INCIDENT 2026-08-14 07:05:48 trigger: php_rss=1705MB ================================================================== load: 3.96 2.01 1.38 15/623 1596848 ncpu:10 mem_avail: 6432MB/11729MB (54.8%) swap_used:1008MB swapout:0/s blocked(D):0 running:12 iowait:0.0% steal:0.0% php: 12 procs / 1705MB heaviest user: madalice (8 procs, 1525MB) apache: 45 procs tcp_estab: 32 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 8 1645 mysql 1 1397 root 236 954 nobody 43 688 evolution 10 266 netdata 8 265 kurri 4 50 dovenull 6 26 wp-toolkit 6 21 mailnull 3 20 mailman 20 15 zabbix 1 14 lowrange 1 13 cpanellogin 1 13 dovecot 3 8 named 1 6 nscd 1 4 cpanelconnecttrack 1 3 polkitd 1 2 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 8 1689 evolution 6 324 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6087 MB Active(file): 4651 MB Inactive(file): 880 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 585 MB CommitLimit: 9960 MB Committed_AS: 9545 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1404480 root 05:54:32 2848 /usr/bin/imunify-agent-proxy 1594722 root 02:48 63024 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 1420296 1 mysql 1430748 3.7 Ssl 05:26:47 /usr/sbin/mariadbd 1596797 1596774 madalice 269060 127 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596801 1596650 madalice 268468 124 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596803 1596637 madalice 265844 114 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596800 1592221 madalice 258564 114 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 213572 2.5 Ssl 45-20:55:50 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1451533 1444234 root 185620 0.0 S 04:28:41 spamd child 1451534 1444234 root 181412 0.0 S 04:28:41 spamd child 1444234 1 root 167280 0.0 Ss 04:43:00 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1596809 1595752 madalice 143460 122 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596807 1595648 madalice 113384 88.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1596830 1593630 evolution 109160 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 159820 1 root 103784 0.0 Rs 24-21:18:58 /usr/lib/systemd/systemd-journald 1596805 1596762 evolution 67772 17.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1596812 1593215 evolution 67132 15.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1594722 1 root 63024 0.7 Ssl 02:48 /opt/imunify360/venv/bin/python3 -m imav.run 1353308 1 root 41840 0.0 Ss 23-04:24:20 cpsrvd (SSL) - waiting for connections 1596815 1596349 evolution 41280 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1596844 1592447 evolution 41212 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 41192 0.1 Sl 45-20:55:45 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2223 1201 root 39344 0.0 Sl 45-20:55:49 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1596878 1596672 evolution 34592 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1443709 1 root 31912 0.0 Ss 04:43:35 lfd - sleeping 1594018 1276780 nobody 22040 0.0 S 03:54 /usr/sbin/httpd -k start 1593812 1276780 nobody 21696 0.0 S 04:15 /usr/sbin/httpd -k start 1593961 1276780 nobody 21280 0.0 S 03:59 /usr/sbin/httpd -k start 1594485 1276780 nobody 20792 0.0 S 03:11 /usr/sbin/httpd -k start 1592221 1276780 nobody 20232 0.0 S 06:41 /usr/sbin/httpd -k start 1595534 1276780 nobody 20088 0.0 S 01:47 /usr/sbin/httpd -k start 1595648 1276780 nobody 19940 0.0 S 01:38 /usr/sbin/httpd -k start 1593988 1276780 nobody 19520 0.0 S 03:58 /usr/sbin/httpd -k start 1595662 1276780 nobody 19520 0.0 S 01:37 /usr/sbin/httpd -k start 1593630 1276780 nobody 19400 0.0 S 04:35 /usr/sbin/httpd -k start 1595752 1276780 nobody 19364 0.1 S 01:29 /usr/sbin/httpd -k start 1595780 1276780 nobody 19196 0.1 S 01:28 /usr/sbin/httpd -k start 1592447 1276780 nobody 18884 0.0 S 06:19 /usr/sbin/httpd -k start 1596350 1276780 nobody 18716 0.1 S 00:42 /usr/sbin/httpd -k start 1596673 1276780 nobody 18580 0.2 S 00:12 /usr/sbin/httpd -k start 1596669 1276780 nobody 18344 0.2 S 00:12 /usr/sbin/httpd -k start 1596725 1276780 nobody 18228 0.3 S 00:09 /usr/sbin/httpd -k start 1593215 1276780 nobody 18144 0.0 S 05:10 /usr/sbin/httpd -k start 1595792 1276780 nobody 17860 0.0 S 01:27 /usr/sbin/httpd -k start 1596389 1276780 nobody 17756 0.0 S 00:39 /usr/sbin/httpd -k start 1595790 1276780 nobody 17596 0.0 S 01:27 /usr/sbin/httpd -k start 1596763 1276780 nobody 17532 0.0 S 00:08 /usr/sbin/httpd -k start 1596659 1276780 nobody 17528 0.0 R 00:13 /usr/sbin/httpd -k start 1596637 1276780 nobody 17216 0.2 S 00:15 /usr/sbin/httpd -k start 1596774 1276780 nobody 16976 0.0 S 00:07 /usr/sbin/httpd -k start 1585544 1471 root 16788 0.0 S 16:51 cPhulkd - dbprocessor 1595779 1276780 nobody 16572 0.0 S 01:28 /usr/sbin/httpd -k start 1596349 1276780 nobody 16504 0.0 S 00:42 /usr/sbin/httpd -k start 1596661 1276780 nobody 16132 0.0 S 00:13 /usr/sbin/httpd -k start 1596772 1276780 nobody 15836 0.0 S 00:07 /usr/sbin/httpd -k start 1596660 1276780 nobody 15636 0.0 S 00:13 /usr/sbin/httpd -k start 1596658 1276780 nobody 15572 0.0 S 00:13 /usr/sbin/httpd -k start 1596650 1276780 nobody 15488 0.0 S 00:14 /usr/sbin/httpd -k start 1471 1 root 15456 0.0 Ss 45-20:55:49 cPhulkd - processor 1594001 1471 root 15300 0.0 S 03:56 cPhulkd - processor - http socket 1596651 1276780 nobody 15268 0.0 S 00:14 /usr/sbin/httpd -k start 1596762 1276780 nobody 15080 0.2 S 00:08 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+--------------------+--------------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+--------------------+--------------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 214809 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 214779 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Sending data | SELECT option_name, option_value FROM QpCIPREUS_options WHERE option_name IN ('_transient_et_core_path','_transient_timeout_et_core_path') | | 214706 | root | 108-1481181613 | Execute | 0 | Sending data | SELECT jobs.id, jobs.pmId, jobs.clientid, jobs.company, jobs.status, jobs.suburb, jobs.new_flag, jobs.reference, jobs.cat, jobs.dateadded, jobs.price, jobs.nextaction, jobs.repId, contacts.code, contacts.company, contacts.lastname, contacts.firstname, contacts.trading_names, jobs.site, jobs | +--------+--------------------+--------------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/portal.evolutionerp.com.au-ssl_log 230 evolution/my.evolutionerp.com.au-ssl_log 223 evolution/wp.evolutionerp.com.au 64 madalice/madalice.com.au-ssl_log 40 evolution/evolutionerp.com.au-ssl_log 23 whiz/whizengineering.com.au-ssl_log 13 aaa/aaadownunder.com.au-ssl_log 10 alison/alisonarts.com.au-ssl_log 10 tubesupplies/tubesupplies.com.au-ssl_log 7 corpkicks/corporatekicks.com.au-ssl_log 2 otter2/otterfencing.net.au-ssl_log 2 tubesupplies/tubesupplies.com.au 1 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 272 203.54.180.238 86 103.104.165.99 64 20.63.34.22 37 103.104.164.114 35 180.181.236.49 21 136.70.81.125 13 20.104.82.183 12 2.57.122.178 9 93.152.205.81 8 216.73.216.122 7 101.166.96.210 6 116.91.223.103 5 54.86.66.252 5 39.194.2.90 5 184.72.115.35 --- top request paths across all vhosts (last 3 min) --- 98 GET /factory_session_checker.php 79 POST /functions.php 49 GET /factory_session_processed_qty.php 49 GET /factory_session_joiner.php 48 GET /app/ajax.php 33 GET /heartbeat.php 30 GET /index.php 15 POST /app/ajax/selectFilter.php 12 POST /app/ajax.php 9 POST /app/ajax/selectFilterSingle.php 8 POST /plugins/csvexporter/plugin.php 6 GET / 5 POST /inveditsave.php 5 GET /store/diamond-bling-laces/ 3 POST /wp-cron.php 3 POST /purchaseaddsave.php 3 POST /opportunityeditsave.php 2 POST /wp-login.php 2 POST /wp-json/batch/v1 2 POST /quoteditsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 98 GET /factory_session_checker.php 49 GET /factory_session_processed_qty.php 49 GET /factory_session_joiner.php 33 GET /heartbeat.php 1 GET /index.php -- last 10 requests -- 203.54.180.238 - - [14/Aug/2026:07:05:39 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [14/Aug/2026:07:05:39 +1000] "GET /factory_session_joiner.php?id=34581 HTTP/1.1" 200 86 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [14/Aug/2026:07:05:39 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:07:05:39 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:07:05:40 +1000] "GET /heartbeat.php?sentAt=1786655140&bytes=106,126,49,164&_=1786602372622 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:07:05:43 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:07:05:44 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:07:05:44 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:07:05:45 +1000] "GET /factory_session_joiner.php?id=34557 HTTP/1.1" 200 94 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [14/Aug/2026:07:05:45 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 79 POST /functions.php 48 GET /app/ajax.php 29 GET /index.php 15 POST /app/ajax/selectFilter.php 12 POST /app/ajax.php 9 POST /app/ajax/selectFilterSingle.php 8 POST /plugins/csvexporter/plugin.php 5 POST /inveditsave.php 3 POST /purchaseaddsave.php 3 POST /opportunityeditsave.php 2 POST /quoteditsave.php 2 POST /clienteditsave.php -- last 10 requests -- 203.54.180.238 - - [14/Aug/2026:07:05:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 238 "https://my.evolutionerp.com.au/index.php?page=purchasereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 180.181.236.49 - - [14/Aug/2026:07:05:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=1255" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 116.91.223.103 - - [14/Aug/2026:07:05:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2273" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:15 180.181.236.49 - - [14/Aug/2026:07:05:39 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 14520 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=1255" "Mozilla/5.0 (Windows NT 10.0; Win64; 103.104.165.99 - - [14/Aug/2026:07:05:41 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 282 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11786&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 180.181.236.49 - - [14/Aug/2026:07:05:41 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=1255" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 101.166.96.210 - - [14/Aug/2026:07:05:41 +1000] "GET /index.php?page=quotereg HTTP/1.1" 200 46532 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36604" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 101.166.96.210 - - [14/Aug/2026:07:05:41 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 101.166.96.210 - - [14/Aug/2026:07:05:42 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotereg&call=getUserSetting&caller=ajaxSubmitLocal&seq=18086546137 HTTP/1.1" 200 90 "https://my.evolutionerp.com.au/index.php?p 101.166.96.210 - - [14/Aug/2026:07:05:42 +1000] "POST /quoteditsave.php?call=getTheQuotes HTTP/1.1" 200 13233 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi == evolution/wp.evolutionerp.com.au == -- top paths -- 2 GET /wp-ws68.php 2 GET /qterm.php 2 GET /makeasmtp.php 2 GET /ccc.php 1 GET /yj09.php 1 GET /xyn.php 1 GET /x.php 1 GET /wp-temp.php 1 GET /wp-includes/Text/ 1 GET /wp-includes/sodium_compat/ 1 GET //wp-includes/Requests/ 1 GET /wp-includes/ID3/about.php -- last 10 requests -- 20.63.34.22 - - [14/Aug/2026:07:04:51 +1000] "GET /wp-includes/blocks/details/ HTTP/1.1" 200 2326 "-" "-" 20.63.34.22 - - [14/Aug/2026:07:04:52 +1000] "GET /wp-includes/blocks/audio/ HTTP/1.1" 200 3046 "-" "-" 20.63.34.22 - - [14/Aug/2026:07:04:52 +1000] "GET /wp-temp.php HTTP/1.1" 404 130059 "-" "-" 20.63.34.22 - - [14/Aug/2026:07:04:53 +1000] "GET //wp-admin/js/index.php HTTP/1.1" 500 188 "-" "-" 20.63.34.22 - - [14/Aug/2026:07:04:55 +1000] "GET /puc.php HTTP/1.1" 404 130055 "-" "-" 20.63.34.22 - - [14/Aug/2026:07:04:56 +1000] "GET //wp-includes/Requests/ HTTP/1.1" 200 1025 "-" "-" 20.63.34.22 - - [14/Aug/2026:07:04:57 +1000] "GET /8.php HTTP/1.1" 404 130053 "-" "-" 20.63.34.22 - - [14/Aug/2026:07:04:58 +1000] "GET /1.php HTTP/1.1" 404 130053 "-" "-" 20.63.34.22 - - [14/Aug/2026:07:04:59 +1000] "GET /about.php HTTP/1.1" 404 130057 "-" "-" 20.63.34.22 - - [14/Aug/2026:07:05:01 +1000] "GET //admin.php HTTP/1.1" 301 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-14 07:03:20 L1=1.73 run=3 blk=0 avail=7768 (66.2%) swpO=0 conn=2 myRSS=1389 php=2 phpRSS=188 ap=29 tcp=30 topuser=madalice 2026-08-14 07:03:28 L1=1.54 run=1 blk=0 avail=7906 (67.4%) swpO=0 conn=1 myRSS=1389 php=0 phpRSS=0 ap=28 tcp=29 topuser=- 2026-08-14 07:03:30 L1=1.54 run=2 blk=0 avail=7772 (66.3%) swpO=0 conn=2 myRSS=1389 php=2 phpRSS=195 ap=28 tcp=46 topuser=madalice 2026-08-14 07:03:38 L1=1.45 run=1 blk=0 avail=7902 (67.4%) swpO=0 conn=1 myRSS=1389 php=0 phpRSS=0 ap=28 tcp=31 topuser=- 2026-08-14 07:03:40 L1=1.45 run=6 blk=0 avail=7787 (66.4%) swpO=0 conn=2 myRSS=1389 php=3 phpRSS=212 ap=28 tcp=32 topuser=evolution 2026-08-14 07:03:48 L1=1.46 run=3 blk=0 avail=7606 (64.8%) swpO=0 conn=4 myRSS=1389 php=3 phpRSS=387 ap=29 tcp=35 topuser=evolution 2026-08-14 07:03:50 L1=1.46 run=4 blk=0 avail=7369 (62.8%) swpO=0 conn=2 myRSS=1389 php=5 phpRSS=548 ap=29 tcp=38 topuser=madalice 2026-08-14 07:03:58 L1=1.47 run=5 blk=0 avail=7477 (63.7%) swpO=0 conn=4 myRSS=1389 php=4 phpRSS=537 ap=31 tcp=35 topuser=madalice 2026-08-14 07:04:00 L1=1.47 run=3 blk=0 avail=7540 (64.3%) swpO=0 conn=3 myRSS=1389 php=3 phpRSS=252 ap=31 tcp=38 topuser=madalice 2026-08-14 07:04:08 L1=1.69 run=5 blk=0 avail=7687 (65.5%) swpO=0 conn=4 myRSS=1389 php=6 phpRSS=359 ap=33 tcp=35 topuser=evolution 2026-08-14 07:04:10 L1=1.69 run=2 blk=0 avail=7810 (66.6%) swpO=0 conn=3 myRSS=1389 php=2 phpRSS=127 ap=33 tcp=39 topuser=alison 2026-08-14 07:04:18 L1=1.97 run=4 blk=0 avail=7719 (65.8%) swpO=0 conn=4 myRSS=1390 php=2 phpRSS=209 ap=35 tcp=34 topuser=madalice 2026-08-14 07:04:20 L1=1.97 run=2 blk=0 avail=7730 (65.9%) swpO=0 conn=3 myRSS=1390 php=2 phpRSS=198 ap=34 tcp=39 topuser=evolution 2026-08-14 07:04:28 L1=1.90 run=2 blk=0 avail=7823 (66.7%) swpO=0 conn=4 myRSS=1390 php=1 phpRSS=75 ap=36 tcp=30 topuser=evolution 2026-08-14 07:04:30 L1=1.90 run=3 blk=0 avail=7763 (66.2%) swpO=0 conn=3 myRSS=1390 php=2 phpRSS=175 ap=34 tcp=31 topuser=evolution 2026-08-14 07:04:38 L1=1.91 run=4 blk=0 avail=7851 (66.9%) swpO=0 conn=4 myRSS=1390 php=3 phpRSS=159 ap=28 tcp=33 topuser=aaa 2026-08-14 07:04:40 L1=1.91 run=2 blk=0 avail=7792 (66.4%) swpO=0 conn=3 myRSS=1390 php=2 phpRSS=186 ap=28 tcp=34 topuser=evolution 2026-08-14 07:04:48 L1=2.09 run=5 blk=0 avail=7739 (66.0%) swpO=0 conn=3 myRSS=1395 php=2 phpRSS=227 ap=29 tcp=33 topuser=speedlin 2026-08-14 07:04:50 L1=2.09 run=3 blk=0 avail=7723 (65.8%) swpO=0 conn=3 myRSS=1396 php=3 phpRSS=141 ap=29 tcp=33 topuser=evolution 2026-08-14 07:04:58 L1=1.92 run=3 blk=0 avail=7802 (66.5%) swpO=0 conn=3 myRSS=1396 php=2 phpRSS=156 ap=29 tcp=37 topuser=evolution 2026-08-14 07:05:00 L1=1.92 run=4 blk=0 avail=7865 (67.1%) swpO=0 conn=2 myRSS=1396 php=2 phpRSS=99 ap=30 tcp=31 topuser=alison 2026-08-14 07:05:08 L1=1.94 run=6 blk=0 avail=7809 (66.6%) swpO=0 conn=3 myRSS=1396 php=1 phpRSS=96 ap=32 tcp=34 topuser=evolution 2026-08-14 07:05:10 L1=1.94 run=2 blk=0 avail=7725 (65.9%) swpO=0 conn=2 myRSS=1396 php=2 phpRSS=207 ap=33 tcp=37 topuser=madalice 2026-08-14 07:05:18 L1=2.19 run=4 blk=0 avail=7770 (66.3%) swpO=0 conn=3 myRSS=1396 php=4 phpRSS=196 ap=33 tcp=37 topuser=evolution 2026-08-14 07:05:20 L1=2.19 run=1 blk=0 avail=7852 (66.9%) swpO=0 conn=2 myRSS=1396 php=1 phpRSS=40 ap=33 tcp=31 topuser=evolution 2026-08-14 07:05:28 L1=2.24 run=4 blk=0 avail=7734 (65.9%) swpO=0 conn=3 myRSS=1396 php=2 phpRSS=240 ap=28 tcp=31 topuser=madalice 2026-08-14 07:05:30 L1=2.24 run=2 blk=0 avail=7656 (65.3%) swpO=0 conn=2 myRSS=1396 php=3 phpRSS=341 ap=28 tcp=34 topuser=evolution 2026-08-14 07:05:38 L1=2.46 run=3 blk=0 avail=7606 (64.9%) swpO=0 conn=3 myRSS=1396 php=2 phpRSS=254 ap=43 tcp=44 topuser=evolution 2026-08-14 07:05:40 L1=2.46 run=7 blk=0 avail=7043 (60.1%) swpO=0 conn=2 myRSS=1396 php=9 phpRSS=1008 ap=44 tcp=55 topuser=evolution 2026-08-14 07:05:48 L1=3.96 run=12 blk=0 avail=6432 (54.8%) swpO=0 conn=12 myRSS=1397 php=12 phpRSS=1705 ap=45 tcp=32 topuser=madalice