INCIDENT 2026-08-14 07:56:24 trigger: php_rss=2361MB ================================================================== load: 3.63 2.07 1.98 18/652 1637302 ncpu:10 mem_avail: 5892MB/11729MB (50.2%) swap_used:1013MB swapout:521/s blocked(D):0 running:19 iowait:0.2% steal:0.0% php: 23 procs / 2361MB heaviest user: madalice (9 procs, 1692MB) apache: 65 procs tcp_estab: 62 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 9 1755 mysql 1 1504 nobody 64 1045 root 236 905 evolution 17 561 netdata 8 262 alison 1 116 cpanellogin 1 67 kurri 5 64 dovenull 6 27 lowrange 2 25 wp-toolkit 6 21 mailnull 3 18 mailman 20 15 zabbix 1 14 dovecot 3 8 named 1 6 nscd 1 4 cpanelconnecttrack 1 3 polkitd 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 9 1800 evolution 14 595 alison 1 118 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5353 MB Active(file): 3547 MB Inactive(file): 948 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 453 MB CommitLimit: 9960 MB Committed_AS: 11285 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1404480 root 06:45:08 2848 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 1420296 1 mysql 1540584 6.5 Ssl 06:17:23 /usr/sbin/mariadbd 1637256 1636481 madalice 267476 112 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1637258 1637121 madalice 267028 115 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1637253 1637184 madalice 260472 111 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1637254 1636453 madalice 235120 109 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1637257 1636473 madalice 228500 102 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1637260 1637259 madalice 226084 101 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 214236 2.5 Ssl 45-21:46:26 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1637255 1635861 madalice 212476 112 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1637262 1637213 madalice 188160 86.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1451533 1444234 root 188132 0.0 S 05:19:17 spamd child 1451534 1444234 root 179356 0.0 S 05:19:17 spamd child 1444234 1 root 143732 0.0 Ss 05:33:36 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1637266 1636449 alison 131396 131 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 159820 1 root 118004 0.0 Ss 24-22:09:34 /usr/lib/systemd/systemd-journald 1637267 1636469 madalice 108768 78.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1633930 1629364 evolution 73056 0.0 S 04:44 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1611528 1353308 cpanellogin 69320 0.0 S 30:45 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 1634805 1634169 evolution 44200 0.0 S 03:31 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1634428 1634245 evolution 44160 0.0 S 04:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1637270 1632941 evolution 43256 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 42180 0.1 Ss 45-21:46:25 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 41860 0.0 Ss 23-05:14:56 cpsrvd (SSL) - waiting for connections 1634032 1631550 evolution 41288 0.0 S 04:34 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1634100 1633456 evolution 41280 0.0 S 04:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1633931 1632904 evolution 41268 0.0 S 04:43 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1634750 1628263 evolution 41200 0.0 S 03:35 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1634114 1631544 evolution 40908 0.0 S 04:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1637271 1635888 evolution 40472 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1637265 1636467 evolution 40060 1.5 S 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1637263 1636394 evolution 40008 1.5 S 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1637274 1636458 evolution 39636 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1637300 1636465 evolution 39476 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 38908 0.0 Sl 45-21:46:25 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 37944 0.1 Sl 45-21:46:21 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1443709 1 root 30496 0.0 Ss 05:34:11 lfd - sleeping 1633457 1276780 nobody 21760 0.0 S 05:30 /usr/sbin/httpd -k start 1635027 1276780 nobody 21176 0.0 S 03:12 /usr/sbin/httpd -k start 1628263 1276780 nobody 20800 0.0 S 10:32 /usr/sbin/httpd -k start 1631544 1276780 nobody 19428 0.0 S 07:24 /usr/sbin/httpd -k start 1635609 1276780 nobody 19360 0.0 S 02:13 /usr/sbin/httpd -k start 1633684 1276780 nobody 19332 0.0 S 05:10 /usr/sbin/httpd -k start 1636458 1276780 nobody 19160 0.0 S 01:16 /usr/sbin/httpd -k start 1636068 1276780 nobody 19084 0.0 S 01:39 /usr/sbin/httpd -k start 1631550 1276780 nobody 19052 0.0 S 07:24 /usr/sbin/httpd -k start 1636104 1276780 nobody 18916 0.0 S 01:37 /usr/sbin/httpd -k start 1632904 1276780 nobody 18784 0.0 S 06:12 /usr/sbin/httpd -k start 1636442 1276780 nobody 18740 0.0 S 01:17 /usr/sbin/httpd -k start 1635888 1276780 nobody 18736 0.0 S 01:59 /usr/sbin/httpd -k start 1636112 1276780 nobody 18700 0.0 S 01:36 /usr/sbin/httpd -k start 1636086 1276780 nobody 18600 0.0 S 01:38 /usr/sbin/httpd -k start 1636465 1276780 nobody 18388 0.1 S 01:16 /usr/sbin/httpd -k start 1635591 1276780 nobody 18232 0.0 S 02:14 /usr/sbin/httpd -k start 1636431 1276780 nobody 18084 0.0 S 01:18 /usr/sbin/httpd -k start 1635861 1276780 nobody 18008 0.0 S 02:00 /usr/sbin/httpd -k start 1636459 1276780 nobody 17968 0.0 S 01:16 /usr/sbin/httpd -k start 1636394 1276780 nobody 17944 0.0 S 01:20 /usr/sbin/httpd -k start 1636444 1276780 nobody 17884 0.0 S 01:17 /usr/sbin/httpd -k start 1636457 1276780 nobody 17884 0.0 S 01:17 /usr/sbin/httpd -k start 1636448 1276780 nobody 17832 0.0 S 01:17 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 550163 | root | 85-1559715131 | Execute | 0 | Sending data | SELECT inventory_soh.*, branches.name from inventory_soh,branches where branches.id=inventory_soh.branchid AND branches.status = '1' AND itemid = '8915' | | 550161 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 373 evolution/portal.evolutionerp.com.au-ssl_log 95 madalice/madalice.com.au-ssl_log 51 evolution/portal.evolutionerp.com.au 18 aaa/aaadownunder.com.au-ssl_log 10 tubesupplies/tubesupplies.com.au-ssl_log 3 alison/alisonarts.com.au-ssl_log 1 customc/customcentral.com.au-ssl_log 1 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 177 203.54.180.238 99 103.104.164.114 67 182.239.240.254 66 103.104.165.99 37 68.221.73.131 23 104.28.222.131 10 116.91.223.103 9 180.181.236.49 9 118.127.40.55 6 165.225.233.109 5 216.73.216.122 5 2001:8004:dad:e7bd:c8c4:982c:5614:3ccb 5 124.190.136.22 2 91.92.243.243 2 207.46.13.51 --- top request paths across all vhosts (last 3 min) --- 136 POST /functions.php 84 GET /app/ajax.php 32 GET /index.php 25 GET /heartbeat.php 25 GET /factory_session_checker.php 18 POST /clienteditsave.php 16 POST /app/ajax.php 13 POST /app/ajax/selectFilterSingle.php 13 GET /factory_session_processed_qty.php 13 GET /factory_session_joiner.php 11 POST /plugins/csvexporter/plugin.php 9 POST /logsave.php 7 GET //app/ajax.php 6 POST /reqSave.php 6 POST /purchaseaddsave.php 6 POST / 6 GET / 5 POST /app/ajax/selectFilter.php 5 GET /store/design-your-own-send-in/ 4 POST /inveditsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 136 POST /functions.php 84 GET /app/ajax.php 32 GET /index.php 18 POST /clienteditsave.php 16 POST /app/ajax.php 13 POST /app/ajax/selectFilterSingle.php 11 POST /plugins/csvexporter/plugin.php 9 POST /logsave.php 7 GET //app/ajax.php 6 POST /reqSave.php 6 POST /purchaseaddsave.php 5 POST /app/ajax/selectFilter.php -- last 10 requests -- 203.54.180.238 - - [14/Aug/2026:07:56:12 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29291" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 103.104.165.99 - - [14/Aug/2026:07:56:12 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=activities&date=2026-08-17&focus=11916" "Mozilla/5.0 (Windows NT 10.0; 165.225.233.109 - - [14/Aug/2026:07:56:13 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=testTagDesc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 180.181.236.49 - - [14/Aug/2026:07:56:14 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=1240" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 103.104.165.99 - - [14/Aug/2026:07:56:15 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=11197" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 182.239.240.254 - - [14/Aug/2026:07:56:18 +1000] "POST //functions.php?call=heartbeat HTTP/1.1" 200 996 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=4155" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 203.54.180.238 - - [14/Aug/2026:07:56:19 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities&date=13-08-2026&keyword=br&filtertype=1" "Mozilla/5.0 (Windo 165.225.233.109 - - [14/Aug/2026:07:56:19 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=testTagDesc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 165.225.233.109 - - [14/Aug/2026:07:56:20 +1000] "POST /testTagSave.php?call=fetch HTTP/1.1" 200 657 "https://my.evolutionerp.com.au/index.php?page=testTagDesc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 165.225.233.109 - - [14/Aug/2026:07:56:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=testTagDesc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 25 GET /heartbeat.php 25 GET /factory_session_checker.php 13 GET /factory_session_processed_qty.php 13 GET /factory_session_joiner.php 1 GET /xx.php 1 GET /sf.php 1 GET /ops.php 1 GET /media.php 1 GET /mac.php 1 GET /k.php 1 GET /jriuaaol.php 1 GET /images.php -- last 10 requests -- 203.54.180.238 - - [14/Aug/2026:07:55:50 +1000] "GET /heartbeat.php?sentAt=1786658150&bytes=106,126,61,102&_=1786602372923 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:07:55:51 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 128 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [14/Aug/2026:07:55:51 +1000] "GET /factory_session_joiner.php?id=34542 HTTP/1.1" 200 94 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [14/Aug/2026:07:55:52 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:07:55:57 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:07:55:58 +1000] "GET /heartbeat.php?sentAt=1786658158&bytes=106,126,61,110&_=1786657464164 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:07:56:00 +1000] "GET /heartbeat.php?sentAt=1786658160&bytes=106,126,61,112&_=1786602372924 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:07:56:01 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 128 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [14/Aug/2026:07:56:01 +1000] "GET /factory_session_joiner.php?id=34542 HTTP/1.1" 200 94 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [14/Aug/2026:07:56:02 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == madalice/madalice.com.au-ssl_log == -- top paths -- 6 POST / 5 GET /store/design-your-own-send-in/ 4 GET / 3 GET /sitemap_index.xml 2 GET /store/xl-magnetic-drop-down-side-door-sneaker-display-case-black/ 1 POST /wp-admin/admin-ajax.php 1 GET /wp-login.php 1 GET /wp-config.php.bak 1 GET /wp-config.php 1 GET /wp-admin/ 1 GET /store/hand-painted-nike-af1-ktm/ 1 GET /sitemap.xml -- last 10 requests -- 104.28.222.131 - - [14/Aug/2026:07:56:14 +1000] "GET /.git/config HTTP/1.1" 404 30543 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 104.28.222.131 - - [14/Aug/2026:07:56:14 +1000] "GET /.dev.vars HTTP/1.1" 404 30543 "https://www.google.com/search?q=madalice.com.au" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 118.127.40.55 - - [14/Aug/2026:07:56:16 +1000] "POST /?wordfence_syncAttackData=1786658175.816 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://madalice.com.au" 104.28.222.131 - - [14/Aug/2026:07:56:16 +1000] "GET /.env.bak HTTP/1.1" 404 30542 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0" 104.28.222.134 - - [14/Aug/2026:07:56:16 +1000] "GET /config.yml HTTP/1.1" 404 30542 "https://www.google.com/search?q=madalice.com.au" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chro 118.127.40.55 - - [14/Aug/2026:07:56:16 +1000] "POST /?wordfence_syncAttackData=1786658175.9357 HTTP/1.1" 200 36585 "-" "WordPress/7.0.4; https://madalice.com.au" 118.127.40.55 - - [14/Aug/2026:07:56:16 +1000] "POST /?wordfence_syncAttackData=1786658175.9125 HTTP/1.1" 200 36585 "-" "WordPress/7.0.4; https://madalice.com.au" 118.127.40.55 - - [14/Aug/2026:07:56:16 +1000] "POST /?wordfence_syncAttackData=1786658175.9459 HTTP/1.1" 200 36585 "-" "WordPress/7.0.4; https://madalice.com.au" 118.127.40.55 - - [14/Aug/2026:07:56:16 +1000] "POST /?wordfence_syncAttackData=1786658175.8785 HTTP/1.1" 200 36586 "-" "WordPress/7.0.4; https://madalice.com.au" 104.28.254.132 - - [14/Aug/2026:07:56:15 +1000] "GET /.env.old HTTP/1.1" 404 30541 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" --- last 30 samples (run-up to this incident) --- 2026-08-14 07:54:04 L1=1.27 run=3 blk=0 avail=7428 (63.3%) swpO=0 conn=2 myRSS=1503 php=12 phpRSS=659 ap=35 tcp=32 topuser=evolution 2026-08-14 07:54:04 L1=1.27 run=2 blk=0 avail=7510 (64.0%) swpO=0 conn=1 myRSS=1503 php=11 phpRSS=540 ap=35 tcp=31 topuser=evolution 2026-08-14 07:54:14 L1=1.23 run=2 blk=0 avail=7475 (63.7%) swpO=0 conn=2 myRSS=1503 php=10 phpRSS=470 ap=48 tcp=33 topuser=evolution 2026-08-14 07:54:14 L1=1.23 run=1 blk=0 avail=7480 (63.8%) swpO=0 conn=1 myRSS=1503 php=10 phpRSS=470 ap=47 tcp=31 topuser=evolution 2026-08-14 07:54:24 L1=1.52 run=2 blk=0 avail=7364 (62.8%) swpO=0 conn=2 myRSS=1503 php=11 phpRSS=656 ap=39 tcp=36 topuser=evolution 2026-08-14 07:54:24 L1=1.52 run=2 blk=0 avail=7285 (62.1%) swpO=0 conn=1 myRSS=1503 php=11 phpRSS=728 ap=40 tcp=39 topuser=evolution 2026-08-14 07:54:34 L1=1.51 run=4 blk=0 avail=7447 (63.5%) swpO=0 conn=2 myRSS=1503 php=10 phpRSS=470 ap=40 tcp=28 topuser=evolution 2026-08-14 07:54:34 L1=1.51 run=1 blk=0 avail=7516 (64.1%) swpO=0 conn=1 myRSS=1503 php=10 phpRSS=470 ap=39 tcp=28 topuser=evolution 2026-08-14 07:54:44 L1=1.43 run=2 blk=0 avail=7496 (63.9%) swpO=0 conn=2 myRSS=1503 php=11 phpRSS=524 ap=38 tcp=34 topuser=evolution 2026-08-14 07:54:44 L1=1.43 run=6 blk=0 avail=7456 (63.6%) swpO=0 conn=1 myRSS=1503 php=11 phpRSS=560 ap=38 tcp=32 topuser=evolution 2026-08-14 07:54:54 L1=1.45 run=3 blk=0 avail=7381 (62.9%) swpO=0 conn=2 myRSS=1503 php=14 phpRSS=634 ap=49 tcp=38 topuser=evolution 2026-08-14 07:54:54 L1=1.45 run=1 blk=0 avail=7463 (63.6%) swpO=0 conn=1 myRSS=1503 php=10 phpRSS=470 ap=48 tcp=38 topuser=evolution 2026-08-14 07:55:04 L1=1.23 run=2 blk=0 avail=7460 (63.6%) swpO=0 conn=1 myRSS=1503 php=10 phpRSS=470 ap=45 tcp=59 topuser=evolution 2026-08-14 07:55:04 L1=1.23 run=1 blk=0 avail=7448 (63.5%) swpO=0 conn=1 myRSS=1503 php=10 phpRSS=470 ap=47 tcp=60 topuser=evolution 2026-08-14 07:55:14 L1=1.19 run=1 blk=0 avail=7083 (60.4%) swpO=0 conn=1 myRSS=1503 php=10 phpRSS=470 ap=103 tcp=44 topuser=evolution 2026-08-14 07:55:14 L1=1.19 run=1 blk=0 avail=7090 (60.4%) swpO=0 conn=1 myRSS=1503 php=10 phpRSS=470 ap=102 tcp=45 topuser=evolution 2026-08-14 07:55:24 L1=1.00 run=1 blk=0 avail=7148 (60.9%) swpO=0 conn=1 myRSS=1503 php=10 phpRSS=470 ap=93 tcp=26 topuser=evolution 2026-08-14 07:55:24 L1=1.00 run=4 blk=0 avail=7112 (60.6%) swpO=0 conn=1 myRSS=1503 php=11 phpRSS=544 ap=92 tcp=26 topuser=evolution 2026-08-14 07:55:34 L1=1.09 run=5 blk=0 avail=6839 (58.3%) swpO=0 conn=1 myRSS=1503 php=12 phpRSS=916 ap=83 tcp=51 topuser=madalice 2026-08-14 07:55:35 L1=1.09 run=3 blk=0 avail=6716 (57.3%) swpO=0 conn=1 myRSS=1503 php=12 phpRSS=1047 ap=82 tcp=51 topuser=madalice 2026-08-14 07:55:44 L1=1.08 run=4 blk=0 avail=7124 (60.7%) swpO=0 conn=1 myRSS=1504 php=9 phpRSS=584 ap=74 tcp=70 topuser=evolution 2026-08-14 07:55:45 L1=1.08 run=2 blk=0 avail=7318 (62.4%) swpO=0 conn=1 myRSS=1504 php=9 phpRSS=398 ap=74 tcp=64 topuser=evolution 2026-08-14 07:55:54 L1=1.16 run=3 blk=0 avail=7079 (60.4%) swpO=0 conn=1 myRSS=1504 php=10 phpRSS=715 ap=68 tcp=41 topuser=evolution 2026-08-14 07:55:55 L1=1.16 run=4 blk=0 avail=6954 (59.3%) swpO=0 conn=1 myRSS=1504 php=11 phpRSS=877 ap=67 tcp=42 topuser=evolution 2026-08-14 07:56:04 L1=1.21 run=2 blk=0 avail=7245 (61.8%) swpO=0 conn=2 myRSS=1504 php=9 phpRSS=594 ap=58 tcp=28 topuser=evolution 2026-08-14 07:56:05 L1=1.21 run=1 blk=0 avail=7451 (63.5%) swpO=0 conn=1 myRSS=1504 php=8 phpRSS=358 ap=57 tcp=29 topuser=evolution 2026-08-14 07:56:14 L1=1.41 run=9 blk=0 avail=7072 (60.3%) swpO=0 conn=2 myRSS=1504 php=14 phpRSS=925 ap=48 tcp=52 topuser=madalice 2026-08-14 07:56:15 L1=1.41 run=7 blk=0 avail=6912 (58.9%) swpO=0 conn=7 myRSS=1504 php=14 phpRSS=1089 ap=48 tcp=53 topuser=madalice 2026-08-14 07:56:24 L1=3.63 run=19 blk=0 avail=5892 (50.2%) swpO=521 conn=12 myRSS=1504 php=23 phpRSS=2361 ap=65 tcp=62 topuser=madalice 2026-08-14 07:56:25 L1=3.63 run=14 blk=0 avail=5827 (49.7%) swpO=521 conn=9 myRSS=1504 php=22 phpRSS=2064 ap=65 tcp=62 topuser=madalice