INCIDENT 2026-09-10 11:11:24 trigger: php_rss=1838MB ================================================================== load: 2.33 1.55 1.42 8/719 1361273 ncpu:10 mem_avail: 6008MB/13777MB (43.6%) swap_used:1386MB swapout:987/s blocked(D):0 running:9 iowait:0.4% steal:0.0% php: 13 procs / 1838MB heaviest user: madalice (8 procs, 1576MB) apache: 114 procs tcp_estab: 110 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2941 nobody 113 1739 madalice 8 1575 root 248 1199 netdata 8 255 corpkicks 1 236 mailman 20 185 evolution 9 94 dovenull 6 66 cpanellogin 1 62 wp-toolkit 3 61 kurri 3 40 dovecot 3 28 alison 2 26 polkitd 1 15 lowrange 1 14 zabbix 1 9 nscd 1 6 named 1 5 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 8 1494 corpkicks 1 237 evolution 4 67 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5207 MB Active(file): 4327 MB Inactive(file): 998 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 562 MB CommitLimit: 10984 MB Committed_AS: 10141 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1343077 root 03:24 58016 /opt/imunify360/venv/bin/python3 -m imav.run 3926885 root 9-08:49:00 3748 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 3012416 14.1 Ssl 2-06:25:57 /usr/sbin/mariadbd 1361185 1361110 corpkicks 258876 67.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1360962 167896 madalice 252624 47.4 S 00:09 php-fpm: pool madalice_com_au 1360075 167896 madalice 234132 12.3 R 01:02 php-fpm: pool madalice_com_au 166870 1 netdata 199016 2.7 Ssl 4-08:49:06 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3701672 3652415 root 194596 0.1 S 08:36:12 spamd child 2328754 1 root 189612 0.0 Ss 2-06:26:07 /usr/lib/systemd/systemd-journald 3701673 3652415 root 162620 0.0 S 08:36:12 spamd child 1360968 167896 madalice 162480 34.7 S 00:08 php-fpm: pool madalice_com_au 1360970 167896 madalice 162328 48.8 S 00:08 php-fpm: pool madalice_com_au 1360967 167896 madalice 162308 33.5 S 00:08 php-fpm: pool madalice_com_au 1360961 167896 madalice 159544 43.5 S 00:09 php-fpm: pool madalice_com_au 1360960 167896 madalice 159540 45.0 S 00:09 php-fpm: pool madalice_com_au 3652415 1 root 157524 0.0 Ss 08:46:33 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1361125 167896 madalice 152952 45.3 R 00:03 php-fpm: pool madalice_com_au 509236 509098 root 66808 0.0 Sl 13-08:51:46 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1109979 1353308 cpanellogin 64000 0.0 S 01:03:41 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 1343077 1 root 58016 0.6 Ssl 03:24 /opt/imunify360/venv/bin/python3 -m imav.run 1361286 1360987 evolution 43636 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1353308 1 root 42612 0.0 Ss 50-08:30:12 cpsrvd (SSL) - waiting for connections 1469 1 root 40012 0.1 Ss 73-01:01:41 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1361234 1469 root 38224 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 167562 166914 netdata 36908 0.1 Sl 4-08:49:01 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2495258 1 wp-toolkit 36224 0.0 Ss 1-09:57:31 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 3651775 1 root 31440 0.0 Ss 08:47:07 lfd - sleeping 1361307 1361116 evolution 29732 0.0 S 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1361308 1360311 evolution 29000 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2495169 1 wp-toolkit 24744 0.0 Ss 1-09:57:31 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1342263 506832 nobody 24592 0.1 S 04:14 /usr/sbin/httpd -k start 1343924 506832 nobody 23324 0.1 S 02:46 /usr/sbin/httpd -k start 1343892 506832 nobody 22980 0.1 S 02:47 /usr/sbin/httpd -k start 1344363 506832 nobody 22756 0.1 S 02:18 /usr/sbin/httpd -k start 1344377 506832 nobody 22564 0.0 S 02:17 /usr/sbin/httpd -k start 1344576 506832 nobody 22444 0.1 S 02:11 /usr/sbin/httpd -k start 1344356 506832 nobody 22012 0.1 S 02:19 /usr/sbin/httpd -k start 1344394 506832 nobody 21592 0.0 S 02:16 /usr/sbin/httpd -k start 1360251 506832 nobody 21128 0.1 S 00:55 /usr/sbin/httpd -k start 1344520 506832 nobody 21116 0.0 S 02:12 /usr/sbin/httpd -k start 1344486 506832 nobody 21072 0.0 S 02:13 /usr/sbin/httpd -k start 1344379 506832 nobody 21004 0.0 S 02:17 /usr/sbin/httpd -k start 1345144 506832 nobody 20992 0.0 S 01:24 /usr/sbin/httpd -k start 1360250 506832 nobody 20984 0.0 R 00:55 /usr/sbin/httpd -k start 1344388 506832 nobody 20948 0.0 S 02:16 /usr/sbin/httpd -k start 1360313 506832 nobody 20772 0.0 S 00:54 /usr/sbin/httpd -k start 1360227 506832 nobody 20716 0.0 S 00:59 /usr/sbin/httpd -k start 1345145 506832 nobody 20668 0.0 S 01:24 /usr/sbin/httpd -k start 1360239 506832 nobody 20632 0.0 S 00:56 /usr/sbin/httpd -k start 1360311 506832 nobody 20604 0.0 S 00:54 /usr/sbin/httpd -k start 1360252 506832 nobody 20596 0.0 S 00:55 /usr/sbin/httpd -k start 1360286 506832 nobody 20256 0.0 S 00:54 /usr/sbin/httpd -k start 1360243 506832 nobody 20180 0.0 S 00:56 /usr/sbin/httpd -k start 1360254 506832 nobody 20176 0.0 S 00:55 /usr/sbin/httpd -k start 1344373 506832 nobody 20140 0.0 S 02:17 /usr/sbin/httpd -k start 1360299 506832 nobody 20092 0.0 S 00:54 /usr/sbin/httpd -k start 1360304 506832 nobody 20068 0.0 S 00:54 /usr/sbin/httpd -k start 1463 1 root 19968 0.0 Ss 73-01:01:41 tailwatchd 1360249 506832 nobody 19920 0.1 S 00:55 /usr/sbin/httpd -k start 1360236 506832 nobody 19908 0.0 S 00:56 /usr/sbin/httpd -k start 1361001 506832 nobody 19884 0.4 S 00:07 /usr/sbin/httpd -k start 1360258 506832 nobody 19628 0.0 S 00:55 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9830528 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 534 cosgrovecreative/cosgrovecreative.com.au-ssl_log 241 kurri/kurrimotorinn.com.au-ssl_log 213 madalice/madalice.com.au-ssl_log 189 evolution/app.evolutionerp.com.au-ssl_log 127 evolution/portal.evolutionerp.com.au-ssl_log 76 evolution/staging.evolutionerp.com.au-ssl_log 76 aaa/aaadownunder.com.au-ssl_log 11 infinium/infinium.net.au-ssl_log 3 alison/alisonarts.com.au-ssl_log 2 corpkicks/corporatekicks.com.au-ssl_log 2 evolution/evolutionerp.com.au-ssl_log 2 kamcool/kamcool.com.au-ssl_log 1 nrg/nrgservices.net.au-ssl_log 1 tubesupplies/tubesupplies.com.au 1 (total vhosts taking traffic: 16) --- top client IPs across all vhosts (last 3 min) --- 270 81.171.72.93 221 203.54.180.238 176 103.104.165.99 127 40.115.94.245 112 81.171.72.135 104 81.171.74.60 100 1.144.107.82 85 91.148.245.81 72 118.127.40.55 65 165.225.233.87 57 91.148.244.131 16 124.170.183.15 14 182.239.240.254 14 103.104.164.114 11 150.228.151.88 --- top request paths across all vhosts (last 3 min) --- 210 POST /functions.php 127 GET /api/getItem/LWPB2001KG 114 GET /app/ajax.php 44 GET /index.php 35 GET /companies/85-1516155235/files/Forms%20and%20Templates/1713410864.html 35 GET /companies/85-1516155235/files/Forms%20and%20Templates/1713397831.html 32 GET / 30 POST /plugins/csvexporter/plugin.php 26 GET /heartbeat.php 25 POST / 24 HEAD / 24 GET /factory_session_checker.php 23 POST /jobeditsave.php 23 POST /clienteditsave.php 23 GET /storage/logs/laravel.log 23 GET /database_backup.sql 22 GET /wp-config.php 22 GET /_vti_pvt/service.pwd 22 GET /.svn/wc.db 22 GET /database.sql --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 201 POST /functions.php 94 GET /app/ajax.php 39 GET /index.php 35 GET /companies/85-1516155235/files/Forms%20and%20Templates/1713410864.html 35 GET /companies/85-1516155235/files/Forms%20and%20Templates/1713397831.html 30 POST /plugins/csvexporter/plugin.php 17 POST /jobeditsave.php 15 POST /clienteditsave.php 12 POST /app/ajax.php 10 POST /quoteditsave.php 10 POST /app/ajax/selectFilterSingle.php 8 POST /itemModify.php -- last 10 requests -- 1.144.107.82 - - [10/Sep/2026:11:11:24 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=16939767545 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/index. 1.144.107.82 - - [10/Sep/2026:11:11:24 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvedit%26id%3D7090%26tab%3Dgeneraltab&call=getUserSetting&caller=ajaxSubmitLocal&seq=19400500702 HTTP/1.1" 200 109 "https://my.ev 203.54.180.238 - - [10/Sep/2026:11:11:24 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78477" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 1.144.107.82 - - [10/Sep/2026:11:11:24 +1000] "POST /app/ajax/selectTicketFilter.php?call=filterinv&filter=&from=support_ticket HTTP/1.1" 200 2875 "https://my.evolutionerp.com.au/index.php?page=support_ticketedit&id=1373 1.144.107.82 - - [10/Sep/2026:11:11:24 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dsupport_ticketedit%26id%3D1373&call=getUserSetting&caller=ajaxSubmitLocal&seq=11180580074 HTTP/1.1" 200 107 "https://my.evolutione 203.54.180.238 - - [10/Sep/2026:11:11:24 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=17472286290 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 203.54.180.238 - - [10/Sep/2026:11:11:24 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=15459452087 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 203.54.180.238 - - [10/Sep/2026:11:11:24 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dpurchaseadd%26purchaseid%3D14270&call=getUserSetting&caller=ajaxSubmitLocal&seq=18677791017 HTTP/1.1" 200 119 203.54.180.238 - - [10/Sep/2026:11:11:24 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=&cursel=&curseltext=&fromMS=1&&nolimit=LIMIT%2050&include=&supplierid=16814&contactid=16814&tid=%25%25&returnobj=item 203.54.180.238 - - [10/Sep/2026:11:11:24 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dpurchaseadd%26purchaseid%3D14270&call=getUserSetting&caller=ajaxSubmitLocal&seq=14180642960 HTTP/1.1" 200 165 "https://my.evolut == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 8 POST / 8 HEAD / 8 GET /wp-config.php 8 GET /wp-admin/setup-config.php 8 GET /_vti_pvt/service.pwd 8 GET /user_secrets.yml 8 GET /.svn/wc.db 8 GET /storage/logs/laravel.log 8 GET /.ssh/id_rsa 8 GET /.ssh/id_ed25519 8 GET /server.key 8 GET /phpinfo.php -- last 10 requests -- 81.171.74.60 - - [10/Sep/2026:11:09:19 +1000] "GET /.env.production HTTP/1.1" 403 12 "-" "Go-http-client/1.1" 81.171.74.60 - - [10/Sep/2026:11:09:19 +1000] "GET /server.key HTTP/1.1" 400 52 "-" "Go-http-client/1.1" 81.171.74.60 - - [10/Sep/2026:11:09:20 +1000] "GET /.npmrc HTTP/1.1" 403 13 "-" "Go-http-client/1.1" 81.171.74.60 - - [10/Sep/2026:11:09:20 +1000] "GET /actuator/heapdump HTTP/1.1" 400 52 "-" "Go-http-client/1.1" 81.171.74.60 - - [10/Sep/2026:11:09:21 +1000] "GET /wp-config.php HTTP/1.1" 403 12 "-" "Go-http-client/1.1" 81.171.74.60 - - [10/Sep/2026:11:09:21 +1000] "GET /backup.tar.gz HTTP/1.1" 400 52 "-" "Go-http-client/1.1" 81.171.74.60 - - [10/Sep/2026:11:09:21 +1000] "GET /backup.zip HTTP/1.1" 400 52 "-" "Go-http-client/1.1" 81.171.74.60 - - [10/Sep/2026:11:09:21 +1000] "GET /.svn/wc.db HTTP/1.1" 403 13 "-" "Go-http-client/1.1" 81.171.74.60 - - [10/Sep/2026:11:09:22 +1000] "GET /.ssh/id_ed25519 HTTP/1.1" 403 13 "-" "Go-http-client/1.1" 81.171.74.60 - - [10/Sep/2026:11:09:22 +1000] "GET /.bash_history HTTP/1.1" 403 13 "-" "Go-http-client/1.1" == kurri/kurrimotorinn.com.au-ssl_log == -- top paths -- 8 POST / 8 HEAD / 8 GET /wp-config.php 8 GET /.svn/wc.db 8 GET /storage/logs/laravel.log 8 GET /.ssh/id_ed25519 8 GET /database.sql 8 GET /database_backup.sql 8 GET /config.xml 8 GET /config.php 8 GET /backup.zip 8 GET /backup.tar.gz -- last 10 requests -- 91.148.244.131 - - [10/Sep/2026:11:10:42 +1000] "GET /.npmrc HTTP/1.1" 403 13 "-" "Go-http-client/1.1" 91.148.245.81 - - [10/Sep/2026:11:10:42 +1000] "GET /phpinfo.php HTTP/1.1" 403 12 "-" "Go-http-client/1.1" 91.148.245.81 - - [10/Sep/2026:11:10:42 +1000] "GET /docker-compose.yml HTTP/1.1" 301 292 "-" "Go-http-client/1.1" 81.171.72.93 - - [10/Sep/2026:11:10:42 +1000] "GET /_vti_pvt/service.pwd HTTP/1.1" 400 52 "-" "Go-http-client/1.1" 81.171.72.135 - - [10/Sep/2026:11:10:42 +1000] "GET /database.sql HTTP/1.1" 404 - "-" "Go-http-client/1.1" 81.171.72.93 - - [10/Sep/2026:11:10:42 +1000] "GET /.ssh/id_ed25519 HTTP/1.1" 403 13 "-" "Go-http-client/1.1" 81.171.72.93 - - [10/Sep/2026:11:10:42 +1000] "GET /backup.tar.gz HTTP/1.1" 401 53 "-" "Go-http-client/1.1" 91.148.245.81 - - [10/Sep/2026:11:10:42 +1000] "GET /user_secrets.yml HTTP/1.1" 301 290 "-" "Go-http-client/1.1" 81.171.72.93 - - [10/Sep/2026:11:10:42 +1000] "GET /actuator/zzcanary-4f526bec3c61b75e HTTP/1.1" 200 910 "-" "Go-http-client/1.1" 91.148.245.81 - - [10/Sep/2026:11:10:43 +1000] "GET /server.key HTTP/1.1" 301 284 "-" "Go-http-client/1.1" --- last 30 samples (run-up to this incident) --- 2026-09-10 11:08:59 L1=1.99 run=8 blk=0 avail=7773 (56.4%) swpO=0 conn=3 myRSS=2973 php=6 phpRSS=331 ap=39 tcp=37 topuser=alison 2026-09-10 11:09:03 L1=1.83 run=1 blk=0 avail=7956 (57.7%) swpO=0 conn=1 myRSS=2969 php=4 phpRSS=134 ap=35 tcp=34 topuser=madalice 2026-09-10 11:09:09 L1=1.68 run=3 blk=0 avail=7717 (56.0%) swpO=0 conn=1 myRSS=2971 php=4 phpRSS=134 ap=64 tcp=61 topuser=madalice 2026-09-10 11:09:13 L1=1.63 run=7 blk=0 avail=7671 (55.7%) swpO=0 conn=1 myRSS=2971 php=5 phpRSS=192 ap=65 tcp=67 topuser=madalice 2026-09-10 11:09:19 L1=1.58 run=1 blk=0 avail=7717 (56.0%) swpO=0 conn=1 myRSS=2973 php=4 phpRSS=134 ap=64 tcp=51 topuser=madalice 2026-09-10 11:09:23 L1=1.45 run=1 blk=0 avail=7744 (56.2%) swpO=0 conn=1 myRSS=2973 php=4 phpRSS=134 ap=61 tcp=47 topuser=madalice 2026-09-10 11:09:30 L1=1.33 run=3 blk=0 avail=7718 (56.0%) swpO=0 conn=1 myRSS=2973 php=6 phpRSS=247 ap=54 tcp=45 topuser=madalice 2026-09-10 11:09:33 L1=1.31 run=1 blk=0 avail=7798 (56.6%) swpO=0 conn=1 myRSS=2973 php=4 phpRSS=134 ap=51 tcp=44 topuser=madalice 2026-09-10 11:09:40 L1=1.52 run=1 blk=0 avail=7831 (56.8%) swpO=0 conn=1 myRSS=2968 php=4 phpRSS=157 ap=45 tcp=45 topuser=madalice 2026-09-10 11:09:43 L1=1.48 run=5 blk=0 avail=7816 (56.7%) swpO=0 conn=2 myRSS=2968 php=6 phpRSS=264 ap=42 tcp=46 topuser=madalice 2026-09-10 11:09:50 L1=1.36 run=1 blk=0 avail=7854 (57.0%) swpO=0 conn=1 myRSS=2968 php=4 phpRSS=157 ap=41 tcp=40 topuser=madalice 2026-09-10 11:09:53 L1=1.25 run=1 blk=0 avail=7886 (57.2%) swpO=0 conn=2 myRSS=2968 php=4 phpRSS=157 ap=39 tcp=33 topuser=madalice 2026-09-10 11:10:00 L1=1.15 run=2 blk=0 avail=7882 (57.2%) swpO=0 conn=1 myRSS=2968 php=4 phpRSS=157 ap=36 tcp=49 topuser=madalice 2026-09-10 11:10:03 L1=1.06 run=5 blk=0 avail=7952 (57.7%) swpO=4 conn=2 myRSS=2968 php=4 phpRSS=58 ap=38 tcp=41 topuser=evolution 2026-09-10 11:10:10 L1=1.22 run=4 blk=0 avail=8025 (58.3%) swpO=4 conn=1 myRSS=2968 php=4 phpRSS=43 ap=37 tcp=33 topuser=evolution 2026-09-10 11:10:13 L1=1.12 run=2 blk=0 avail=7967 (57.8%) swpO=0 conn=2 myRSS=2968 php=4 phpRSS=91 ap=34 tcp=34 topuser=infinium 2026-09-10 11:10:20 L1=1.03 run=1 blk=0 avail=8023 (58.2%) swpO=0 conn=1 myRSS=2968 php=4 phpRSS=59 ap=33 tcp=44 topuser=evolution 2026-09-10 11:10:23 L1=0.95 run=3 blk=0 avail=7875 (57.2%) swpO=3 conn=2 myRSS=2968 php=5 phpRSS=261 ap=31 tcp=44 topuser=madalice 2026-09-10 11:10:30 L1=0.87 run=1 blk=0 avail=7685 (55.8%) swpO=3 conn=1 myRSS=2968 php=5 phpRSS=178 ap=63 tcp=173 topuser=madalice 2026-09-10 11:10:33 L1=0.80 run=6 blk=0 avail=7325 (53.2%) swpO=0 conn=2 myRSS=2968 php=7 phpRSS=308 ap=94 tcp=33 topuser=aaa 2026-09-10 11:10:40 L1=0.73 run=2 blk=0 avail=7492 (54.4%) swpO=0 conn=1 myRSS=2968 php=5 phpRSS=194 ap=87 tcp=63 topuser=madalice 2026-09-10 11:10:44 L1=0.68 run=2 blk=0 avail=7645 (55.5%) swpO=0 conn=1 myRSS=2968 php=4 phpRSS=91 ap=84 tcp=42 topuser=madalice 2026-09-10 11:10:50 L1=0.78 run=4 blk=0 avail=7602 (55.2%) swpO=0 conn=1 myRSS=2968 php=4 phpRSS=187 ap=77 tcp=39 topuser=madalice 2026-09-10 11:10:54 L1=0.80 run=5 blk=0 avail=7610 (55.2%) swpO=0 conn=1 myRSS=2968 php=6 phpRSS=239 ap=74 tcp=43 topuser=madalice 2026-09-10 11:11:00 L1=0.90 run=5 blk=0 avail=7700 (55.9%) swpO=0 conn=1 myRSS=2968 php=9 phpRSS=259 ap=67 tcp=43 topuser=evolution 2026-09-10 11:11:04 L1=1.06 run=2 blk=0 avail=7794 (56.6%) swpO=0 conn=1 myRSS=2968 php=5 phpRSS=111 ap=64 tcp=37 topuser=madalice 2026-09-10 11:11:10 L1=0.98 run=3 blk=0 avail=7603 (55.2%) swpO=0 conn=4 myRSS=2968 php=7 phpRSS=401 ap=57 tcp=54 topuser=corpkicks 2026-09-10 11:11:14 L1=0.90 run=5 blk=0 avail=7850 (57.0%) swpO=0 conn=1 myRSS=2968 php=4 phpRSS=71 ap=54 tcp=47 topuser=madalice 2026-09-10 11:11:20 L1=1.31 run=8 blk=0 avail=6842 (49.7%) swpO=0 conn=4 myRSS=2968 php=12 phpRSS=1161 ap=67 tcp=93 topuser=madalice 2026-09-10 11:11:24 L1=2.33 run=9 blk=0 avail=6008 (43.6%) swpO=987 conn=3 myRSS=2941 php=13 phpRSS=1838 ap=114 tcp=110 topuser=madalice