INCIDENT 2026-08-14 09:51:41 trigger: php_rss=1682MB mysql_conn=15 ================================================================== load: 1.98 1.68 1.57 14/625 1728975 ncpu:10 mem_avail: 6125MB/11729MB (52.2%) swap_used:1041MB swapout:0/s blocked(D):0 running:14 iowait:0.0% steal:0.0% php: 14 procs / 1682MB heaviest user: madalice (11 procs, 1536MB) apache: 46 procs tcp_estab: 61 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1825 madalice 11 1613 root 236 932 nobody 45 719 netdata 8 259 evolution 7 149 alison 4 52 kurri 4 49 cpanellogin 1 47 dovenull 6 29 wp-toolkit 6 21 lowrange 1 20 mailman 20 15 zabbix 1 13 mailnull 2 11 kamcool 1 10 dovecot 3 8 named 1 6 nscd 1 4 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 11 1634 evolution 3 145 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6070 MB Active(file): 4730 MB Inactive(file): 626 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 391 MB CommitLimit: 9960 MB Committed_AS: 9398 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1404480 root 08:40:25 2848 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 1420296 1 mysql 1868956 11.5 Ssl 08:12:40 /usr/sbin/mariadbd 1728922 1725799 madalice 231376 103 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1728925 1728637 madalice 229936 103 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 214088 2.5 Ssl 45-23:41:43 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1728923 1727136 madalice 202032 95.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1728924 1718994 madalice 190776 90.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1451533 1444234 root 188484 0.0 S 07:14:34 spamd child 1451534 1444234 root 178228 0.0 S 07:14:34 spamd child 1728927 1724359 madalice 178008 152 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 159820 1 root 157708 0.0 Ss 25-00:04:51 /usr/lib/systemd/systemd-journald 1728928 1728025 madalice 154352 128 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1728931 1728710 madalice 152756 128 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1728929 1727088 madalice 148672 138 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1728933 1728029 madalice 133036 111 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1444234 1 root 130756 0.0 Ss 07:28:53 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1728941 1728082 madalice 122888 96.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1728944 1725933 madalice 93368 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1728942 1728938 evolution 67520 15.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1728987 1728980 evolution 63748 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1713763 1353308 cpanellogin 48836 0.0 S 18:10 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 1469 1 root 41644 0.1 Ss 45-23:41:42 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 41532 0.0 Ss 23-07:10:13 cpsrvd (SSL) - waiting for connections 1725924 1724357 evolution 40792 0.0 S 03:36 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1728943 1728878 evolution 40732 4.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 39472 0.0 Sl 45-23:41:42 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 35716 0.1 Sl 45-23:41:38 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1443709 1 root 29808 0.0 Ss 07:29:28 lfd - sleeping 1718994 1276780 nobody 22180 0.0 S 11:48 /usr/sbin/httpd -k start 1724359 1276780 nobody 21816 0.0 S 05:33 /usr/sbin/httpd -k start 1724822 3828812 lowrange 21096 0.0 S 05:00 dovecot/imap 1724989 1276780 nobody 20292 0.0 S 04:44 /usr/sbin/httpd -k start 1726411 1276780 nobody 20168 0.1 S 02:56 /usr/sbin/httpd -k start 1725933 1276780 nobody 20128 0.0 S 03:35 /usr/sbin/httpd -k start 1725922 1276780 nobody 20036 0.0 S 03:36 /usr/sbin/httpd -k start 1725495 1276780 nobody 19308 0.0 S 04:06 /usr/sbin/httpd -k start 1726270 1276780 nobody 19248 0.0 S 03:08 /usr/sbin/httpd -k start 1727088 1276780 nobody 18992 0.0 S 02:09 /usr/sbin/httpd -k start 1727855 1276780 nobody 18360 0.0 S 01:28 /usr/sbin/httpd -k start 1728637 1276780 nobody 17900 0.1 S 00:29 /usr/sbin/httpd -k start 1728878 1276780 nobody 17800 0.1 S 00:08 /usr/sbin/httpd -k start 1728740 1276780 nobody 17724 0.0 S 00:19 /usr/sbin/httpd -k start 1728006 1276780 nobody 17620 0.0 S 01:18 /usr/sbin/httpd -k start 1728642 1276780 nobody 17444 0.1 S 00:28 /usr/sbin/httpd -k start 1727994 1276780 nobody 17280 0.0 S 01:19 /usr/sbin/httpd -k start 1724357 1276780 nobody 17212 0.0 S 05:33 /usr/sbin/httpd -k start 1726388 1276780 nobody 17208 0.0 S 02:58 /usr/sbin/httpd -k start 1727305 1276780 nobody 17196 0.0 S 01:50 /usr/sbin/httpd -k start 1725799 1276780 nobody 17188 0.0 S 03:41 /usr/sbin/httpd -k start 1726791 1276780 nobody 17076 0.0 S 02:29 /usr/sbin/httpd -k start 1726806 1276780 nobody 17064 0.0 S 02:28 /usr/sbin/httpd -k start 1728082 1276780 nobody 16916 0.0 S 01:14 /usr/sbin/httpd -k start 1728008 1276780 nobody 16852 0.0 S 01:18 /usr/sbin/httpd -k start 1728029 1276780 nobody 16836 0.0 S 01:17 /usr/sbin/httpd -k start 1471 1 root 16820 0.0 Ss 45-23:41:42 cPhulkd - processor 1727136 1276780 nobody 16736 0.0 S 02:03 /usr/sbin/httpd -k start 1728097 1276780 nobody 16680 0.0 S 01:13 /usr/sbin/httpd -k start 1728156 1276780 nobody 16544 0.0 S 01:10 /usr/sbin/httpd -k start 1601939 1471 root 16528 0.0 S 02:38:43 cPhulkd - dbprocessor 1728764 1276780 nobody 16104 0.0 S 00:15 /usr/sbin/httpd -k start 1727995 1276780 nobody 16028 0.0 S 01:19 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 1446628 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 1446627 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 1446626 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 561 evolution/portal.evolutionerp.com.au-ssl_log 228 lowrange/lowrange.com.au-ssl_log 81 madalice/madalice.com.au-ssl_log 75 madalice/madalice.com.au 49 aaa/aaadownunder.com.au-ssl_log 23 kurri/kurrimotorinn.com.au-ssl_log 5 corpkicks/corporatekicks.com.au-ssl_log 4 olympic/olympicfencing.com.au-ssl_log 4 customc/customcentral.com.au-ssl_log 3 evolution/evolutionerp.com.au-ssl_log 3 infinium/infinium.net.au-ssl_log 3 tubesupplies/tubesupplies.com.au-ssl_log 3 evolution/pdev.evolutionerp.com.au-ssl_log 2 coscom/coscom.com.au-ssl_log 1 (total vhosts taking traffic: 18) --- top client IPs across all vhosts (last 3 min) --- 461 203.54.180.238 81 68.221.73.131 75 103.104.165.99 66 150.228.151.9 65 103.104.164.114 63 85.203.23.27 52 116.91.223.103 49 85.203.23.37 33 180.181.236.49 22 1.145.84.81 11 182.239.240.254 11 118.127.40.55 8 206.83.113.125 7 1.145.73.14 5 195.178.110.101 --- top request paths across all vhosts (last 3 min) --- 240 POST /functions.php 97 GET /heartbeat.php 91 GET /app/ajax.php 64 GET /factory_session_checker.php 43 POST /app/ajax/selectFilter.php 42 GET /index.php 32 GET /factory_session_processed_qty.php 32 GET /factory_session_joiner.php 29 POST /plugins/csvexporter/plugin.php 28 POST /quoteditsave.php 19 POST /app/ajax/selectFilterSingle.php 16 POST /app/ajax.php 16 GET /plugins/fensa/fensa-ajax.php 10 GET / 9 POST /wp-cron.php 9 POST /clienteditsave.php 5 POST /wp-login.php 4 POST /itemModify.php 4 POST /invoiceaddsave.php 4 GET /store/graffiti-airmax-90-custom-shoes/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 240 POST /functions.php 91 GET /app/ajax.php 43 POST /app/ajax/selectFilter.php 41 GET /index.php 29 POST /plugins/csvexporter/plugin.php 28 POST /quoteditsave.php 19 POST /app/ajax/selectFilterSingle.php 16 POST /app/ajax.php 16 GET /plugins/fensa/fensa-ajax.php 9 POST /clienteditsave.php 4 POST /itemModify.php 4 POST /invoiceaddsave.php -- last 10 requests -- 103.104.165.99 - - [14/Aug/2026:09:51:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=65420&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; 150.228.151.9 - - [14/Aug/2026:09:51:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78345§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win64 203.54.180.238 - - [14/Aug/2026:09:51:38 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78386§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 103.104.165.99 - - [14/Aug/2026:09:51:39 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11887&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 203.54.180.238 - - [14/Aug/2026:09:51:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invedit&id=6372&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 116.91.223.103 - - [14/Aug/2026:09:51:40 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2276§ionid=422" "Mozilla/5.0 (Windows NT 10.0; Win 203.54.180.238 - - [14/Aug/2026:09:51:40 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78352§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 103.104.164.114 - - [14/Aug/2026:09:51:40 +1000] "GET /invoiceaddsave.php?cashSale=1 HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=invoicereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 203.54.180.238 - - [14/Aug/2026:09:51:42 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78379§ionid=9797" "Mozilla/5.0 (Windows NT 10.0; W 203.54.180.238 - - [14/Aug/2026:09:51:42 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=76529" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 97 GET /heartbeat.php 64 GET /factory_session_checker.php 32 GET /factory_session_processed_qty.php 32 GET /factory_session_joiner.php 1 POST /inventory.php 1 GET /uploadsave.php 1 GET /index.php -- last 10 requests -- 203.54.180.238 - - [14/Aug/2026:09:51:35 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:09:51:36 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [14/Aug/2026:09:51:36 +1000] "GET /factory_session_joiner.php?id=34542 HTTP/1.1" 200 94 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [14/Aug/2026:09:51:36 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:09:51:36 +1000] "GET /heartbeat.php?sentAt=1786665096&bytes=106,126,88,136&_=1786664556049 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=9" 203.54.180.238 - - [14/Aug/2026:09:51:37 +1000] "GET /heartbeat.php?sentAt=1786665096&bytes=106,126,88,136&_=1786663821659 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:09:51:37 +1000] "GET /heartbeat.php?sentAt=1786665096&bytes=106,126,88,136&_=1786663632504 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:09:51:40 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:09:51:40 +1000] "GET /heartbeat.php?sentAt=1786665100&bytes=106,126,88,140&_=1786602373618 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:09:51:42 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == lowrange/lowrange.com.au-ssl_log == -- top paths -- 2 GET /admin.php 1 GET /yj09.php 1 GET /xyn.php 1 GET /xxx.php 1 GET /x.php 1 GET /wp-ws68.php 1 GET /wp-temp.php 1 GET /wp.php 1 GET /wp-includes/Text/Diff/Engine/about.php 1 GET /wp-includes/Text/ 1 GET /wp-includes/sodium_compat/ 1 GET /wp-includes/Requests/ -- last 10 requests -- 68.221.73.131 - - [14/Aug/2026:09:50:37 +1000] "GET /wp-includes/l10n/ HTTP/1.1" 404 5750 "-" "-" 68.221.73.131 - - [14/Aug/2026:09:50:38 +1000] "GET /wp.php HTTP/1.1" 404 5750 "-" "-" 68.221.73.131 - - [14/Aug/2026:09:50:38 +1000] "GET /abcd.php HTTP/1.1" 404 5750 "-" "-" 68.221.73.131 - - [14/Aug/2026:09:50:39 +1000] "GET /i.php HTTP/1.1" 404 5750 "-" "-" 68.221.73.131 - - [14/Aug/2026:09:50:40 +1000] "GET /wp-includes/Text/Diff/Engine/about.php HTTP/1.1" 404 5750 "-" "-" 68.221.73.131 - - [14/Aug/2026:09:50:40 +1000] "GET /cgi-bin/admin.php HTTP/1.1" 404 5750 "-" "-" 68.221.73.131 - - [14/Aug/2026:09:50:41 +1000] "GET /wp-content/ HTTP/1.1" 404 5750 "-" "-" 68.221.73.131 - - [14/Aug/2026:09:50:41 +1000] "GET /simple.php HTTP/1.1" 404 5750 "-" "-" 68.221.73.131 - - [14/Aug/2026:09:50:42 +1000] "GET /xxx.php HTTP/1.1" 404 5750 "-" "-" 68.221.73.131 - - [14/Aug/2026:09:50:42 +1000] "GET /hypo.php HTTP/1.1" 404 5750 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-14 09:49:21 L1=1.76 run=4 blk=0 avail=7304 (62.3%) swpO=0 conn=5 myRSS=1824 php=5 phpRSS=246 ap=44 tcp=55 topuser=evolution 2026-08-14 09:49:21 L1=1.76 run=4 blk=0 avail=7205 (61.4%) swpO=0 conn=3 myRSS=1824 php=4 phpRSS=308 ap=44 tcp=56 topuser=olympic 2026-08-14 09:49:31 L1=2.11 run=3 blk=0 avail=7330 (62.5%) swpO=0 conn=5 myRSS=1824 php=3 phpRSS=139 ap=42 tcp=58 topuser=madalice 2026-08-14 09:49:31 L1=2.11 run=2 blk=0 avail=7283 (62.1%) swpO=0 conn=3 myRSS=1824 php=4 phpRSS=231 ap=43 tcp=60 topuser=madalice 2026-08-14 09:49:41 L1=1.86 run=3 blk=0 avail=7261 (61.9%) swpO=0 conn=2 myRSS=1824 php=2 phpRSS=80 ap=56 tcp=62 topuser=evolution 2026-08-14 09:49:41 L1=1.86 run=1 blk=0 avail=7272 (62.0%) swpO=0 conn=3 myRSS=1824 php=2 phpRSS=80 ap=56 tcp=63 topuser=evolution 2026-08-14 09:49:51 L1=1.72 run=4 blk=0 avail=7123 (60.7%) swpO=0 conn=2 myRSS=1824 php=4 phpRSS=319 ap=48 tcp=56 topuser=madalice 2026-08-14 09:49:51 L1=1.72 run=4 blk=0 avail=7027 (59.9%) swpO=0 conn=4 myRSS=1824 php=4 phpRSS=419 ap=49 tcp=57 topuser=madalice 2026-08-14 09:50:01 L1=2.00 run=5 blk=0 avail=7081 (60.4%) swpO=0 conn=2 myRSS=1824 php=5 phpRSS=409 ap=47 tcp=54 topuser=madalice 2026-08-14 09:50:01 L1=2.00 run=4 blk=0 avail=7049 (60.1%) swpO=0 conn=4 myRSS=1824 php=4 phpRSS=385 ap=46 tcp=58 topuser=madalice 2026-08-14 09:50:11 L1=1.93 run=3 blk=0 avail=7355 (62.7%) swpO=0 conn=2 myRSS=1824 php=2 phpRSS=80 ap=40 tcp=49 topuser=evolution 2026-08-14 09:50:11 L1=1.93 run=1 blk=0 avail=7367 (62.8%) swpO=0 conn=4 myRSS=1824 php=2 phpRSS=80 ap=39 tcp=50 topuser=evolution 2026-08-14 09:50:21 L1=2.02 run=4 blk=0 avail=7314 (62.4%) swpO=0 conn=2 myRSS=1824 php=4 phpRSS=181 ap=40 tcp=58 topuser=evolution 2026-08-14 09:50:22 L1=2.02 run=5 blk=0 avail=7260 (61.9%) swpO=0 conn=4 myRSS=1824 php=5 phpRSS=261 ap=41 tcp=64 topuser=evolution 2026-08-14 09:50:31 L1=2.08 run=2 blk=0 avail=6946 (59.2%) swpO=0 conn=2 myRSS=1824 php=3 phpRSS=343 ap=58 tcp=64 topuser=madalice 2026-08-14 09:50:32 L1=2.08 run=1 blk=0 avail=7167 (61.1%) swpO=0 conn=4 myRSS=1824 php=2 phpRSS=80 ap=59 tcp=67 topuser=evolution 2026-08-14 09:50:41 L1=1.92 run=3 blk=0 avail=7099 (60.5%) swpO=0 conn=3 myRSS=1824 php=3 phpRSS=306 ap=52 tcp=49 topuser=madalice 2026-08-14 09:50:42 L1=1.92 run=1 blk=0 avail=7299 (62.2%) swpO=0 conn=4 myRSS=1824 php=2 phpRSS=80 ap=51 tcp=50 topuser=evolution 2026-08-14 09:50:51 L1=1.70 run=1 blk=0 avail=7377 (62.9%) swpO=0 conn=3 myRSS=1824 php=2 phpRSS=79 ap=42 tcp=38 topuser=evolution 2026-08-14 09:50:52 L1=1.70 run=1 blk=0 avail=7384 (63.0%) swpO=0 conn=1 myRSS=1824 php=2 phpRSS=79 ap=41 tcp=42 topuser=evolution 2026-08-14 09:51:01 L1=1.60 run=1 blk=0 avail=7417 (63.2%) swpO=0 conn=3 myRSS=1824 php=2 phpRSS=79 ap=37 tcp=41 topuser=evolution 2026-08-14 09:51:02 L1=1.60 run=1 blk=0 avail=7418 (63.2%) swpO=0 conn=1 myRSS=1824 php=1 phpRSS=39 ap=37 tcp=39 topuser=evolution 2026-08-14 09:51:11 L1=1.74 run=3 blk=0 avail=7229 (61.6%) swpO=0 conn=3 myRSS=1824 php=4 phpRSS=339 ap=35 tcp=46 topuser=madalice 2026-08-14 09:51:12 L1=1.74 run=3 blk=0 avail=7125 (60.7%) swpO=0 conn=1 myRSS=1824 php=3 phpRSS=415 ap=35 tcp=49 topuser=madalice 2026-08-14 09:51:21 L1=1.70 run=2 blk=0 avail=7413 (63.2%) swpO=0 conn=3 myRSS=1824 php=2 phpRSS=80 ap=36 tcp=48 topuser=evolution 2026-08-14 09:51:22 L1=1.70 run=3 blk=0 avail=7367 (62.8%) swpO=0 conn=1 myRSS=1824 php=3 phpRSS=170 ap=36 tcp=48 topuser=madalice 2026-08-14 09:51:31 L1=1.90 run=6 blk=0 avail=7324 (62.4%) swpO=0 conn=3 myRSS=1825 php=5 phpRSS=244 ap=40 tcp=46 topuser=evolution 2026-08-14 09:51:32 L1=1.90 run=8 blk=0 avail=7216 (61.5%) swpO=0 conn=1 myRSS=1825 php=9 phpRSS=426 ap=40 tcp=51 topuser=evolution 2026-08-14 09:51:41 L1=1.98 run=14 blk=0 avail=6125 (52.2%) swpO=0 conn=15 myRSS=1825 php=14 phpRSS=1682 ap=46 tcp=61 topuser=madalice 2026-08-14 09:51:42 L1=1.98 run=20 blk=0 avail=5565 (47.4%) swpO=0 conn=13 myRSS=1825 php=15 phpRSS=1829 ap=48 tcp=57 topuser=madalice