INCIDENT 2026-09-07 16:41:43 trigger: php_rss=1720MB ================================================================== load: 3.02 2.07 2.03 13/740 4044194 ncpu:10 mem_avail: 7209MB/13777MB (52.3%) swap_used:2656MB swapout:49/s blocked(D):1 running:11 iowait:7.9% steal:0.0% php: 14 procs / 1720MB heaviest user: madalice (10 procs, 1697MB) apache: 76 procs tcp_estab: 67 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2380 madalice 10 1741 nobody 74 1280 root 249 957 netdata 8 254 mailman 20 98 cpanellogin 1 87 infinium 2 82 dovenull 6 67 wp-toolkit 3 56 dovecot 3 28 mailnull 3 22 alison 1 14 aaa 1 14 kurri 1 13 zabbix 1 10 evolution 11 9 cpanelphpmyadmin 1 8 named 1 7 polkitd 1 6 --- php workers by user --- USER PROCS RSS_MB madalice 10 1758 root 1 22 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6309 MB Active(file): 3843 MB Inactive(file): 2601 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 572 MB CommitLimit: 10984 MB Committed_AS: 10454 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-14:19:17 4804 /usr/bin/imunify-agent-proxy 4109079 root 2-11:56:55 1952 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-11:56:55 66672 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 2437280 8.4 Ssl 1-21:05:12 /usr/sbin/mariadbd 4043631 167896 madalice 246560 19.4 R 00:30 php-fpm: pool madalice_com_au 4043588 167896 madalice 246512 20.8 R 00:39 php-fpm: pool madalice_com_au 4043633 167896 madalice 234984 15.8 S 00:30 php-fpm: pool madalice_com_au 166870 1 netdata 196136 2.6 Ssl 1-14:19:23 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 923653 904997 root 179416 0.0 S 14:11:58 spamd child 4044115 167896 madalice 173800 47.0 R 00:04 php-fpm: pool madalice_com_au 4043632 167896 madalice 172712 18.6 R 00:30 php-fpm: pool madalice_com_au 4043630 167896 madalice 171084 18.6 R 00:30 php-fpm: pool madalice_com_au 4043628 167896 madalice 165292 21.7 R 00:31 php-fpm: pool madalice_com_au 3368408 904997 root 160504 0.0 S 03:01:51 spamd child 4043634 167896 madalice 159180 15.2 S 00:30 php-fpm: pool madalice_com_au 4043629 167896 madalice 158104 18.5 S 00:31 php-fpm: pool madalice_com_au 4044116 167896 madalice 148464 49.5 R 00:04 php-fpm: pool madalice_com_au 904997 1 root 114968 0.0 Ss 14:18:46 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3883926 1353308 cpanellogin 90004 0.0 S 42:38 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 4109105 4109079 root 66672 1.3 Sl 2-11:56:55 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 4043599 1353308 infinium 54856 0.3 S 00:38 webmaild - serving 1.41.252.211 167871 1 root 45688 0.0 Ss 1-14:19:16 /usr/lib/systemd/systemd-journald 1353308 1 root 41836 0.1 Ss 47-14:00:29 cpsrvd (SSL) - waiting for connections 1469 1 root 39956 0.1 Ss 70-06:31:58 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 509236 509098 root 35000 0.0 Sl 10-14:22:03 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 167562 166914 netdata 34564 0.1 Sl 1-14:19:18 /usr/libexec/netdata/plugins.d/go.d.plugin 1 166645 1 wp-toolkit 31756 0.0 Ss 1-14:19:27 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29952 0.0 Ss 14:19:18 lfd - sleeping 3920753 1542095 infinium 29112 0.0 S 32:06 php-fpm: pool user_infinium 1463 1 root 23660 0.0 Ss 70-06:31:58 tailwatchd 4028395 506832 nobody 23624 0.1 S 02:02 /usr/sbin/httpd -k start 167896 1 root 23288 0.0 Ss 1-14:19:15 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 4028089 506832 nobody 23276 0.0 S 02:15 /usr/sbin/httpd -k start 4028405 506832 nobody 23236 0.1 S 02:01 /usr/sbin/httpd -k start 4026781 506832 nobody 22788 0.0 S 04:31 /usr/sbin/httpd -k start 4031301 506832 nobody 22732 0.1 S 01:38 /usr/sbin/httpd -k start 4028381 506832 nobody 21904 0.0 S 02:04 /usr/sbin/httpd -k start 4026576 506832 nobody 21720 0.0 S 04:48 /usr/sbin/httpd -k start 4009768 506832 nobody 21632 0.0 S 08:37 /usr/sbin/httpd -k start 4031302 506832 nobody 21592 0.0 S 01:38 /usr/sbin/httpd -k start 4028388 506832 nobody 21248 0.0 S 02:03 /usr/sbin/httpd -k start 4043584 506832 nobody 21112 0.1 S 00:39 /usr/sbin/httpd -k start 4033012 506832 nobody 20984 0.1 S 01:37 /usr/sbin/httpd -k start 4028409 506832 nobody 20752 0.0 S 02:01 /usr/sbin/httpd -k start 4043729 506832 nobody 20744 0.1 S 00:26 /usr/sbin/httpd -k start 4033010 506832 nobody 20660 0.1 S 01:37 /usr/sbin/httpd -k start 4043728 506832 nobody 20284 0.1 S 00:26 /usr/sbin/httpd -k start 4043195 506832 nobody 20052 0.0 S 01:12 /usr/sbin/httpd -k start 4043732 506832 nobody 19740 0.0 S 00:26 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19556 0.0 Ss 1-14:19:16 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 4043714 506832 nobody 19504 0.0 S 00:27 /usr/sbin/httpd -k start 4043585 506832 nobody 19380 0.0 S 00:39 /usr/sbin/httpd -k start 4043522 506832 nobody 19364 0.0 S 00:41 /usr/sbin/httpd -k start 4043776 506832 nobody 19236 0.0 S 00:25 /usr/sbin/httpd -k start 4043587 506832 nobody 19232 0.0 S 00:39 /usr/sbin/httpd -k start 4043711 506832 nobody 19072 0.0 S 00:27 /usr/sbin/httpd -k start 4043750 506832 nobody 19044 0.0 S 00:25 /usr/sbin/httpd -k start 4043762 506832 nobody 19028 0.0 S 00:25 /usr/sbin/httpd -k start 4043708 506832 nobody 18732 0.0 S 00:27 /usr/sbin/httpd -k start 4043710 506832 nobody 18712 0.0 S 00:27 /usr/sbin/httpd -k start 4043707 506832 nobody 18708 0.0 S 00:27 /usr/sbin/httpd -k start 4043575 506832 nobody 18640 0.1 S 00:40 /usr/sbin/httpd -k start 4043586 506832 nobody 18580 0.0 S 00:39 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4826612 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 4826577 | madalice_wp | madalice_wp | Query | 0 | starting | SELECT t.*, tt.* FROM AMuqf6qZ_terms AS t INNER JOIN AMuqf6qZ_term_taxonomy AS tt ON t.term_id = tt.term_id WHERE t.term_id = 492 | | 4826573 | madalice_wp | madalice_wp | Query | 0 | Creating sort index | SELECT post_id, meta_key, meta_value FROM AMuqf6qZ_postmeta WHERE post_id IN (3670) ORDER BY meta_id ASC | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min alison/alisonarts.com.au-ssl_log 264 evolution/my.evolutionerp.com.au-ssl_log 206 evolution/app.evolutionerp.com.au-ssl_log 157 aaa/aaadownunder.com.au-ssl_log 70 madalice/madalice.com.au-ssl_log 39 evolution/portal.evolutionerp.com.au-ssl_log 25 infinium/infinium.net.au-ssl_log 13 olympic/olympicfencing.com.au-ssl_log 2 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 262 34.166.218.115 157 40.115.94.245 154 203.54.180.238 60 34.134.120.178 43 203.166.236.147 38 34.11.238.182 12 147.161.213.78 8 34.71.223.229 8 103.104.164.114 7 101.182.108.127 5 118.127.40.55 3 180.181.236.49 3 116.91.221.245 3 1.145.70.156 2 165.225.233.87 --- top request paths across all vhosts (last 3 min) --- 83 POST /functions.php 53 GET /api/getItem/LWHG2001KG 41 GET /api/getItem/LWPG2001KG 38 GET /api/getItem/LWFBW2001KG 25 GET /heartbeat.php 25 GET /app/ajax.php 17 POST /jobeditsave.php 11 POST /app/ajax/selectFilter.php 11 GET /index.php 9 POST /plugins/csvexporter/plugin.php 8 POST /itemModify.php 8 GET / 6 POST /quoteditsave.php 6 POST //functions.php 6 POST /clienteditsave.php 5 POST /wp-cron.php 5 POST /app/ajax/selectFilterSingle.php 4 POST /app/ajax.php 4 POST / 4 GET /modalload.php --- busiest 3 vhosts: top paths + last 10 requests --- == alison/alisonarts.com.au-ssl_log == -- top paths -- 4 POST / 2 GET /airbrushed-bonnet-liner-spiderman-movie/ 2 GET / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment -- last 10 requests -- 34.166.218.115 - - [07/Sep/2026:16:40:29 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.218.115 - - [07/Sep/2026:16:40:29 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.218.115 - - [07/Sep/2026:16:40:29 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.218.115 - - [07/Sep/2026:16:40:29 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.218.115 - - [07/Sep/2026:16:40:30 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.218.115 - - [07/Sep/2026:16:40:30 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.218.115 - - [07/Sep/2026:16:40:30 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.218.115 - - [07/Sep/2026:16:40:35 +1000] "GET / HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 104.28.57.228 - - [07/Sep/2026:16:41:02 +1000] "GET /airbrushed-bonnet-liner-spiderman-movie/ HTTP/1.1" 200 12620 "https://www.google.com/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KH 104.28.57.228 - - [07/Sep/2026:16:41:04 +1000] "GET /airbrushed-bonnet-liner-spiderman-movie/ HTTP/1.1" 200 12620 "https://www.google.com/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KH == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 83 POST /functions.php 25 GET /app/ajax.php 17 POST /jobeditsave.php 11 POST /app/ajax/selectFilter.php 11 GET /index.php 9 POST /plugins/csvexporter/plugin.php 8 POST /itemModify.php 6 POST /quoteditsave.php 6 POST //functions.php 6 POST /clienteditsave.php 5 POST /app/ajax/selectFilterSingle.php 4 POST /app/ajax.php -- last 10 requests -- 203.54.180.238 - - [07/Sep/2026:16:41:31 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobedit%26id%3D15173%26tab%3Djobeditinv&call=getUserSetting&caller=ajaxSubmitLocal&seq=16340555673 HTTP/1.1" 200 168 "https://my 203.54.180.238 - - [07/Sep/2026:16:41:32 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=SS1225B-500 HTTP/1.1" 200 1741 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29719&tab=jobeditinv" "Mozil 203.54.180.238 - - [07/Sep/2026:16:41:32 +1000] "POST /itemModify.php?call=getJobInvFiles HTTP/1.1" 200 338 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29719&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; W 203.54.180.238 - - [07/Sep/2026:16:41:32 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 8425 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=15173&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [07/Sep/2026:16:41:32 +1000] "POST /itemModify.php?call=getJobInvBOM HTTP/1.1" 200 501 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29719&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win 203.166.236.147 - - [07/Sep/2026:16:41:32 +1000] "POST /itemModify.php?call=getInvMFMeta&modifyid=7973 HTTP/1.1" 200 49 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37114§ionid=32982" "Mozilla/5.0 203.166.236.147 - - [07/Sep/2026:16:41:33 +1000] "POST /itemModify.php?call=getBOM HTTP/1.1" 200 22 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37114§ionid=32982" "Mozilla/5.0 (Windows NT 10.0; Wi 203.54.180.238 - - [07/Sep/2026:16:41:34 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=15173&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 103.104.164.114 - - [07/Sep/2026:16:41:36 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 180.181.236.49 - - [07/Sep/2026:16:41:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=timesheetHistory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 53 GET /api/getItem/LWHG2001KG 41 GET /api/getItem/LWPG2001KG 38 GET /api/getItem/LWFBW2001KG 4 GET /api/getItem/PWFBW3151KG 1 GET /api/getItem/CLSGNSTD32350KK 1 GET /api/getItem/CLPGNSTD50315KK 1 GET /api/getItem/CLPGNSTD50250KK 1 GET /api/getItem/CLPGNSTD45315KK 1 GET /api/getItem/CLPGNSTD45250KK 1 GET /api/getItem/CLPGNSTD40315KK 1 GET /api/getItem/CLPGNSTD40250KK 1 GET /api/getItem/CLPGNSTD32315KK -- last 10 requests -- 40.115.94.245 - - [07/Sep/2026:16:41:39 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:16:41:39 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:16:41:39 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:16:41:40 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:16:41:40 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:16:41:40 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:16:41:41 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:16:41:41 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:16:41:41 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:16:41:41 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-07 16:39:22 L1=1.37 run=1 blk=1 avail=9113 (66.1%) swpO=0 conn=3 myRSS=2382 php=5 phpRSS=62 ap=19 tcp=30 topuser=evolution 2026-09-07 16:39:22 L1=1.37 run=2 blk=1 avail=9113 (66.1%) swpO=0 conn=2 myRSS=2382 php=5 phpRSS=62 ap=19 tcp=30 topuser=evolution 2026-09-07 16:39:32 L1=1.31 run=1 blk=1 avail=9103 (66.1%) swpO=0 conn=2 myRSS=2382 php=5 phpRSS=62 ap=21 tcp=29 topuser=evolution 2026-09-07 16:39:32 L1=1.31 run=2 blk=1 avail=9102 (66.1%) swpO=0 conn=2 myRSS=2382 php=5 phpRSS=62 ap=21 tcp=29 topuser=evolution 2026-09-07 16:39:42 L1=1.51 run=2 blk=1 avail=8988 (65.2%) swpO=0 conn=2 myRSS=2382 php=6 phpRSS=118 ap=34 tcp=42 topuser=evolution 2026-09-07 16:39:42 L1=1.51 run=3 blk=1 avail=8986 (65.2%) swpO=0 conn=2 myRSS=2382 php=6 phpRSS=118 ap=34 tcp=42 topuser=evolution 2026-09-07 16:39:52 L1=1.43 run=4 blk=1 avail=8880 (64.5%) swpO=0 conn=2 myRSS=2382 php=10 phpRSS=361 ap=29 tcp=36 topuser=evolution 2026-09-07 16:39:52 L1=1.43 run=6 blk=1 avail=8877 (64.4%) swpO=0 conn=3 myRSS=2382 php=10 phpRSS=361 ap=29 tcp=36 topuser=evolution 2026-09-07 16:40:02 L1=1.52 run=4 blk=1 avail=8767 (63.6%) swpO=0 conn=2 myRSS=2382 php=9 phpRSS=413 ap=25 tcp=35 topuser=evolution 2026-09-07 16:40:02 L1=1.52 run=5 blk=1 avail=8764 (63.6%) swpO=0 conn=3 myRSS=2382 php=8 phpRSS=287 ap=25 tcp=35 topuser=evolution 2026-09-07 16:40:12 L1=1.51 run=3 blk=1 avail=8988 (65.2%) swpO=0 conn=2 myRSS=2382 php=6 phpRSS=135 ap=29 tcp=31 topuser=infinium 2026-09-07 16:40:12 L1=1.51 run=3 blk=1 avail=8985 (65.2%) swpO=0 conn=3 myRSS=2382 php=6 phpRSS=138 ap=29 tcp=31 topuser=infinium 2026-09-07 16:40:22 L1=1.43 run=1 blk=1 avail=9059 (65.8%) swpO=0 conn=2 myRSS=2382 php=5 phpRSS=62 ap=23 tcp=36 topuser=evolution 2026-09-07 16:40:22 L1=1.43 run=4 blk=1 avail=9063 (65.8%) swpO=0 conn=3 myRSS=2382 php=5 phpRSS=62 ap=23 tcp=36 topuser=evolution 2026-09-07 16:40:32 L1=1.44 run=4 blk=1 avail=9018 (65.5%) swpO=0 conn=3 myRSS=2382 php=5 phpRSS=62 ap=27 tcp=41 topuser=evolution 2026-09-07 16:40:32 L1=1.44 run=3 blk=1 avail=9013 (65.4%) swpO=0 conn=2 myRSS=2382 php=5 phpRSS=62 ap=27 tcp=41 topuser=evolution 2026-09-07 16:40:42 L1=1.37 run=2 blk=1 avail=9055 (65.7%) swpO=0 conn=2 myRSS=2383 php=5 phpRSS=62 ap=24 tcp=32 topuser=evolution 2026-09-07 16:40:42 L1=1.37 run=2 blk=1 avail=9055 (65.7%) swpO=0 conn=3 myRSS=2383 php=5 phpRSS=62 ap=24 tcp=32 topuser=evolution 2026-09-07 16:40:52 L1=1.31 run=2 blk=1 avail=9072 (65.8%) swpO=0 conn=2 myRSS=2383 php=5 phpRSS=62 ap=21 tcp=33 topuser=evolution 2026-09-07 16:40:52 L1=1.31 run=2 blk=1 avail=9072 (65.8%) swpO=0 conn=2 myRSS=2383 php=5 phpRSS=62 ap=21 tcp=33 topuser=evolution 2026-09-07 16:41:02 L1=1.27 run=2 blk=1 avail=8999 (65.3%) swpO=0 conn=2 myRSS=2383 php=6 phpRSS=151 ap=24 tcp=41 topuser=vinesit 2026-09-07 16:41:02 L1=1.27 run=6 blk=1 avail=8997 (65.3%) swpO=0 conn=2 myRSS=2383 php=6 phpRSS=152 ap=24 tcp=41 topuser=vinesit 2026-09-07 16:41:12 L1=1.45 run=13 blk=1 avail=8115 (58.9%) swpO=37 conn=2 myRSS=2382 php=14 phpRSS=1058 ap=36 tcp=53 topuser=madalice 2026-09-07 16:41:13 L1=1.45 run=13 blk=1 avail=8117 (58.9%) swpO=41 conn=2 myRSS=2381 php=14 phpRSS=1083 ap=36 tcp=53 topuser=madalice 2026-09-07 16:41:23 L1=1.90 run=4 blk=1 avail=7411 (53.8%) swpO=93 conn=2 myRSS=2380 php=15 phpRSS=1438 ap=96 tcp=91 topuser=madalice 2026-09-07 16:41:23 L1=1.90 run=5 blk=1 avail=7399 (53.7%) swpO=94 conn=2 myRSS=2380 php=14 phpRSS=1375 ap=96 tcp=89 topuser=madalice 2026-09-07 16:41:33 L1=2.08 run=3 blk=1 avail=7516 (54.6%) swpO=0 conn=1 myRSS=2381 php=13 phpRSS=1320 ap=86 tcp=45 topuser=madalice 2026-09-07 16:41:33 L1=2.08 run=2 blk=1 avail=7553 (54.8%) swpO=0 conn=2 myRSS=2381 php=12 phpRSS=1265 ap=86 tcp=43 topuser=madalice 2026-09-07 16:41:43 L1=3.02 run=11 blk=1 avail=7209 (52.3%) swpO=49 conn=9 myRSS=2380 php=14 phpRSS=1720 ap=76 tcp=67 topuser=madalice 2026-09-07 16:41:43 L1=3.02 run=11 blk=1 avail=7178 (52.1%) swpO=49 conn=9 myRSS=2380 php=14 phpRSS=1744 ap=75 tcp=66 topuser=madalice