INCIDENT 2026-09-08 08:49:50 trigger: php_rss=2315MB mysql_conn=15 ================================================================== load: 3.22 2.52 2.27 20/667 3191980 ncpu:10 mem_avail: 8437MB/13777MB (61.2%) swap_used:1938MB swapout:80/s blocked(D):1 running:21 iowait:7.9% steal:0.0% php: 24 procs / 2315MB heaviest user: alison (16 procs, 1989MB) apache: 46 procs tcp_estab: 56 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1489 alison 11 1426 nobody 49 775 root 249 580 evolution 17 234 netdata 8 231 madalice 1 132 cpanellogin 1 77 mailman 20 36 mailnull 3 32 dovenull 6 23 kurri 2 22 wp-toolkit 3 12 aaa 1 12 zabbix 1 11 dovecot 3 9 named 1 6 nscd 1 4 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB alison 11 1443 evolution 6 190 madalice 1 132 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 8493 MB Active(file): 4206 MB Inactive(file): 3950 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 383 MB CommitLimit: 10984 MB Committed_AS: 9731 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 7-06:27:25 5288 /usr/bin/imunify-agent-proxy 4109079 root 3-04:05:03 4 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 3-04:05:03 73236 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 1525316 13.5 Ssl 04:04:22 /usr/sbin/mariadbd 166870 1 netdata 185156 2.8 Ssl 2-06:27:31 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3191897 3191037 alison 163352 48.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3191899 3190401 alison 155504 44.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1911708 1859745 root 153664 0.0 S 06:12:40 spamd child 3191913 3191496 alison 142372 42.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3191912 3189835 alison 141040 43.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3191932 3189849 alison 139336 62.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3191749 167896 madalice 135804 7.7 S 00:16 php-fpm: pool madalice_com_au 3191933 3191476 alison 128232 53.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3191935 3191924 alison 127728 53.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2684593 1353308 cpanellogin 79356 0.0 S 02:23:50 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 4109105 4109079 root 73236 1.1 Sl 3-04:05:03 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2328754 1 root 72732 0.0 Ss 04:04:32 /usr/lib/systemd/systemd-journald 3191946 3191078 alison 72504 40.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3191891 3191157 evolution 58096 2.7 S 00:04 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3191997 3190250 alison 48636 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3192014 3191163 alison 43328 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3191945 3191943 evolution 40560 5.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3191909 3191757 evolution 38620 1.3 S 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 509236 509098 root 38196 0.0 Sl 11-06:30:11 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3191903 3191902 evolution 37928 2.3 Rl 00:03 /usr/local/bin/wkhtmltopdf --enable-local-file-access --encoding utf-8 --title WORKSHOP PRODUCTION ORDER --header-html /home/evolution/ 1353308 1 root 32724 0.0 Ss 48-06:08:37 cpsrvd (SSL) - waiting for connections 167562 166914 netdata 32044 0.1 Sl 2-06:27:26 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1859745 1 root 26864 0.0 Ss 06:27:02 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3192043 3191048 evolution 25312 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3191487 1 root 24408 0.2 S 00:35 /usr/sbin/exim -Mc 1x3i9M-0000000DOFa-29QH 3191491 3191487 mailnull 21936 0.0 S 00:35 /usr/sbin/exim -Mc 1x3i9M-0000000DOFa-29QH 3173071 506832 nobody 21824 0.0 S 05:27 /usr/sbin/httpd -k start 3173224 506832 nobody 21572 0.1 R 05:20 /usr/sbin/httpd -k start 3173426 506832 nobody 20880 0.0 S 05:11 /usr/sbin/httpd -k start 3173070 506832 nobody 20640 0.0 S 05:27 /usr/sbin/httpd -k start 3189798 506832 nobody 20480 0.0 S 02:28 /usr/sbin/httpd -k start 3189835 506832 nobody 20348 0.1 S 02:24 /usr/sbin/httpd -k start 3189834 506832 nobody 19568 0.0 S 02:24 /usr/sbin/httpd -k start 3191046 506832 nobody 19556 0.1 S 01:05 /usr/sbin/httpd -k start 3191158 506832 nobody 19356 0.1 S 00:59 /usr/sbin/httpd -k start 3190390 506832 nobody 19144 0.0 S 01:45 /usr/sbin/httpd -k start 3191077 506832 nobody 19092 0.0 S 01:02 /usr/sbin/httpd -k start 3191047 506832 nobody 18896 0.0 S 01:05 /usr/sbin/httpd -k start 3191322 506832 nobody 18860 0.1 S 00:45 /usr/sbin/httpd -k start 3191048 506832 nobody 18716 0.0 S 01:05 /usr/sbin/httpd -k start 3191476 506832 nobody 18624 0.1 S 00:35 /usr/sbin/httpd -k start 3190379 506832 nobody 18460 0.0 S 01:46 /usr/sbin/httpd -k start 3191507 506832 nobody 18164 0.1 S 00:33 /usr/sbin/httpd -k start 3191037 506832 nobody 18156 0.0 S 01:06 /usr/sbin/httpd -k start 3191078 506832 nobody 18064 0.1 S 01:02 /usr/sbin/httpd -k start 3189836 506832 nobody 17952 0.0 S 02:24 /usr/sbin/httpd -k start 3190401 506832 nobody 17856 0.0 S 01:44 /usr/sbin/httpd -k start 3189849 506832 nobody 17836 0.0 S 02:23 /usr/sbin/httpd -k start 3191161 506832 nobody 17804 0.1 S 00:59 /usr/sbin/httpd -k start 3191795 506832 nobody 17804 0.1 S 00:12 /usr/sbin/httpd -k start 3190402 506832 nobody 17664 0.0 S 01:44 /usr/sbin/httpd -k start 3190425 506832 nobody 17560 0.1 S 01:43 /usr/sbin/httpd -k start 3191038 506832 nobody 17548 0.0 S 01:06 /usr/sbin/httpd -k start 3191741 506832 nobody 17520 0.2 R 00:16 /usr/sbin/httpd -k start 3190250 506832 nobody 17424 0.0 S 01:54 /usr/sbin/httpd -k start 3191157 506832 nobody 17332 0.0 S 00:59 /usr/sbin/httpd -k start 3191163 506832 nobody 16928 0.1 S 00:59 /usr/sbin/httpd -k start 3191146 506832 nobody 16764 0.0 S 01:01 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+-----------------+-----------------+---------+------+----------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+-----------------+-----------------+---------+------+----------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 742940 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 742890 | alison_wp_jihlc | alison_wp_z9crm | Query | 0 | Statistics | SELECT a.action_id FROM zNZUUL_actionscheduler_actions a WHERE 1=1 AND a.hook='wpforms_process_entry_emails_meta_cleanup' AND a.status IN ('in-progress', 'pending') LIMIT 0, 1 | +--------+-----------------+-----------------+---------+------+----------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 583 lowrange/lowrange.com.au-ssl_log 273 aaa/aaadownunder.com.au-ssl_log 254 evolution/portal.evolutionerp.com.au-ssl_log 203 candyfabcom/candyfab.com.au-ssl_log 125 alison/alisonarts.com.au-ssl_log 99 speedlin/speedlinefencing.com.au-ssl_log 14 madalice/madalice.com.au-ssl_log 5 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 534 203.54.180.238 244 34.131.208.84 144 103.104.165.99 140 34.131.240.91 133 34.176.146.72 125 34.130.57.39 56 34.104.178.164 52 34.88.234.10 50 182.239.240.254 16 180.181.236.49 14 118.127.40.55 9 146.70.178.252 9 120.21.154.188 9 103.104.164.114 7 203.166.236.147 --- top request paths across all vhosts (last 3 min) --- 214 POST /functions.php 112 GET /app/ajax.php 65 GET /factory_session_checker.php 64 GET /index.php 60 GET /heartbeat.php 43 POST / 33 GET /factory_session_processed_qty.php 33 GET /factory_session_joiner.php 30 POST /quoteditsave.php 30 GET / 29 POST /plugins/csvexporter/plugin.php 20 POST /app/ajax/selectFilterSingle.php 17 POST /app/ajax.php 12 POST /jobeditsave.php 12 POST /clienteditsave.php 12 POST /app/ajax/selectFilter.php 11 GET /.env.save 11 GET /.env.old 11 GET /.env.bak 11 GET /.env.backup --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 214 POST /functions.php 112 GET /app/ajax.php 53 GET /index.php 30 POST /quoteditsave.php 29 POST /plugins/csvexporter/plugin.php 20 POST /app/ajax/selectFilterSingle.php 17 POST /app/ajax.php 12 POST /jobeditsave.php 12 POST /clienteditsave.php 12 POST /app/ajax/selectFilter.php 10 POST /plugins/fencecosting/plugin.php 9 GET //app/ajax.php -- last 10 requests -- 103.104.165.99 - - [08/Sep/2026:08:49:41 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 21430 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37148§ionid=0" "Mozilla/5.0 (Windows NT 10.0; 103.104.165.99 - - [08/Sep/2026:08:49:42 +1000] "GET /index.php?page=quotereg HTTP/1.1" 200 48126 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37148§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win64; x 103.104.165.99 - - [08/Sep/2026:08:49:42 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 165.225.233.87 - - [08/Sep/2026:08:49:42 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=testTagUpload-2&jobFilter_required=14271%C2%A0%C2%A0%C2%A0%C2%A0Program 103.104.165.99 - - [08/Sep/2026:08:49:42 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotereg&call=getUserSetting&caller=ajaxSubmitLocal&seq=11279801785 HTTP/1.1" 200 90 "https://my.evolutionerp.com.au/index.php?p 103.104.165.99 - - [08/Sep/2026:08:49:42 +1000] "POST /quoteditsave.php?call=getTheQuotes HTTP/1.1" 200 13550 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 103.104.165.99 - - [08/Sep/2026:08:49:43 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 103.104.165.99 - - [08/Sep/2026:08:49:45 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 101.166.96.210 - - [08/Sep/2026:08:49:46 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 233 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37136§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 203.54.180.238 - - [08/Sep/2026:08:49:46 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=dispatchedit&dispatchid=34149" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 == lowrange/lowrange.com.au-ssl_log == -- top paths -- 13 GET / 10 POST / 6 POST /php/php.exe 6 POST /php/php-cgi.exe 6 POST /php.exe 6 POST /php-cgi/php-cgi.exe 6 POST /php-cgi/php-cgi 6 POST /php-cgi.exe 6 POST /cgi/php-cgi 6 POST /cgi/php 6 POST /cgi-bin/php-cgi.exe 6 POST /cgi-bin/php-cgi -- last 10 requests -- 34.176.146.72 - - [08/Sep/2026:08:47:58 +1000] "POST /php-cgi/php-cgi?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.3 34.176.146.72 - - [08/Sep/2026:08:47:59 +1000] "POST /php-cgi/php-cgi?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp://input HTTP/1.1" 404 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (K 34.176.146.72 - - [08/Sep/2026:08:47:59 +1000] "POST /php-cgi/php-cgi HTTP/1.1" 404 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.176.146.72 - - [08/Sep/2026:08:47:59 +1000] "POST /php-cgi.exe?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (K 34.176.146.72 - - [08/Sep/2026:08:48:00 +1000] "POST /php-cgi.exe?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp://input HTTP/1.1" 404 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML 34.176.146.72 - - [08/Sep/2026:08:48:00 +1000] "POST /php-cgi.exe HTTP/1.1" 404 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.176.146.72 - - [08/Sep/2026:08:48:01 +1000] "POST /php.exe?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML 34.176.146.72 - - [08/Sep/2026:08:48:01 +1000] "POST /php.exe?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp://input HTTP/1.1" 404 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, li 34.176.146.72 - - [08/Sep/2026:08:48:01 +1000] "POST /php.exe HTTP/1.1" 404 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.176.146.72 - - [08/Sep/2026:08:48:02 +1000] "GET / HTTP/1.1" 200 482 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 4 POST / 2 POST /wp-cron.php 1 POST /wp-login.php 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/.env 1 GET /wp-login.php 1 GET /wp/.env 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php -- last 10 requests -- 34.131.208.84 - - [08/Sep/2026:08:49:34 +1000] "GET /_profiler/phpinfo HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.208.84 - - [08/Sep/2026:08:49:34 +1000] "GET /_environment HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.208.84 - - [08/Sep/2026:08:49:35 +1000] "GET /webroot/index.php/_environment HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537 34.131.208.84 - - [08/Sep/2026:08:49:35 +1000] "GET /mail/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.208.84 - - [08/Sep/2026:08:49:35 +1000] "GET /cpanel/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.208.84 - - [08/Sep/2026:08:49:35 +1000] "GET /hosting/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.208.84 - - [08/Sep/2026:08:49:36 +1000] "GET /webmail/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.208.84 - - [08/Sep/2026:08:49:36 +1000] "GET /smtp/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.208.84 - - [08/Sep/2026:08:49:36 +1000] "GET /phpinfo.php.bak HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.208.84 - - [08/Sep/2026:08:49:36 +1000] "GET /phpinfo.php.old HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-08 08:47:29 L1=2.42 run=4 blk=1 avail=9944 (72.2%) swpO=0 conn=3 myRSS=1490 php=6 phpRSS=327 ap=50 tcp=47 topuser=madalice 2026-09-08 08:47:29 L1=2.42 run=6 blk=1 avail=9912 (71.9%) swpO=0 conn=1 myRSS=1490 php=7 phpRSS=393 ap=50 tcp=55 topuser=madalice 2026-09-08 08:47:39 L1=2.51 run=4 blk=1 avail=9989 (72.5%) swpO=0 conn=3 myRSS=1490 php=8 phpRSS=383 ap=45 tcp=41 topuser=madalice 2026-09-08 08:47:39 L1=2.51 run=10 blk=1 avail=9927 (72.1%) swpO=0 conn=1 myRSS=1490 php=11 phpRSS=540 ap=45 tcp=43 topuser=evolution 2026-09-08 08:47:49 L1=2.58 run=6 blk=1 avail=9712 (70.5%) swpO=127 conn=3 myRSS=1487 php=7 phpRSS=690 ap=38 tcp=38 topuser=evolution 2026-09-08 08:47:49 L1=2.58 run=5 blk=1 avail=10121(73.5%) swpO=127 conn=1 myRSS=1487 php=6 phpRSS=252 ap=38 tcp=38 topuser=madalice 2026-09-08 08:47:59 L1=2.49 run=1 blk=1 avail=10181(73.9%) swpO=0 conn=3 myRSS=1487 php=4 phpRSS=157 ap=36 tcp=47 topuser=madalice 2026-09-08 08:47:59 L1=2.49 run=3 blk=1 avail=10181(73.9%) swpO=0 conn=1 myRSS=1487 php=4 phpRSS=157 ap=36 tcp=45 topuser=madalice 2026-09-08 08:48:09 L1=2.58 run=1 blk=1 avail=10218(74.2%) swpO=0 conn=3 myRSS=1487 php=3 phpRSS=2 ap=50 tcp=54 topuser=root 2026-09-08 08:48:09 L1=2.58 run=1 blk=1 avail=10218(74.2%) swpO=0 conn=1 myRSS=1487 php=3 phpRSS=2 ap=50 tcp=52 topuser=root 2026-09-08 08:48:19 L1=2.65 run=2 blk=1 avail=10135(73.6%) swpO=0 conn=3 myRSS=1488 php=4 phpRSS=135 ap=43 tcp=43 topuser=madalice 2026-09-08 08:48:19 L1=2.65 run=1 blk=1 avail=10163(73.8%) swpO=0 conn=1 myRSS=1488 php=4 phpRSS=135 ap=43 tcp=43 topuser=madalice 2026-09-08 08:48:29 L1=2.55 run=2 blk=1 avail=10211(74.1%) swpO=0 conn=3 myRSS=1488 php=4 phpRSS=135 ap=34 tcp=36 topuser=madalice 2026-09-08 08:48:29 L1=2.55 run=2 blk=1 avail=10207(74.1%) swpO=0 conn=1 myRSS=1488 php=5 phpRSS=175 ap=34 tcp=38 topuser=madalice 2026-09-08 08:48:39 L1=2.54 run=1 blk=1 avail=10351(75.1%) swpO=0 conn=1 myRSS=1488 php=3 phpRSS=2 ap=32 tcp=36 topuser=root 2026-09-08 08:48:40 L1=2.54 run=3 blk=1 avail=10308(74.8%) swpO=0 conn=1 myRSS=1488 php=5 phpRSS=98 ap=32 tcp=37 topuser=evolution 2026-09-08 08:48:49 L1=2.54 run=4 blk=0 avail=10108(73.4%) swpO=0 conn=1 myRSS=1488 php=10 phpRSS=358 ap=42 tcp=52 topuser=evolution 2026-09-08 08:48:50 L1=2.54 run=7 blk=1 avail=10047(72.9%) swpO=0 conn=1 myRSS=1488 php=8 phpRSS=299 ap=42 tcp=52 topuser=aaa 2026-09-08 08:48:59 L1=2.69 run=4 blk=1 avail=10095(73.3%) swpO=0 conn=1 myRSS=1488 php=7 phpRSS=261 ap=47 tcp=44 topuser=madalice 2026-09-08 08:49:00 L1=2.69 run=3 blk=1 avail=10047(72.9%) swpO=0 conn=1 myRSS=1488 php=9 phpRSS=358 ap=47 tcp=47 topuser=evolution 2026-09-08 08:49:09 L1=3.06 run=3 blk=1 avail=9971 (72.4%) swpO=26 conn=1 myRSS=1487 php=7 phpRSS=401 ap=45 tcp=49 topuser=madalice 2026-09-08 08:49:10 L1=3.06 run=2 blk=1 avail=10076(73.1%) swpO=26 conn=1 myRSS=1487 php=7 phpRSS=290 ap=45 tcp=47 topuser=madalice 2026-09-08 08:49:19 L1=2.91 run=4 blk=1 avail=10055(73.0%) swpO=0 conn=1 myRSS=1487 php=7 phpRSS=257 ap=49 tcp=60 topuser=madalice 2026-09-08 08:49:20 L1=2.91 run=3 blk=1 avail=10041(72.9%) swpO=0 conn=3 myRSS=1487 php=6 phpRSS=253 ap=49 tcp=55 topuser=madalice 2026-09-08 08:49:29 L1=2.92 run=10 blk=1 avail=9390 (68.2%) swpO=103 conn=1 myRSS=1483 php=11 phpRSS=1079 ap=45 tcp=47 topuser=alison 2026-09-08 08:49:30 L1=2.92 run=4 blk=1 avail=9986 (72.5%) swpO=103 conn=3 myRSS=1483 php=6 phpRSS=339 ap=45 tcp=45 topuser=madalice 2026-09-08 08:49:39 L1=3.24 run=7 blk=1 avail=10036(72.8%) swpO=0 conn=3 myRSS=1483 php=6 phpRSS=264 ap=49 tcp=54 topuser=madalice 2026-09-08 08:49:40 L1=3.24 run=3 blk=1 avail=10004(72.6%) swpO=0 conn=3 myRSS=1483 php=6 phpRSS=295 ap=49 tcp=52 topuser=madalice 2026-09-08 08:49:50 L1=3.22 run=21 blk=1 avail=8437 (61.2%) swpO=80 conn=15 myRSS=1489 php=24 phpRSS=2315 ap=46 tcp=56 topuser=alison 2026-09-08 08:49:50 L1=3.22 run=20 blk=1 avail=8882 (64.5%) swpO=88 conn=11 myRSS=1489 php=20 phpRSS=1506 ap=50 tcp=55 topuser=alison