% steal:0.0% php: 14 procs / 1540MB heaviest user: madalice (9 procs, 1447MB) apache: 52 procs tcp_estab: 53 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2327 madalice 9 1447 root 252 1090 nobody 51 820 netdata 8 243 mailman 20 98 corpkicks 1 76 wp-toolkit 3 56 dovenull 6 55 dovecot 3 22 cpanellogin 1 18 alison 1 14 zabbix 1 10 mailnull 1 10 kurri 1 9 evolution 11 9 named 1 7 polkitd 1 6 nscd 1 5 rpc 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 9 1447 corpkicks 1 80 root 1 22 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6964 MB Active(file): 3315 MB Inactive(file): 3741 MB Dirty: 4 MB Writeback: 0 MB SReclaimable: 580 MB CommitLimit: 10984 MB Committed_AS: 9643 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-11:25:34 4932 /usr/bin/imunify-agent-proxy 4109079 root 2-09:03:12 1948 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-09:03:12 50680 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 2383000 7.4 Ssl 1-18:11:29 /usr/sbin/mariadbd 3406706 167896 madalice 249480 29.7 S 00:08 php-fpm: pool madalice_com_au 166870 1 netdata 184536 2.6 Ssl 1-11:25:40 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 167871 1 root 170220 0.0 Ss 1-11:25:33 /usr/lib/systemd/systemd-journald 3405823 167896 madalice 162652 10.7 S 00:55 php-fpm: pool madalice_com_au 3406705 167896 madalice 161560 30.0 S 00:08 php-fpm: pool madalice_com_au 3406697 167896 madalice 161244 26.5 S 00:09 php-fpm: pool madalice_com_au 3406712 167896 madalice 158856 32.5 S 00:08 php-fpm: pool madalice_com_au 3406704 167896 madalice 158376 30.2 S 00:08 php-fpm: pool madalice_com_au 3406708 167896 madalice 154824 27.2 S 00:08 php-fpm: pool madalice_com_au 3406698 167896 madalice 138560 14.6 S 00:09 php-fpm: pool madalice_com_au 3406715 167896 madalice 136956 18.0 S 00:08 php-fpm: pool madalice_com_au 923653 904997 root 136436 0.0 S 11:18:15 spamd child 904997 1 root 129456 0.0 Ss 11:25:03 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3368408 904997 root 124144 0.0 S 08:08 spamd child 3406793 3388087 corpkicks 93160 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 4109105 4109079 root 50680 1.4 Sl 2-09:03:12 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1353308 1 root 41648 0.1 Ss 47-11:06:46 cpsrvd (SSL) - waiting for connections 167562 166914 netdata 34576 0.1 Sl 1-11:25:35 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 34352 0.0 Sl 10-11:28:20 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3406791 1469 root 34220 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3406795 1469 root 34216 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3406790 1469 root 34140 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1469 1 root 32752 0.1 Ss 70-03:38:15 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 166645 1 wp-toolkit 31788 0.0 Ss 1-11:25:44 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29892 0.0 Ss 11:25:35 lfd - sleeping 1463 1 root 23860 0.0 Ss 70-03:38:15 tailwatchd 167896 1 root 23364 0.0 Ss 1-11:25:32 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3388087 506832 nobody 21100 0.0 S 03:46 /usr/sbin/httpd -k start 3388053 506832 nobody 20660 0.0 S 03:47 /usr/sbin/httpd -k start 3405291 506832 nobody 20496 0.1 S 01:23 /usr/sbin/httpd -k start 3405018 506832 nobody 20448 0.0 S 01:37 /usr/sbin/httpd -k start 3386035 506832 nobody 20244 0.0 S 05:17 /usr/sbin/httpd -k start 3404429 506832 nobody 20012 0.0 S 02:04 /usr/sbin/httpd -k start 3388864 506832 nobody 19920 0.0 S 03:02 /usr/sbin/httpd -k start 3358291 506832 nobody 19772 0.1 S 12:50 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19604 0.0 Ss 1-11:25:33 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3404989 506832 nobody 19588 0.0 S 01:39 /usr/sbin/httpd -k start 3405006 506832 nobody 19392 0.1 S 01:38 /usr/sbin/httpd -k start 3404800 506832 nobody 19368 0.0 S 01:49 /usr/sbin/httpd -k start 3405899 506832 nobody 19308 0.0 S 00:50 /usr/sbin/httpd -k start 3387696 1353308 cpanellogin 19116 0.0 S 03:55 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 3404052 506832 nobody 19100 0.1 S 02:19 /usr/sbin/httpd -k start 3405405 506832 nobody 19088 0.0 S 01:19 /usr/sbin/httpd -k start 3402026 506832 nobody 18984 0.0 S 02:48 /usr/sbin/httpd -k start 3405309 506832 nobody 18960 0.0 S 01:22 /usr/sbin/httpd -k start 3398794 506832 nobody 18880 0.0 S 02:50 /usr/sbin/httpd -k start 3395640 506832 nobody 18820 0.0 S 02:52 /usr/sbin/httpd -k start 3405574 506832 nobody 18548 0.0 S 01:09 /usr/sbin/httpd -k start 3405955 506832 nobody 18352 0.0 S 00:49 /usr/sbin/httpd -k start 3405992 506832 nobody 18252 0.0 S 00:45 /usr/sbin/httpd -k start 167566 166914 netdata 18124 2.2 Sl 1-11:25:35 /usr/libexec/netdata/plugins.d/apps.plugin 1 3386709 506832 nobody 18112 0.0 S 04:39 /usr/sbin/httpd -k start 3406524 506832 nobody 18000 0.1 S 00:18 /usr/sbin/httpd -k start 3405312 506832 nobody 17896 0.1 S 01:22 /usr/sbin/httpd -k start 3406725 506832 nobody 17880 0.3 S 00:06 /usr/sbin/httpd -k start 3406744 506832 nobody 17792 0.2 S 00:05 /usr/sbin/httpd -k start 3406175 506832 nobody 17164 0.0 S 00:36 /usr/sbin/httpd -k start 3404550 506832 nobody 16776 0.1 S 02:00 /usr/sbin/httpd -k start 3405956 506832 nobody 16768 0.1 S 00:49 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3934661 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 290 candyfabcom/candyfab.com.au-ssl_log 215 bigdeals/bigdeals.com.au-ssl_log 212 evolution/app.evolutionerp.com.au-ssl_log 121 customc/customcentral.com.au-ssl_log 110 evolution/portal.evolutionerp.com.au-ssl_log 100 corpkicks/corporatekicks.com.au-ssl_log 53 cosgrovecreative/cosgrovecreative.com.au-ssl_log 51 coscom/coscom.com.au-ssl_log 49 evolution/evolutionerp.com.au-ssl_log 43 evolution/evolutionerp.com.au 19 madalice/madalice.com.au-ssl_log 13 alison/alisonarts.com.au-ssl_log 7 aaa/aaadownunder.com.au-ssl_log 2 (total vhosts taking traffic: 14) --- top client IPs across all vhosts (last 3 min) --- 688 45.148.10.12 222 203.54.180.238 121 40.115.94.245 61 93.152.221.156 57 103.104.165.99 48 103.104.164.114 30 182.239.240.254 16 116.91.221.245 11 180.181.236.49 5 157.230.113.200 5 118.127.40.55 3 114.119.130.40 2 165.225.233.87 2 1.145.70.156 2 114.119.140.234 --- top request paths across all vhosts (last 3 min) --- 156 POST /functions.php 86 POST / 61 GET /api/getItem/LWPB2001KG 47 GET /heartbeat.php 42 POST /wordpress/ 40 GET /app/ajax.php 33 POST /login 28 POST /wordpress/index.php 27 GET /index.php 24 POST /wp/ 24 POST /signin 23 GET /factory_session_checker.php 21 POST /blog/ 20 POST /register 20 GET / 18 GET /wp/ 18 GET /wordpress/ 17 POST /wordpress/wp-json/batch/v1 17 POST /admin 16 POST /wp/index.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 156 POST /functions.php 40 GET /app/ajax.php 16 POST /app/ajax/selectFilter.php 16 GET /index.php 8 POST /itemModify.php 8 POST /app/ajax/selectFilterSingle.php 8 POST /app/ajax.php 6 POST /quoteditsave.php 6 POST /plugins/csvexporter/plugin.php 6 POST /jobeditsave.php 6 POST /clienteditsave.php 2 POST /plugins/fencecosting/plugin.php -- last 10 requests -- 103.104.165.99 - - [07/Sep/2026:13:47:50 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37073§ionid=32951" "Mozilla/5.0 (Windows NT 10.0; 203.54.180.238 - - [07/Sep/2026:13:47:51 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 233 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=14211" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 116.91.221.245 - - [07/Sep/2026:13:47:53 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:13:47:54 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 238 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 182.239.240.254 - - [07/Sep/2026:13:47:54 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 203.54.180.238 - - [07/Sep/2026:13:47:56 +1000] "POST /jobeditsave.php?call=fetch_inventory HTTP/1.1" 200 125710 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=25858&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10 203.54.180.238 - - [07/Sep/2026:13:47:56 +1000] "POST /itemModify.php?call=getBOM HTTP/1.1" 200 1472 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79188§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win64 203.54.180.238 - - [07/Sep/2026:13:47:56 +1000] "POST /itemModify.php?call=getInvMFMeta&modifyid=6771 HTTP/1.1" 200 152 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79188§ionid=0" "Mozilla/5.0 (Win 203.54.180.238 - - [07/Sep/2026:13:47:58 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page%3Dinvoiceadd%26invoiceid%3D40732" "Mozilla/5.0 (Windows NT 10.0; Win64; 182.239.240.254 - - [07/Sep/2026:13:47:58 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=2920" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 21 POST /wp/ 21 POST /wordpress/ 14 POST /wp/index.php 14 POST /wordpress/index.php 9 POST /admin 9 GET /wp/ 9 GET /wordpress/ 7 POST /wp/wp-json/Batch/v1 7 POST /wp/wp-json/batch/v1/ 7 POST /wp/wp-json/batch/v1 7 POST /wp//wp-json/batch/v1 7 POST /wp/wordpress/wp-json/batch/v1 -- last 10 requests -- 45.148.10.12 - - [07/Sep/2026:13:47:50 +1000] "GET /wordpress/?rest_route=/wp/v2/tags HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:47:50 +1000] "GET /wordpress/wp/v2/posts/999998 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:47:51 +1000] "GET /wordpress/?rest_route=/wp/v2/posts/999998 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari 45.148.10.12 - - [07/Sep/2026:13:47:51 +1000] "GET /wordpress/wp/v2/posts/99999 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:47:51 +1000] "GET /wordpress/?rest_route=/wp/v2/posts/99999 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/ 45.148.10.12 - - [07/Sep/2026:13:47:52 +1000] "GET /wordpress/wp/v2/posts/9999999 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:47:52 +1000] "GET /wordpress/?rest_route=/wp/v2/posts/9999999 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safar 45.148.10.12 - - [07/Sep/2026:13:47:52 +1000] "GET /wordpress/wp/v2/users HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:47:53 +1000] "GET /wordpress/?rest_route=/wp/v2/users HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 45.148.10.12 - - [07/Sep/2026:13:47:53 +1000] "POST /blog/index.php?rest_route=/batch/v1 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537. == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 21 POST /wordpress/ 21 POST /blog/ 14 POST /wordpress/index.php 14 POST /blog/index.php 9 GET /wp/ 9 GET /wordpress/ 7 POST /wordpress/wp-json/Batch/v1 7 POST /wordpress/wp-json/batch/v1/ 7 POST /wordpress/wp-json/batch/v1 7 POST /wordpress//wp-json/batch/v1 7 POST /wordpress/wordpress/wp-json/batch/v1 7 POST /wordpress/blog/wp-json/batch/v1 -- last 10 requests -- 45.148.10.12 - - [07/Sep/2026:13:47:15 +1000] "POST /blog/wordpress/wp-json/batch/v1 HTTP/1.1" 401 53 "https://cpcontacts.bigdeals.com.au/blog/wp-admin/" "WordPress/6.4.3" 45.148.10.12 - - [07/Sep/2026:13:47:15 +1000] "GET /blog/wp/v2/posts/999999 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:47:15 +1000] "GET /blog/?rest_route=/wp/v2/posts/999999 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537. 45.148.10.12 - - [07/Sep/2026:13:47:16 +1000] "GET /blog/wp/v2/pages HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:47:16 +1000] "GET /blog/?rest_route=/wp/v2/pages HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:47:17 +1000] "GET /blog/wp/v2/media HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:47:17 +1000] "GET /blog/?rest_route=/wp/v2/media HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:47:17 +1000] "GET /blog/wp/v2/categories HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:47:18 +1000] "GET /blog/?rest_route=/wp/v2/categories HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 45.148.10.12 - - [07/Sep/2026:13:47:18 +1000] "GET /blog/wp/v2/tags HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-07 13:45:39 L1=2.64 run=3 blk=1 avail=8977 (65.2%) swpO=0 conn=1 myRSS=2325 php=6 phpRSS=302 ap=37 tcp=44 topuser=madalice 2026-09-07 13:45:39 L1=2.64 run=3 blk=1 avail=8955 (65.0%) swpO=0 conn=3 myRSS=2325 php=6 phpRSS=195 ap=37 tcp=44 topuser=madalice 2026-09-07 13:45:49 L1=2.53 run=4 blk=1 avail=9017 (65.5%) swpO=0 conn=1 myRSS=2325 php=8 phpRSS=283 ap=36 tcp=48 topuser=madalice 2026-09-07 13:45:49 L1=2.53 run=2 blk=1 avail=9031 (65.6%) swpO=0 conn=3 myRSS=2325 php=8 phpRSS=283 ap=36 tcp=46 topuser=madalice 2026-09-07 13:45:59 L1=2.82 run=5 blk=1 avail=8978 (65.2%) swpO=0 conn=2 myRSS=2326 php=6 phpRSS=237 ap=37 tcp=47 topuser=madalice 2026-09-07 13:45:59 L1=2.82 run=2 blk=1 avail=9001 (65.3%) swpO=0 conn=3 myRSS=2326 php=6 phpRSS=237 ap=37 tcp=48 topuser=madalice 2026-09-07 13:46:09 L1=2.62 run=1 blk=1 avail=9105 (66.1%) swpO=0 conn=2 myRSS=2326 php=5 phpRSS=177 ap=35 tcp=45 topuser=madalice 2026-09-07 13:46:09 L1=2.62 run=1 blk=1 avail=9095 (66.0%) swpO=0 conn=3 myRSS=2326 php=5 phpRSS=177 ap=34 tcp=44 topuser=madalice 2026-09-07 13:46:19 L1=2.68 run=4 blk=1 avail=8945 (64.9%) swpO=0 conn=2 myRSS=2326 php=6 phpRSS=309 ap=37 tcp=47 topuser=madalice 2026-09-07 13:46:19 L1=2.68 run=2 blk=1 avail=8961 (65.0%) swpO=0 conn=3 myRSS=2326 php=6 phpRSS=309 ap=37 tcp=47 topuser=madalice 2026-09-07 13:46:29 L1=2.65 run=1 blk=1 avail=9057 (65.7%) swpO=0 conn=2 myRSS=2326 php=5 phpRSS=177 ap=41 tcp=45 topuser=madalice 2026-09-07 13:46:29 L1=2.65 run=2 blk=1 avail=9073 (65.9%) swpO=0 conn=3 myRSS=2326 php=6 phpRSS=216 ap=40 tcp=45 topuser=madalice 2026-09-07 13:46:39 L1=2.78 run=4 blk=1 avail=9040 (65.6%) swpO=0 conn=2 myRSS=2326 php=5 phpRSS=177 ap=44 tcp=51 topuser=madalice 2026-09-07 13:46:39 L1=2.78 run=2 blk=1 avail=9035 (65.6%) swpO=0 conn=1 myRSS=2326 php=5 phpRSS=177 ap=44 tcp=51 topuser=madalice 2026-09-07 13:46:49 L1=2.98 run=4 blk=1 avail=9031 (65.6%) swpO=0 conn=2 myRSS=2326 php=6 phpRSS=259 ap=40 tcp=36 topuser=madalice 2026-09-07 13:46:49 L1=2.98 run=6 blk=1 avail=8959 (65.0%) swpO=0 conn=1 myRSS=2326 php=8 phpRSS=407 ap=39 tcp=38 topuser=evolution 2026-09-07 13:46:59 L1=3.29 run=2 blk=1 avail=9196 (66.7%) swpO=0 conn=2 myRSS=2326 php=5 phpRSS=96 ap=40 tcp=42 topuser=evolution 2026-09-07 13:46:59 L1=3.29 run=3 blk=1 avail=9172 (66.6%) swpO=0 conn=1 myRSS=2326 php=5 phpRSS=132 ap=39 tcp=44 topuser=evolution 2026-09-07 13:47:09 L1=3.25 run=3 blk=1 avail=9065 (65.8%) swpO=0 conn=2 myRSS=2326 php=6 phpRSS=233 ap=37 tcp=49 topuser=madalice 2026-09-07 13:47:09 L1=3.25 run=3 blk=1 avail=9021 (65.5%) swpO=0 conn=1 myRSS=2326 php=7 phpRSS=308 ap=37 tcp=50 topuser=madalice 2026-09-07 13:47:19 L1=3.06 run=4 blk=1 avail=9012 (65.4%) swpO=0 conn=2 myRSS=2326 php=9 phpRSS=348 ap=39 tcp=48 topuser=evolution 2026-09-07 13:47:19 L1=3.06 run=6 blk=1 avail=8977 (65.2%) swpO=0 conn=1 myRSS=2326 php=9 phpRSS=382 ap=39 tcp=46 topuser=madalice 2026-09-07 13:47:29 L1=3.19 run=2 blk=1 avail=8994 (65.3%) swpO=1 conn=2 myRSS=2328 php=6 phpRSS=304 ap=41 tcp=40 topuser=madalice 2026-09-07 13:47:30 L1=3.19 run=2 blk=1 avail=8962 (65.0%) swpO=1 conn=1 myRSS=2328 php=6 phpRSS=331 ap=41 tcp=40 topuser=evolution 2026-09-07 13:47:39 L1=3.40 run=2 blk=1 avail=9029 (65.5%) swpO=0 conn=2 myRSS=2329 php=6 phpRSS=303 ap=35 tcp=41 topuser=madalice 2026-09-07 13:47:40 L1=3.40 run=3 blk=1 avail=9004 (65.4%) swpO=0 conn=2 myRSS=2329 php=7 phpRSS=367 ap=35 tcp=41 topuser=evolution 2026-09-07 13:47:49 L1=3.72 run=2 blk=1 avail=8991 (65.3%) swpO=0 conn=2 myRSS=2330 php=6 phpRSS=336 ap=37 tcp=39 topuser=alison 2026-09-07 13:47:50 L1=3.72 run=1 blk=1 avail=9116 (66.2%) swpO=0 conn=2 myRSS=2330 php=5 phpRSS=177 ap=37 tcp=43 topuser=madalice 2026-09-07 13:47:59 L1=4.14 run=2 blk=1 avail=7850 (57.0%) swpO=195 conn=3 myRSS=2327 php=14 phpRSS=1540 ap=52 tcp=53 topuser=madalice 2026-09-07 13:48:00 L1=4.14 run=4 blk=1 avail=7820 (56.8%) swpO=195 conn=3 myRSS=2327 php=14 phpRSS=1581 ap=52 tcp=58 topuser=madalice