INCIDENT 2026-09-07 14:38:05 trigger: php_rss=1792MB ================================================================== load: 2.43 2.23 2.18 5/712 3592172 ncpu:10 mem_avail: 7595MB/13777MB (55.1%) swap_used:2612MB swapout:267/s blocked(D):1 running:6 iowait:7.2% steal:0.0% php: 15 procs / 1792MB heaviest user: madalice (10 procs, 1713MB) apache: 50 procs tcp_estab: 55 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2331 madalice 10 1732 root 248 866 nobody 49 814 netdata 8 244 mailman 20 98 evolution 12 66 wp-toolkit 3 56 dovenull 6 55 cpanellogin 1 48 mailnull 4 35 dovecot 3 22 alison 1 15 lowrange 1 14 aaa 1 13 zabbix 1 9 kurri 1 9 named 1 7 polkitd 1 6 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1734 evolution 4 56 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6974 MB Active(file): 3578 MB Inactive(file): 3552 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 578 MB CommitLimit: 10984 MB Committed_AS: 9829 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-12:15:40 4872 /usr/bin/imunify-agent-proxy 4109079 root 2-09:53:18 1960 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-09:53:18 89028 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 2387820 7.7 Ssl 1-19:01:35 /usr/sbin/mariadbd 3592069 167896 madalice 248580 54.2 S 00:05 php-fpm: pool madalice_com_au 3592070 167896 madalice 222548 52.6 R 00:05 php-fpm: pool madalice_com_au 166870 1 netdata 186284 2.6 Ssl 1-12:15:46 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3592071 167896 madalice 184244 47.0 R 00:05 php-fpm: pool madalice_com_au 3592066 167896 madalice 159324 56.0 S 00:05 php-fpm: pool madalice_com_au 3592065 167896 madalice 159308 55.2 S 00:05 php-fpm: pool madalice_com_au 3592064 167896 madalice 159280 54.2 S 00:05 php-fpm: pool madalice_com_au 3592068 167896 madalice 159240 58.8 S 00:05 php-fpm: pool madalice_com_au 3592062 167896 madalice 159204 45.3 S 00:06 php-fpm: pool madalice_com_au 923653 904997 root 146848 0.0 S 12:08:21 spamd child 3592108 167896 madalice 136624 37.0 S 00:04 php-fpm: pool madalice_com_au 3592106 167896 madalice 135932 36.0 S 00:04 php-fpm: pool madalice_com_au 904997 1 root 127564 0.0 Ss 12:15:09 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3368408 904997 root 122204 0.0 S 58:14 spamd child 4109105 4109079 root 89028 1.3 Sl 2-09:53:18 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 3592143 3591567 evolution 57616 10.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3387696 1353308 cpanellogin 49856 0.0 S 54:01 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 1353308 1 root 41832 0.1 Ss 47-11:56:52 cpsrvd (SSL) - waiting for connections 1469 1 root 41572 0.1 Ss 70-04:28:21 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3592201 3591297 evolution 40944 0.0 S 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3592200 3592132 evolution 38416 0.0 S 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 509236 509098 root 35120 0.0 Sl 10-12:18:26 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 167562 166914 netdata 34712 0.1 Sl 1-12:15:41 /usr/libexec/netdata/plugins.d/go.d.plugin 1 166645 1 wp-toolkit 31504 0.0 Ss 1-12:15:50 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29864 0.0 Ss 12:15:41 lfd - sleeping 1463 1 root 23388 0.0 Ss 70-04:28:21 tailwatchd 167896 1 root 23296 0.0 Ss 1-12:15:38 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3573863 506832 nobody 21608 0.0 S 05:05 /usr/sbin/httpd -k start 3591318 506832 nobody 21448 0.1 S 00:56 /usr/sbin/httpd -k start 3574310 506832 nobody 21148 0.0 S 04:31 /usr/sbin/httpd -k start 3575179 506832 nobody 21072 0.1 S 03:15 /usr/sbin/httpd -k start 3590197 506832 nobody 21028 0.1 S 02:25 /usr/sbin/httpd -k start 3573292 506832 nobody 20584 0.1 S 05:45 /usr/sbin/httpd -k start 3590389 506832 nobody 20408 0.0 S 02:10 /usr/sbin/httpd -k start 3591299 506832 nobody 19892 0.1 S 00:57 /usr/sbin/httpd -k start 3591284 506832 nobody 19632 0.1 S 00:58 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19576 0.0 Ss 1-12:15:39 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3575170 506832 nobody 19400 0.1 S 03:16 /usr/sbin/httpd -k start 3590553 506832 nobody 19244 0.0 S 01:55 /usr/sbin/httpd -k start 3591592 506832 nobody 19160 0.1 S 00:35 /usr/sbin/httpd -k start 3591148 506832 nobody 19088 0.1 S 01:06 /usr/sbin/httpd -k start 3587752 506832 nobody 18992 0.0 S 02:55 /usr/sbin/httpd -k start 3590780 506832 nobody 18900 0.1 S 01:38 /usr/sbin/httpd -k start 3591277 506832 nobody 18784 0.0 S 00:59 /usr/sbin/httpd -k start 3590561 506832 nobody 18716 0.0 S 01:54 /usr/sbin/httpd -k start 3591297 506832 nobody 18540 0.3 S 00:57 /usr/sbin/httpd -k start 3591597 506832 nobody 18528 0.0 S 00:35 /usr/sbin/httpd -k start 3591312 506832 nobody 18456 0.0 S 00:56 /usr/sbin/httpd -k start 3591199 506832 nobody 18404 0.0 S 01:02 /usr/sbin/httpd -k start 3591315 506832 nobody 18336 0.0 S 00:56 /usr/sbin/httpd -k start 3591313 506832 nobody 18268 0.1 S 00:56 /usr/sbin/httpd -k start 3591568 506832 nobody 18252 0.0 S 00:37 /usr/sbin/httpd -k start 3591580 506832 nobody 18144 0.0 S 00:36 /usr/sbin/httpd -k start 3591593 506832 nobody 18108 0.0 S 00:35 /usr/sbin/httpd -k start 167566 166914 netdata 18068 2.2 Sl 1-12:15:41 /usr/libexec/netdata/plugins.d/apps.plugin 1 3591317 506832 nobody 17940 0.1 S 00:56 /usr/sbin/httpd -k start 3592114 506832 nobody 17932 0.6 S 00:03 /usr/sbin/httpd -k start 3592118 506832 nobody 17860 1.0 S 00:02 /usr/sbin/httpd -k start 3592105 506832 nobody 17808 0.5 S 00:04 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+---------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+---------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4195910 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 4195905 | root | 85-1559715131 | Execute | 0 | Sending data | SELECT sectionRef,sectionId,sum(total) as total from quoteitems WHERE `quoteid` = '37072' and status!='0' group by sectionId order by sectionRef | +---------+------+---------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 502 evolution/app.evolutionerp.com.au-ssl_log 97 evolution/portal.evolutionerp.com.au-ssl_log 75 madalice/madalice.com.au-ssl_log 13 corpkicks/corporatekicks.com.au-ssl_log 9 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 360 203.54.180.238 107 103.104.165.99 97 40.115.94.245 38 182.239.240.254 25 1.145.70.156 13 1.144.107.82 11 116.91.221.245 10 103.104.164.114 8 34.56.103.171 8 180.181.236.49 6 139.130.144.42 3 203.166.236.147 3 118.127.40.55 1 43.173.181.243 1 43.172.196.157 --- top request paths across all vhosts (last 3 min) --- 163 POST /functions.php 97 GET /api/getItem/LWFB2001KG 95 GET /app/ajax.php 34 GET /index.php 32 GET /heartbeat.php 28 POST /plugins/csvexporter/plugin.php 23 POST /jobeditsave.php 21 GET /factory_session_checker.php 20 POST /app/ajax/selectFilterSingle.php 18 POST /quoteditsave.php 18 POST /clienteditsave.php 15 POST /app/ajax.php 12 POST /app/ajax/selectFilter.php 11 GET /factory_session_processed_qty.php 11 GET /factory_session_joiner.php 11 GET //app/ajax.php 10 POST /itemModify.php 8 POST //functions.php 6 GET /plugins/fensa/fensa-ajax.php 5 POST /plugins/fencecosting/plugin.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 163 POST /functions.php 95 GET /app/ajax.php 34 GET /index.php 28 POST /plugins/csvexporter/plugin.php 23 POST /jobeditsave.php 20 POST /app/ajax/selectFilterSingle.php 18 POST /quoteditsave.php 18 POST /clienteditsave.php 15 POST /app/ajax.php 12 POST /app/ajax/selectFilter.php 11 GET //app/ajax.php 10 POST /itemModify.php -- last 10 requests -- 180.181.236.49 - - [07/Sep/2026:14:37:58 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=6953§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win64 103.104.165.99 - - [07/Sep/2026:14:37:58 +1000] "POST /jobeditsave.php HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11947" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM 103.104.165.99 - - [07/Sep/2026:14:37:58 +1000] "GET /index.php?page=jobregister HTTP/1.1" 200 16176 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11947" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 103.104.165.99 - - [07/Sep/2026:14:37:58 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 103.104.165.99 - - [07/Sep/2026:14:37:58 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 11117 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 103.104.165.99 - - [07/Sep/2026:14:37:59 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobregister&call=getUserSetting&caller=ajaxSubmitLocal&seq=12704405566 HTTP/1.1" 200 163 "https://my.evolutionerp.com.au/index.p 103.104.165.99 - - [07/Sep/2026:14:38:00 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 1.145.70.156 - - [07/Sep/2026:14:38:02 +1000] "POST /quoteditsave.php?call=getTheQuotes HTTP/1.1" 200 386 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 203.54.180.238 - - [07/Sep/2026:14:38:02 +1000] "POST /quoteditsave.php?call=getTheQuotes HTTP/1.1" 200 10460 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 103.104.164.114 - - [07/Sep/2026:14:38:04 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 97 GET /api/getItem/LWFB2001KG -- last 10 requests -- 40.115.94.245 - - [07/Sep/2026:14:37:51 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:14:37:51 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:14:37:52 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:14:37:52 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:14:37:52 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:14:37:53 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:14:37:53 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:14:37:53 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:14:37:54 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:14:37:54 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 32 GET /heartbeat.php 21 GET /factory_session_checker.php 11 GET /factory_session_processed_qty.php 11 GET /factory_session_joiner.php -- last 10 requests -- 203.54.180.238 - - [07/Sep/2026:14:37:37 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 124 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [07/Sep/2026:14:37:36 +1000] "GET /heartbeat.php?sentAt=1788755856&bytes=106,158,63,144&_=1788753043238 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:14:37:37 +1000] "GET /heartbeat.php?sentAt=1788755851&bytes=106,158,63,139&_=1788739088151 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:14:37:39 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:14:37:38 +1000] "GET /heartbeat.php?sentAt=1788755852&bytes=106,158,63,140&_=1788753887958 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:14:37:44 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:14:37:47 +1000] "GET /factory_session_joiner.php?id=35173 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [07/Sep/2026:14:37:47 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 124 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [07/Sep/2026:14:37:46 +1000] "GET /heartbeat.php?sentAt=1788755866&bytes=106,158,63,154&_=1788753043239 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:14:37:47 +1000] "GET /heartbeat.php?sentAt=1788755861&bytes=106,158,63,149&_=1788739088152 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-09-07 14:35:44 L1=2.39 run=2 blk=1 avail=9188 (66.7%) swpO=0 conn=2 myRSS=2341 php=5 phpRSS=80 ap=35 tcp=41 topuser=evolution 2026-09-07 14:35:45 L1=2.39 run=2 blk=1 avail=9182 (66.6%) swpO=0 conn=3 myRSS=2341 php=5 phpRSS=82 ap=35 tcp=41 topuser=evolution 2026-09-07 14:35:54 L1=2.42 run=1 blk=1 avail=9257 (67.2%) swpO=0 conn=1 myRSS=2341 php=4 phpRSS=22 ap=29 tcp=42 topuser=root 2026-09-07 14:35:55 L1=2.42 run=2 blk=1 avail=9230 (67.0%) swpO=0 conn=3 myRSS=2341 php=5 phpRSS=78 ap=29 tcp=42 topuser=evolution 2026-09-07 14:36:04 L1=2.35 run=1 blk=1 avail=9253 (67.2%) swpO=0 conn=1 myRSS=2341 php=4 phpRSS=22 ap=30 tcp=35 topuser=root 2026-09-07 14:36:05 L1=2.35 run=1 blk=1 avail=9253 (67.2%) swpO=0 conn=3 myRSS=2341 php=4 phpRSS=22 ap=29 tcp=35 topuser=root 2026-09-07 14:36:14 L1=2.29 run=3 blk=1 avail=9187 (66.7%) swpO=0 conn=1 myRSS=2341 php=6 phpRSS=115 ap=34 tcp=35 topuser=madalice 2026-09-07 14:36:15 L1=2.29 run=3 blk=1 avail=9084 (65.9%) swpO=0 conn=3 myRSS=2341 php=6 phpRSS=211 ap=34 tcp=31 topuser=madalice 2026-09-07 14:36:25 L1=2.25 run=2 blk=1 avail=9016 (65.4%) swpO=0 conn=1 myRSS=2341 php=6 phpRSS=297 ap=32 tcp=35 topuser=madalice 2026-09-07 14:36:25 L1=2.25 run=2 blk=1 avail=9017 (65.4%) swpO=0 conn=3 myRSS=2341 php=7 phpRSS=321 ap=31 tcp=37 topuser=madalice 2026-09-07 14:36:35 L1=2.13 run=1 blk=1 avail=9001 (65.3%) swpO=0 conn=1 myRSS=2341 php=6 phpRSS=297 ap=33 tcp=40 topuser=madalice 2026-09-07 14:36:35 L1=2.13 run=2 blk=1 avail=9000 (65.3%) swpO=0 conn=3 myRSS=2341 php=6 phpRSS=297 ap=33 tcp=40 topuser=madalice 2026-09-07 14:36:45 L1=2.11 run=1 blk=1 avail=9134 (66.3%) swpO=0 conn=1 myRSS=2341 php=5 phpRSS=144 ap=32 tcp=40 topuser=madalice 2026-09-07 14:36:45 L1=2.11 run=1 blk=1 avail=9138 (66.3%) swpO=0 conn=3 myRSS=2341 php=5 phpRSS=144 ap=31 tcp=39 topuser=madalice 2026-09-07 14:36:55 L1=1.94 run=2 blk=1 avail=9178 (66.6%) swpO=0 conn=2 myRSS=2341 php=5 phpRSS=161 ap=24 tcp=34 topuser=alison 2026-09-07 14:36:55 L1=1.94 run=1 blk=1 avail=9285 (67.4%) swpO=0 conn=3 myRSS=2341 php=4 phpRSS=22 ap=24 tcp=32 topuser=root 2026-09-07 14:37:05 L1=2.03 run=2 blk=1 avail=8886 (64.5%) swpO=0 conn=2 myRSS=2341 php=7 phpRSS=450 ap=29 tcp=43 topuser=madalice 2026-09-07 14:37:05 L1=2.03 run=2 blk=1 avail=8883 (64.5%) swpO=0 conn=3 myRSS=2341 php=7 phpRSS=453 ap=29 tcp=41 topuser=madalice 2026-09-07 14:37:15 L1=1.95 run=4 blk=1 avail=8652 (62.8%) swpO=42 conn=2 myRSS=2340 php=12 phpRSS=527 ap=42 tcp=36 topuser=madalice 2026-09-07 14:37:15 L1=1.95 run=2 blk=1 avail=8884 (64.5%) swpO=42 conn=2 myRSS=2340 php=11 phpRSS=486 ap=41 tcp=40 topuser=madalice 2026-09-07 14:37:25 L1=2.04 run=7 blk=1 avail=9010 (65.4%) swpO=0 conn=2 myRSS=2340 php=11 phpRSS=388 ap=40 tcp=46 topuser=evolution 2026-09-07 14:37:25 L1=2.04 run=2 blk=1 avail=9022 (65.5%) swpO=0 conn=2 myRSS=2340 php=9 phpRSS=320 ap=39 tcp=47 topuser=evolution 2026-09-07 14:37:35 L1=2.11 run=2 blk=1 avail=9105 (66.1%) swpO=0 conn=2 myRSS=2340 php=4 phpRSS=22 ap=51 tcp=49 topuser=root 2026-09-07 14:37:35 L1=2.11 run=2 blk=1 avail=9112 (66.1%) swpO=0 conn=2 myRSS=2340 php=4 phpRSS=22 ap=50 tcp=48 topuser=root 2026-09-07 14:37:45 L1=2.02 run=2 blk=1 avail=9017 (65.4%) swpO=0 conn=2 myRSS=2340 php=10 phpRSS=303 ap=45 tcp=51 topuser=evolution 2026-09-07 14:37:45 L1=2.02 run=2 blk=1 avail=9142 (66.4%) swpO=0 conn=2 myRSS=2340 php=4 phpRSS=22 ap=45 tcp=45 topuser=root 2026-09-07 14:37:55 L1=1.94 run=4 blk=1 avail=9166 (66.5%) swpO=0 conn=2 myRSS=2340 php=6 phpRSS=113 ap=39 tcp=40 topuser=evolution 2026-09-07 14:37:55 L1=1.94 run=1 blk=1 avail=9194 (66.7%) swpO=0 conn=2 myRSS=2340 php=5 phpRSS=45 ap=39 tcp=40 topuser=evolution 2026-09-07 14:38:05 L1=2.43 run=6 blk=1 avail=7595 (55.1%) swpO=267 conn=6 myRSS=2331 php=15 phpRSS=1792 ap=50 tcp=55 topuser=madalice 2026-09-07 14:38:05 L1=2.43 run=7 blk=1 avail=7575 (55.0%) swpO=267 conn=4 myRSS=2331 php=15 phpRSS=1765 ap=50 tcp=57 topuser=madalice