INCIDENT 2026-08-12 20:28:08 trigger: php_rss=1808MB mysql_conn=17 ================================================================== load: 3.47 1.27 0.93 19/677 183378 ncpu:10 mem_avail: 5368MB/11729MB (45.8%) swap_used:1801MB swapout:0/s blocked(D):0 running:25 iowait:0.1% steal:0.0% php: 18 procs / 1808MB heaviest user: madalice (18 procs, 1808MB) apache: 77 procs tcp_estab: 111 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2387 madalice 18 2004 nobody 76 1242 root 242 811 netdata 8 267 cpanellogin 1 55 dovenull 6 34 mailman 20 30 evolution 11 24 wp-toolkit 6 19 dovecot 3 13 corpkicks 1 12 zabbix 1 11 kurri 1 10 named 1 6 nscd 1 4 dbus 1 3 cpanelconnecttrack 1 3 polkitd 1 2 mailnull 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 18 2032 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5489 MB Active(file): 3924 MB Inactive(file): 639 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 414 MB CommitLimit: 9960 MB Committed_AS: 10748 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3432421 root 19:16:53 3596 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2125801 1 mysql 2445140 15.2 Ssl 1-23:55:03 /usr/sbin/mariadbd 183326 183112 madalice 225000 52.5 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 213796 2.5 Ssl 44-10:18:10 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3478969 3472245 root 188316 0.0 S 17:53:16 spamd child 183330 183275 madalice 181760 55.0 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 183329 181727 madalice 181604 53.6 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 183331 183273 madalice 162572 50.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 183327 182553 madalice 159720 49.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 183341 183300 madalice 144568 63.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3979356 3472245 root 141048 0.0 S 07:17:06 spamd child 183328 183231 madalice 127856 34.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3472245 1 root 122996 0.0 Ss 18:05:26 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 183335 183305 madalice 117148 49.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 183342 183274 madalice 116696 44.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 183339 182387 madalice 115772 47.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 183334 183293 madalice 115516 50.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 183337 183140 madalice 111044 45.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 183338 183294 madalice 106404 40.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 183340 183143 madalice 99704 33.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 183333 183124 madalice 87448 25.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 159820 1 root 79172 0.0 Ss 23-10:41:18 /usr/lib/systemd/systemd-journald 183345 183336 madalice 73200 15.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 183356 183350 madalice 72488 29.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 183354 183349 madalice 71532 31.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 167479 1353308 cpanellogin 57276 0.0 S 25:35 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 2223 1201 root 42740 0.0 Sl 44-10:18:09 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 183415 183272 madalice 42408 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1469 1 root 41928 0.1 Ss 44-10:18:09 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 41656 0.0 Ss 21-17:46:40 cpsrvd (SSL) - waiting for connections 183414 180155 madalice 35016 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4922 2431 netdata 32088 0.1 Sl 44-10:18:05 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3471498 1 root 24520 0.0 Ss 18:05:57 lfd - sleeping 1463 1 root 23288 0.0 Ss 44-10:18:09 tailwatchd 180155 1276780 nobody 22284 0.0 S 05:57 /usr/sbin/httpd -k start 181727 1276780 nobody 21892 0.0 S 03:02 /usr/sbin/httpd -k start 1481367 2431 netdata 21616 2.2 Sl 21-11:42:54 /usr/libexec/netdata/plugins.d/apps.plugin 1 181924 1276780 nobody 20956 0.0 S 02:54 /usr/sbin/httpd -k start 181937 1276780 nobody 20560 0.0 S 02:53 /usr/sbin/httpd -k start 182780 1276780 nobody 19404 0.0 S 01:06 /usr/sbin/httpd -k start 181935 1276780 nobody 19360 0.0 S 02:53 /usr/sbin/httpd -k start 182388 1276780 nobody 19276 0.0 S 01:59 /usr/sbin/httpd -k start 182553 1276780 nobody 19260 0.0 S 01:33 /usr/sbin/httpd -k start 182387 1276780 nobody 19132 0.0 S 01:59 /usr/sbin/httpd -k start 183126 1276780 nobody 19044 0.1 S 00:16 /usr/sbin/httpd -k start 182754 1276780 nobody 18996 0.0 S 01:09 /usr/sbin/httpd -k start 183128 1276780 nobody 18996 0.1 S 00:16 /usr/sbin/httpd -k start 183118 1276780 nobody 18912 0.1 S 00:17 /usr/sbin/httpd -k start 183122 1276780 nobody 18892 0.1 S 00:16 /usr/sbin/httpd -k start 183124 1276780 nobody 18880 0.1 S 00:16 /usr/sbin/httpd -k start 183125 1276780 nobody 18776 0.1 S 00:16 /usr/sbin/httpd -k start 183138 1276780 nobody 18756 0.2 S 00:15 /usr/sbin/httpd -k start 183147 1276780 nobody 18728 0.2 S 00:15 /usr/sbin/httpd -k start 183279 1276780 nobody 18724 0.2 S 00:08 /usr/sbin/httpd -k start 180838 1276780 nobody 18592 0.0 S 04:43 /usr/sbin/httpd -k start 182563 1276780 nobody 18376 0.0 S 01:32 /usr/sbin/httpd -k start 183153 1276780 nobody 18012 0.0 S 00:15 /usr/sbin/httpd -k start 183119 1276780 nobody 18004 0.0 S 00:17 /usr/sbin/httpd -k start 183149 1276780 nobody 17984 0.1 S 00:15 /usr/sbin/httpd -k start 182552 1276780 nobody 17960 0.0 S 01:33 /usr/sbin/httpd -k start 183120 1276780 nobody 17936 0.1 S 00:17 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9264855 | root | NULL | Query | 0 | Filling schema table | SELECT VARIABLE_VALUE FROM information_schema.GLOBAL_STATUS WHERE VARIABLE_NAME='Threads_running' | | 9264854 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 124 evolution/my.evolutionerp.com.au-ssl_log 83 otter2/otterfencing.net.au 42 evolution/portal.evolutionerp.com.au-ssl_log 29 infinium/infinium.net.au-ssl_log 5 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 121 35.252.157.190 42 4.232.185.206 41 180.181.236.49 32 206.83.118.145 22 203.54.180.238 7 195.178.110.103 3 147.161.213.78 2 175.36.227.212 2 129.121.76.191 2 118.127.40.55 2 1.141.176.34 1 40.77.167.21 1 198.235.24.204 1 162.240.105.3 1 157.55.39.57 --- top request paths across all vhosts (last 3 min) --- 22 GET /heartbeat.php 20 GET /app/ajax.php 19 POST /functions.php 15 GET /fetch 10 POST /app/ajax.php 10 GET /index.php 6 POST /clienteditsave.php 4 POST /app/ajax/selectFilter.php 4 GET /wp-login.php 4 GET / 3 POST /plugins/csvexporter/plugin.php 3 POST /logsave.php 3 GET /@fs/proc/self/environ 2 POST /wp-cron.php 2 POST /plugins/fencecosting/plugin.php 2 POST /app/ajax/selectFilterSingle.php 2 GET /userlogin.php 2 GET /redirect 2 GET /proxy 2 GET /@fs/root/.aws/credentials --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 15 GET /fetch 3 GET /@fs/proc/self/environ 2 GET /redirect 2 GET /proxy 2 GET /@fs/root/.aws/credentials 2 GET /@fs/home/ec2-user/.aws/credentials 2 GET /@fs/etc/passwd 2 GET / 1 GET /web/.env 1 GET /var/www/html/.env 1 GET /var/www/.env 1 GET /store/custom-labubu-nike-af1-sneakers/ -- last 10 requests -- 35.252.157.190 - - [12/Aug/2026:20:28:06 +1000] "GET /internal/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 35.252.157.190 - - [12/Aug/2026:20:28:06 +1000] "GET /prod/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 35.252.157.190 - - [12/Aug/2026:20:28:06 +1000] "GET /.env.orig HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 35.252.157.190 - - [12/Aug/2026:20:28:06 +1000] "GET /docker/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 35.252.157.190 - - [12/Aug/2026:20:28:06 +1000] "GET /production/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 35.252.157.190 - - [12/Aug/2026:20:28:06 +1000] "GET /frontend/.env.production HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 35.252.157.190 - - [12/Aug/2026:20:28:06 +1000] "GET /config.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 35.252.157.190 - - [12/Aug/2026:20:28:07 +1000] "GET /services/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 35.252.157.190 - - [12/Aug/2026:20:28:07 +1000] "GET /config/.env.local HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 35.252.157.190 - - [12/Aug/2026:20:28:07 +1000] "GET /application.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 20 GET /app/ajax.php 19 POST /functions.php 10 POST /app/ajax.php 10 GET /index.php 6 POST /clienteditsave.php 4 POST /app/ajax/selectFilter.php 3 POST /plugins/csvexporter/plugin.php 3 POST /logsave.php 2 POST /plugins/fencecosting/plugin.php 2 POST /app/ajax/selectFilterSingle.php 1 POST /timesheets.php 1 POST /notesave.php -- last 10 requests -- 206.83.118.145 - - [12/Aug/2026:20:27:59 +1000] "GET /index.php?page=jobedit&id=11997 HTTP/1.1" 200 199037 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11997" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 206.83.118.145 - - [12/Aug/2026:20:28:00 +1000] "POST /logsave.php?call=getHistory&id=11997&module=job HTTP/1.1" 200 681 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11997" "Mozilla/5.0 (Windows NT 10.0; Win 206.83.118.145 - - [12/Aug/2026:20:28:01 +1000] "POST /clienteditsave.php?clientid=2474&call=getCategoryDiscounts HTTP/1.1" 200 25 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11997" "Mozilla/5.0 (Windows NT 206.83.118.145 - - [12/Aug/2026:20:28:01 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11997" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 147.161.213.78 - - [12/Aug/2026:20:28:01 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 206.83.118.145 - - [12/Aug/2026:20:28:01 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 2857 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11997" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe 206.83.118.145 - - [12/Aug/2026:20:28:01 +1000] "POST /plugins/fencecosting/plugin.php HTTP/1.1" 200 3913 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11997" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 206.83.118.145 - - [12/Aug/2026:20:28:01 +1000] "GET /app/ajax.php?cn=&furi=true&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=17411751757 HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id 206.83.118.145 - - [12/Aug/2026:20:28:01 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=14665952381 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 206.83.118.145 - - [12/Aug/2026:20:28:01 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=12181335070 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index == otter2/otterfencing.net.au == -- top paths -- 1 GET /www.php 1 GET /wso.php 1 GET /wp-login.php 1 GET /wp-includes/rest-api/ 1 GET /wp-includes/pomo/ 1 GET /wp-includes/js/tinymce/plugins/compat3x/css/ 1 GET /wp-includes/images/smilies/ 1 GET /wp-includes/ID3/ 1 GET /wp-includes/blocks/shortcode/index.php 1 GET /wp-good.php 1 GET /wp-content/x/index.php 1 GET /wp-content/uploads/index.php -- last 10 requests -- 4.232.185.206 - - [12/Aug/2026:20:26:10 +1000] "GET /index/function.php HTTP/1.1" 404 - "-" "-" 4.232.185.206 - - [12/Aug/2026:20:26:11 +1000] "GET /edit.php HTTP/1.1" 404 - "-" "-" 4.232.185.206 - - [12/Aug/2026:20:26:11 +1000] "GET /wp-includes/rest-api/ HTTP/1.1" 404 - "-" "-" 4.232.185.206 - - [12/Aug/2026:20:26:11 +1000] "GET /wp-content/themes/twentytwenty/404.php HTTP/1.1" 404 - "-" "-" 4.232.185.206 - - [12/Aug/2026:20:26:12 +1000] "GET /wp-good.php HTTP/1.1" 404 - "-" "-" 4.232.185.206 - - [12/Aug/2026:20:26:12 +1000] "GET /wp-admin/js/widgets/ HTTP/1.1" 404 - "-" "-" 4.232.185.206 - - [12/Aug/2026:20:26:12 +1000] "GET /wp-admin/css/colors/midnight/ HTTP/1.1" 404 - "-" "-" 4.232.185.206 - - [12/Aug/2026:20:26:13 +1000] "GET /tes.php HTTP/1.1" 404 - "-" "-" 4.232.185.206 - - [12/Aug/2026:20:26:13 +1000] "GET /files/index.php HTTP/1.1" 404 - "-" "-" 4.232.185.206 - - [12/Aug/2026:20:26:14 +1000] "GET /wp-content/uploads/index.php HTTP/1.1" 403 12 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-12 20:25:47 L1=0.77 run=2 blk=0 avail=6915 (59.0%) swpO=0 conn=2 myRSS=2397 php=2 phpRSS=148 ap=23 tcp=24 topuser=infinium 2026-08-12 20:25:48 L1=0.77 run=1 blk=0 avail=6992 (59.6%) swpO=0 conn=2 myRSS=2397 php=1 phpRSS=39 ap=22 tcp=23 topuser=evolution 2026-08-12 20:25:57 L1=0.72 run=1 blk=0 avail=6989 (59.6%) swpO=0 conn=2 myRSS=2397 php=1 phpRSS=39 ap=22 tcp=28 topuser=evolution 2026-08-12 20:25:58 L1=0.72 run=1 blk=0 avail=6988 (59.6%) swpO=0 conn=2 myRSS=2397 php=1 phpRSS=39 ap=22 tcp=27 topuser=evolution 2026-08-12 20:26:07 L1=0.69 run=1 blk=0 avail=7014 (59.8%) swpO=0 conn=2 myRSS=2397 php=1 phpRSS=39 ap=19 tcp=26 topuser=evolution 2026-08-12 20:26:08 L1=0.69 run=2 blk=0 avail=7002 (59.7%) swpO=0 conn=2 myRSS=2397 php=2 phpRSS=84 ap=19 tcp=27 topuser=evolution 2026-08-12 20:26:18 L1=0.81 run=1 blk=0 avail=6986 (59.6%) swpO=0 conn=2 myRSS=2398 php=1 phpRSS=39 ap=22 tcp=27 topuser=evolution 2026-08-12 20:26:18 L1=0.81 run=1 blk=0 avail=6986 (59.6%) swpO=0 conn=2 myRSS=2398 php=1 phpRSS=39 ap=22 tcp=27 topuser=evolution 2026-08-12 20:26:28 L1=0.83 run=2 blk=0 avail=7017 (59.8%) swpO=0 conn=2 myRSS=2398 php=1 phpRSS=39 ap=19 tcp=21 topuser=evolution 2026-08-12 20:26:28 L1=0.77 run=1 blk=0 avail=7024 (59.9%) swpO=0 conn=2 myRSS=2398 php=1 phpRSS=39 ap=18 tcp=21 topuser=evolution 2026-08-12 20:26:38 L1=0.71 run=3 blk=0 avail=6788 (57.9%) swpO=0 conn=2 myRSS=2398 php=4 phpRSS=332 ap=22 tcp=32 topuser=vinesit 2026-08-12 20:26:38 L1=0.65 run=1 blk=0 avail=6924 (59.0%) swpO=0 conn=2 myRSS=2398 php=2 phpRSS=136 ap=22 tcp=29 topuser=vinesit 2026-08-12 20:26:48 L1=0.60 run=1 blk=0 avail=7020 (59.9%) swpO=0 conn=2 myRSS=2398 php=1 phpRSS=39 ap=19 tcp=21 topuser=evolution 2026-08-12 20:26:48 L1=0.55 run=1 blk=0 avail=7041 (60.0%) swpO=0 conn=2 myRSS=2398 php=0 phpRSS=0 ap=18 tcp=23 topuser=- 2026-08-12 20:26:58 L1=0.50 run=1 blk=0 avail=7048 (60.1%) swpO=1 conn=2 myRSS=2398 php=1 phpRSS=39 ap=15 tcp=23 topuser=evolution 2026-08-12 20:26:58 L1=0.46 run=1 blk=0 avail=7058 (60.2%) swpO=1 conn=1 myRSS=2398 php=0 phpRSS=0 ap=15 tcp=24 topuser=- 2026-08-12 20:27:08 L1=0.51 run=2 blk=0 avail=6926 (59.0%) swpO=0 conn=2 myRSS=2398 php=3 phpRSS=205 ap=17 tcp=25 topuser=infinium 2026-08-12 20:27:08 L1=0.55 run=2 blk=0 avail=6824 (58.2%) swpO=0 conn=1 myRSS=2398 php=3 phpRSS=305 ap=17 tcp=27 topuser=infinium 2026-08-12 20:27:18 L1=0.50 run=1 blk=0 avail=7036 (60.0%) swpO=0 conn=2 myRSS=2398 php=1 phpRSS=39 ap=17 tcp=25 topuser=evolution 2026-08-12 20:27:18 L1=0.46 run=2 blk=0 avail=7046 (60.1%) swpO=0 conn=1 myRSS=2398 php=0 phpRSS=0 ap=17 tcp=25 topuser=- 2026-08-12 20:27:28 L1=0.43 run=1 blk=0 avail=7036 (60.0%) swpO=0 conn=2 myRSS=2398 php=1 phpRSS=39 ap=17 tcp=23 topuser=evolution 2026-08-12 20:27:28 L1=0.47 run=2 blk=0 avail=7047 (60.1%) swpO=0 conn=1 myRSS=2398 php=0 phpRSS=0 ap=17 tcp=23 topuser=- 2026-08-12 20:27:38 L1=0.51 run=3 blk=0 avail=7009 (59.8%) swpO=0 conn=2 myRSS=2398 php=2 phpRSS=79 ap=17 tcp=24 topuser=evolution 2026-08-12 20:27:38 L1=0.47 run=1 blk=0 avail=7045 (60.1%) swpO=0 conn=1 myRSS=2398 php=0 phpRSS=0 ap=17 tcp=23 topuser=- 2026-08-12 20:27:48 L1=0.43 run=1 blk=0 avail=7037 (60.0%) swpO=0 conn=2 myRSS=2398 php=1 phpRSS=39 ap=17 tcp=22 topuser=evolution 2026-08-12 20:27:48 L1=0.48 run=1 blk=0 avail=7048 (60.1%) swpO=0 conn=1 myRSS=2398 php=0 phpRSS=0 ap=17 tcp=22 topuser=- 2026-08-12 20:27:58 L1=1.40 run=5 blk=0 avail=6712 (57.2%) swpO=489 conn=2 myRSS=2387 php=5 phpRSS=297 ap=48 tcp=56 topuser=madalice 2026-08-12 20:27:59 L1=1.61 run=5 blk=0 avail=6503 (55.4%) swpO=444 conn=5 myRSS=2387 php=4 phpRSS=454 ap=48 tcp=55 topuser=madalice 2026-08-12 20:28:08 L1=2.12 run=25 blk=0 avail=5368 (45.8%) swpO=0 conn=17 myRSS=2387 php=18 phpRSS=1808 ap=77 tcp=111 topuser=madalice 2026-08-12 20:28:09 L1=3.47 run=27 blk=0 avail=4941 (42.1%) swpO=0 conn=20 myRSS=2387 php=20 phpRSS=2299 ap=77 tcp=117 topuser=madalice