INCIDENT 2026-08-14 05:36:53 trigger: php_rss=1709MB ================================================================== load: 1.40 1.07 0.92 12/677 1543955 ncpu:10 mem_avail: 6419MB/11729MB (54.7%) swap_used:1076MB swapout:617/s blocked(D):1 running:8 iowait:0.2% steal:0.0% php: 10 procs / 1709MB heaviest user: madalice (7 procs, 1518MB) apache: 105 procs tcp_estab: 43 --- RSS by user (all processes) --- USER PROCS RSS_MB nobody 104 1607 madalice 6 1183 mysql 1 1129 root 234 824 netdata 8 270 infinium 4 191 evolution 5 43 dovenull 6 26 aaa 2 26 kurri 2 25 wp-toolkit 6 21 lowrange 2 18 cpanellogin 1 18 mailnull 2 16 mailman 20 15 zabbix 1 14 kamcool 1 11 dovecot 3 8 named 1 6 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 6 1087 infinium 2 167 evolution 1 39 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6033 MB Active(file): 3884 MB Inactive(file): 1932 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 624 MB CommitLimit: 9960 MB Committed_AS: 9295 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1404480 root 04:25:37 800 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 1420296 1 mysql 1157028 2.4 Ssl 03:57:52 /usr/sbin/mariadbd 1543916 1543901 madalice 245552 72.3 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1543919 1543758 madalice 235824 72.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1543918 1543903 madalice 231096 70.6 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 216960 2.5 Ssl 45-19:26:55 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1543917 1543902 madalice 207636 68.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1543920 1543899 madalice 207372 68.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1451533 1444234 root 185616 0.0 S 02:59:46 spamd child 1444234 1 root 171464 0.0 Ss 03:14:05 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1451534 1444234 root 166116 0.0 S 02:59:46 spamd child 1543921 1543814 infinium 103696 48.0 S 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1543926 1543763 infinium 82028 25.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 159820 1 root 71880 0.0 Ss 24-19:50:03 /usr/lib/systemd/systemd-journald 4922 2431 netdata 42752 0.1 Sl 45-19:26:50 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1353308 1 root 41952 0.0 Ss 23-02:55:25 cpsrvd (SSL) - waiting for connections 1543924 1543584 evolution 40788 5.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 38592 0.0 Sl 45-19:26:54 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1443709 1 root 32576 0.0 Ss 03:14:40 lfd - sleeping 1542217 1276780 nobody 20712 0.0 S 03:25 /usr/sbin/httpd -k start 1541450 1276780 nobody 20624 0.0 S 04:50 /usr/sbin/httpd -k start 1541378 1276780 nobody 20216 0.0 S 04:53 /usr/sbin/httpd -k start 1542849 1276780 nobody 20040 0.0 S 02:13 /usr/sbin/httpd -k start 1542384 1276780 nobody 19880 0.0 S 03:08 /usr/sbin/httpd -k start 1541500 1276780 nobody 19780 0.0 S 04:49 /usr/sbin/httpd -k start 1542878 1276780 nobody 19140 0.0 S 02:10 /usr/sbin/httpd -k start 1536162 1353308 cpanellogin 19124 0.0 S 15:03 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 1543760 1276780 nobody 18128 0.1 S 00:11 /usr/sbin/httpd -k start 1541438 1276780 nobody 18100 0.0 S 04:51 /usr/sbin/httpd -k start 1543584 1276780 nobody 18032 0.0 S 00:38 /usr/sbin/httpd -k start 1543800 1276780 nobody 17848 0.0 S 00:09 /usr/sbin/httpd -k start 1543763 1276780 nobody 17520 0.0 S 00:11 /usr/sbin/httpd -k start 1543881 1276780 nobody 17492 0.0 S 00:07 /usr/sbin/httpd -k start 1541487 1276780 nobody 17484 0.0 S 04:49 /usr/sbin/httpd -k start 1543889 1276780 nobody 17316 0.0 S 00:07 /usr/sbin/httpd -k start 1543795 1276780 nobody 17196 0.1 S 00:09 /usr/sbin/httpd -k start 1543787 1276780 nobody 17168 0.0 S 00:10 /usr/sbin/httpd -k start 1543825 1276780 nobody 17152 0.1 S 00:08 /usr/sbin/httpd -k start 1543876 1276780 nobody 17120 0.0 S 00:07 /usr/sbin/httpd -k start 1543882 1276780 nobody 17092 0.0 S 00:07 /usr/sbin/httpd -k start 1543875 1276780 nobody 17052 0.0 S 00:07 /usr/sbin/httpd -k start 1543878 1276780 nobody 17052 0.1 S 00:07 /usr/sbin/httpd -k start 1543835 1276780 nobody 17048 0.0 S 00:08 /usr/sbin/httpd -k start 1543841 1276780 nobody 17048 0.1 S 00:08 /usr/sbin/httpd -k start 1543880 1276780 nobody 17028 0.2 S 00:07 /usr/sbin/httpd -k start 1543817 1276780 nobody 17000 0.0 S 00:08 /usr/sbin/httpd -k start 1543839 1276780 nobody 17000 0.0 S 00:08 /usr/sbin/httpd -k start 1543893 1276780 nobody 16984 0.0 S 00:07 /usr/sbin/httpd -k start 1543822 1276780 nobody 16980 0.0 S 00:08 /usr/sbin/httpd -k start 1543791 1276780 nobody 16976 0.1 S 00:10 /usr/sbin/httpd -k start 1543895 1276780 nobody 16968 0.0 S 00:07 /usr/sbin/httpd -k start 1543840 1276780 nobody 16964 0.1 S 00:08 /usr/sbin/httpd -k start 1543789 1276780 nobody 16960 0.0 S 00:10 /usr/sbin/httpd -k start 1543805 1276780 nobody 16960 0.0 S 00:09 /usr/sbin/httpd -k start 1543827 1276780 nobody 16960 0.0 S 00:08 /usr/sbin/httpd -k start 1543844 1276780 nobody 16956 0.0 S 00:08 /usr/sbin/httpd -k start 1543820 1276780 nobody 16944 0.0 S 00:08 /usr/sbin/httpd -k start 1543818 1276780 nobody 16936 0.0 S 00:08 /usr/sbin/httpd -k start 1543843 1276780 nobody 16936 0.0 S 00:08 /usr/sbin/httpd -k start 1543883 1276780 nobody 16928 0.0 S 00:07 /usr/sbin/httpd -k start 1543819 1276780 nobody 16920 0.0 S 00:08 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 55281 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 35 evolution/portal.evolutionerp.com.au-ssl_log 23 evolution/my.evolutionerp.com.au-ssl_log 12 aaa/aaadownunder.com.au-ssl_log 11 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 23 203.54.180.238 12 216.73.216.122 9 13.59.149.157 6 20.151.131.114 6 103.104.165.99 3 157.55.39.58 3 118.127.40.55 2 91.92.243.248 2 182.239.240.254 2 114.119.144.41 2 114.119.140.234 2 114.119.131.88 1 66.249.65.170 1 18.214.251.19 1 157.55.39.49 --- top request paths across all vhosts (last 3 min) --- 23 GET /heartbeat.php 8 POST /functions.php 6 GET / 4 GET /index.php 3 POST /wp-cron.php 2 POST /wp-login.php 1 POST / 1 GET /wp-signup.php 1 GET /.well-known/security.txt 1 GET /.well-known/openid-configuration 1 GET /.well-known/apple-app-site-association 1 GET /Versus+7Vogue+7SoccerBible+7Financial%20Times+4GQ+4Vogue+4 1 GET /unique-christmas-shoes-kids/ 1 GET /top-custom-jordans-shoes-where-to-find-them/ 1 GET /store/hand-painted-nike-af1-westernsydney-wanderers 1 GET /store/hand-painted-nike-af1-sunflower/ 1 GET /store/hand-painted-nike-af1-roses/ 1 GET /store/hand-painted-nike-af1-canberra-raiders/ 1 GET /store/hand-painted-nike-af1-bournemouth/ 1 GET /store/haha-hand-painted-af1-shoes/ --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 5 GET / 1 POST / 1 GET /wp-signup.php 1 GET /.well-known/security.txt 1 GET /.well-known/openid-configuration 1 GET /.well-known/apple-app-site-association 1 GET /Versus+7Vogue+7SoccerBible+7Financial%20Times+4GQ+4Vogue+4 1 GET /unique-christmas-shoes-kids/ 1 GET /top-custom-jordans-shoes-where-to-find-them/ 1 GET /store/hand-painted-nike-af1-westernsydney-wanderers 1 GET /store/hand-painted-nike-af1-sunflower/ 1 GET /store/hand-painted-nike-af1-roses/ -- last 10 requests -- 13.59.149.157 - - [14/Aug/2026:05:36:40 +1000] "GET /sitemap_index.xml HTTP/1.1" 200 439 "-" "python-httpx/0.28.1" 13.59.149.157 - - [14/Aug/2026:05:36:39 +1000] "GET /.well-known/security.txt HTTP/1.1" 404 30574 "-" "python-httpx/0.28.1" 13.59.149.157 - - [14/Aug/2026:05:36:39 +1000] "GET /.well-known/openid-configuration HTTP/1.1" 404 30577 "-" "python-httpx/0.28.1" 13.59.149.157 - - [14/Aug/2026:05:36:39 +1000] "GET /.well-known/apple-app-site-association HTTP/1.1" 404 30582 "-" "python-httpx/0.28.1" 13.59.149.157 - - [14/Aug/2026:05:36:39 +1000] "GET /ads.txt HTTP/1.1" 404 30560 "-" "python-httpx/0.28.1" 13.59.149.157 - - [14/Aug/2026:05:36:42 +1000] "GET /post-sitemap.xml HTTP/1.1" 200 6074 "-" "python-httpx/0.28.1" 13.59.149.157 - - [14/Aug/2026:05:36:44 +1000] "GET /page-sitemap.xml HTTP/1.1" 200 2940 "-" "python-httpx/0.28.1" 13.59.149.157 - - [14/Aug/2026:05:36:47 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149. 13.59.149.157 - - [14/Aug/2026:05:36:47 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 216.73.216.122 - - [14/Aug/2026:05:36:47 +1000] "GET /?p=26687 HTTP/1.1" 301 1 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 23 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [14/Aug/2026:05:35:03 +1000] "GET /heartbeat.php?sentAt=1786649703&bytes=106,126,28,103&_=1786596794328 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:05:35:10 +1000] "GET /heartbeat.php?sentAt=1786649710&bytes=106,126,28,110&_=1786602372079 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:05:35:13 +1000] "GET /heartbeat.php?sentAt=1786649713&bytes=106,126,28,113&_=1786596794329 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:05:35:20 +1000] "GET /heartbeat.php?sentAt=1786649720&bytes=106,126,28,120&_=1786602372080 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:05:35:23 +1000] "GET /heartbeat.php?sentAt=1786649723&bytes=106,126,28,123&_=1786596794330 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:05:35:30 +1000] "GET /heartbeat.php?sentAt=1786649730&bytes=106,126,28,130&_=1786602372081 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:05:35:33 +1000] "GET /heartbeat.php?sentAt=1786649733&bytes=106,126,28,133&_=1786596794331 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:05:35:40 +1000] "GET /heartbeat.php?sentAt=1786649740&bytes=106,126,28,140&_=1786602372082 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:05:35:43 +1000] "GET /heartbeat.php?sentAt=1786649743&bytes=106,126,28,143&_=1786596794332 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:05:35:50 +1000] "GET /heartbeat.php?sentAt=1786649750&bytes=106,126,28,150&_=1786602372083 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 8 POST /functions.php 4 GET /index.php -- last 10 requests -- 157.55.39.58 - - [14/Aug/2026:05:34:32 +1000] "GET /index.php?page=jobedit&id=29077 HTTP/1.1" 200 5263 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Ch 182.239.240.254 - - [14/Aug/2026:05:34:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=mfshoporderdetail&id=5375" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 103.104.165.99 - - [14/Aug/2026:05:34:43 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 157.55.39.49 - - [14/Aug/2026:05:34:55 +1000] "GET /index.php?page=activities&keyword=Yuliett+Torres%EF%BB%BF HTTP/1.1" 200 5281 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://ww 103.104.165.99 - - [14/Aug/2026:05:35:13 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 157.55.39.58 - - [14/Aug/2026:05:35:32 +1000] "GET /index.php?page=activities&keyword=%E9%AC%BC%E6%BB%85%E4%B9%8B%E5%A5%8F HTTP/1.1" 200 5291 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2. 103.104.165.99 - - [14/Aug/2026:05:35:43 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 103.104.165.99 - - [14/Aug/2026:05:36:13 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 182.239.240.254 - - [14/Aug/2026:05:36:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=mfshoporderdetail&id=5375" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 103.104.165.99 - - [14/Aug/2026:05:36:44 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. --- last 30 samples (run-up to this incident) --- 2026-08-14 05:34:25 L1=1.22 run=1 blk=0 avail=8378 (71.4%) swpO=0 conn=1 myRSS=1129 php=0 phpRSS=0 ap=16 tcp=21 topuser=- 2026-08-14 05:34:32 L1=1.03 run=3 blk=0 avail=8344 (71.1%) swpO=0 conn=1 myRSS=1129 php=1 phpRSS=58 ap=15 tcp=22 topuser=alison 2026-08-14 05:34:35 L1=1.03 run=1 blk=0 avail=8388 (71.5%) swpO=0 conn=1 myRSS=1129 php=0 phpRSS=0 ap=15 tcp=22 topuser=- 2026-08-14 05:34:42 L1=0.87 run=1 blk=0 avail=8381 (71.5%) swpO=0 conn=1 myRSS=1129 php=0 phpRSS=0 ap=16 tcp=25 topuser=- 2026-08-14 05:34:45 L1=0.87 run=2 blk=0 avail=8276 (70.6%) swpO=0 conn=1 myRSS=1129 php=1 phpRSS=144 ap=17 tcp=25 topuser=corpkicks 2026-08-14 05:34:52 L1=0.96 run=1 blk=0 avail=8396 (71.6%) swpO=0 conn=1 myRSS=1129 php=0 phpRSS=0 ap=15 tcp=23 topuser=- 2026-08-14 05:34:55 L1=0.96 run=1 blk=0 avail=8396 (71.6%) swpO=0 conn=1 myRSS=1129 php=0 phpRSS=0 ap=15 tcp=24 topuser=- 2026-08-14 05:35:02 L1=0.81 run=3 blk=0 avail=8352 (71.2%) swpO=0 conn=1 myRSS=1129 php=1 phpRSS=64 ap=15 tcp=24 topuser=madalice 2026-08-14 05:35:05 L1=0.81 run=1 blk=0 avail=8393 (71.6%) swpO=0 conn=1 myRSS=1129 php=0 phpRSS=0 ap=15 tcp=26 topuser=- 2026-08-14 05:35:12 L1=0.69 run=1 blk=0 avail=8397 (71.6%) swpO=0 conn=1 myRSS=1129 php=0 phpRSS=0 ap=15 tcp=20 topuser=- 2026-08-14 05:35:15 L1=0.69 run=2 blk=0 avail=8216 (70.1%) swpO=0 conn=1 myRSS=1129 php=1 phpRSS=214 ap=15 tcp=23 topuser=madalice 2026-08-14 05:35:22 L1=0.65 run=1 blk=0 avail=8395 (71.6%) swpO=0 conn=1 myRSS=1129 php=0 phpRSS=0 ap=15 tcp=23 topuser=- 2026-08-14 05:35:25 L1=0.65 run=1 blk=0 avail=8395 (71.6%) swpO=0 conn=1 myRSS=1129 php=0 phpRSS=0 ap=15 tcp=21 topuser=- 2026-08-14 05:35:32 L1=0.63 run=1 blk=0 avail=8391 (71.5%) swpO=0 conn=1 myRSS=1129 php=0 phpRSS=0 ap=15 tcp=21 topuser=- 2026-08-14 05:35:35 L1=0.63 run=1 blk=0 avail=8393 (71.6%) swpO=0 conn=1 myRSS=1129 php=0 phpRSS=0 ap=15 tcp=22 topuser=- 2026-08-14 05:35:42 L1=0.61 run=2 blk=0 avail=8295 (70.7%) swpO=0 conn=1 myRSS=1129 php=1 phpRSS=130 ap=14 tcp=21 topuser=olympic 2026-08-14 05:35:45 L1=0.61 run=1 blk=0 avail=8397 (71.6%) swpO=0 conn=1 myRSS=1129 php=0 phpRSS=0 ap=14 tcp=22 topuser=- 2026-08-14 05:35:53 L1=0.60 run=1 blk=0 avail=8398 (71.6%) swpO=0 conn=1 myRSS=1129 php=0 phpRSS=0 ap=14 tcp=21 topuser=- 2026-08-14 05:35:55 L1=0.60 run=1 blk=0 avail=8397 (71.6%) swpO=0 conn=1 myRSS=1129 php=0 phpRSS=0 ap=14 tcp=21 topuser=- 2026-08-14 05:36:03 L1=0.58 run=3 blk=0 avail=8388 (71.5%) swpO=0 conn=1 myRSS=1129 php=1 phpRSS=40 ap=14 tcp=22 topuser=evolution 2026-08-14 05:36:05 L1=0.58 run=1 blk=0 avail=8392 (71.5%) swpO=0 conn=1 myRSS=1129 php=0 phpRSS=0 ap=14 tcp=21 topuser=- 2026-08-14 05:36:13 L1=0.49 run=1 blk=0 avail=8383 (71.5%) swpO=0 conn=1 myRSS=1129 php=1 phpRSS=40 ap=14 tcp=24 topuser=evolution 2026-08-14 05:36:15 L1=0.49 run=2 blk=0 avail=8270 (70.5%) swpO=0 conn=1 myRSS=1129 php=1 phpRSS=149 ap=15 tcp=26 topuser=madalice 2026-08-14 05:36:23 L1=0.50 run=1 blk=0 avail=8374 (71.4%) swpO=0 conn=2 myRSS=1129 php=1 phpRSS=40 ap=15 tcp=23 topuser=evolution 2026-08-14 05:36:25 L1=0.50 run=3 blk=0 avail=8368 (71.3%) swpO=0 conn=1 myRSS=1129 php=1 phpRSS=53 ap=15 tcp=22 topuser=madalice 2026-08-14 05:36:33 L1=0.50 run=1 blk=0 avail=8370 (71.4%) swpO=0 conn=2 myRSS=1129 php=1 phpRSS=40 ap=15 tcp=20 topuser=evolution 2026-08-14 05:36:35 L1=0.50 run=1 blk=0 avail=8381 (71.5%) swpO=0 conn=1 myRSS=1129 php=0 phpRSS=0 ap=15 tcp=21 topuser=- 2026-08-14 05:36:43 L1=0.90 run=3 blk=0 avail=8248 (70.3%) swpO=0 conn=2 myRSS=1129 php=1 phpRSS=106 ap=22 tcp=61 topuser=madalice 2026-08-14 05:36:45 L1=0.90 run=3 blk=0 avail=7891 (67.3%) swpO=0 conn=1 myRSS=1129 php=2 phpRSS=158 ap=78 tcp=96 topuser=madalice 2026-08-14 05:36:53 L1=1.40 run=8 blk=1 avail=6419 (54.7%) swpO=617 conn=10 myRSS=1129 php=10 phpRSS=1709 ap=105 tcp=43 topuser=madalice