INCIDENT 2026-08-14 00:40:51 trigger: php_rss=3113MB mysql_conn=18 ================================================================== load: 8.43 2.55 1.60 27/698 1384923 ncpu:10 mem_avail: 5653MB/11729MB (48.2%) swap_used:1348MB swapout:1371/s blocked(D):0 running:25 iowait:0.4% steal:0.0% php: 18 procs / 3113MB heaviest user: madalice (17 procs, 3017MB) apache: 64 procs tcp_estab: 91 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 17 2668 mysql 1 1331 nobody 63 895 root 242 571 netdata 8 252 corpkicks 1 105 cpanellogin 1 63 kurri 4 52 aaa 3 33 lowrange 2 27 infinium 2 27 dovenull 6 24 wp-toolkit 6 22 mailman 20 14 zabbix 1 12 dovecot 3 7 named 1 4 cpanelconnecttrack 1 3 polkitd 1 2 nscd 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 16 2734 corpkicks 1 105 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5806 MB Active(file): 2210 MB Inactive(file): 2188 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 297 MB CommitLimit: 9960 MB Committed_AS: 10446 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 342014 root 23:29:35 660 /usr/bin/imunify-agent-proxy 1384301 root 00:51 3096 /bin/sh -c bash -c "sleep $((RANDOM % 60))" ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 1339177 1 mysql 1363480 3.5 Ssl 01:25:14 /usr/sbin/mariadbd 1384820 1384616 madalice 266072 31.3 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1384816 1381515 madalice 263060 30.8 R 00:09 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1384830 1384436 madalice 252788 32.6 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1384829 1384460 madalice 250944 35.5 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1384831 1384437 madalice 217824 37.5 R 00:07 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1384841 1384823 madalice 210204 48.0 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 203388 2.5 Ssl 45-14:30:53 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1384844 1384722 madalice 190104 46.8 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1384842 1384593 madalice 188632 45.4 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1384839 1384819 madalice 186920 49.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1384835 1382700 madalice 179056 35.1 R 00:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1384840 1384817 madalice 176548 40.0 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1384848 1384845 madalice 171284 52.0 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1384847 1384721 madalice 167016 42.0 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 388652 382990 root 154568 0.0 S 22:06:53 spamd child 1384843 1384463 madalice 147872 32.0 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1384846 1384723 madalice 125768 32.0 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1384857 1384818 corpkicks 119832 27.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 382990 1 root 67304 0.0 Ss 22:18:05 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1384920 1384853 madalice 65196 35.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1375356 1353308 cpanellogin 64780 0.0 S 18:45 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 159820 1 root 56788 0.0 Ss 24-14:54:01 /usr/lib/systemd/systemd-journald 1384944 1384447 madalice 55176 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353308 1 root 42284 0.0 Ss 22-21:59:23 cpsrvd (SSL) - waiting for connections 1469 1 root 41888 0.1 Ss 45-14:30:52 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 39676 0.1 Sl 45-14:30:48 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2223 1201 root 37072 0.0 Sl 45-14:30:52 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1363144 1 root 32856 0.0 Ss 40:50 lfd - sleeping 1383925 1276780 nobody 21044 0.1 S 01:20 /usr/sbin/httpd -k start 1383932 1276780 nobody 20636 0.1 S 01:19 /usr/sbin/httpd -k start 1383935 1276780 nobody 20220 0.0 S 01:19 /usr/sbin/httpd -k start 1384447 1276780 nobody 20080 0.1 S 00:45 /usr/sbin/httpd -k start 1384449 1276780 nobody 19920 0.0 S 00:45 /usr/sbin/httpd -k start 1384713 1276780 nobody 18992 0.2 S 00:15 /usr/sbin/httpd -k start 1384437 1276780 nobody 18848 0.0 S 00:46 /usr/sbin/httpd -k start 1384459 1276780 nobody 18808 0.0 S 00:44 /usr/sbin/httpd -k start 1384436 1276780 nobody 18796 0.0 S 00:46 /usr/sbin/httpd -k start 1384615 1276780 nobody 18584 0.1 S 00:28 /usr/sbin/httpd -k start 1384616 1276780 nobody 18488 0.1 S 00:28 /usr/sbin/httpd -k start 1384806 1276780 nobody 18168 0.1 S 00:10 /usr/sbin/httpd -k start 1384614 1276780 nobody 17884 0.1 S 00:28 /usr/sbin/httpd -k start 1384593 1276780 nobody 17712 0.1 S 00:30 /usr/sbin/httpd -k start 1384617 1276780 nobody 17684 0.1 S 00:28 /usr/sbin/httpd -k start 1384704 1276780 nobody 17644 0.1 S 00:16 /usr/sbin/httpd -k start 1384463 1276780 nobody 17616 0.0 S 00:44 /usr/sbin/httpd -k start 1384851 1276780 nobody 17580 0.2 S 00:04 /usr/sbin/httpd -k start 1384723 1276780 nobody 17460 0.1 S 00:14 /usr/sbin/httpd -k start 1384808 1276780 nobody 17428 0.2 S 00:10 /usr/sbin/httpd -k start 1384732 1276780 nobody 17424 0.1 S 00:12 /usr/sbin/httpd -k start 1384798 1276780 nobody 17424 0.1 S 00:11 /usr/sbin/httpd -k start 1384721 1276780 nobody 17360 0.2 S 00:14 /usr/sbin/httpd -k start 1384722 1276780 nobody 17360 0.1 S 00:14 /usr/sbin/httpd -k start 1384797 1276780 nobody 17352 0.2 S 00:11 /usr/sbin/httpd -k start 1384809 1276780 nobody 17328 0.2 S 00:10 /usr/sbin/httpd -k start 1384850 1276780 nobody 17308 0.0 S 00:04 /usr/sbin/httpd -k start 1384822 1276780 nobody 17200 0.1 S 00:09 /usr/sbin/httpd -k start 1384825 1276780 nobody 17128 0.1 S 00:09 /usr/sbin/httpd -k start 1384460 1276780 nobody 17032 0.0 S 00:44 /usr/sbin/httpd -k start 1383984 1471 root 16764 0.0 S 01:17 cPhulkd - dbprocessor --- processes in D state (uninterruptible IO) --- 1384859 D - /usr/sbin/httpd -k start --- mariadb processlist (non-sleeping) --- +-------+-------------+-------------+---------+------+------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +-------+-------------+-------------+---------+------+------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 16247 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 16220 | madalice_wp | madalice_wp | Query | 0 | Waiting for table level lock | DELETE FROM `AMuqf6qZ_options` WHERE `option_name` = '_transient_timeout_wcpa_fields_34372' | | 16218 | madalice_wp | madalice_wp | Query | 0 | Waiting for table level lock | SELECT option_value FROM AMuqf6qZ_options WHERE option_name = 'commercegurus-plp-mobile_size_w' LIMIT 1 | +-------+-------------+-------------+---------+------+------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +-------+-------------+------+------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +-------+-------------+------+------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 16240 | madalice_wp | 0 | Waiting for table level lock | SELECT option_value FROM AMuqf6qZ_options WHERE option_name = 'wordfence_lastSyncAttackData' LIMIT 1 | | 16235 | madalice_wp | 0 | Waiting for table level lock | SELECT option_value FROM AMuqf6qZ_options WHERE option_name = 'elementor_experiment-e_wp_abilities_api' LIMIT 1 | | 16234 | madalice_wp | 0 | Waiting for table level lock | SELECT option_value FROM AMuqf6qZ_options WHERE option_name = 'wc_settings_shippit_debug' LIMIT 1 | | 16233 | madalice_wp | 0 | Waiting for table level lock | SELECT option_name, option_value FROM AMuqf6qZ_options WHERE option_name IN ('_transient_jetpack_connection_active_plugins_refresh','_transient_timeout_jetpack_connection_active_plugins_refresh') | +-------+-------------+------+------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 134 evolution/portal.evolutionerp.com.au-ssl_log 26 aaa/aaadownunder.com.au-ssl_log 8 vinesit/vinesit.com.au 8 vinesit/vinesit.com.au-ssl_log 7 evolution/evolutionerp.com.au-ssl_log 5 corpkicks/corporatekicks.com.au-ssl_log 4 tubesupplies/tubesupplies.com.au-ssl_log 3 evolution/my.evolutionerp.com.au-ssl_log 2 corpkicks/2025.corporatekicks.com.au 1 coscom/coscom.com.au-ssl_log 1 olytis/tis.com.au-ssl_log 1 speedlin/speedlinefencing.com.au-ssl_log 1 (total vhosts taking traffic: 13) --- top client IPs across all vhosts (last 3 min) --- 26 203.54.180.238 21 20.220.195.189 15 4.223.165.84 5 45.148.10.9 4 118.127.40.55 2 91.92.243.249 2 91.92.243.248 2 91.92.243.243 2 89.149.91.63 2 88.15.94.133 2 49.15.96.167 2 45.167.106.61 2 43.242.243.121 2 41.62.73.111 2 41.116.21.14 --- top request paths across all vhosts (last 3 min) --- 36 GET / 31 POST / 26 GET /heartbeat.php 7 POST /wp-login.php 4 POST /wp-cron.php 3 GET /wp-editor.php 3 GET /ettidaxe.php 3 GET /crgio.php 2 HEAD / 2 GET /store/pink-butterfly-blossom-af1-shoes/ 2 GET /robots.txt 2 GET /index.php 1 GET /wp-login.php 1 GET /wp-json/ 1 GET /wp-includes/js/crop/cropper.php 1 GET /wp-includes/IXR/test1.php 1 GET /wp-includes/ID3/ 1 GET /wp-content/themes/ 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-content/plugins/core-plugin/include.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 31 POST / 31 GET / 2 GET /store/pink-butterfly-blossom-af1-shoes/ 1 GET /wp-includes/js/crop/cropper.php 1 GET /wp-includes/IXR/test1.php 1 GET /wp-includes/ID3/ 1 GET /wp-content/themes/ 1 GET /wp-content/plugins/core-plugin/include.php 1 GET /wp-admin/network/index.php 1 GET /wp-admin/js/widgets/ 1 GET /wp-admin/js/ 1 GET /wp-admin/css/colors -- last 10 requests -- 14.191.175.68 - - [14/Aug/2026:00:40:53 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 400 - "https://madalice.com.au/store/custom-vans-shoes-bridal-pearl-edition/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15 223.233.80.60 - - [14/Aug/2026:00:40:47 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/store/custom-buzz-woody-nike-af1/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW 105.74.11.36 - - [14/Aug/2026:00:40:46 +1000] "GET /size-charts/ HTTP/1.1" 200 31701 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" 79.232.21.68 - - [14/Aug/2026:00:40:46 +1000] "GET /store/custom-sneaker-personalised-ribbon-laces/ HTTP/1.1" 200 44367 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1 184.82.154.83 - - [14/Aug/2026:00:40:46 +1000] "GET /the-ultimate-guide-to-caring-for-your-custom-air-force-1s/ HTTP/1.1" 200 32435 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gec 27.109.115.135 - - [14/Aug/2026:00:40:47 +1000] "GET /store/multi-colour-drippy-cartoon-af1/ HTTP/1.1" 200 49206 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0. 161.18.49.204 - - [14/Aug/2026:00:40:45 +1000] "GET /store/cartoon-drippy-pink-nike-court-vision/ HTTP/1.1" 200 47923 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145 14.164.32.180 - - [14/Aug/2026:00:40:47 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/store/custom-af1-groom-black-gold/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Apple 43.119.100.1 - - [14/Aug/2026:00:40:47 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/store/custom-vans-shoes-bridal-pearl-edition/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 37.238.4.238 - - [14/Aug/2026:00:40:47 +1000] "GET /store/cow-girl-western-edition-af1/ HTTP/1.1" 200 46208 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Saf == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 26 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [14/Aug/2026:00:39:20 +1000] "GET /heartbeat.php?sentAt=1786631960&bytes=106,125,215,24&_=1786602370304 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:00:39:23 +1000] "GET /heartbeat.php?sentAt=1786631963&bytes=106,125,215,27&_=1786596792554 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:00:39:30 +1000] "GET /heartbeat.php?sentAt=1786631970&bytes=106,125,215,34&_=1786602370305 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:00:39:34 +1000] "GET /heartbeat.php?sentAt=1786631973&bytes=106,125,215,37&_=1786596792555 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:00:39:40 +1000] "GET /heartbeat.php?sentAt=1786631980&bytes=106,125,215,44&_=1786602370306 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:00:39:43 +1000] "GET /heartbeat.php?sentAt=1786631983&bytes=106,125,215,47&_=1786596792556 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:00:39:50 +1000] "GET /heartbeat.php?sentAt=1786631990&bytes=106,125,215,54&_=1786602370307 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:00:39:53 +1000] "GET /heartbeat.php?sentAt=1786631993&bytes=106,125,215,57&_=1786596792557 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:00:40:00 +1000] "GET /heartbeat.php?sentAt=1786632000&bytes=106,125,215,64&_=1786602370308 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:00:40:03 +1000] "GET /heartbeat.php?sentAt=1786632003&bytes=106,125,215,67&_=1786596792558 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 4 POST /wp-login.php 2 GET / 1 POST /wp-cron.php 1 GET /robots.txt -- last 10 requests -- 118.127.40.55 - - [14/Aug/2026:00:39:07 +1000] "POST /wp-cron.php?doing_wp_cron=1786631947.8435521125793457031250 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://aaadownunder.com.au" 54.78.122.116 - - [14/Aug/2026:00:39:07 +1000] "GET / HTTP/1.0" 200 49957 "-" "Mozilla/5.0 (compatible; NetcraftSurveyAgent/1.0; +info@netcraft.com)" 91.92.243.248 - - [14/Aug/2026:00:39:41 +1000] "POST /wp-login.php HTTP/1.1" 200 6202 "-" "Mozilla/5.0" 91.92.243.248 - - [14/Aug/2026:00:39:41 +1000] "POST /wp-login.php HTTP/1.1" 200 6196 "-" "Mozilla/5.0" 91.92.243.249 - - [14/Aug/2026:00:39:41 +1000] "POST /wp-login.php HTTP/1.1" 200 6202 "-" "Mozilla/5.0" 91.92.243.249 - - [14/Aug/2026:00:39:41 +1000] "POST /wp-login.php HTTP/1.1" 200 6196 "-" "Mozilla/5.0" 170.64.229.95 - - [14/Aug/2026:00:39:50 +1000] "GET / HTTP/1.1" 301 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" 170.64.229.95 - - [14/Aug/2026:00:39:55 +1000] "GET /robots.txt HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-14 00:38:30 L1=0.34 run=1 blk=0 avail=8428 (71.9%) swpO=0 conn=1 myRSS=1338 php=1 phpRSS=40 ap=18 tcp=24 topuser=evolution 2026-08-14 00:38:30 L1=0.34 run=1 blk=0 avail=8442 (72.0%) swpO=0 conn=2 myRSS=1338 php=1 phpRSS=40 ap=18 tcp=24 topuser=evolution 2026-08-14 00:38:40 L1=0.29 run=2 blk=0 avail=8440 (72.0%) swpO=0 conn=2 myRSS=1338 php=1 phpRSS=41 ap=18 tcp=26 topuser=evolution 2026-08-14 00:38:40 L1=0.29 run=1 blk=0 avail=8437 (71.9%) swpO=0 conn=2 myRSS=1338 php=1 phpRSS=41 ap=18 tcp=26 topuser=evolution 2026-08-14 00:38:50 L1=0.24 run=2 blk=0 avail=8329 (71.0%) swpO=0 conn=2 myRSS=1338 php=2 phpRSS=180 ap=18 tcp=25 topuser=madalice 2026-08-14 00:38:50 L1=0.24 run=2 blk=0 avail=8310 (70.8%) swpO=0 conn=2 myRSS=1338 php=2 phpRSS=194 ap=18 tcp=26 topuser=madalice 2026-08-14 00:39:00 L1=0.21 run=1 blk=0 avail=8439 (71.9%) swpO=0 conn=2 myRSS=1338 php=1 phpRSS=41 ap=17 tcp=21 topuser=evolution 2026-08-14 00:39:00 L1=0.21 run=1 blk=0 avail=8438 (71.9%) swpO=0 conn=2 myRSS=1338 php=1 phpRSS=41 ap=17 tcp=21 topuser=evolution 2026-08-14 00:39:10 L1=0.25 run=4 blk=0 avail=8242 (70.3%) swpO=0 conn=2 myRSS=1338 php=2 phpRSS=269 ap=17 tcp=23 topuser=corpkicks 2026-08-14 00:39:10 L1=0.25 run=1 blk=0 avail=8442 (72.0%) swpO=0 conn=2 myRSS=1338 php=1 phpRSS=39 ap=17 tcp=22 topuser=evolution 2026-08-14 00:39:20 L1=0.21 run=1 blk=0 avail=8443 (72.0%) swpO=0 conn=2 myRSS=1338 php=1 phpRSS=41 ap=17 tcp=23 topuser=evolution 2026-08-14 00:39:20 L1=0.21 run=1 blk=0 avail=8441 (72.0%) swpO=0 conn=2 myRSS=1338 php=1 phpRSS=41 ap=17 tcp=23 topuser=evolution 2026-08-14 00:39:30 L1=0.58 run=2 blk=0 avail=8201 (69.9%) swpO=0 conn=2 myRSS=1338 php=2 phpRSS=299 ap=18 tcp=29 topuser=madalice 2026-08-14 00:39:30 L1=0.58 run=1 blk=0 avail=8427 (71.8%) swpO=0 conn=2 myRSS=1338 php=1 phpRSS=39 ap=18 tcp=29 topuser=evolution 2026-08-14 00:39:40 L1=1.46 run=2 blk=0 avail=8178 (69.7%) swpO=46 conn=3 myRSS=1338 php=2 phpRSS=242 ap=29 tcp=28 topuser=madalice 2026-08-14 00:39:40 L1=1.46 run=4 blk=0 avail=8136 (69.4%) swpO=46 conn=2 myRSS=1338 php=3 phpRSS=316 ap=29 tcp=31 topuser=madalice 2026-08-14 00:39:50 L1=1.46 run=3 blk=0 avail=8191 (69.8%) swpO=0 conn=3 myRSS=1338 php=1 phpRSS=39 ap=25 tcp=25 topuser=evolution 2026-08-14 00:39:50 L1=1.46 run=1 blk=0 avail=8373 (71.4%) swpO=0 conn=2 myRSS=1338 php=1 phpRSS=39 ap=25 tcp=26 topuser=evolution 2026-08-14 00:40:00 L1=1.38 run=1 blk=0 avail=8395 (71.6%) swpO=0 conn=3 myRSS=1338 php=1 phpRSS=41 ap=20 tcp=25 topuser=evolution 2026-08-14 00:40:00 L1=1.38 run=1 blk=0 avail=8394 (71.6%) swpO=0 conn=2 myRSS=1338 php=1 phpRSS=41 ap=20 tcp=25 topuser=evolution 2026-08-14 00:40:10 L1=3.28 run=4 blk=0 avail=7900 (67.4%) swpO=156 conn=3 myRSS=1335 php=4 phpRSS=423 ap=34 tcp=44 topuser=madalice 2026-08-14 00:40:10 L1=3.28 run=4 blk=0 avail=8089 (69.0%) swpO=156 conn=2 myRSS=1335 php=3 phpRSS=311 ap=34 tcp=43 topuser=madalice 2026-08-14 00:40:20 L1=3.33 run=5 blk=0 avail=7716 (65.8%) swpO=0 conn=3 myRSS=1335 php=5 phpRSS=814 ap=27 tcp=33 topuser=madalice 2026-08-14 00:40:20 L1=3.33 run=6 blk=0 avail=7668 (65.4%) swpO=0 conn=2 myRSS=1335 php=5 phpRSS=623 ap=27 tcp=33 topuser=madalice 2026-08-14 00:40:30 L1=3.85 run=4 blk=0 avail=8163 (69.6%) swpO=12 conn=3 myRSS=1335 php=4 phpRSS=288 ap=31 tcp=31 topuser=madalice 2026-08-14 00:40:31 L1=3.85 run=5 blk=0 avail=8132 (69.3%) swpO=11 conn=5 myRSS=1335 php=4 phpRSS=319 ap=31 tcp=30 topuser=madalice 2026-08-14 00:40:40 L1=4.59 run=10 blk=0 avail=7828 (66.7%) swpO=0 conn=8 myRSS=1346 php=8 phpRSS=635 ap=36 tcp=49 topuser=madalice 2026-08-14 00:40:41 L1=4.59 run=10 blk=0 avail=7825 (66.7%) swpO=0 conn=5 myRSS=1346 php=8 phpRSS=706 ap=36 tcp=50 topuser=madalice 2026-08-14 00:40:51 L1=8.43 run=25 blk=0 avail=5653 (48.2%) swpO=1371 conn=18 myRSS=1331 php=18 phpRSS=3113 ap=64 tcp=91 topuser=madalice 2026-08-14 00:40:51 L1=8.43 run=24 blk=0 avail=5641 (48.1%) swpO=1509 conn=17 myRSS=1331 php=18 phpRSS=3142 ap=64 tcp=91 topuser=madalice