INCIDENT 2026-08-13 02:39:44 trigger: php_rss=1976MB ================================================================== load: 6.31 2.23 1.30 15/614 392833 ncpu:10 mem_avail: 6444MB/11729MB (54.9%) swap_used:957MB swapout:0/s blocked(D):0 running:17 iowait:0.3% steal:0.0% php: 14 procs / 1976MB heaviest user: evolution (14 procs, 1976MB) apache: 29 procs tcp_estab: 58 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1666 evolution 15 1417 root 245 865 nobody 28 405 netdata 8 273 cpanellogin 1 49 wp-toolkit 6 45 lowrange 3 37 mailman 20 30 dovenull 6 26 aaa 2 25 mailnull 3 17 zabbix 1 15 kurri 1 11 infinium 1 11 dovecot 3 9 named 1 7 nscd 1 3 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB evolution 10 1417 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4770 MB Active(file): 4176 MB Inactive(file): 929 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 505 MB CommitLimit: 9960 MB Committed_AS: 7645 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 342014 root 01:28:28 7368 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 184574 1 mysql 1706156 3.6 Ssl 06:06:13 /usr/sbin/mariadbd 1220 1 netdata 222444 2.5 Ssl 44-16:29:46 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 382990 1 root 174696 0.4 Ss 16:58 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 392790 391989 evolution 174676 49.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 392788 392784 evolution 170196 45.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 388651 382990 root 168840 0.0 S 05:46 spamd child 392785 392284 evolution 168280 45.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 388652 382990 root 167136 0.0 S 05:46 spamd child 392798 392777 evolution 133084 54.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 392793 391999 evolution 131164 28.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 392797 391997 evolution 127956 27.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 159820 1 root 106976 0.0 Ss 23-16:52:54 /usr/lib/systemd/systemd-journald 392794 391994 evolution 104876 48.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 392804 392800 evolution 97660 36.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 380279 1353308 cpanellogin 50468 0.0 S 21:15 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 1353308 1 root 42192 0.0 Ss 21-23:58:16 cpsrvd (SSL) - waiting for connections 2223 1201 root 39856 0.0 Sl 44-16:29:45 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 38032 0.1 Sl 44-16:29:41 /usr/libexec/netdata/plugins.d/go.d.plugin 1 382254 1 root 33092 0.0 Ss 17:32 lfd - sleeping 392268 1198 wp-toolkit 25828 0.1 S 00:17 sw-engine-fpm: pool wordpress-toolkit 391205 1276780 nobody 19004 0.1 S 01:15 /usr/sbin/httpd -k start 391997 1276780 nobody 18300 0.0 S 00:31 /usr/sbin/httpd -k start 391999 1276780 nobody 18076 0.1 S 00:31 /usr/sbin/httpd -k start 391310 1276780 nobody 17796 0.0 S 01:02 /usr/sbin/httpd -k start 185104 2431 netdata 17568 1.9 Sl 06:06:04 /usr/libexec/netdata/plugins.d/apps.plugin 1 1469 1 root 17332 0.1 Ss 44-16:29:45 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 391562 1276780 nobody 17104 0.0 S 01:00 /usr/sbin/httpd -k start 391989 1276780 nobody 16912 0.0 S 00:32 /usr/sbin/httpd -k start 391129 1276780 nobody 16756 0.0 S 01:26 /usr/sbin/httpd -k start 391702 1276780 nobody 16684 0.0 S 00:46 /usr/sbin/httpd -k start 392284 1276780 nobody 16204 0.0 S 00:16 /usr/sbin/httpd -k start 391564 1276780 nobody 15876 0.0 S 01:00 /usr/sbin/httpd -k start 391998 1276780 nobody 15832 0.0 S 00:31 /usr/sbin/httpd -k start 1204 1 zabbix 15788 0.2 Ssl 44-16:29:46 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 391561 1276780 nobody 15756 0.0 S 01:00 /usr/sbin/httpd -k start 391994 1276780 nobody 15700 0.0 S 00:31 /usr/sbin/httpd -k start 391993 1276780 nobody 15672 0.0 S 00:31 /usr/sbin/httpd -k start 391970 1276780 nobody 15612 0.0 S 00:34 /usr/sbin/httpd -k start 391705 1276780 nobody 15608 0.0 S 00:46 /usr/sbin/httpd -k start 392283 1276780 nobody 15448 0.0 S 00:16 /usr/sbin/httpd -k start 392286 1276780 nobody 15424 0.0 S 00:16 /usr/sbin/httpd -k start 392777 1276780 nobody 15252 0.0 S 00:03 /usr/sbin/httpd -k start 392783 1276780 nobody 15092 0.0 S 00:02 /usr/sbin/httpd -k start 392800 1276780 nobody 14668 0.0 S 00:01 /usr/sbin/httpd -k start 392784 1276780 nobody 14652 0.0 S 00:02 /usr/sbin/httpd -k start 1463 1 root 14352 0.0 Ss 44-16:29:45 tailwatchd 392801 1276780 nobody 13664 0.0 S 00:01 /usr/sbin/httpd -k start 392802 1276780 nobody 13664 0.0 S 00:01 /usr/sbin/httpd -k start 392803 1276780 nobody 13664 0.0 S 00:01 /usr/sbin/httpd -k start 390770 1276780 nobody 13528 0.0 S 02:18 /usr/sbin/httpd -k start 374784 3828812 aaa 13476 0.0 S 30:48 dovecot/imap 367498 3828812 lowrange 12988 0.0 S 44:17 dovecot/imap 391284 3828812 lowrange 12956 0.0 S 01:08 dovecot/pop3 273730 3828812 lowrange 12772 0.0 S 03:31:19 dovecot/imap 392755 3828812 aaa 12516 0.4 S 00:05 dovecot/imap 347756 3828812 infinium 12148 0.0 S 01:19:55 dovecot/imap 383627 3828812 kurri 11784 0.0 S 16:17 dovecot/imap 392561 1471 root 11340 0.0 S 00:13 cPhulkd - processor - http socket 391281 3828812 root 11064 0.0 S 01:10 dovecot/auth -w 837413 1471 root 10084 0.0 S 3-07:30:54 cPhulkd - dbprocessor --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 109872 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/evolutionerp.com.au-ssl_log 185 evolution/portal.evolutionerp.com.au-ssl_log 29 infinium/infinium.net.au-ssl_log 29 madalice/madalice.com.au-ssl_log 12 corpkicks/corporatekicks.com.au-ssl_log 6 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 180 136.85.33.248 29 203.54.180.238 9 118.127.40.55 3 203.56.244.114 2 66.116.199.98 2 50.6.6.8 2 50.6.231.19 2 49.177.59.195 2 2a10:3c0:5:0:1:24:0:5 2 216.73.217.37 2 209.42.21.221 2 185.6.9.128 2 167.99.71.20 2 157.230.98.178 2 141.94.97.18 --- top request paths across all vhosts (last 3 min) --- 29 GET /heartbeat.php 12 GET / 9 POST /wp-login.php 9 GET /wp-login.php 5 POST /wp-cron.php 4 POST / 3 GET /wp-json/wp/v2/users/me 3 GET /store/kids-custom-cookie-swoosh-muncher-af1/ 2 GET /store/kids-swarovski-blinged-diamond-kicks/ 2 GET /store/kids-hand-painted-af1-shoes/ 2 GET /.git/config 1 POST /mcp 1 HEAD / 1 GET /.zsh_history 1 GET /wp-config.php.old 1 GET /wp-config.php.bak 1 GET /wp-config.php 1 GET /web/.env 1 GET /v1/graphql 1 GET /tag/cricket/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 10 GET / 1 POST /wp-cron.php 1 GET /.zsh_history 1 GET /wp-config.php.old 1 GET /wp-config.php.bak 1 GET /wp-config.php 1 GET /web/.env 1 GET /v1/graphql 1 GET /staging/.env 1 GET /.ssh/id_rsa 1 GET /.ssh/id_ed25519 1 GET /.ssh/id_ecdsa -- last 10 requests -- 136.85.33.248 - - [13/Aug/2026:02:39:34 +1000] "GET /app/.env.local HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 136.85.33.248 - - [13/Aug/2026:02:39:34 +1000] "GET /app/.env.production HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 136.85.33.248 - - [13/Aug/2026:02:39:34 +1000] "GET /client/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 136.85.33.248 - - [13/Aug/2026:02:39:34 +1000] "GET /backup/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 136.85.33.248 - - [13/Aug/2026:02:39:34 +1000] "GET /dev/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 136.85.33.248 - - [13/Aug/2026:02:39:34 +1000] "GET /production/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 136.85.33.248 - - [13/Aug/2026:02:39:34 +1000] "GET /staging/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 136.85.33.248 - - [13/Aug/2026:02:39:34 +1000] "GET /.env.docker HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 136.85.33.248 - - [13/Aug/2026:02:39:41 +1000] "GET /.github/workflows/deploy.yml HTTP/1.1" 404 119097 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 136.85.33.248 - - [13/Aug/2026:02:39:41 +1000] "GET /.gitlab-ci.yml HTTP/1.1" 404 122571 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 29 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [13/Aug/2026:02:38:37 +1000] "GET /heartbeat.php?sentAt=1786552717&bytes=106,124,161,141&_=1786510907727 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:02:38:45 +1000] "GET /heartbeat.php?sentAt=1786552722&bytes=106,124,161,146&_=1786532340323 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:02:38:47 +1000] "GET /heartbeat.php?sentAt=1786552727&bytes=106,124,161,151&_=1786510907728 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:02:38:52 +1000] "GET /heartbeat.php?sentAt=1786552732&bytes=106,124,161,156&_=1786532340324 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:02:38:59 +1000] "GET /heartbeat.php?sentAt=1786552737&bytes=106,124,161,161&_=1786510907729 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:02:39:02 +1000] "GET /heartbeat.php?sentAt=1786552742&bytes=106,124,161,166&_=1786532340325 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:02:39:07 +1000] "GET /heartbeat.php?sentAt=1786552747&bytes=106,124,161,171&_=1786510907730 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:02:39:14 +1000] "GET /heartbeat.php?sentAt=1786552752&bytes=106,124,161,176&_=1786532340326 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:02:39:17 +1000] "GET /heartbeat.php?sentAt=1786552757&bytes=106,124,161,181&_=1786510907731 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:02:39:22 +1000] "GET /heartbeat.php?sentAt=1786552762&bytes=106,124,161,186&_=1786532340327 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 == infinium/infinium.net.au-ssl_log == -- top paths -- 9 POST /wp-login.php 9 GET /wp-login.php 4 POST / 3 POST /wp-cron.php 3 GET /wp-json/wp/v2/users/me 1 GET /.git/config -- last 10 requests -- 167.99.71.20 - - [13/Aug/2026:02:37:57 +1000] "GET /wp-login.php HTTP/1.1" 200 1706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 167.99.71.20 - - [13/Aug/2026:02:37:59 +1000] "POST /wp-login.php HTTP/1.1" 503 6747 "https://mail.infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/13 108.179.192.20 - - [13/Aug/2026:02:38:00 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 401 82 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 209.42.18.223 - - [13/Aug/2026:02:38:10 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 401 82 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 118.127.40.55 - - [13/Aug/2026:02:38:12 +1000] "POST /wp-cron.php?doing_wp_cron=1786552692.9268140792846679687500 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://infinium.net.au" 50.6.231.19 - - [13/Aug/2026:02:38:12 +1000] "GET /wp-login.php HTTP/1.1" 200 1706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 50.6.231.19 - - [13/Aug/2026:02:38:13 +1000] "POST /wp-login.php HTTP/1.1" 503 6747 "https://mail.infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133 157.230.98.178 - - [13/Aug/2026:02:38:17 +1000] "GET /wp-login.php HTTP/1.1" 200 1706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 157.230.98.178 - - [13/Aug/2026:02:38:18 +1000] "POST /wp-login.php HTTP/1.1" 503 6747 "https://mail.infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ 34.50.190.141 - - [13/Aug/2026:02:38:25 +1000] "GET /.git/config HTTP/1.1" 404 67076 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-13 02:37:14 L1=0.44 run=2 blk=0 avail=7933 (67.6%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=137 ap=17 tcp=19 topuser=alison 2026-08-13 02:37:22 L1=0.40 run=1 blk=0 avail=8031 (68.5%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=39 ap=17 tcp=20 topuser=evolution 2026-08-13 02:37:24 L1=0.37 run=4 blk=0 avail=7901 (67.4%) swpO=0 conn=2 myRSS=1662 php=2 phpRSS=212 ap=16 tcp=22 topuser=corpkicks 2026-08-13 02:37:32 L1=0.42 run=1 blk=0 avail=7989 (68.1%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=39 ap=23 tcp=21 topuser=evolution 2026-08-13 02:37:34 L1=0.39 run=1 blk=0 avail=7909 (67.4%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=121 ap=23 tcp=19 topuser=infinium 2026-08-13 02:37:42 L1=0.36 run=2 blk=0 avail=7869 (67.1%) swpO=0 conn=2 myRSS=1662 php=2 phpRSS=227 ap=17 tcp=21 topuser=madalice 2026-08-13 02:37:44 L1=0.41 run=2 blk=0 avail=7850 (66.9%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=219 ap=17 tcp=21 topuser=corpkicks 2026-08-13 02:37:52 L1=0.45 run=1 blk=0 avail=8029 (68.5%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=39 ap=17 tcp=22 topuser=evolution 2026-08-13 02:37:54 L1=0.42 run=1 blk=0 avail=8037 (68.5%) swpO=0 conn=2 myRSS=1662 php=0 phpRSS=0 ap=17 tcp=20 topuser=- 2026-08-13 02:38:02 L1=0.47 run=1 blk=0 avail=8026 (68.4%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=39 ap=16 tcp=23 topuser=evolution 2026-08-13 02:38:04 L1=0.43 run=1 blk=0 avail=8036 (68.5%) swpO=0 conn=2 myRSS=1662 php=0 phpRSS=0 ap=16 tcp=22 topuser=- 2026-08-13 02:38:12 L1=0.39 run=2 blk=0 avail=7947 (67.8%) swpO=0 conn=2 myRSS=1662 php=2 phpRSS=147 ap=16 tcp=22 topuser=infinium 2026-08-13 02:38:14 L1=0.60 run=1 blk=0 avail=8036 (68.5%) swpO=0 conn=2 myRSS=1662 php=0 phpRSS=0 ap=16 tcp=22 topuser=- 2026-08-13 02:38:22 L1=0.63 run=1 blk=0 avail=8035 (68.5%) swpO=0 conn=2 myRSS=1662 php=1 phpRSS=39 ap=16 tcp=17 topuser=evolution 2026-08-13 02:38:24 L1=0.58 run=2 blk=0 avail=8046 (68.6%) swpO=0 conn=2 myRSS=1662 php=0 phpRSS=0 ap=16 tcp=19 topuser=- 2026-08-13 02:38:32 L1=0.73 run=3 blk=0 avail=7840 (66.8%) swpO=22 conn=2 myRSS=1662 php=3 phpRSS=273 ap=22 tcp=22 topuser=madalice 2026-08-13 02:38:34 L1=0.73 run=11 blk=0 avail=7600 (64.8%) swpO=22 conn=2 myRSS=1662 php=8 phpRSS=677 ap=21 tcp=34 topuser=evolution 2026-08-13 02:38:43 L1=1.89 run=19 blk=0 avail=6470 (55.2%) swpO=26 conn=11 myRSS=1662 php=12 phpRSS=1686 ap=20 tcp=53 topuser=evolution 2026-08-13 02:38:45 L1=1.89 run=13 blk=0 avail=6867 (58.5%) swpO=23 conn=10 myRSS=1662 php=9 phpRSS=1356 ap=32 tcp=45 topuser=evolution 2026-08-13 02:38:54 L1=1.60 run=1 blk=0 avail=8002 (68.2%) swpO=0 conn=11 myRSS=1662 php=0 phpRSS=0 ap=25 tcp=20 topuser=- 2026-08-13 02:38:55 L1=1.60 run=1 blk=0 avail=8010 (68.3%) swpO=0 conn=10 myRSS=1662 php=0 phpRSS=0 ap=24 tcp=21 topuser=- 2026-08-13 02:39:04 L1=4.29 run=2 blk=0 avail=7940 (67.7%) swpO=0 conn=1 myRSS=1668 php=0 phpRSS=0 ap=29 tcp=35 topuser=- 2026-08-13 02:39:05 L1=4.29 run=1 blk=0 avail=7964 (67.9%) swpO=0 conn=10 myRSS=1668 php=0 phpRSS=0 ap=29 tcp=26 topuser=- 2026-08-13 02:39:14 L1=4.76 run=1 blk=0 avail=7927 (67.6%) swpO=3 conn=1 myRSS=1668 php=1 phpRSS=39 ap=38 tcp=34 topuser=evolution 2026-08-13 02:39:15 L1=4.76 run=3 blk=0 avail=7840 (66.8%) swpO=3 conn=10 myRSS=1668 php=2 phpRSS=160 ap=38 tcp=20 topuser=tubesupplies 2026-08-13 02:39:24 L1=4.47 run=3 blk=0 avail=7931 (67.6%) swpO=0 conn=1 myRSS=1668 php=1 phpRSS=83 ap=29 tcp=21 topuser=evolution 2026-08-13 02:39:25 L1=4.47 run=3 blk=0 avail=7807 (66.6%) swpO=0 conn=10 myRSS=1668 php=1 phpRSS=182 ap=28 tcp=23 topuser=evolution 2026-08-13 02:39:34 L1=5.95 run=1 blk=0 avail=7977 (68.0%) swpO=318 conn=1 myRSS=1666 php=0 phpRSS=0 ap=30 tcp=29 topuser=- 2026-08-13 02:39:35 L1=5.95 run=5 blk=0 avail=7939 (67.7%) swpO=318 conn=10 myRSS=1666 php=0 phpRSS=0 ap=29 tcp=30 topuser=- 2026-08-13 02:39:44 L1=6.31 run=17 blk=0 avail=6444 (54.9%) swpO=0 conn=12 myRSS=1666 php=14 phpRSS=1976 ap=29 tcp=58 topuser=evolution