INCIDENT 2026-08-14 12:07:48 trigger: php_rss=1922MB ================================================================== load: 1.98 1.47 1.59 17/622 1840824 ncpu:10 mem_avail: 5919MB/11729MB (50.5%) swap_used:1108MB swapout:0/s blocked(D):0 running:24 iowait:0.0% steal:0.0% php: 12 procs / 1922MB heaviest user: madalice (10 procs, 1840MB) apache: 37 procs tcp_estab: 44 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 10 1929 mysql 1 1815 root 237 950 nobody 36 573 netdata 8 265 evolution 6 115 kurri 7 89 mailnull 7 45 dovenull 6 31 wp-toolkit 6 20 cpanellogin 1 18 mailman 20 15 alison 1 14 zabbix 1 11 aaa 1 11 dovecot 3 8 named 1 5 nscd 1 4 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1936 evolution 2 106 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6451 MB Active(file): 4461 MB Inactive(file): 999 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 369 MB CommitLimit: 9960 MB Committed_AS: 9043 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1404480 root 10:56:32 2456 /usr/bin/imunify-agent-proxy 1839816 root 01:18 60512 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 1420296 1 mysql 1859056 15.1 Ssl 10:28:47 /usr/sbin/mariadbd 1840777 1839049 madalice 264140 74.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1840775 1840742 madalice 252952 72.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1840774 1840741 madalice 245948 71.3 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1840776 1839662 madalice 221260 66.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 216120 2.5 Ssl 46-01:57:50 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1840778 1839683 madalice 211872 70.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1451533 1444234 root 206764 0.1 S 09:30:41 spamd child 1840782 1839030 madalice 191224 88.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1840781 1839749 madalice 188472 94.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1840779 1839639 madalice 182516 83.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1840780 1838410 madalice 178980 86.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1840783 1839653 madalice 178792 88.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1451534 1444234 root 177440 0.0 S 09:30:41 spamd child 1444234 1 root 126304 0.0 Ss 09:45:00 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 159820 1 root 108204 0.0 Ss 25-02:20:58 /usr/lib/systemd/systemd-journald 1840793 1839712 evolution 67140 13.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1839816 1 root 60512 1.7 Ssl 01:18 /opt/imunify360/venv/bin/python3 -m imav.run 1353308 1 root 42060 0.0 Ss 23-09:26:20 cpsrvd (SSL) - waiting for connections 1469 1 root 41624 0.1 Ss 46-01:57:49 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1840792 1839645 evolution 40888 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 37924 0.0 Sl 46-01:57:49 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 33596 0.1 Sl 46-01:57:45 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1443709 1 root 26336 0.0 Ss 09:45:35 lfd - sleeping 1837133 1276780 nobody 21608 0.0 S 04:54 /usr/sbin/httpd -k start 1839034 1276780 nobody 21368 0.0 S 02:09 /usr/sbin/httpd -k start 1837463 1276780 nobody 19820 0.0 S 04:24 /usr/sbin/httpd -k start 1839197 1276780 nobody 19320 0.0 S 01:57 /usr/sbin/httpd -k start 1839681 1276780 nobody 19064 0.0 S 01:26 /usr/sbin/httpd -k start 1824883 1353308 cpanellogin 19052 0.0 S 20:03 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 1839644 1276780 nobody 19052 0.0 S 01:29 /usr/sbin/httpd -k start 1839749 1276780 nobody 18924 0.0 S 01:23 /usr/sbin/httpd -k start 1837508 1276780 nobody 18876 0.0 S 04:22 /usr/sbin/httpd -k start 1839030 1276780 nobody 18780 0.0 S 02:10 /usr/sbin/httpd -k start 1839049 1276780 nobody 18296 0.0 S 02:08 /usr/sbin/httpd -k start 1840370 1276780 nobody 18152 0.0 S 00:37 /usr/sbin/httpd -k start 1838410 1276780 nobody 18112 0.0 S 02:57 /usr/sbin/httpd -k start 1839683 1276780 nobody 18056 0.0 S 01:26 /usr/sbin/httpd -k start 1839668 1276780 nobody 17884 0.1 S 01:27 /usr/sbin/httpd -k start 1839653 1276780 nobody 17776 0.0 S 01:28 /usr/sbin/httpd -k start 1838028 1276780 nobody 17580 0.0 S 03:33 /usr/sbin/httpd -k start 1839654 1276780 nobody 17568 0.0 S 01:28 /usr/sbin/httpd -k start 1838404 1276780 nobody 17564 0.0 S 02:58 /usr/sbin/httpd -k start 1838061 1276780 nobody 17420 0.0 S 03:31 /usr/sbin/httpd -k start 1838689 1276780 nobody 17340 0.0 S 02:42 /usr/sbin/httpd -k start 1839684 1276780 nobody 17264 0.0 S 01:26 /usr/sbin/httpd -k start 1839712 1276780 nobody 17024 0.0 S 01:24 /usr/sbin/httpd -k start 1839662 1276780 nobody 17020 0.0 S 01:27 /usr/sbin/httpd -k start 1839639 1276780 nobody 16936 0.0 S 01:30 /usr/sbin/httpd -k start 1839664 1276780 nobody 16892 0.0 S 01:27 /usr/sbin/httpd -k start 1839645 1276780 nobody 16588 0.0 S 01:29 /usr/sbin/httpd -k start 1839691 1276780 nobody 16396 0.0 S 01:26 /usr/sbin/httpd -k start 1839748 1276780 nobody 16236 0.0 S 01:23 /usr/sbin/httpd -k start 1839665 1276780 nobody 16188 0.1 S 01:27 /usr/sbin/httpd -k start 1601939 1471 root 15776 0.0 S 04:54:50 cPhulkd - dbprocessor 1471 1 root 15736 0.0 Ss 46-01:57:49 cPhulkd - processor 1840304 1276780 nobody 15576 0.0 S 00:41 /usr/sbin/httpd -k start 1840742 1276780 nobody 15040 0.0 S 00:08 /usr/sbin/httpd -k start 1840741 1276780 nobody 14996 0.0 S 00:08 /usr/sbin/httpd -k start 1840573 1276780 nobody 14968 0.0 S 00:23 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+----------------------+---------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+----------------------+---------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 2350403 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 2350402 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 2350400 | root | 85-1701079776 | Execute | 0 | init for update | UPDATE purchases SET phone = '02 4351 4022' WHERE id = '1256' | | 2350366 | madalice_wp | madalice_wp | Query | 0 | Writing to net | select * from AMuqf6qZ_addonlibrary_addons as addons where addons.addontype in('elementor','bg_addon') and addons.is_active=1 | +---------+----------------------+---------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 344 evolution/portal.evolutionerp.com.au-ssl_log 271 madalice/madalice.com.au-ssl_log 111 customc/customcentral.com.au-ssl_log 40 lowrange/lowrange.com.au 18 evolution/evolutionerp.com.au-ssl_log 17 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 388 203.54.180.238 101 20.151.131.114 75 103.104.164.114 46 180.181.236.49 31 20.250.10.77 22 103.104.165.99 21 120.19.183.39 18 84.17.60.251 15 91.215.85.88 15 20.14.187.132 14 165.225.233.109 6 1.145.73.14 5 182.239.240.254 5 117.132.188.205 5 116.91.223.103 --- top request paths across all vhosts (last 3 min) --- 184 POST /functions.php 94 GET /factory_session_checker.php 66 GET /heartbeat.php 48 GET /factory_session_processed_qty.php 48 GET /factory_session_joiner.php 44 GET /app/ajax.php 26 GET /index.php 24 POST /app/ajax/selectFilter.php 16 POST /clienteditsave.php 9 POST /app/ajax/selectFilterSingle.php 9 GET / 8 POST /app/ajax.php 7 POST /plugins/csvexporter/plugin.php 7 GET /userlogin.php 6 POST /jobeditsave.php 5 POST /logsave.php 5 POST /invoiceaddsave.php 5 POST //functions.php 4 POST /print.php 4 GET /store/custom-port-adelaide-kids/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 184 POST /functions.php 44 GET /app/ajax.php 24 POST /app/ajax/selectFilter.php 20 GET /index.php 16 POST /clienteditsave.php 9 POST /app/ajax/selectFilterSingle.php 8 POST /app/ajax.php 7 POST /plugins/csvexporter/plugin.php 6 POST /jobeditsave.php 5 POST /logsave.php 5 POST /invoiceaddsave.php 5 POST //functions.php -- last 10 requests -- 203.54.180.238 - - [14/Aug/2026:12:07:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29354&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [14/Aug/2026:12:07:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29361" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 203.54.180.238 - - [14/Aug/2026:12:07:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:12:07:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 203.54.180.238 - - [14/Aug/2026:12:07:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=mfshoporderdetail&id=43129" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 103.104.164.114 - - [14/Aug/2026:12:07:34 +1000] "POST /print.php HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4349%2Findex.php%3Fpage%3Dinvoiceadd&invoiceid=4349&tab=maintab" "Moz 180.181.236.49 - - [14/Aug/2026:12:07:38 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=1256" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 203.54.180.238 - - [14/Aug/2026:12:07:40 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78390§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 165.225.233.109 - - [14/Aug/2026:12:07:42 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 282 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=14155" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 103.104.164.114 - - [14/Aug/2026:12:07:48 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4349%2Findex.php%3Fpage%3Dinvoiceadd&invoiceid=43 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 94 GET /factory_session_checker.php 66 GET /heartbeat.php 48 GET /factory_session_processed_qty.php 48 GET /factory_session_joiner.php 7 GET /userlogin.php 6 GET /index.php 1 GET /logoff.php 1 GET / -- last 10 requests -- 203.54.180.238 - - [14/Aug/2026:12:07:37 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [14/Aug/2026:12:07:37 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 127 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [14/Aug/2026:12:07:37 +1000] "GET /factory_session_joiner.php?id=34605 HTTP/1.1" 200 79 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [14/Aug/2026:12:07:37 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:12:07:38 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 130 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [14/Aug/2026:12:07:38 +1000] "GET /factory_session_joiner.php?id=34552 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [14/Aug/2026:12:07:38 +1000] "GET /heartbeat.php?sentAt=1786673256&bytes=106,126,120,104&_=1786663633320 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [14/Aug/2026:12:07:40 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:12:07:40 +1000] "GET /heartbeat.php?sentAt=1786673260&bytes=106,126,120,108&_=1786602374434 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [14/Aug/2026:12:07:40 +1000] "GET /heartbeat.php?sentAt=1786673260&bytes=106,126,120,108&_=1786672740625 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=8 == madalice/madalice.com.au-ssl_log == -- top paths -- 4 GET /store/custom-port-adelaide-kids/ 1 POST / 1 GET /x.php 1 GET /xmlrpc.php0 1 GET /wp_wol.php 1 GET /wp-includes/wp-class.php 1 GET /wp-includes/rest-api/fields/ 1 GET /wp-includes/js/codemirror/about.php 1 GET /wp-includes/interactivity-api/index.php 1 GET /wp-includes/ID3/ 1 GET /wp-includes/css/dist/widgets/ 1 GET /wp-includes/certificates/ -- last 10 requests -- 20.151.131.114 - - [14/Aug/2026:12:07:22 +1000] "GET /NewFile.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.151.131.114 - - [14/Aug/2026:12:07:23 +1000] "GET /system.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.151.131.114 - - [14/Aug/2026:12:07:23 +1000] "GET /IDhrIlrLb.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.151.131.114 - - [14/Aug/2026:12:07:23 +1000] "GET /cJLGqzB.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.151.131.114 - - [14/Aug/2026:12:07:23 +1000] "GET /akc.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.151.131.114 - - [14/Aug/2026:12:07:24 +1000] "GET /flower.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.151.131.114 - - [14/Aug/2026:12:07:24 +1000] "GET /class-IXR-encryption.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.151.131.114 - - [14/Aug/2026:12:07:24 +1000] "GET /OK.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.151.131.114 - - [14/Aug/2026:12:07:24 +1000] "GET /config.php7 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.151.131.114 - - [14/Aug/2026:12:07:25 +1000] "GET /hyIPpxWDQ.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-14 12:05:24 L1=0.88 run=2 blk=0 avail=7536 (64.3%) swpO=0 conn=1 myRSS=1815 php=0 phpRSS=0 ap=32 tcp=41 topuser=- 2026-08-14 12:05:27 L1=0.89 run=3 blk=0 avail=7534 (64.2%) swpO=0 conn=3 myRSS=1815 php=0 phpRSS=0 ap=32 tcp=41 topuser=- 2026-08-14 12:05:34 L1=0.98 run=3 blk=0 avail=7517 (64.1%) swpO=0 conn=1 myRSS=1815 php=1 phpRSS=43 ap=33 tcp=38 topuser=evolution 2026-08-14 12:05:37 L1=0.90 run=2 blk=0 avail=7502 (64.0%) swpO=0 conn=2 myRSS=1815 php=2 phpRSS=104 ap=32 tcp=43 topuser=evolution 2026-08-14 12:05:44 L1=0.83 run=3 blk=0 avail=7422 (63.3%) swpO=0 conn=1 myRSS=1815 php=1 phpRSS=66 ap=44 tcp=39 topuser=evolution 2026-08-14 12:05:47 L1=0.92 run=9 blk=0 avail=7293 (62.2%) swpO=0 conn=2 myRSS=1815 php=4 phpRSS=272 ap=42 tcp=51 topuser=tubesupplies 2026-08-14 12:05:54 L1=0.85 run=3 blk=0 avail=7122 (60.7%) swpO=0 conn=1 myRSS=1815 php=3 phpRSS=385 ap=48 tcp=51 topuser=madalice 2026-08-14 12:05:57 L1=0.86 run=3 blk=0 avail=7426 (63.3%) swpO=0 conn=2 myRSS=1815 php=1 phpRSS=33 ap=46 tcp=46 topuser=evolution 2026-08-14 12:06:04 L1=0.87 run=5 blk=0 avail=7310 (62.3%) swpO=0 conn=1 myRSS=1815 php=2 phpRSS=212 ap=40 tcp=49 topuser=evolution 2026-08-14 12:06:07 L1=0.88 run=4 blk=0 avail=7134 (60.8%) swpO=0 conn=2 myRSS=1815 php=3 phpRSS=422 ap=40 tcp=51 topuser=corpkicks 2026-08-14 12:06:15 L1=0.81 run=2 blk=0 avail=7440 (63.4%) swpO=0 conn=1 myRSS=1815 php=0 phpRSS=0 ap=41 tcp=45 topuser=- 2026-08-14 12:06:17 L1=0.91 run=3 blk=0 avail=7437 (63.4%) swpO=0 conn=2 myRSS=1815 php=0 phpRSS=0 ap=41 tcp=44 topuser=- 2026-08-14 12:06:25 L1=0.84 run=2 blk=0 avail=7191 (61.3%) swpO=0 conn=2 myRSS=1815 php=1 phpRSS=91 ap=71 tcp=83 topuser=madalice 2026-08-14 12:06:27 L1=1.25 run=4 blk=0 avail=7180 (61.2%) swpO=0 conn=2 myRSS=1815 php=3 phpRSS=138 ap=73 tcp=79 topuser=alison 2026-08-14 12:06:35 L1=1.15 run=1 blk=0 avail=7252 (61.8%) swpO=0 conn=2 myRSS=1815 php=0 phpRSS=0 ap=68 tcp=39 topuser=- 2026-08-14 12:06:37 L1=1.14 run=2 blk=0 avail=7264 (61.9%) swpO=0 conn=1 myRSS=1815 php=1 phpRSS=40 ap=66 tcp=38 topuser=evolution 2026-08-14 12:06:45 L1=1.13 run=2 blk=0 avail=7325 (62.5%) swpO=0 conn=2 myRSS=1815 php=0 phpRSS=0 ap=58 tcp=33 topuser=- 2026-08-14 12:06:47 L1=1.20 run=1 blk=0 avail=7339 (62.6%) swpO=0 conn=1 myRSS=1815 php=0 phpRSS=0 ap=56 tcp=31 topuser=- 2026-08-14 12:06:55 L1=1.10 run=2 blk=0 avail=7376 (62.9%) swpO=0 conn=2 myRSS=1815 php=1 phpRSS=43 ap=48 tcp=43 topuser=evolution 2026-08-14 12:06:57 L1=1.09 run=3 blk=0 avail=7258 (61.9%) swpO=0 conn=1 myRSS=1815 php=2 phpRSS=200 ap=47 tcp=47 topuser=alison 2026-08-14 12:07:05 L1=1.00 run=5 blk=0 avail=7325 (62.5%) swpO=0 conn=2 myRSS=1815 php=5 phpRSS=229 ap=42 tcp=52 topuser=evolution 2026-08-14 12:07:07 L1=0.92 run=2 blk=0 avail=7347 (62.6%) swpO=0 conn=1 myRSS=1815 php=1 phpRSS=96 ap=43 tcp=52 topuser=madalice 2026-08-14 12:07:15 L1=1.01 run=2 blk=0 avail=7171 (61.1%) swpO=0 conn=2 myRSS=1815 php=2 phpRSS=299 ap=44 tcp=38 topuser=customc 2026-08-14 12:07:17 L1=0.93 run=1 blk=0 avail=7434 (63.4%) swpO=0 conn=1 myRSS=1815 php=0 phpRSS=0 ap=41 tcp=31 topuser=- 2026-08-14 12:07:25 L1=1.01 run=1 blk=0 avail=7400 (63.1%) swpO=0 conn=2 myRSS=1815 php=2 phpRSS=107 ap=36 tcp=49 topuser=evolution 2026-08-14 12:07:28 L1=1.17 run=1 blk=0 avail=7464 (63.6%) swpO=0 conn=1 myRSS=1815 php=0 phpRSS=0 ap=37 tcp=40 topuser=- 2026-08-14 12:07:35 L1=1.24 run=4 blk=0 avail=7123 (60.7%) swpO=0 conn=2 myRSS=1815 php=4 phpRSS=456 ap=36 tcp=45 topuser=madalice 2026-08-14 12:07:38 L1=1.30 run=6 blk=0 avail=7404 (63.1%) swpO=0 conn=3 myRSS=1815 php=2 phpRSS=126 ap=36 tcp=43 topuser=alison 2026-08-14 12:07:45 L1=1.20 run=1 blk=0 avail=7450 (63.5%) swpO=0 conn=2 myRSS=1815 php=0 phpRSS=0 ap=39 tcp=33 topuser=- 2026-08-14 12:07:48 L1=1.98 run=24 blk=0 avail=5919 (50.5%) swpO=0 conn=12 myRSS=1815 php=12 phpRSS=1922 ap=37 tcp=44 topuser=madalice