INCIDENT 2026-09-08 09:27:33 trigger: php_rss=1526MB ================================================================== load: 2.59 2.49 2.40 9/650 3338279 ncpu:10 mem_avail: 8876MB/13777MB (64.4%) swap_used:1968MB swapout:121/s blocked(D):1 running:8 iowait:7.4% steal:0.0% php: 15 procs / 1526MB heaviest user: evolution (11 procs, 1010MB) apache: 49 procs tcp_estab: 61 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1561 evolution 17 939 nobody 48 797 root 243 685 madalice 3 520 netdata 8 230 cpanellogin 1 64 mailman 20 36 kurri 3 35 infinium 2 23 dovenull 6 23 mailnull 3 21 wp-toolkit 3 12 alison 1 12 zabbix 1 10 dovecot 3 9 named 1 6 nscd 1 4 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB evolution 7 748 madalice 3 526 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 8429 MB Active(file): 4133 MB Inactive(file): 4498 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 392 MB CommitLimit: 10984 MB Committed_AS: 9034 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 7-07:05:08 5320 /usr/bin/imunify-agent-proxy 4109079 root 3-04:42:46 4 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 3-04:42:46 72204 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 1599416 15.7 Ssl 04:42:05 /usr/sbin/mariadbd 3338091 167896 madalice 249800 28.0 R 00:09 php-fpm: pool madalice_com_au 166870 1 netdata 186392 2.8 Ssl 2-07:05:14 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3338199 3320650 evolution 160180 40.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3337767 167896 madalice 160020 22.2 S 00:28 php-fpm: pool madalice_com_au 3338196 3336399 evolution 157880 41.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1911708 1859745 root 156184 0.1 S 06:50:23 spamd child 3338213 3336359 evolution 156012 89.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3338103 167896 madalice 138052 17.5 S 00:08 php-fpm: pool madalice_com_au 1911709 1859745 root 137160 0.0 S 06:50:23 spamd child 3338191 3336335 evolution 89944 37.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2328754 1 root 83484 0.0 Ss 04:42:15 /usr/lib/systemd/systemd-journald 4109105 4109079 root 72204 1.1 Sl 3-04:42:46 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 3265533 1353308 cpanellogin 66412 0.0 S 18:32 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 1353308 1 root 42836 0.0 Ss 48-06:46:20 cpsrvd (SSL) - waiting for connections 3338198 3337760 evolution 38840 39.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 509236 509098 root 38208 0.0 Sl 11-07:07:54 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 167562 166914 netdata 31944 0.1 Sl 2-07:05:09 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1859745 1 root 27860 0.0 Ss 07:04:45 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3319999 506832 nobody 21664 0.0 S 03:42 /usr/sbin/httpd -k start 3320365 506832 nobody 21280 0.1 S 03:28 /usr/sbin/httpd -k start 3320650 506832 nobody 21252 0.0 S 03:02 /usr/sbin/httpd -k start 3308029 506832 nobody 21152 0.1 S 07:26 /usr/sbin/httpd -k start 3318704 506832 nobody 21044 0.0 S 05:17 /usr/sbin/httpd -k start 3336335 506832 nobody 20400 0.0 S 01:54 /usr/sbin/httpd -k start 3336512 506832 nobody 20216 0.1 S 01:44 /usr/sbin/httpd -k start 3336401 506832 nobody 19992 0.1 S 01:51 /usr/sbin/httpd -k start 3337387 506832 nobody 19216 0.0 S 00:49 /usr/sbin/httpd -k start 3337775 506832 nobody 19176 0.1 S 00:28 /usr/sbin/httpd -k start 3336751 506832 nobody 19152 0.0 R 01:28 /usr/sbin/httpd -k start 3336399 506832 nobody 19096 0.0 S 01:51 /usr/sbin/httpd -k start 3337776 506832 nobody 19088 0.0 S 00:28 /usr/sbin/httpd -k start 3320647 506832 nobody 18648 0.1 S 03:02 /usr/sbin/httpd -k start 3320649 506832 nobody 18456 0.0 S 03:02 /usr/sbin/httpd -k start 3336511 506832 nobody 18404 0.1 S 01:44 /usr/sbin/httpd -k start 3337777 506832 nobody 18368 0.0 S 00:28 /usr/sbin/httpd -k start 3336359 506832 nobody 18328 0.2 S 01:52 /usr/sbin/httpd -k start 3320871 506832 nobody 18136 0.2 S 02:52 /usr/sbin/httpd -k start 3320804 506832 nobody 18120 0.1 S 02:55 /usr/sbin/httpd -k start 3337758 506832 nobody 18020 0.0 S 00:29 /usr/sbin/httpd -k start 3320074 506832 nobody 18016 0.1 S 03:40 /usr/sbin/httpd -k start 3336825 506832 nobody 17976 0.0 S 01:22 /usr/sbin/httpd -k start 3337741 506832 nobody 17916 0.0 S 00:30 /usr/sbin/httpd -k start 3320878 506832 nobody 17828 0.0 S 02:52 /usr/sbin/httpd -k start 3320847 506832 nobody 17752 0.0 S 02:53 /usr/sbin/httpd -k start 3336492 506832 nobody 17500 0.0 S 01:46 /usr/sbin/httpd -k start 3336514 506832 nobody 17100 0.1 S 01:44 /usr/sbin/httpd -k start 3336344 506832 nobody 17072 0.1 S 01:53 /usr/sbin/httpd -k start 3337740 506832 nobody 16796 0.0 S 00:30 /usr/sbin/httpd -k start 3337574 506832 nobody 16604 0.0 S 00:36 /usr/sbin/httpd -k start 3336750 506832 nobody 16472 0.0 S 01:28 /usr/sbin/httpd -k start 3336513 506832 nobody 16296 0.0 S 01:44 /usr/sbin/httpd -k start 3337778 506832 nobody 16260 0.0 S 00:28 /usr/sbin/httpd -k start 3337300 506832 nobody 16180 0.1 S 00:52 /usr/sbin/httpd -k start 3337760 506832 nobody 16168 0.1 S 00:29 /usr/sbin/httpd -k start 3337761 506832 nobody 16140 0.2 S 00:29 /usr/sbin/httpd -k start 3337436 506832 nobody 15948 0.0 S 00:46 /usr/sbin/httpd -k start 3337692 506832 nobody 15900 0.2 S 00:31 /usr/sbin/httpd -k start 3337759 506832 nobody 15900 0.1 S 00:29 /usr/sbin/httpd -k start 167566 166914 netdata 15856 2.2 Sl 2-07:05:09 /usr/libexec/netdata/plugins.d/apps.plugin 1 --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 1033124 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 817 coscom/coscom.com.au-ssl_log 362 corpkicks/corporatekicks.com.au-ssl_log 262 evolution/portal.evolutionerp.com.au-ssl_log 243 cosgrovecreative/cosgrovecreative.com.au-ssl_log 196 otter2/otterfencing.net.au-ssl_log 137 otterfencing/otterfencing.com.au-ssl_log 136 candyfabcom/candyfab.com.au-ssl_log 118 kamcool/kamcool.com.au-ssl_log 67 madalice/madalice.com.au-ssl_log 4 olympic/olympicfencing.com.au-ssl_log 3 (total vhosts taking traffic: 11) --- top client IPs across all vhosts (last 3 min) --- 802 203.54.180.238 660 34.79.128.45 272 34.26.136.172 157 35.192.130.43 118 34.130.57.39 94 103.104.165.99 67 4.204.224.164 59 103.104.164.114 50 182.239.240.254 15 120.21.154.188 13 180.181.236.49 5 203.166.236.147 4 34.7.38.20 4 116.91.221.245 3 64.233.173.196 --- top request paths across all vhosts (last 3 min) --- 261 POST /functions.php 207 GET /app/ajax.php 87 GET /index.php 86 GET /factory_session_checker.php 80 POST /clienteditsave.php 45 POST /app/ajax.php 44 POST /app/ajax/selectFilterSingle.php 44 GET /heartbeat.php 44 GET /factory_session_processed_qty.php 44 GET /factory_session_joiner.php 27 POST / 23 POST /app/ajax/selectFilter.php 20 GET / 16 POST /plugins/csvexporter/plugin.php 16 POST /itemModify.php 11 GET /.git/config 10 POST /quoteditsave.php 9 POST /cgi-bin/php-cgi.exe 9 POST /cgi-bin/php-cgi 9 POST /cgi-bin/php8.exe --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 261 POST /functions.php 207 GET /app/ajax.php 80 POST /clienteditsave.php 68 GET /index.php 45 POST /app/ajax.php 44 POST /app/ajax/selectFilterSingle.php 23 POST /app/ajax/selectFilter.php 16 POST /plugins/csvexporter/plugin.php 16 POST /itemModify.php 10 POST /quoteditsave.php 7 POST /logsave.php 7 POST /jobeditsave.php -- last 10 requests -- 203.54.180.238 - - [08/Sep/2026:09:27:32 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4996&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; W 203.54.180.238 - - [08/Sep/2026:09:27:32 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4994&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 203.54.180.238 - - [08/Sep/2026:09:27:32 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4968&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; W 203.54.180.238 - - [08/Sep/2026:09:27:32 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4997&tab=maintab" "Mozilla/5.0 (Windows NT 1 203.54.180.238 - - [08/Sep/2026:09:27:32 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvoiceadd%26invoiceid%3D4997%26tab%3Dmaintab&call=getUserSetting&caller=ajaxSubmitLocal&seq=18184137751 HTTP/1.1" 200 112 "http 203.54.180.238 - - [08/Sep/2026:09:27:32 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=dispatchedit&dispatchid=34151" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 203.54.180.238 - - [08/Sep/2026:09:27:32 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 13741 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4995&tab=maintab" "Mozilla/5.0 (Windows NT 10 203.54.180.238 - - [08/Sep/2026:09:27:32 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=17636113815 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 203.54.180.238 - - [08/Sep/2026:09:27:32 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=18578444032 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 203.54.180.238 - - [08/Sep/2026:09:27:32 +1000] "POST /clienteditsave.php?clientid=12&call=getCategoryDiscounts HTTP/1.1" 200 25 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4997&tab=maintab" "Mozi == coscom/coscom.com.au-ssl_log == -- top paths -- 8 POST / 4 GET / 3 POST /php.exe 3 POST /php-cgi/php-cgi 3 POST /php-cgi.exe 3 POST /cgi/php-cgi 3 POST /cgi/php 3 POST /cgi-bin/php-cgi.exe 3 POST /cgi-bin/php-cgi 3 POST /cgi-bin/php8.exe 3 POST /cgi-bin/php8 3 POST /cgi-bin/php5 -- last 10 requests -- 34.79.128.45 - - [08/Sep/2026:09:27:31 +1000] "GET /newsletter/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.192.130.43 - - [08/Sep/2026:09:27:31 +1000] "GET /mail/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.79.128.45 - - [08/Sep/2026:09:27:31 +1000] "GET /ses/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.192.130.43 - - [08/Sep/2026:09:27:31 +1000] "GET /email/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.79.128.45 - - [08/Sep/2026:09:27:31 +1000] "GET /sendgrid/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.79.128.45 - - [08/Sep/2026:09:27:32 +1000] "GET /sparkpost/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.192.130.43 - - [08/Sep/2026:09:27:32 +1000] "GET /smtp/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.79.128.45 - - [08/Sep/2026:09:27:32 +1000] "GET /postmark/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.79.128.45 - - [08/Sep/2026:09:27:32 +1000] "GET /mailgun/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.192.130.43 - - [08/Sep/2026:09:27:32 +1000] "GET /mailing/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == corpkicks/corporatekicks.com.au-ssl_log == -- top paths -- 3 POST / 1 POST /wp-cron.php 1 HEAD / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment -- last 10 requests -- 34.79.128.45 - - [08/Sep/2026:09:26:21 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.79.128.45 - - [08/Sep/2026:09:26:21 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.79.128.45 - - [08/Sep/2026:09:26:21 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.79.128.45 - - [08/Sep/2026:09:26:22 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.79.128.45 - - [08/Sep/2026:09:26:22 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.79.128.45 - - [08/Sep/2026:09:26:22 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.79.128.45 - - [08/Sep/2026:09:26:23 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.79.128.45 - - [08/Sep/2026:09:26:23 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.79.128.45 - - [08/Sep/2026:09:26:23 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 43.165.65.117 - - [08/Sep/2026:09:26:44 +1000] "GET / HTTP/1.1" 200 150439 "http://corporatekicks.com.au" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 --- last 30 samples (run-up to this incident) --- 2026-09-08 09:25:12 L1=2.91 run=3 blk=1 avail=9885 (71.8%) swpO=137 conn=3 myRSS=1569 php=5 phpRSS=191 ap=48 tcp=58 topuser=madalice 2026-09-08 09:25:12 L1=2.91 run=3 blk=1 avail=9887 (71.8%) swpO=151 conn=3 myRSS=1569 php=6 phpRSS=230 ap=47 tcp=63 topuser=madalice 2026-09-08 09:25:22 L1=2.62 run=3 blk=1 avail=9937 (72.1%) swpO=0 conn=3 myRSS=1569 php=5 phpRSS=174 ap=47 tcp=50 topuser=madalice 2026-09-08 09:25:22 L1=2.62 run=2 blk=1 avail=9923 (72.0%) swpO=0 conn=3 myRSS=1569 php=6 phpRSS=230 ap=46 tcp=50 topuser=madalice 2026-09-08 09:25:32 L1=2.37 run=2 blk=1 avail=9994 (72.5%) swpO=0 conn=2 myRSS=1569 php=5 phpRSS=190 ap=37 tcp=48 topuser=madalice 2026-09-08 09:25:32 L1=2.37 run=2 blk=1 avail=9982 (72.5%) swpO=0 conn=3 myRSS=1569 php=6 phpRSS=230 ap=36 tcp=52 topuser=madalice 2026-09-08 09:25:42 L1=2.31 run=2 blk=1 avail=10026(72.8%) swpO=0 conn=2 myRSS=1569 php=4 phpRSS=59 ap=42 tcp=60 topuser=evolution 2026-09-08 09:25:42 L1=2.31 run=2 blk=1 avail=9958 (72.3%) swpO=0 conn=3 myRSS=1569 php=5 phpRSS=101 ap=50 tcp=61 topuser=evolution 2026-09-08 09:25:52 L1=2.18 run=4 blk=1 avail=9885 (71.7%) swpO=0 conn=2 myRSS=1569 php=5 phpRSS=175 ap=55 tcp=61 topuser=madalice 2026-09-08 09:25:53 L1=2.18 run=2 blk=1 avail=9868 (71.6%) swpO=0 conn=2 myRSS=1569 php=6 phpRSS=231 ap=55 tcp=55 topuser=madalice 2026-09-08 09:26:02 L1=2.22 run=1 blk=1 avail=9929 (72.1%) swpO=0 conn=2 myRSS=1570 php=5 phpRSS=175 ap=48 tcp=64 topuser=madalice 2026-09-08 09:26:03 L1=2.22 run=1 blk=1 avail=9928 (72.1%) swpO=0 conn=2 myRSS=1570 php=5 phpRSS=175 ap=48 tcp=59 topuser=madalice 2026-09-08 09:26:12 L1=2.27 run=2 blk=1 avail=9981 (72.4%) swpO=0 conn=2 myRSS=1570 php=4 phpRSS=43 ap=56 tcp=62 topuser=evolution 2026-09-08 09:26:13 L1=2.27 run=2 blk=1 avail=9941 (72.2%) swpO=0 conn=2 myRSS=1570 php=8 phpRSS=191 ap=56 tcp=62 topuser=evolution 2026-09-08 09:26:22 L1=2.15 run=2 blk=1 avail=9872 (71.7%) swpO=0 conn=2 myRSS=1570 php=6 phpRSS=234 ap=52 tcp=48 topuser=madalice 2026-09-08 09:26:23 L1=2.15 run=2 blk=1 avail=9909 (71.9%) swpO=0 conn=2 myRSS=1570 php=5 phpRSS=176 ap=51 tcp=45 topuser=madalice 2026-09-08 09:26:32 L1=2.19 run=3 blk=1 avail=9985 (72.5%) swpO=0 conn=2 myRSS=1570 php=6 phpRSS=217 ap=42 tcp=48 topuser=madalice 2026-09-08 09:26:33 L1=2.19 run=2 blk=1 avail=9934 (72.1%) swpO=0 conn=2 myRSS=1570 php=9 phpRSS=343 ap=41 tcp=47 topuser=evolution 2026-09-08 09:26:42 L1=2.17 run=2 blk=1 avail=9967 (72.3%) swpO=0 conn=2 myRSS=1570 php=6 phpRSS=217 ap=44 tcp=56 topuser=madalice 2026-09-08 09:26:43 L1=2.17 run=2 blk=1 avail=9950 (72.2%) swpO=0 conn=2 myRSS=1570 php=5 phpRSS=177 ap=44 tcp=55 topuser=madalice 2026-09-08 09:26:52 L1=2.22 run=1 blk=1 avail=9899 (71.9%) swpO=59 conn=2 myRSS=1568 php=5 phpRSS=180 ap=47 tcp=52 topuser=madalice 2026-09-08 09:26:53 L1=2.22 run=3 blk=1 avail=9954 (72.3%) swpO=59 conn=1 myRSS=1568 php=5 phpRSS=165 ap=46 tcp=49 topuser=madalice 2026-09-08 09:27:02 L1=2.50 run=2 blk=1 avail=9863 (71.6%) swpO=0 conn=2 myRSS=1568 php=9 phpRSS=328 ap=45 tcp=64 topuser=evolution 2026-09-08 09:27:03 L1=2.50 run=2 blk=1 avail=10045(72.9%) swpO=1 conn=1 myRSS=1568 php=6 phpRSS=111 ap=46 tcp=65 topuser=corpkicks 2026-09-08 09:27:12 L1=2.79 run=1 blk=1 avail=9862 (71.6%) swpO=101 conn=2 myRSS=1565 php=5 phpRSS=198 ap=57 tcp=67 topuser=madalice 2026-09-08 09:27:13 L1=2.79 run=2 blk=1 avail=9876 (71.7%) swpO=100 conn=1 myRSS=1565 php=5 phpRSS=192 ap=56 tcp=66 topuser=madalice 2026-09-08 09:27:22 L1=2.60 run=2 blk=1 avail=9729 (70.6%) swpO=0 conn=2 myRSS=1565 php=7 phpRSS=400 ap=50 tcp=53 topuser=infinium 2026-09-08 09:27:23 L1=2.60 run=5 blk=1 avail=9809 (71.2%) swpO=0 conn=1 myRSS=1565 php=6 phpRSS=301 ap=49 tcp=52 topuser=madalice 2026-09-08 09:27:32 L1=2.59 run=5 blk=1 avail=9262 (67.2%) swpO=117 conn=10 myRSS=1561 php=13 phpRSS=1093 ap=47 tcp=68 topuser=evolution 2026-09-08 09:27:33 L1=2.59 run=8 blk=1 avail=8876 (64.4%) swpO=121 conn=8 myRSS=1561 php=15 phpRSS=1526 ap=49 tcp=61 topuser=evolution