INCIDENT 2026-09-10 13:16:47 trigger: mem_avail=1.7% load=140.49/10cpu blocked=169 swapout=6739/s php_procs=138 php_rss=7472MB mysql_conn=109 ================================================================== load: 238.54 104.64 40.91 146/960 1830483 ncpu:10 mem_avail: 238MB/13777MB (1.7%) swap_used:3909MB swapout:6739/s blocked(D):169 running:210 iowait:6.3% steal:0.0% php: 138 procs / 7472MB heaviest user: alison (103 procs, 6858MB) apache: 158 procs tcp_estab: 143 --- RSS by user (all processes) --- USER PROCS RSS_MB 103 7246 mysql 1 2057 nobody 157 1060 evolution 27 406 root 260 378 netdata 8 157 madalice 1 112 corpkicks 3 110 speedlin 3 90 mailman 20 36 mailnull 6 28 wp-toolkit 3 20 dovenull 6 13 candyfabcom 1 13 zabbix 1 9 dovecot 3 8 kurri 1 4 polkitd 1 2 named 1 2 lowrange 1 2 --- php workers by user --- USER PROCS RSS_MB alison 103 7246 evolution 20 410 madalice 1 112 corpkicks 2 97 speedlin 2 90 root 1 1 coscom 1 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6103 MB Active(file): 100 MB Inactive(file): 105 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 189 MB CommitLimit: 10984 MB Committed_AS: 28350 MB alison 103 7174 mysql 1 2053 nobody 154 1030 root 258 408 evolution 29 229 netdata 8 160 madalice 2 111 corpkicks 3 103 speedlin 2 70 mailman 20 35 mailnull 6 27 wp-toolkit 3 20 zabbix 1 9 dovenull 6 9 candyfabcom 1 7 vinesit 1 6 dovecot 3 5 coscom 1 4 cpanelconnecttrack 1 3 polkitd 1 2 --- php workers by user --- USER PROCS RSS_MB --- backup / dump / scan processes (page-cache evictors) --- alison 103 6995 evolution 18 166 madalice 2 111 corpkicks 2 97 speedlin 2 74 coscom 1 6 root 2 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 PID USER ELAPSED RSS_KB COMMAND Cached: 6356 MB Active(file): 28 MB Inactive(file): 32 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 186 MB CommitLimit: 10984 MB Committed_AS: 28079 MB 3926885 root 9-10:56:45 1880 /usr/bin/imunify-agent-proxy --- backup / dump / scan processes (page-cache evictors) --- --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 2099264 15.6 Ssl 2-08:34:29 /usr/sbin/mariadbd 166870 1 netdata 124820 2.8 Dsl 4-10:57:38 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1821136 167896 madalice 105544 3.6 R 04:54 php-fpm: pool madalice_com_au 1828930 1826937 alison 88668 2.7 D 04:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828503 1828392 alison 72100 2.9 R 04:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828735 1826184 alison 65012 2.2 R 04:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2328754 1 root 64812 0.0 Ds 2-08:34:39 /usr/lib/systemd/systemd-journald 1828458 1828397 alison 64804 3.0 R 04:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829024 1826934 alison 63452 3.2 R 04:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828362 1824448 alison 63244 2.2 D 04:14 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828491 1828400 alison 60976 2.4 R 04:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828420 1828394 alison 59864 3.4 R 04:13 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828934 1826185 alison 59436 1.8 D 04:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828357 1828330 alison 59388 1.7 R 04:14 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828908 1824332 alison 59364 2.0 S 04:07 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828923 1828474 alison 59248 1.8 R 04:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828502 1826188 alison 59168 2.8 R 04:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828935 1828484 alison 58956 1.8 D 04:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828929 1828475 alison 58948 3.9 D 04:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828756 1826938 alison 58892 2.4 R 04:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828590 1828482 alison 58804 2.1 R 04:10 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828932 1817092 alison 58580 3.7 D 04:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828515 1828401 alison 58504 3.2 D 04:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828927 1827701 alison 58504 3.5 R 04:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828755 1826833 alison 58484 3.7 R 04:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828972 1828183 alison 58328 2.5 D 04:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828795 1820859 alison 58216 2.8 R 04:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828649 1822718 alison 57516 1.8 R 04:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828513 1824210 alison 57268 2.1 S 04:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828926 1820728 alison 57236 2.1 D 04:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828922 1826940 alison 57080 3.0 R 04:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828964 1828327 alison 56824 3.9 D 04:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829099 1817845 alison 56680 3.0 S 04:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829431 1829361 alison 56572 2.9 D 04:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829423 1829259 alison 56176 2.6 D 04:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1827514 1824334 alison 56160 3.2 R 04:21 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1827484 1819916 alison 56012 3.1 R 04:21 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828337 1827703 alison 55952 2.9 R 04:14 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828931 1828472 alison 55812 3.0 D 04:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828928 1828485 alison 55492 3.0 R 04:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1827536 1818969 alison 55392 3.7 R 04:21 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828925 1824452 alison 55280 2.0 R 04:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829022 1828970 alison 55232 2.7 D 04:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828933 1828478 alison 55160 1.7 D 04:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828516 1820002 alison 55144 3.0 R 04:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829102 1818986 alison 55116 3.5 D 04:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829120 1828395 alison 54944 3.4 R 04:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829075 1826094 alison 54700 3.3 R 04:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828139 1818982 alison 54344 2.9 D 04:16 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828494 1828393 alison 54304 3.4 R 04:12 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828612 1828466 alison 53960 2.1 R 04:10 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828551 1820869 alison 53804 2.3 R 04:11 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1827666 1818576 alison 53244 2.6 R 04:20 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829520 1823119 alison 53188 3.2 S 04:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1827476 1823120 alison 52960 2.2 R 04:21 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829477 1829359 alison 52852 3.4 D 04:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828936 1828476 alison 52612 3.8 R 04:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829427 1829261 alison 52596 3.6 D 04:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828924 1824447 alison 52372 3.5 R 04:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829424 1829358 alison 52180 2.2 R 04:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- 121 D - [kswapd0] 167382 Ds - /usr/sbin/dovecot -F -c /etc/dovecot/dovecot.conf 167563 Dl - /usr/libexec/netdata/plugins.d/network-viewer.plugin 1 167896 Ds - php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1827484 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828218 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828464 D - /usr/sbin/httpd -k start 1828491 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828513 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828551 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828908 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828924 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828935 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828964 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829090 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829096 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829352 D - /usr/sbin/httpd -k start 1829364 D - /usr/sbin/httpd -k start 1829427 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829430 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829446 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829476 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829480 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829482 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829487 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829519 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829984 D - /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1830378 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1830427 D - /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1830440 D - /opt/cpanel/ea-php83/root/usr/bin/php-cgi --- mariadb processlist (non-sleeping) --- ERROR 2013 (HY000): Lost connection to server at 'handshake: reading initial communication packet', system error: 110 --- lock waits --- ERROR 2002 (HY000): Can't connect to local server through socket '/var/lib/mysql/mysql.sock' (111) --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- PID USER ELAPSED RSS_KB COMMAND 1830656 root 04:25 580 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : 3926885 root 9-11:02:03 4644 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 1828503 1828392 alison 90044 2.4 S 08:45 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 166870 1 netdata 89476 2.8 Ssl 4-11:02:11 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1828491 1828400 alison 66524 2.3 S 08:45 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828930 1826937 alison 65672 1.9 S 08:39 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828206 1823276 alison 65352 2.0 S 08:48 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828420 1828394 alison 62956 2.7 S 08:46 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828458 1828397 alison 60268 2.4 S 08:45 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1827476 1823120 alison 59080 1.4 S 08:54 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828357 1828330 alison 58912 0.9 S 08:47 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828934 1826185 alison 58784 1.9 S 08:39 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829022 1828970 alison 58564 2.3 S 08:39 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829477 1829359 alison 58348 2.3 S 08:34 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828551 1820869 alison 58244 2.1 S 08:44 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828928 1828485 alison 58140 2.2 S 08:39 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828613 1826627 corpkicks 57400 2.8 S 08:43 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1829075 1826094 alison 56756 2.4 S 08:38 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828927 1827701 alison 56176 2.4 S 08:39 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828926 1820728 alison 56000 1.7 S 08:39 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829417 1829256 alison 55316 2.5 S 08:34 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828099 1828058 alison 54760 2.0 S 08:49 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829520 1823119 alison 54684 2.4 S 08:33 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828932 1817092 alison 54548 2.7 S 08:39 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829446 1829354 alison 54184 2.7 S 08:34 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1827485 1818968 alison 54024 1.6 D 08:54 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828923 1828474 alison 54008 1.6 S 08:39 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828790 1820394 corpkicks 53528 2.8 S 08:41 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1829070 1818577 alison 53492 2.6 S 08:38 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829423 1829259 alison 53356 2.0 S 08:34 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828337 1827703 alison 53316 2.5 D 08:47 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829096 1826835 alison 52768 2.5 S 08:38 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828139 1818982 alison 52696 2.3 S 08:49 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828931 1828472 alison 52684 2.4 S 08:39 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828190 1826186 alison 52076 1.8 D 08:48 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829427 1829261 alison 51872 2.7 S 08:34 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829419 1823275 alison 51680 2.5 S 08:34 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828075 1820868 alison 51584 2.1 S 08:49 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829470 1820003 alison 51084 2.7 D 08:34 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828218 1828182 alison 50880 2.8 S 08:48 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1827514 1824334 alison 50848 2.4 S 08:54 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829482 1829360 alison 50512 2.6 S 08:34 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828755 1826833 alison 50356 2.6 S 08:41 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829487 1828465 alison 50296 3.1 S 08:34 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829128 1827596 alison 50148 2.4 D 08:37 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829433 1822221 alison 49880 2.9 S 08:34 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828922 1826940 alison 49656 2.4 S 08:39 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829106 1819499 alison 49368 2.7 S 08:38 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828924 1824447 alison 49248 2.6 S 08:39 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829517 1829357 alison 48620 2.9 S 08:33 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1821136 167896 madalice 48388 2.7 D 09:27 php-fpm: pool madalice_com_au 1827500 1826192 alison 48052 1.0 S 08:54 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1827510 1826932 alison 48028 2.1 S 08:54 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1830810 1820870 speedlin 47052 1.5 D 00:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1827512 1824451 alison 46560 1.5 D 08:54 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829399 1819013 alison 46176 2.9 S 08:34 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829218 1819011 alison 45692 2.7 S 08:36 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829480 1829363 alison 45204 2.8 S 08:34 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828935 1828484 alison 45108 2.0 S 08:39 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1827536 1818969 alison 44300 2.9 D 08:54 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828079 1820870 speedlin 43684 2.7 S 08:49 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828371 1828329 alison 42908 2.3 S 08:46 /opt/cpanel/ea-php82/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- 127867 D - cPhulkd - dbprocessor 167566 Dl - /usr/libexec/netdata/plugins.d/apps.plugin 1 509236 Dl - /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 Ds - /usr/local/cpanel/cpsrvd --llu=1788986914 --listen=10,11,12,18,3,4,5,6,7,8,9 --accepted=14 --systemd 1821136 D - php-fpm: pool madalice_com_au 1827512 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1827536 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1827666 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1827762 D - sw-engine-fpm: pool wordpress-toolkit 1827888 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828190 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1828337 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1829896 D - lfd - (child) checking load... 1829971 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1830471 D - dovecot/imap 1830644 D - /usr/local/cpanel/libexec/cphulkd 1830666 D - /usr/local/cpanel/libexec/cphulkd 1830668 D - /usr/sbin/httpd -k start 1830678 D - cPhulkd - processor 1830680 D - /usr/local/cpanel/libexec/cphulkd 1830709 D - /usr/sbin/httpd -k start 1830710 D - /usr/sbin/httpd -k start 1830713 D - /usr/sbin/httpd -k start 1830715 D - /usr/sbin/httpd -k start 1830716 D - /usr/sbin/httpd -k start 1830717 D - /usr/sbin/httpd -k start 1830718 D - /usr/sbin/httpd -k start 1830723 D - /usr/sbin/httpd -k start 1830731 D - /usr/sbin/httpd -k start 1830732 D - /usr/sbin/httpd -k start --- mariadb processlist (non-sleeping) --- ERROR 2002 (HY000): Can't connect to local server through socket '/var/lib/mysql/mysql.sock' (111) --- lock waits --- ERROR 2002 (HY000): Can't connect to local server through socket '/var/lib/mysql/mysql.sock' (111) --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min olympic/olympicfencing.com.au 20 evolution/my.evolutionerp.com.au-ssl_log 2 (total vhosts taking traffic: 2) --- top client IPs across all vhosts (last 3 min) --- 17 203.54.180.238 17 185.190.143.21 4 147.161.213.71 1 207.46.13.87 1 103.104.165.99 1 101.166.96.210 --- top request paths across all vhosts (last 3 min) --- 10 POST /functions.php 8 GET /index.php 3 GET /logoff.php 3 GET / 1 GET /wp-includes/widgets/ 1 GET /wp-includes/sitemaps/providers/ 1 GET /wp-includes/PHPMailer/ 1 GET /wp-includes/js/plupload/ 1 GET /wp-includes/js/codemirror/ 1 GET /wp-includes/js/ 1 GET /wp-includes/IXR/ 1 GET /wp-includes/images/ 1 GET /wp-content/uploads/ 1 GET /wp-content/upgrade/ 1 GET /wp-content/themes/ 1 GET /wp-content/plugins/ 1 GET /wp-content/languages/ 1 GET /wp-content/IXR/ 1 GET /wp-content/ 1 GET /.well-known/ --- busiest 3 vhosts: top paths + last 10 requests --- == olympic/olympicfencing.com.au == -- top paths -- 3 GET / 1 GET /wp-includes/widgets/ 1 GET /wp-includes/sitemaps/providers/ 1 GET /wp-includes/PHPMailer/ 1 GET /wp-includes/js/plupload/ 1 GET /wp-includes/js/codemirror/ 1 GET /wp-includes/js/ 1 GET /wp-includes/IXR/ 1 GET /wp-includes/images/ 1 GET /wp-content/uploads/ 1 GET /wp-content/upgrade/ 1 GET /wp-content/themes/ -- last 10 requests -- 185.190.143.21 - - [10/Sep/2026:13:24:24 +1000] "GET /wp-includes/widgets/ HTTP/1.1" 301 298 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185.190.143.21 - - [10/Sep/2026:13:24:24 +1000] "GET /wp-content/ HTTP/1.1" 301 289 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185.190.143.21 - - [10/Sep/2026:13:24:24 +1000] "GET /wp-content/languages/ HTTP/1.1" 301 299 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185.190.143.21 - - [10/Sep/2026:13:24:24 +1000] "GET /wp-content/IXR/ HTTP/1.1" 301 293 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185.190.143.21 - - [10/Sep/2026:13:24:24 +1000] "GET /wp-content/uploads/ HTTP/1.1" 301 297 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185.190.143.21 - - [10/Sep/2026:13:24:25 +1000] "GET /wp-content/upgrade/ HTTP/1.1" 301 297 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185.190.143.21 - - [10/Sep/2026:13:24:25 +1000] "GET /wp-content/plugins/ HTTP/1.1" 301 297 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185.190.143.21 - - [10/Sep/2026:13:24:25 +1000] "GET /wp-content/themes/ HTTP/1.1" 301 296 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185.190.143.21 - - [10/Sep/2026:13:24:25 +1000] "GET /.well-known/ HTTP/1.1" 301 290 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185.190.143.21 - - [10/Sep/2026:13:24:25 +1000] "GET /uploads/ HTTP/1.1" 301 286 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 10 POST /functions.php 8 GET /index.php 3 GET /logoff.php -- last 10 requests -- 147.161.213.71 - - [10/Sep/2026:13:24:28 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=report&file=testTagRetest3" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 203.54.180.238 - - [10/Sep/2026:13:24:28 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 500 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29498&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 203.54.180.238 - - [10/Sep/2026:13:24:28 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 500 20 "https://my.evolutionerp.com.au/index.php?page=purchasereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 203.54.180.238 - - [10/Sep/2026:13:24:28 +1000] "GET /index.php?page=invedithist&id=4297&string= HTTP/1.1" 500 5143 "https://my.evolutionerp.com.au/index.php?page=invedithist&id=4297&string=" "Mozilla/5.0 (Windows NT 10. 207.46.13.87 - - [10/Sep/2026:13:24:28 +1000] "GET /index.php?page=activities&keyword=%EA%B8%89%EC%A0%84%EC%8B%A0%EC%B2%AD HTTP/1.1" 500 5164 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2. 203.54.180.238 - - [10/Sep/2026:13:24:25 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 500 20 "https://my.evolutionerp.com.au/index.php?page=reqedit&id=10023" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 203.54.180.238 - - [10/Sep/2026:13:24:26 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 500 20 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79303§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win64 203.54.180.238 - - [10/Sep/2026:13:24:29 +1000] "GET /index.php?page=jobregister HTTP/1.1" 500 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" 147.161.213.71 - - [10/Sep/2026:13:24:29 +1000] "GET /logoff.php?page=report&file=testTagRetest3 HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=report&file=testTagRetest3" "Mozilla/5.0 (Windows NT 10.0; 203.54.180.238 - - [10/Sep/2026:13:24:29 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 500 20 "https://my.evolutionerp.com.au/index.php?page=activities&date=10-09-2026&company=29617" "Mozilla/5.0 (Windows NT 10.0; --- last 30 samples (run-up to this incident) --- 2026-09-10 13:13:45 L1=2.43 run=3 blk=0 avail=7611 (55.2%) swpO=0 conn=3 myRSS=3005 php=7 phpRSS=536 ap=37 tcp=41 topuser=madalice 2026-09-10 13:13:45 L1=2.43 run=7 blk=0 avail=7703 (55.9%) swpO=0 conn=4 myRSS=3005 php=6 phpRSS=319 ap=37 tcp=40 topuser=madalice 2026-09-10 13:13:55 L1=2.51 run=1 blk=0 avail=7797 (56.6%) swpO=0 conn=3 myRSS=3005 php=5 phpRSS=197 ap=46 tcp=47 topuser=madalice 2026-09-10 13:13:55 L1=2.51 run=3 blk=0 avail=7801 (56.6%) swpO=0 conn=4 myRSS=3005 php=6 phpRSS=233 ap=46 tcp=47 topuser=madalice 2026-09-10 13:14:05 L1=2.28 run=3 blk=1 avail=7912 (57.4%) swpO=0 conn=3 myRSS=3005 php=5 phpRSS=197 ap=36 tcp=33 topuser=madalice 2026-09-10 13:14:05 L1=2.28 run=2 blk=0 avail=7911 (57.4%) swpO=0 conn=4 myRSS=3005 php=5 phpRSS=197 ap=36 tcp=33 topuser=madalice 2026-09-10 13:14:15 L1=2.15 run=4 blk=0 avail=7868 (57.1%) swpO=0 conn=3 myRSS=3005 php=8 phpRSS=368 ap=29 tcp=32 topuser=madalice 2026-09-10 13:14:15 L1=2.15 run=8 blk=0 avail=7875 (57.2%) swpO=0 conn=4 myRSS=3005 php=8 phpRSS=375 ap=29 tcp=32 topuser=madalice 2026-09-10 13:14:25 L1=2.05 run=6 blk=0 avail=7650 (55.5%) swpO=0 conn=3 myRSS=3005 php=9 phpRSS=500 ap=35 tcp=36 topuser=madalice 2026-09-10 13:14:25 L1=2.05 run=6 blk=0 avail=7714 (56.0%) swpO=0 conn=4 myRSS=3005 php=8 phpRSS=481 ap=35 tcp=35 topuser=madalice 2026-09-10 13:14:35 L1=2.11 run=4 blk=0 avail=7717 (56.0%) swpO=0 conn=3 myRSS=3005 php=8 phpRSS=481 ap=34 tcp=37 topuser=madalice 2026-09-10 13:14:35 L1=2.11 run=6 blk=0 avail=7709 (56.0%) swpO=0 conn=4 myRSS=3005 php=8 phpRSS=487 ap=34 tcp=37 topuser=madalice 2026-09-10 13:14:45 L1=2.10 run=7 blk=0 avail=7675 (55.7%) swpO=0 conn=3 myRSS=3005 php=9 phpRSS=523 ap=38 tcp=43 topuser=madalice 2026-09-10 13:14:45 L1=2.10 run=7 blk=0 avail=7673 (55.7%) swpO=0 conn=4 myRSS=3005 php=9 phpRSS=535 ap=38 tcp=43 topuser=madalice 2026-09-10 13:14:55 L1=2.72 run=3 blk=0 avail=7590 (55.1%) swpO=1 conn=5 myRSS=3005 php=8 phpRSS=540 ap=44 tcp=47 topuser=madalice 2026-09-10 13:14:55 L1=2.72 run=3 blk=0 avail=7584 (55.1%) swpO=1 conn=4 myRSS=3005 php=8 phpRSS=546 ap=44 tcp=46 topuser=madalice 2026-09-10 13:15:06 L1=2.99 run=11 blk=1 avail=7293 (52.9%) swpO=0 conn=5 myRSS=3005 php=20 phpRSS=1150 ap=45 tcp=120 topuser=alison 2026-09-10 13:15:06 L1=2.99 run=16 blk=0 avail=7280 (52.8%) swpO=0 conn=4 myRSS=3005 php=22 phpRSS=1133 ap=45 tcp=120 topuser=alison 2026-09-10 13:15:16 L1=6.53 run=24 blk=0 avail=5976 (43.4%) swpO=1197 conn=24 myRSS=2975 php=24 phpRSS=2336 ap=72 tcp=53 topuser=alison 2026-09-10 13:15:16 L1=6.53 run=30 blk=0 avail=6025 (43.7%) swpO=1197 conn=20 myRSS=2975 php=24 phpRSS=2438 ap=72 tcp=53 topuser=alison 2026-09-10 13:15:26 L1=7.74 run=55 blk=0 avail=3862 (28.0%) swpO=4467 conn=56 myRSS=2960 php=59 phpRSS=5696 ap=80 tcp=111 topuser=alison 2026-09-10 13:15:29 L1=12.01 run=61 blk=0 avail=3617 (26.3%) swpO=4633 conn=46 myRSS=2937 php=54 phpRSS=5670 ap=90 tcp=71 topuser=alison 2026-09-10 13:15:37 L1=15.53 run=73 blk=0 avail=4862 (35.3%) swpO=1414 conn=42 myRSS=2939 php=68 phpRSS=4679 ap=100 tcp=93 topuser=alison 2026-09-10 13:15:40 L1=20.05 run=84 blk=0 avail=3419 (24.8%) swpO=0 conn=65 myRSS=2940 php=75 phpRSS=6345 ap=100 tcp=89 topuser=alison 2026-09-10 13:15:47 L1=32.50 run=99 blk=1 avail=1764 (12.8%) swpO=11203 conn=74 myRSS=2829 php=89 phpRSS=8511 ap=130 tcp=49 topuser=alison 2026-09-10 13:15:50 L1=32.50 run=111 blk=1 avail=1493 (10.8%) swpO=11499 conn=74 myRSS=2828 php=99 phpRSS=8765 ap=130 tcp=77 topuser=alison 2026-09-10 13:15:59 L1=47.05 run=83 blk=34 avail=514 (3.7%) swpO=17148 conn=110 myRSS=2574 php=118 phpRSS=10968 ap=161 tcp=36 topuser=alison 2026-09-10 13:16:01 L1=47.05 run=15 blk=86 avail=447 (3.2%) swpO=29403 conn=109 myRSS=2390 php=122 phpRSS=10545 ap=156 tcp=36 topuser=alison 2026-09-10 13:16:29 L1=99.78 run=124 blk=6 avail=132 (1.0%) swpO=14224 conn=110 myRSS=2062 php=138 phpRSS=7474 ap=158 tcp=143 topuser=alison 2026-09-10 13:16:47 L1=140.49 run=210 blk=169 avail=238 (1.7%) swpO=6739 conn=109 myRSS=2062 php=138 phpRSS=7472 ap=158 tcp=143 topuser=alison VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 21 olympic/olympicfencing.com.au 20 madalice/madalice.com.au-ssl_log 5 (total vhosts taking traffic: 3) --- top client IPs across all vhosts (last 3 min) --- 19 203.54.180.238 17 185.190.143.21 5 147.161.213.71 4 34.165.225.103 1 207.46.13.87 1 114.119.143.14 1 103.104.165.99 1 103.104.164.114 1 101.166.96.210 --- top request paths across all vhosts (last 3 min) --- 13 POST /functions.php 9 GET /index.php 3 GET /logoff.php 3 GET / 1 GET /wp-includes/widgets/ 1 GET /wp-includes/sitemaps/providers/ 1 GET /wp-includes/PHPMailer/ 1 GET /wp-includes/js/plupload/ 1 GET /wp-includes/js/codemirror/ 1 GET /wp-includes/js/ 1 GET /wp-includes/IXR/ 1 GET /wp-includes/images/ 1 GET /wp-content/uploads/ 1 GET /wp-content/upgrade/ 1 GET /wp-content/themes/ 1 GET /wp-content/plugins/ 1 GET /wp-content/languages/ 1 GET /wp-content/IXR/ 1 GET /wp-content/ 1 GET /.well-known/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 13 POST /functions.php 9 GET /index.php 3 GET /logoff.php -- last 10 requests -- 207.46.13.87 - - [10/Sep/2026:13:24:28 +1000] "GET /index.php?page=activities&keyword=%EA%B8%89%EC%A0%84%EC%8B%A0%EC%B2%AD HTTP/1.1" 500 5164 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2. 203.54.180.238 - - [10/Sep/2026:13:24:25 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 500 20 "https://my.evolutionerp.com.au/index.php?page=reqedit&id=10023" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 203.54.180.238 - - [10/Sep/2026:13:24:26 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 500 20 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79303§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win64 203.54.180.238 - - [10/Sep/2026:13:24:29 +1000] "GET /index.php?page=jobregister HTTP/1.1" 500 20 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" 147.161.213.71 - - [10/Sep/2026:13:24:29 +1000] "GET /logoff.php?page=report&file=testTagRetest3 HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=report&file=testTagRetest3" "Mozilla/5.0 (Windows NT 10.0; 203.54.180.238 - - [10/Sep/2026:13:24:29 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 500 20 "https://my.evolutionerp.com.au/index.php?page=activities&date=10-09-2026&company=29617" "Mozilla/5.0 (Windows NT 10.0; 203.54.180.238 - - [10/Sep/2026:13:24:29 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 500 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29479&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; x 147.161.213.71 - - [10/Sep/2026:13:24:30 +1000] "GET /index.php?page=report&file=testTagRetest3 HTTP/1.1" 500 5140 "https://my.evolutionerp.com.au/index.php?page=report&file=testTagRetest3" "Mozilla/5.0 (Windows NT 10.0; 103.104.164.114 - - [10/Sep/2026:13:24:26 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 500 20 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 203.54.180.238 - - [10/Sep/2026:13:24:30 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 52 "https://my.evolutionerp.com.au/index.php?page=invedithist&id=4297&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) == olympic/olympicfencing.com.au == -- top paths -- 3 GET / 1 GET /wp-includes/widgets/ 1 GET /wp-includes/sitemaps/providers/ 1 GET /wp-includes/PHPMailer/ 1 GET /wp-includes/js/plupload/ 1 GET /wp-includes/js/codemirror/ 1 GET /wp-includes/js/ 1 GET /wp-includes/IXR/ 1 GET /wp-includes/images/ 1 GET /wp-content/uploads/ 1 GET /wp-content/upgrade/ 1 GET /wp-content/themes/ -- last 10 requests -- 185.190.143.21 - - [10/Sep/2026:13:24:24 +1000] "GET /wp-includes/widgets/ HTTP/1.1" 301 298 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185.190.143.21 - - [10/Sep/2026:13:24:24 +1000] "GET /wp-content/ HTTP/1.1" 301 289 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185.190.143.21 - - [10/Sep/2026:13:24:24 +1000] "GET /wp-content/languages/ HTTP/1.1" 301 299 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185.190.143.21 - - [10/Sep/2026:13:24:24 +1000] "GET /wp-content/IXR/ HTTP/1.1" 301 293 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185.190.143.21 - - [10/Sep/2026:13:24:24 +1000] "GET /wp-content/uploads/ HTTP/1.1" 301 297 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185.190.143.21 - - [10/Sep/2026:13:24:25 +1000] "GET /wp-content/upgrade/ HTTP/1.1" 301 297 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185.190.143.21 - - [10/Sep/2026:13:24:25 +1000] "GET /wp-content/plugins/ HTTP/1.1" 301 297 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185.190.143.21 - - [10/Sep/2026:13:24:25 +1000] "GET /wp-content/themes/ HTTP/1.1" 301 296 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185.190.143.21 - - [10/Sep/2026:13:24:25 +1000] "GET /.well-known/ HTTP/1.1" 301 290 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 185.190.143.21 - - [10/Sep/2026:13:24:25 +1000] "GET /uploads/ HTTP/1.1" 301 286 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 1 GET /store/create-your-own-nike-af1-colourway 1 GET /phpinfo.php 1 GET /.env.test 1 GET /.env.remote 1 GET /.env.bak -- last 10 requests -- 34.165.225.103 - - [10/Sep/2026:13:24:26 +1000] "GET /.env.remote HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.225.103 - - [10/Sep/2026:13:24:26 +1000] "GET /.env.bak HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.225.103 - - [10/Sep/2026:13:24:26 +1000] "GET /.env.test HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 114.119.143.14 - - [10/Sep/2026:13:24:26 +1000] "GET /store/create-your-own-nike-af1-colourway HTTP/1.1" 500 833 "https://madalice.com.au/store/air-force-1-custom-butterfly-swarovski-diamond-sneakers?verified=1&rating=3& 34.165.225.103 - - [10/Sep/2026:13:24:27 +1000] "GET /phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-10 13:13:45 L1=2.43 run=3 blk=0 avail=7611 (55.2%) swpO=0 conn=3 myRSS=3005 php=7 phpRSS=536 ap=37 tcp=41 topuser=madalice 2026-09-10 13:13:45 L1=2.43 run=7 blk=0 avail=7703 (55.9%) swpO=0 conn=4 myRSS=3005 php=6 phpRSS=319 ap=37 tcp=40 topuser=madalice 2026-09-10 13:13:55 L1=2.51 run=1 blk=0 avail=7797 (56.6%) swpO=0 conn=3 myRSS=3005 php=5 phpRSS=197 ap=46 tcp=47 topuser=madalice 2026-09-10 13:13:55 L1=2.51 run=3 blk=0 avail=7801 (56.6%) swpO=0 conn=4 myRSS=3005 php=6 phpRSS=233 ap=46 tcp=47 topuser=madalice 2026-09-10 13:14:05 L1=2.28 run=3 blk=1 avail=7912 (57.4%) swpO=0 conn=3 myRSS=3005 php=5 phpRSS=197 ap=36 tcp=33 topuser=madalice 2026-09-10 13:14:05 L1=2.28 run=2 blk=0 avail=7911 (57.4%) swpO=0 conn=4 myRSS=3005 php=5 phpRSS=197 ap=36 tcp=33 topuser=madalice 2026-09-10 13:14:15 L1=2.15 run=4 blk=0 avail=7868 (57.1%) swpO=0 conn=3 myRSS=3005 php=8 phpRSS=368 ap=29 tcp=32 topuser=madalice 2026-09-10 13:14:15 L1=2.15 run=8 blk=0 avail=7875 (57.2%) swpO=0 conn=4 myRSS=3005 php=8 phpRSS=375 ap=29 tcp=32 topuser=madalice 2026-09-10 13:14:25 L1=2.05 run=6 blk=0 avail=7650 (55.5%) swpO=0 conn=3 myRSS=3005 php=9 phpRSS=500 ap=35 tcp=36 topuser=madalice 2026-09-10 13:14:25 L1=2.05 run=6 blk=0 avail=7714 (56.0%) swpO=0 conn=4 myRSS=3005 php=8 phpRSS=481 ap=35 tcp=35 topuser=madalice 2026-09-10 13:14:35 L1=2.11 run=4 blk=0 avail=7717 (56.0%) swpO=0 conn=3 myRSS=3005 php=8 phpRSS=481 ap=34 tcp=37 topuser=madalice 2026-09-10 13:14:35 L1=2.11 run=6 blk=0 avail=7709 (56.0%) swpO=0 conn=4 myRSS=3005 php=8 phpRSS=487 ap=34 tcp=37 topuser=madalice 2026-09-10 13:14:45 L1=2.10 run=7 blk=0 avail=7675 (55.7%) swpO=0 conn=3 myRSS=3005 php=9 phpRSS=523 ap=38 tcp=43 topuser=madalice 2026-09-10 13:14:45 L1=2.10 run=7 blk=0 avail=7673 (55.7%) swpO=0 conn=4 myRSS=3005 php=9 phpRSS=535 ap=38 tcp=43 topuser=madalice 2026-09-10 13:14:55 L1=2.72 run=3 blk=0 avail=7590 (55.1%) swpO=1 conn=5 myRSS=3005 php=8 phpRSS=540 ap=44 tcp=47 topuser=madalice 2026-09-10 13:14:55 L1=2.72 run=3 blk=0 avail=7584 (55.1%) swpO=1 conn=4 myRSS=3005 php=8 phpRSS=546 ap=44 tcp=46 topuser=madalice 2026-09-10 13:15:06 L1=2.99 run=11 blk=1 avail=7293 (52.9%) swpO=0 conn=5 myRSS=3005 php=20 phpRSS=1150 ap=45 tcp=120 topuser=alison 2026-09-10 13:15:06 L1=2.99 run=16 blk=0 avail=7280 (52.8%) swpO=0 conn=4 myRSS=3005 php=22 phpRSS=1133 ap=45 tcp=120 topuser=alison 2026-09-10 13:15:16 L1=6.53 run=24 blk=0 avail=5976 (43.4%) swpO=1197 conn=24 myRSS=2975 php=24 phpRSS=2336 ap=72 tcp=53 topuser=alison 2026-09-10 13:15:16 L1=6.53 run=30 blk=0 avail=6025 (43.7%) swpO=1197 conn=20 myRSS=2975 php=24 phpRSS=2438 ap=72 tcp=53 topuser=alison 2026-09-10 13:15:26 L1=7.74 run=55 blk=0 avail=3862 (28.0%) swpO=4467 conn=56 myRSS=2960 php=59 phpRSS=5696 ap=80 tcp=111 topuser=alison 2026-09-10 13:15:29 L1=12.01 run=61 blk=0 avail=3617 (26.3%) swpO=4633 conn=46 myRSS=2937 php=54 phpRSS=5670 ap=90 tcp=71 topuser=alison 2026-09-10 13:15:37 L1=15.53 run=73 blk=0 avail=4862 (35.3%) swpO=1414 conn=42 myRSS=2939 php=68 phpRSS=4679 ap=100 tcp=93 topuser=alison 2026-09-10 13:15:40 L1=20.05 run=84 blk=0 avail=3419 (24.8%) swpO=0 conn=65 myRSS=2940 php=75 phpRSS=6345 ap=100 tcp=89 topuser=alison 2026-09-10 13:15:47 L1=32.50 run=99 blk=1 avail=1764 (12.8%) swpO=11203 conn=74 myRSS=2829 php=89 phpRSS=8511 ap=130 tcp=49 topuser=alison 2026-09-10 13:15:50 L1=32.50 run=111 blk=1 avail=1493 (10.8%) swpO=11499 conn=74 myRSS=2828 php=99 phpRSS=8765 ap=130 tcp=77 topuser=alison 2026-09-10 13:15:59 L1=47.05 run=83 blk=34 avail=514 (3.7%) swpO=17148 conn=110 myRSS=2574 php=118 phpRSS=10968 ap=161 tcp=36 topuser=alison 2026-09-10 13:16:01 L1=47.05 run=15 blk=86 avail=447 (3.2%) swpO=29403 conn=109 myRSS=2390 php=122 phpRSS=10545 ap=156 tcp=36 topuser=alison 2026-09-10 13:16:29 L1=99.78 run=124 blk=6 avail=132 (1.0%) swpO=14224 conn=110 myRSS=2062 php=138 phpRSS=7474 ap=158 tcp=143 topuser=alison 2026-09-10 13:16:47 L1=140.49 run=210 blk=169 avail=238 (1.7%) swpO=6739 conn=109 myRSS=2062 php=138 phpRSS=7472 ap=158 tcp=143 topuser=alison