INCIDENT 2026-09-08 08:19:00 trigger: php_procs=26 ================================================================== load: 1.86 2.11 2.32 4/656 3080090 ncpu:10 mem_avail: 10026MB/13777MB (72.8%) swap_used:1893MB swapout:0/s blocked(D):1 running:6 iowait:9.0% steal:0.0% php: 26 procs / 1036MB heaviest user: evolution (24 procs, 901MB) apache: 48 procs tcp_estab: 57 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1309 evolution 32 907 nobody 47 781 root 248 580 netdata 8 231 madalice 1 132 cpanellogin 1 82 kurri 4 46 mailman 20 36 dovenull 6 22 lowrange 2 17 wp-toolkit 3 12 zabbix 1 11 mailnull 2 10 dovecot 3 9 named 1 5 nscd 1 4 dbus 1 3 cpanelconnecttrack 1 3 polkitd 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 24 902 madalice 1 132 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 9480 MB Active(file): 4750 MB Inactive(file): 4939 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 355 MB CommitLimit: 10984 MB Committed_AS: 8744 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 7-05:56:34 5336 /usr/bin/imunify-agent-proxy 4109079 root 3-03:34:12 4 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 3-03:34:12 74140 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 1340980 10.9 Rsl 03:33:32 /usr/sbin/mariadbd 166870 1 netdata 184700 2.8 Ssl 2-05:56:41 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1911708 1859745 root 156608 0.0 S 05:41:50 spamd child 3080011 167896 madalice 135424 20.6 S 00:06 php-fpm: pool madalice_com_au 2684593 1353308 cpanellogin 84700 0.0 S 01:53:00 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 4109105 4109079 root 74140 1.1 Sl 3-03:34:13 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 3078666 3072590 evolution 65980 0.1 S 01:36 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3080016 3078759 evolution 65864 9.0 S 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2328754 1 root 64572 0.0 Ss 03:33:42 /usr/lib/systemd/systemd-journald 3080028 3079971 evolution 58780 10.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3080022 3078905 evolution 57088 5.5 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3080032 3079778 evolution 40544 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3078791 3060331 evolution 38592 0.0 S 01:23 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3079870 3078043 evolution 38580 0.1 S 00:16 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3079620 3061600 evolution 38576 0.0 S 00:32 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3078740 3078522 evolution 38480 0.0 S 01:31 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 509236 509098 root 38108 0.0 Sl 11-05:59:21 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3080031 3078904 evolution 37152 3.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3080029 3079987 evolution 37024 3.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3080030 3079626 evolution 37000 4.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3079713 3079696 evolution 36816 0.1 S 00:28 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3079472 3078758 evolution 36804 0.0 S 00:45 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3078673 3061474 evolution 36788 0.0 S 01:35 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3080026 3078517 evolution 36776 2.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3080027 3078902 evolution 36748 2.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3080033 3079686 evolution 36744 2.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3079746 3077380 evolution 36604 0.0 S 00:25 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3080023 3078900 evolution 36416 2.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3080024 3059283 evolution 36348 1.5 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1353308 1 root 34192 0.0 Ss 48-05:37:47 cpsrvd (SSL) - waiting for connections 167562 166914 netdata 33136 0.1 Sl 2-05:56:36 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1859745 1 root 26888 0.0 Ss 05:56:12 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3072590 506832 nobody 21664 0.0 S 03:51 /usr/sbin/httpd -k start 3059283 506832 nobody 21596 0.0 S 08:27 /usr/sbin/httpd -k start 3060145 506832 nobody 20940 0.0 S 07:13 /usr/sbin/httpd -k start 3078301 506832 nobody 20384 0.2 S 02:17 /usr/sbin/httpd -k start 3061600 506832 nobody 20232 0.0 S 05:16 /usr/sbin/httpd -k start 3062331 506832 nobody 20188 0.0 S 04:11 /usr/sbin/httpd -k start 3061984 506832 nobody 20060 0.0 S 04:46 /usr/sbin/httpd -k start 3078058 506832 nobody 19656 0.0 S 02:46 /usr/sbin/httpd -k start 3078516 506832 nobody 19524 0.0 S 01:53 /usr/sbin/httpd -k start 3078901 506832 nobody 19500 0.1 S 01:18 /usr/sbin/httpd -k start 3078903 506832 nobody 19476 0.1 S 01:18 /usr/sbin/httpd -k start 3078307 506832 nobody 19344 0.0 S 02:16 /usr/sbin/httpd -k start 3078902 506832 nobody 19260 0.0 S 01:18 /usr/sbin/httpd -k start 3078905 506832 nobody 19240 0.1 S 01:18 /usr/sbin/httpd -k start 3077380 506832 nobody 19176 0.0 S 03:34 /usr/sbin/httpd -k start 3078043 506832 nobody 18908 0.0 S 02:48 /usr/sbin/httpd -k start 3078900 506832 nobody 18744 0.0 S 01:18 /usr/sbin/httpd -k start 3079686 506832 nobody 18708 0.0 S 00:30 /usr/sbin/httpd -k start 3078523 506832 nobody 18532 0.1 S 01:52 /usr/sbin/httpd -k start 3078517 506832 nobody 18468 0.0 S 01:53 /usr/sbin/httpd -k start 3079987 506832 nobody 18464 0.0 S 00:09 /usr/sbin/httpd -k start 3079915 506832 nobody 18416 0.0 S 00:11 /usr/sbin/httpd -k start 3078759 506832 nobody 18384 0.1 S 01:28 /usr/sbin/httpd -k start 3061474 506832 nobody 18096 0.0 S 05:28 /usr/sbin/httpd -k start 3079916 506832 nobody 18092 0.0 S 00:11 /usr/sbin/httpd -k start 3078522 506832 nobody 18032 0.0 S 01:52 /usr/sbin/httpd -k start 3078778 506832 nobody 17968 0.0 S 01:25 /usr/sbin/httpd -k start 3079991 506832 nobody 17616 0.3 S 00:09 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+----------------------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+----------------------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 525762 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 525759 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 525751 | root | 85-1559715131 | Execute | 0 | Sending data | SELECT sum(quoteitems.total) as total, inventory.cat, quoteitems.sectionRef, quoteitems.sectionId from quoteitems,inventory where quoteitems.itemid=inventory.id AND quoteitems.quoteid=? AND quoteitems.status='1' group by quoteitems.sectionId, inventory.cat | | 525690 | root | 108-1481181613 | Execute | 0 | Sending data | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29479' AND dispatchitems.j | +--------+----------------------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 327 customc/customcentral.com.au-ssl_log 261 cosgrovecreative/cosgrovecreative.com.au-ssl_log 257 coscom/coscom.com.au-ssl_log 250 evolution/portal.evolutionerp.com.au-ssl_log 59 tubesupplies/tubesupplies.com.au-ssl_log 2 evolution/evolutionerp.com.au-ssl_log 1 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 768 34.131.110.118 205 203.54.180.238 54 103.104.164.114 50 103.104.165.99 38 182.239.240.254 22 116.91.221.245 7 180.181.236.49 4 203.166.236.147 3 52.167.144.221 2 165.225.233.89 1 43.173.179.19 1 43.172.196.95 1 118.127.40.55 1 101.166.96.210 --- top request paths across all vhosts (last 3 min) --- 130 POST /functions.php 58 GET /app/ajax.php 52 GET /heartbeat.php 36 GET /index.php 24 POST /quoteditsave.php 17 POST / 17 GET / 14 POST /plugins/csvexporter/plugin.php 10 POST /app/ajax/selectFilterSingle.php 9 POST /jobeditsave.php 7 POST /clienteditsave.php 7 POST /app/ajax.php 6 POST /php/php.exe 6 POST /php/php-cgi.exe 6 POST /php-cgi/php-cgi.exe 6 POST /php-cgi/php-cgi 6 POST /inveditsave.php 6 POST /cgi/php-cgi 6 POST /cgi/php 6 POST /cgi-bin/php-cgi.exe --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 130 POST /functions.php 58 GET /app/ajax.php 33 GET /index.php 24 POST /quoteditsave.php 14 POST /plugins/csvexporter/plugin.php 10 POST /app/ajax/selectFilterSingle.php 9 POST /jobeditsave.php 7 POST /clienteditsave.php 7 POST /app/ajax.php 6 POST /inveditsave.php 6 POST /app/ajax/selectFilter.php 5 POST /purchaseaddsave.php -- last 10 requests -- 103.104.165.99 - - [08/Sep/2026:08:18:50 +1000] "POST /print.php HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37145§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 116.91.221.245 - - [08/Sep/2026:08:18:54 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2321" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 203.54.180.238 - - [08/Sep/2026:08:18:55 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 165.225.233.89 - - [08/Sep/2026:08:18:56 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Ch 203.54.180.238 - - [08/Sep/2026:08:18:56 +1000] "POST /quoteditsave.php?call=searchFilterClients&filter=P%20&%20T HTTP/1.1" 200 7335 "https://my.evolutionerp.com.au/index.php?page=quotedit" "Mozilla/5.0 (Windows NT 10.0; 116.91.221.245 - - [08/Sep/2026:08:18:57 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2323§ionid=568" "Mozilla/5.0 (Windows NT 10.0; Win 203.166.236.147 - - [08/Sep/2026:08:18:57 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 103.104.165.99 - - [08/Sep/2026:08:18:57 +1000] "POST /quoteditsave.php HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37145§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 203.54.180.238 - - [08/Sep/2026:08:18:57 +1000] "GET /index.php?page=jobedit&id=29717 HTTP/1.1" 200 177278 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 103.104.165.99 - - [08/Sep/2026:08:18:57 +1000] "GET /index.php?page=jobedit&id=11320 HTTP/1.1" 200 329653 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi == customc/customcentral.com.au-ssl_log == -- top paths -- 12 GET / 9 POST / 6 POST /php/php.exe 6 POST /php/php-cgi.exe 6 POST /php-cgi/php-cgi.exe 6 POST /php-cgi/php-cgi 6 POST /cgi/php-cgi 6 POST /cgi/php 6 POST /cgi-bin/php-cgi.exe 6 POST /cgi-bin/php-cgi 6 POST /cgi-bin/php8.exe 6 POST /cgi-bin/php8 -- last 10 requests -- 34.131.110.118 - - [08/Sep/2026:08:18:21 +1000] "POST /cgi/php?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (K 34.131.110.118 - - [08/Sep/2026:08:18:21 +1000] "POST /cgi/php?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML 34.131.110.118 - - [08/Sep/2026:08:18:22 +1000] "POST /cgi/php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:22 +1000] "POST /cgi/php-cgi?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.3 34.131.110.118 - - [08/Sep/2026:08:18:22 +1000] "POST /cgi/php-cgi?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (K 34.131.110.118 - - [08/Sep/2026:08:18:22 +1000] "POST /cgi/php-cgi HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:23 +1000] "POST /php-cgi/php-cgi?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/5 34.131.110.118 - - [08/Sep/2026:08:18:23 +1000] "POST /php-cgi/php-cgi?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.3 34.131.110.118 - - [08/Sep/2026:08:18:23 +1000] "POST /php-cgi/php-cgi HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:23 +1000] "POST /php-cgi.exe?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.3 == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env 1 GET /vue/.env -- last 10 requests -- 34.131.110.118 - - [08/Sep/2026:08:18:37 +1000] "GET /staging/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:37 +1000] "GET /beta/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:37 +1000] "GET /uat/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:38 +1000] "GET /qa/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:38 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:38 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:38 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:38 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:39 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:39 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-08 08:16:39 L1=1.63 run=2 blk=1 avail=10470(76.0%) swpO=0 conn=2 myRSS=1311 php=6 phpRSS=210 ap=29 tcp=36 topuser=madalice 2026-09-08 08:16:39 L1=1.63 run=4 blk=1 avail=10466(76.0%) swpO=0 conn=5 myRSS=1311 php=6 phpRSS=214 ap=29 tcp=36 topuser=madalice 2026-09-08 08:16:49 L1=1.54 run=3 blk=1 avail=10408(75.5%) swpO=0 conn=2 myRSS=1312 php=6 phpRSS=232 ap=32 tcp=43 topuser=madalice 2026-09-08 08:16:49 L1=1.54 run=4 blk=1 avail=10408(75.5%) swpO=0 conn=5 myRSS=1312 php=6 phpRSS=232 ap=32 tcp=43 topuser=madalice 2026-09-08 08:16:59 L1=1.53 run=3 blk=1 avail=10309(74.8%) swpO=29 conn=2 myRSS=1310 php=6 phpRSS=316 ap=32 tcp=40 topuser=madalice 2026-09-08 08:16:59 L1=1.53 run=4 blk=1 avail=10312(74.9%) swpO=29 conn=5 myRSS=1310 php=6 phpRSS=316 ap=32 tcp=40 topuser=madalice 2026-09-08 08:17:09 L1=1.45 run=5 blk=2 avail=10009(72.7%) swpO=48 conn=2 myRSS=1308 php=11 phpRSS=731 ap=40 tcp=48 topuser=madalice 2026-09-08 08:17:09 L1=1.45 run=7 blk=1 avail=10000(72.6%) swpO=48 conn=8 myRSS=1308 php=11 phpRSS=738 ap=40 tcp=48 topuser=madalice 2026-09-08 08:17:19 L1=1.75 run=1 blk=1 avail=10301(74.8%) swpO=0 conn=2 myRSS=1308 php=6 phpRSS=318 ap=35 tcp=38 topuser=madalice 2026-09-08 08:17:19 L1=1.75 run=3 blk=1 avail=10301(74.8%) swpO=0 conn=8 myRSS=1308 php=6 phpRSS=318 ap=35 tcp=38 topuser=madalice 2026-09-08 08:17:29 L1=1.70 run=1 blk=1 avail=10297(74.7%) swpO=0 conn=2 myRSS=1308 php=8 phpRSS=420 ap=30 tcp=37 topuser=madalice 2026-09-08 08:17:29 L1=1.70 run=3 blk=2 avail=10294(74.7%) swpO=0 conn=8 myRSS=1308 php=7 phpRSS=262 ap=30 tcp=37 topuser=evolution 2026-09-08 08:17:39 L1=1.68 run=2 blk=1 avail=10329(75.0%) swpO=0 conn=2 myRSS=1308 php=10 phpRSS=406 ap=35 tcp=48 topuser=evolution 2026-09-08 08:17:39 L1=1.68 run=3 blk=1 avail=10328(75.0%) swpO=0 conn=8 myRSS=1308 php=10 phpRSS=406 ap=35 tcp=50 topuser=evolution 2026-09-08 08:17:49 L1=1.73 run=6 blk=1 avail=10218(74.2%) swpO=0 conn=2 myRSS=1309 php=12 phpRSS=473 ap=49 tcp=48 topuser=evolution 2026-09-08 08:17:49 L1=1.73 run=4 blk=1 avail=10216(74.1%) swpO=0 conn=8 myRSS=1309 php=10 phpRSS=406 ap=49 tcp=48 topuser=evolution 2026-09-08 08:17:59 L1=1.69 run=1 blk=1 avail=10397(75.5%) swpO=0 conn=2 myRSS=1309 php=8 phpRSS=217 ap=44 tcp=51 topuser=evolution 2026-09-08 08:17:59 L1=1.69 run=2 blk=1 avail=10396(75.5%) swpO=0 conn=8 myRSS=1309 php=8 phpRSS=217 ap=44 tcp=51 topuser=evolution 2026-09-08 08:18:09 L1=1.58 run=2 blk=1 avail=10325(74.9%) swpO=0 conn=2 myRSS=1309 php=10 phpRSS=388 ap=37 tcp=43 topuser=evolution 2026-09-08 08:18:09 L1=1.58 run=3 blk=1 avail=10325(74.9%) swpO=0 conn=4 myRSS=1309 php=10 phpRSS=388 ap=37 tcp=43 topuser=evolution 2026-09-08 08:18:19 L1=1.57 run=1 blk=1 avail=10338(75.0%) swpO=0 conn=2 myRSS=1309 php=10 phpRSS=375 ap=36 tcp=42 topuser=evolution 2026-09-08 08:18:19 L1=1.57 run=2 blk=1 avail=10337(75.0%) swpO=0 conn=4 myRSS=1309 php=10 phpRSS=375 ap=36 tcp=42 topuser=evolution 2026-09-08 08:18:29 L1=1.48 run=2 blk=1 avail=10308(74.8%) swpO=0 conn=4 myRSS=1309 php=12 phpRSS=472 ap=35 tcp=52 topuser=evolution 2026-09-08 08:18:29 L1=1.48 run=5 blk=1 avail=10306(74.8%) swpO=0 conn=4 myRSS=1309 php=12 phpRSS=472 ap=35 tcp=53 topuser=evolution 2026-09-08 08:18:39 L1=1.72 run=10 blk=1 avail=10170(73.8%) swpO=0 conn=4 myRSS=1309 php=16 phpRSS=693 ap=40 tcp=54 topuser=evolution 2026-09-08 08:18:39 L1=1.72 run=7 blk=1 avail=10169(73.8%) swpO=0 conn=4 myRSS=1309 php=16 phpRSS=693 ap=40 tcp=54 topuser=evolution 2026-09-08 08:18:49 L1=1.83 run=4 blk=1 avail=10224(74.2%) swpO=1 conn=4 myRSS=1309 php=16 phpRSS=609 ap=42 tcp=59 topuser=evolution 2026-09-08 08:18:49 L1=1.83 run=4 blk=1 avail=10223(74.2%) swpO=1 conn=4 myRSS=1309 php=17 phpRSS=620 ap=42 tcp=59 topuser=evolution 2026-09-08 08:19:00 L1=1.86 run=6 blk=1 avail=10026(72.8%) swpO=0 conn=7 myRSS=1309 php=26 phpRSS=1036 ap=48 tcp=57 topuser=evolution 2026-09-08 08:19:00 L1=1.86 run=5 blk=1 avail=10026(72.8%) swpO=0 conn=6 myRSS=1309 php=26 phpRSS=1037 ap=48 tcp=57 topuser=evolution