INCIDENT 2026-09-08 12:35:37 trigger: php_rss=2279MB ================================================================== load: 3.00 3.06 2.90 9/657 4044567 ncpu:10 mem_avail: 7544MB/13777MB (54.8%) swap_used:1971MB swapout:707/s blocked(D):1 running:17 iowait:7.1% steal:0.0% php: 14 procs / 2279MB heaviest user: corpkicks (8 procs, 2070MB) apache: 52 procs tcp_estab: 66 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1927 corpkicks 7 1550 nobody 51 842 root 252 835 netdata 8 228 madalice 1 130 cpanellogin 1 60 mailnull 5 43 mailman 20 36 dovenull 6 26 wp-toolkit 3 12 alison 1 12 aaa 1 11 kurri 1 10 evolution 10 9 dovecot 3 9 zabbix 1 8 named 1 5 nscd 1 4 dbus 1 3 --- php workers by user --- USER PROCS RSS_MB corpkicks 6 1117 madalice 1 130 root 1 2 evolution 2 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6899 MB Active(file): 4691 MB Inactive(file): 2416 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 412 MB CommitLimit: 10984 MB Committed_AS: 8953 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 7-10:13:12 3236 /usr/bin/imunify-agent-proxy 4029510 root 00:36 2972 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : 4109079 root 3-07:50:50 40 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 3-07:50:50 106200 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 1973380 20.4 Ssl 07:50:09 /usr/sbin/mariadbd 4044523 4029413 corpkicks 282048 162 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 4044519 4029333 corpkicks 256784 132 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 166870 1 netdata 184544 2.8 Ssl 2-10:13:18 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1911708 1859745 root 172892 0.1 S 09:58:27 spamd child 1911709 1859745 root 143340 0.0 S 09:58:27 spamd child 4044406 167896 madalice 133844 14.5 S 00:10 php-fpm: pool madalice_com_au 2328754 1 root 122188 0.0 Ss 07:50:19 /usr/lib/systemd/systemd-journald 4109105 4109079 root 106200 1.2 Sl 3-07:50:50 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 3673446 1353308 cpanellogin 62212 0.0 S 01:37:02 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 4044595 4028294 evolution 38576 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 509236 509098 root 36792 0.0 Sl 11-10:15:58 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 36372 0.0 Ss 48-09:54:24 cpsrvd (SSL) - waiting for connections 167562 166914 netdata 31708 0.1 Sl 2-10:13:13 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1859745 1 root 27804 0.0 Ss 10:12:49 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1466 1 root 25640 0.0 Ss 71-02:25:53 dnsadmin - server mode 4026646 4008596 root 23520 0.0 S 03:54 /usr/sbin/exim -q 4027395 506832 nobody 21788 0.1 S 03:11 /usr/sbin/httpd -k start 4009680 506832 nobody 21628 0.1 S 06:49 /usr/sbin/httpd -k start 4027710 506832 nobody 21200 0.1 S 02:47 /usr/sbin/httpd -k start 4026651 4026646 mailnull 20856 0.0 S 03:54 /usr/sbin/exim -q 4028030 506832 nobody 20164 0.0 S 02:23 /usr/sbin/httpd -k start 4027360 506832 nobody 19932 0.0 S 03:12 /usr/sbin/httpd -k start 4010416 506832 nobody 19788 0.0 S 05:59 /usr/sbin/httpd -k start 4029418 506832 nobody 19388 0.0 S 00:44 /usr/sbin/httpd -k start 4010806 506832 nobody 19372 0.0 S 05:36 /usr/sbin/httpd -k start 4029378 506832 nobody 19300 0.0 S 00:46 /usr/sbin/httpd -k start 4028924 506832 nobody 19264 0.1 S 01:17 /usr/sbin/httpd -k start 4028276 506832 nobody 19080 0.0 S 02:02 /usr/sbin/httpd -k start 4028683 506832 nobody 19064 0.0 S 01:31 /usr/sbin/httpd -k start 4010353 506832 nobody 19040 0.0 S 06:01 /usr/sbin/httpd -k start 4029417 506832 nobody 18944 0.1 S 00:44 /usr/sbin/httpd -k start 4028268 506832 nobody 18924 0.0 S 02:03 /usr/sbin/httpd -k start 4029333 506832 nobody 18904 0.0 S 00:48 /usr/sbin/httpd -k start 4029408 506832 nobody 18812 0.1 S 00:44 /usr/sbin/httpd -k start 4027320 506832 nobody 18476 0.0 S 03:13 /usr/sbin/httpd -k start 4029419 506832 nobody 18440 0.0 S 00:44 /usr/sbin/httpd -k start 4028680 506832 nobody 18224 0.1 S 01:32 /usr/sbin/httpd -k start 4029342 506832 nobody 18192 0.0 S 00:47 /usr/sbin/httpd -k start 4028287 506832 nobody 18048 0.0 S 02:01 /usr/sbin/httpd -k start 4029406 506832 nobody 17800 0.2 S 00:44 /usr/sbin/httpd -k start 4029415 506832 nobody 17744 0.0 S 00:44 /usr/sbin/httpd -k start 4044217 506832 nobody 17688 0.0 S 00:22 /usr/sbin/httpd -k start 4029383 506832 nobody 17096 0.0 S 00:45 /usr/sbin/httpd -k start 4028719 506832 nobody 17012 0.0 S 01:30 /usr/sbin/httpd -k start 4037662 506832 nobody 16984 0.1 S 00:28 /usr/sbin/httpd -k start 4029410 506832 nobody 16956 0.2 S 00:44 /usr/sbin/httpd -k start 4008956 506832 nobody 16836 0.0 S 07:47 /usr/sbin/httpd -k start 4028857 506832 nobody 16800 0.0 S 01:21 /usr/sbin/httpd -k start 4029412 506832 nobody 16604 0.1 S 00:44 /usr/sbin/httpd -k start 4028849 506832 nobody 16580 0.1 S 01:22 /usr/sbin/httpd -k start 4028294 506832 nobody 16524 0.0 S 02:01 /usr/sbin/httpd -k start 4029411 506832 nobody 16080 0.1 S 00:44 /usr/sbin/httpd -k start 4044229 506832 nobody 16036 0.0 S 00:21 /usr/sbin/httpd -k start 4029384 506832 nobody 16016 0.0 S 00:45 /usr/sbin/httpd -k start 4037665 506832 nobody 15988 0.0 S 00:28 /usr/sbin/httpd -k start 4036301 506832 nobody 15832 0.1 S 00:29 /usr/sbin/httpd -k start 4029148 506832 nobody 15792 0.0 S 01:01 /usr/sbin/httpd -k start 4029381 506832 nobody 15724 0.0 S 00:45 /usr/sbin/httpd -k start 167566 166914 netdata 15720 2.2 Sl 2-10:13:13 /usr/libexec/netdata/plugins.d/apps.plugin 1 --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 2137016 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 657 evolution/portal.evolutionerp.com.au-ssl_log 379 bigdeals/bigdeals.com.au-ssl_log 139 evolution/evolutionerp.com.au-ssl_log 52 corpkicks/corporatekicks.com.au-ssl_log 35 aaa/aaadownunder.com.au-ssl_log 30 madalice/madalice.com.au-ssl_log 5 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 618 203.54.180.238 151 103.104.165.99 139 34.175.67.20 54 203.166.236.147 44 120.20.96.253 39 20.151.10.161 38 180.181.236.49 38 116.91.221.245 33 103.104.164.114 31 34.180.84.76 28 1.141.176.34 22 1.144.107.82 21 182.239.240.254 12 34.136.192.24 5 120.21.154.188 --- top request paths across all vhosts (last 3 min) --- 287 POST /functions.php 150 GET /factory_session_checker.php 112 GET /app/ajax.php 77 GET /factory_session_processed_qty.php 77 GET /factory_session_joiner.php 69 GET /index.php 65 GET /cgi-sys/suspendedpage.cgi 45 GET /heartbeat.php 32 POST /plugins/csvexporter/plugin.php 18 POST /clienteditsave.php 18 POST /app/ajax.php 17 POST /app/ajax/selectFilterSingle.php 16 POST /app/ajax/contactFilter.php 14 POST /quoteditsave.php 12 POST /app/ajax/selectFilter.php 11 POST /portal/register 8 POST /plugins/fencecosting/plugin.php 8 POST /logsave.php 8 POST /jobeditsave.php 8 POST /billaddsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 287 POST /functions.php 112 GET /app/ajax.php 53 GET /index.php 32 POST /plugins/csvexporter/plugin.php 18 POST /clienteditsave.php 18 POST /app/ajax.php 17 POST /app/ajax/selectFilterSingle.php 16 POST /app/ajax/contactFilter.php 14 POST /quoteditsave.php 12 POST /app/ajax/selectFilter.php 8 POST /plugins/fencecosting/plugin.php 8 POST /logsave.php -- last 10 requests -- 203.54.180.238 - - [08/Sep/2026:12:35:35 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=billadd" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 203.54.180.238 - - [08/Sep/2026:12:35:35 +1000] "POST /app/ajax/contactFilter.php?call=filterClients&filter=A HTTP/1.1" 200 2030 "https://my.evolutionerp.com.au/index.php?page=billadd" "Mozilla/5.0 (Windows NT 10.0; Win6 203.54.180.238 - - [08/Sep/2026:12:35:35 +1000] "POST /app/ajax/contactFilter.php?call=filterClients&filter=AL HTTP/1.1" 200 1922 "https://my.evolutionerp.com.au/index.php?page=billadd" "Mozilla/5.0 (Windows NT 10.0; Win 203.54.180.238 - - [08/Sep/2026:12:35:35 +1000] "POST /app/ajax/contactFilter.php?call=filterClients&filter=ALL HTTP/1.1" 200 1905 "https://my.evolutionerp.com.au/index.php?page=billadd" "Mozilla/5.0 (Windows NT 10.0; Wi 103.104.165.99 - - [08/Sep/2026:12:35:35 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 282 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12119&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [08/Sep/2026:12:35:37 +1000] "POST /app/ajax/contactFilter.php?call=filterClients&filter=ALLS HTTP/1.1" 200 547 "https://my.evolutionerp.com.au/index.php?page=billadd" "Mozilla/5.0 (Windows NT 10.0; Wi 203.54.180.238 - - [08/Sep/2026:12:35:37 +1000] "POST /app/ajax/contactFilter.php?call=filterClients&filter=ALLST HTTP/1.1" 200 156 "https://my.evolutionerp.com.au/index.php?page=billadd" "Mozilla/5.0 (Windows NT 10.0; W 203.54.180.238 - - [08/Sep/2026:12:35:37 +1000] "POST /app/ajax/contactFilter.php?call=filterClients&filter=ALLSTE HTTP/1.1" 200 102 "https://my.evolutionerp.com.au/index.php?page=billadd" "Mozilla/5.0 (Windows NT 10.0; 103.104.165.99 - - [08/Sep/2026:12:35:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 203.54.180.238 - - [08/Sep/2026:12:35:37 +1000] "POST /app/ajax/contactFilter.php?call=filterClients&filter=ALLSTEE HTTP/1.1" 200 102 "https://my.evolutionerp.com.au/index.php?page=billadd" "Mozilla/5.0 (Windows NT 10.0; == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 150 GET /factory_session_checker.php 77 GET /factory_session_processed_qty.php 77 GET /factory_session_joiner.php 45 GET /heartbeat.php 16 GET /index.php 11 POST /portal/register 2 POST /factory_functions.php 1 GET /uploadsave.php -- last 10 requests -- 203.54.180.238 - - [08/Sep/2026:12:35:29 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:12:35:29 +1000] "GET /heartbeat.php?sentAt=1788834929&bytes=106,159,116,113&_=1788786031970 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [08/Sep/2026:12:35:30 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:12:35:31 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:12:35:31 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:12:35:31 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [08/Sep/2026:12:35:32 +1000] "GET /factory_session_joiner.php?id=35182 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [08/Sep/2026:12:35:32 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:12:35:33 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [08/Sep/2026:12:35:33 +1000] "GET /factory_session_joiner.php?id=35192 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 65 GET /cgi-sys/suspendedpage.cgi 3 POST /cgi-sys/suspendedpage.cgi 1 POST / 1 GET /www/.env 1 GET /web/.env 1 GET /var/www/html/.env 1 GET /var/www/.env 1 GET /storage/.env 1 GET /staging/.env 1 GET /src/.env 1 GET /site/.env 1 GET /shared/.env -- last 10 requests -- 34.175.67.20 - - [08/Sep/2026:12:35:33 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.67.20 - - [08/Sep/2026:12:35:33 +1000] "GET /prod/.env HTTP/1.1" 302 250 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.67.20 - - [08/Sep/2026:12:35:34 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.67.20 - - [08/Sep/2026:12:35:34 +1000] "GET /dev/.env HTTP/1.1" 302 250 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.67.20 - - [08/Sep/2026:12:35:34 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.67.20 - - [08/Sep/2026:12:35:34 +1000] "GET /staging/.env HTTP/1.1" 302 250 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.67.20 - - [08/Sep/2026:12:35:35 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.67.20 - - [08/Sep/2026:12:35:35 +1000] "GET /opt/.env HTTP/1.1" 302 250 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.67.20 - - [08/Sep/2026:12:35:35 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.67.20 - - [08/Sep/2026:12:35:36 +1000] "GET /laravel/.env HTTP/1.1" 302 250 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-08 12:33:10 L1=3.11 run=2 blk=1 avail=9369 (68.0%) swpO=0 conn=3 myRSS=1943 php=5 phpRSS=349 ap=44 tcp=48 topuser=madalice 2026-09-08 12:33:17 L1=3.18 run=3 blk=1 avail=9359 (67.9%) swpO=0 conn=2 myRSS=1943 php=6 phpRSS=349 ap=47 tcp=59 topuser=madalice 2026-09-08 12:33:21 L1=3.17 run=1 blk=1 avail=9380 (68.1%) swpO=0 conn=3 myRSS=1943 php=5 phpRSS=314 ap=46 tcp=49 topuser=madalice 2026-09-08 12:33:27 L1=2.99 run=3 blk=1 avail=9412 (68.3%) swpO=0 conn=2 myRSS=1943 php=6 phpRSS=331 ap=41 tcp=44 topuser=madalice 2026-09-08 12:33:31 L1=3.07 run=3 blk=1 avail=9379 (68.1%) swpO=0 conn=3 myRSS=1943 php=6 phpRSS=354 ap=43 tcp=53 topuser=madalice 2026-09-08 12:33:37 L1=2.99 run=2 blk=1 avail=9473 (68.8%) swpO=0 conn=4 myRSS=1943 php=9 phpRSS=247 ap=58 tcp=67 topuser=evolution 2026-09-08 12:33:41 L1=3.15 run=3 blk=1 avail=9555 (69.4%) swpO=0 conn=3 myRSS=1943 php=3 phpRSS=2 ap=58 tcp=64 topuser=root 2026-09-08 12:33:47 L1=3.22 run=4 blk=1 avail=9406 (68.3%) swpO=0 conn=4 myRSS=1943 php=8 phpRSS=294 ap=58 tcp=60 topuser=evolution 2026-09-08 12:33:51 L1=3.28 run=3 blk=1 avail=9556 (69.4%) swpO=0 conn=3 myRSS=1943 php=4 phpRSS=41 ap=55 tcp=56 topuser=evolution 2026-09-08 12:33:57 L1=3.10 run=4 blk=1 avail=9585 (69.6%) swpO=0 conn=4 myRSS=1943 php=4 phpRSS=60 ap=51 tcp=45 topuser=evolution 2026-09-08 12:34:01 L1=3.01 run=7 blk=1 avail=9560 (69.4%) swpO=0 conn=2 myRSS=1943 php=6 phpRSS=152 ap=47 tcp=51 topuser=evolution 2026-09-08 12:34:07 L1=2.85 run=2 blk=1 avail=9506 (69.0%) swpO=0 conn=4 myRSS=1943 php=4 phpRSS=134 ap=47 tcp=57 topuser=madalice 2026-09-08 12:34:11 L1=2.78 run=2 blk=1 avail=9494 (68.9%) swpO=0 conn=2 myRSS=1943 php=4 phpRSS=134 ap=50 tcp=40 topuser=madalice 2026-09-08 12:34:17 L1=2.80 run=3 blk=1 avail=9196 (66.8%) swpO=0 conn=4 myRSS=1943 php=6 phpRSS=433 ap=50 tcp=64 topuser=madalice 2026-09-08 12:34:21 L1=2.73 run=9 blk=1 avail=8202 (59.5%) swpO=1 conn=2 myRSS=1943 php=11 phpRSS=1428 ap=53 tcp=60 topuser=madalice 2026-09-08 12:34:27 L1=2.59 run=1 blk=1 avail=8777 (63.7%) swpO=1 conn=4 myRSS=1943 php=11 phpRSS=956 ap=52 tcp=56 topuser=madalice 2026-09-08 12:34:31 L1=2.55 run=1 blk=1 avail=8844 (64.2%) swpO=0 conn=2 myRSS=1943 php=10 phpRSS=901 ap=48 tcp=45 topuser=madalice 2026-09-08 12:34:37 L1=2.58 run=1 blk=1 avail=8842 (64.2%) swpO=0 conn=1 myRSS=1944 php=10 phpRSS=901 ap=50 tcp=55 topuser=madalice 2026-09-08 12:34:41 L1=2.46 run=2 blk=1 avail=8857 (64.3%) swpO=0 conn=2 myRSS=1944 php=11 phpRSS=929 ap=48 tcp=39 topuser=madalice 2026-09-08 12:34:47 L1=2.50 run=1 blk=1 avail=8827 (64.1%) swpO=0 conn=1 myRSS=1944 php=11 phpRSS=997 ap=42 tcp=50 topuser=madalice 2026-09-08 12:34:51 L1=2.54 run=5 blk=1 avail=8770 (63.7%) swpO=0 conn=2 myRSS=1944 php=12 phpRSS=992 ap=49 tcp=73 topuser=madalice 2026-09-08 12:34:57 L1=2.74 run=1 blk=1 avail=9375 (68.1%) swpO=0 conn=1 myRSS=1944 php=4 phpRSS=124 ap=70 tcp=68 topuser=madalice 2026-09-08 12:35:01 L1=2.60 run=10 blk=2 avail=9375 (68.0%) swpO=0 conn=2 myRSS=1945 php=5 phpRSS=144 ap=66 tcp=56 topuser=evolution 2026-09-08 12:35:07 L1=2.79 run=7 blk=1 avail=9476 (68.8%) swpO=0 conn=1 myRSS=1945 php=7 phpRSS=170 ap=61 tcp=75 topuser=evolution 2026-09-08 12:35:11 L1=2.97 run=11 blk=1 avail=9439 (68.5%) swpO=0 conn=2 myRSS=1945 php=9 phpRSS=215 ap=64 tcp=65 topuser=evolution 2026-09-08 12:35:17 L1=2.97 run=1 blk=1 avail=9492 (68.9%) swpO=0 conn=1 myRSS=1945 php=3 phpRSS=2 ap=66 tcp=64 topuser=root 2026-09-08 12:35:21 L1=2.89 run=5 blk=1 avail=9393 (68.2%) swpO=0 conn=2 myRSS=1945 php=4 phpRSS=60 ap=63 tcp=53 topuser=evolution 2026-09-08 12:35:27 L1=2.82 run=3 blk=1 avail=9566 (69.4%) swpO=0 conn=1 myRSS=1945 php=3 phpRSS=2 ap=57 tcp=55 topuser=root 2026-09-08 12:35:31 L1=2.92 run=3 blk=1 avail=9375 (68.1%) swpO=0 conn=2 myRSS=1945 php=5 phpRSS=265 ap=54 tcp=54 topuser=olympic 2026-09-08 12:35:37 L1=3.00 run=17 blk=1 avail=7544 (54.8%) swpO=707 conn=7 myRSS=1927 php=14 phpRSS=2279 ap=52 tcp=66 topuser=corpkicks