INCIDENT 2026-08-14 13:13:15 trigger: php_rss=2149MB mysql_conn=15 ================================================================== load: 1.80 1.75 1.54 16/613 1897224 ncpu:10 mem_avail: 5720MB/11729MB (48.8%) swap_used:1125MB swapout:0/s blocked(D):0 running:18 iowait:0.0% steal:0.0% php: 14 procs / 2149MB heaviest user: madalice (12 procs, 2033MB) apache: 34 procs tcp_estab: 40 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 12 2156 mysql 1 1895 root 239 913 nobody 33 516 netdata 8 261 alison 2 99 cpanellogin 1 67 evolution 5 43 aaa 3 40 dovenull 6 30 wp-toolkit 6 20 mailman 20 15 mailnull 2 12 kurri 1 12 corpkicks 1 12 candyfabcom 1 12 zabbix 1 11 dovecot 3 8 named 1 6 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 12 2176 alison 1 86 evolution 1 39 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6388 MB Active(file): 4573 MB Inactive(file): 666 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 364 MB CommitLimit: 9960 MB Committed_AS: 9284 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1404480 root 12:01:59 2872 /usr/bin/imunify-agent-proxy 1885659 root 13:14 1232 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 1420296 1 mysql 1937856 16.4 Ssl 11:34:14 /usr/sbin/mariadbd 1897178 1895887 madalice 248768 110 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1897176 1895859 madalice 248116 111 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1897179 1897072 madalice 247696 107 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1897181 1895838 madalice 235656 102 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1897180 1891250 madalice 223584 110 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1897183 1895839 madalice 213452 100 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 212716 2.5 Ssl 46-03:03:17 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1897174 1892967 madalice 209976 104 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1451533 1444234 root 204528 0.1 S 10:36:08 spamd child 1897175 1891249 madalice 181068 81.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1897177 1895732 madalice 179824 81.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1451534 1444234 root 177204 0.0 S 10:36:08 spamd child 1897184 1895574 madalice 157924 68.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1897182 1895860 madalice 144588 68.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 159820 1 root 128984 0.0 Ss 25-03:26:25 /usr/lib/systemd/systemd-journald 1444234 1 root 126108 0.0 Ss 10:50:27 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1897185 1896774 madalice 110024 44.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1897187 1897186 alison 104096 71.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1875202 1353308 cpanellogin 69152 0.0 S 25:52 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 1353308 1 root 42240 0.0 Ss 23-10:31:47 cpsrvd (SSL) - waiting for connections 1469 1 root 41624 0.1 Ss 46-03:03:16 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1897193 1891444 evolution 40712 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 38336 0.0 Sl 46-03:03:16 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 33048 0.1 Sl 46-03:03:12 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1443709 1 root 25920 0.0 Ss 10:51:02 lfd - sleeping 1891249 1276780 nobody 22692 0.0 S 07:08 /usr/sbin/httpd -k start 1892967 1276780 nobody 20996 0.0 S 05:11 /usr/sbin/httpd -k start 1892409 1276780 nobody 20968 0.0 S 05:56 /usr/sbin/httpd -k start 1891444 1276780 nobody 20552 0.0 S 06:51 /usr/sbin/httpd -k start 1891250 1276780 nobody 19888 0.0 S 07:08 /usr/sbin/httpd -k start 1895839 1276780 nobody 18720 0.0 S 01:41 /usr/sbin/httpd -k start 1895838 1276780 nobody 18580 0.0 S 01:41 /usr/sbin/httpd -k start 1892976 1276780 nobody 18372 0.0 S 05:10 /usr/sbin/httpd -k start 1894476 1276780 nobody 17780 0.0 S 03:25 /usr/sbin/httpd -k start 1895860 1276780 nobody 17768 0.0 S 01:40 /usr/sbin/httpd -k start 1895859 1276780 nobody 17636 0.0 S 01:40 /usr/sbin/httpd -k start 1893573 1276780 nobody 17224 0.0 S 04:20 /usr/sbin/httpd -k start 1895574 1276780 nobody 17224 0.0 S 01:59 /usr/sbin/httpd -k start 1896811 1276780 nobody 17156 0.0 S 00:37 /usr/sbin/httpd -k start 1895895 1276780 nobody 16976 0.1 S 01:39 /usr/sbin/httpd -k start 1895887 1276780 nobody 16920 0.0 S 01:39 /usr/sbin/httpd -k start 1895700 1276780 nobody 16736 0.0 S 01:49 /usr/sbin/httpd -k start 1896808 1276780 nobody 16440 0.0 S 00:37 /usr/sbin/httpd -k start 1896809 1276780 nobody 16180 0.0 S 00:37 /usr/sbin/httpd -k start 1896806 1276780 nobody 16108 0.0 S 00:38 /usr/sbin/httpd -k start 1895732 1276780 nobody 15844 0.0 S 01:48 /usr/sbin/httpd -k start 1896774 1276780 nobody 15836 0.0 S 00:39 /usr/sbin/httpd -k start 1601939 1471 root 15768 0.0 S 06:00:17 cPhulkd - dbprocessor 1895888 1276780 nobody 15700 0.0 S 01:39 /usr/sbin/httpd -k start 1896922 1276780 nobody 15608 0.0 S 00:24 /usr/sbin/httpd -k start 1896611 1276780 nobody 15500 0.0 S 00:54 /usr/sbin/httpd -k start 1471 1 root 15360 0.0 Ss 46-03:03:16 cPhulkd - processor 1897072 1276780 nobody 15356 0.0 S 00:14 /usr/sbin/httpd -k start 1896805 1276780 nobody 15244 0.0 S 00:38 /usr/sbin/httpd -k start 1897186 1276780 nobody 14836 0.0 S 00:02 /usr/sbin/httpd -k start 1872870 3828812 aaa 14736 0.0 S 28:40 dovecot/imap 1897073 1276780 nobody 14732 0.0 S 00:14 /usr/sbin/httpd -k start 1463 1 root 14504 0.0 Ss 46-03:03:16 tailwatchd 1860569 3828812 alison 14384 0.0 S 43:57 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 2794208 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 521 evolution/portal.evolutionerp.com.au-ssl_log 189 madalice/madalice.com.au-ssl_log 12 corpkicks/corporatekicks.com.au-ssl_log 2 coscom/coscom.com.au-ssl_log 2 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 422 203.54.180.238 95 103.104.165.99 62 182.239.240.254 44 120.19.183.39 42 103.104.164.114 22 116.91.223.103 10 180.181.236.49 9 1.145.84.81 7 1.145.73.14 4 84.201.20.36 3 207.46.13.154 3 165.225.233.109 3 147.161.213.98 2 118.127.40.55 2 107.173.160.154 --- top request paths across all vhosts (last 3 min) --- 200 POST /functions.php 111 GET /app/ajax.php 80 GET /factory_session_checker.php 42 GET /index.php 42 GET /factory_session_processed_qty.php 41 GET /heartbeat.php 40 GET /factory_session_joiner.php 27 POST /plugins/csvexporter/plugin.php 23 POST /app/ajax/selectFilterSingle.php 21 POST /app/ajax.php 20 POST /clienteditsave.php 19 POST /app/ajax/selectFilter.php 13 POST /jobeditsave.php 11 POST /purchaseaddsave.php 10 POST /quoteditsave.php 6 POST /logsave.php 5 POST /invoiceaddsave.php 4 GET /plugins/fensa/fensa-ajax.php 4 GET / 3 GET /store/veja-custom-swarovski-crystal-shoes/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 200 POST /functions.php 111 GET /app/ajax.php 42 GET /index.php 27 POST /plugins/csvexporter/plugin.php 23 POST /app/ajax/selectFilterSingle.php 21 POST /app/ajax.php 20 POST /clienteditsave.php 19 POST /app/ajax/selectFilter.php 13 POST /jobeditsave.php 11 POST /purchaseaddsave.php 10 POST /quoteditsave.php 6 POST /logsave.php -- last 10 requests -- 203.54.180.238 - - [14/Aug/2026:13:13:05 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=14039" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 203.54.180.238 - - [14/Aug/2026:13:13:05 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29336&tab=jobeditmf" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gec 203.54.180.238 - - [14/Aug/2026:13:13:05 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=14038" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 203.54.180.238 - - [14/Aug/2026:13:13:06 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities&date=20-08-2026&company=ajm" "Mozilla/5.0 (Windows NT 10.0; 116.91.223.103 - - [14/Aug/2026:13:13:07 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invedit&id=2051&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 203.54.180.238 - - [14/Aug/2026:13:13:07 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29339" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) 203.54.180.238 - - [14/Aug/2026:13:13:08 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities&date=20-08-2026&company=ajm" "Mozilla/5.0 (Windows NT 10.0; 103.104.164.114 - - [14/Aug/2026:13:13:08 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 233 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) C 103.104.164.114 - - [14/Aug/2026:13:13:09 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 280 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=49&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 103.104.164.114 - - [14/Aug/2026:13:13:10 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=1624§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 80 GET /factory_session_checker.php 42 GET /factory_session_processed_qty.php 41 GET /heartbeat.php 40 GET /factory_session_joiner.php -- last 10 requests -- 203.54.180.238 - - [14/Aug/2026:13:13:10 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:13:13:10 +1000] "GET /heartbeat.php?sentAt=1786677190&bytes=106,126,135,198&_=1786602374827 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [14/Aug/2026:13:13:12 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:13:13:12 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [14/Aug/2026:13:13:12 +1000] "GET /factory_session_joiner.php?id=34609 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [14/Aug/2026:13:13:13 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:13:13:15 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:13:13:15 +1000] "GET /heartbeat.php?sentAt=1786677193&bytes=106,126,135,201&_=1786676060058 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [14/Aug/2026:13:13:16 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 124 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [14/Aug/2026:13:13:16 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET /store/veja-custom-swarovski-crystal-shoes/ 2 POST / 1 GET /wp-config.php.bak 1 GET /tag/joel/ 1 GET /store/turtles-custom-shoes/ 1 GET /.env.bak 1 GET /.env 1 GET /0jmg20817lcm.php 1 GET / -- last 10 requests -- 114.119.143.14 - - [14/Aug/2026:13:11:26 +1000] "GET /store/veja-custom-swarovski-crystal-shoes/?image=1&verified=1 HTTP/1.1" 200 43968 "https://madalice.com.au/store/veja-custom-swarovski-crystal-shoes/?image=1&verified 114.119.130.40 - - [14/Aug/2026:13:11:48 +1000] "GET /store/veja-custom-swarovski-crystal-shoes/?amp%3Brating=2&wcpr_page=4&wcpr_image=1&wcpr_rating=3 HTTP/1.1" 200 43964 "https://madalice.com.au/store/veja-custom-swarov 17.246.23.82 - - [14/Aug/2026:13:11:49 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/store/pink-cartoon-custom-adidas-samba/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15 17.246.19.30 - - [14/Aug/2026:13:11:51 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/store/pink-cartoon-custom-adidas-samba/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) A 84.201.20.36 - - [14/Aug/2026:13:12:05 +1000] "GET /0jmg20817lcm.php HTTP/1.1" 404 30546 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 84.201.20.36 - - [14/Aug/2026:13:12:08 +1000] "GET /.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 84.201.20.36 - - [14/Aug/2026:13:12:08 +1000] "GET /.env.bak HTTP/1.1" 404 30540 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 114.119.140.234 - - [14/Aug/2026:13:12:10 +1000] "GET /store/turtles-custom-shoes/?rating=2&wcpr_rating=3&wcpr_verified=1 HTTP/1.1" 404 30567 "https://madalice.com.au/store/turtles-custom-shoes/?rating=2&wcpr_rating=3" " 118.127.40.55 - - [14/Aug/2026:13:12:11 +1000] "POST /?wordfence_syncAttackData=1786677131.8977 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://madalice.com.au" 84.201.20.36 - - [14/Aug/2026:13:12:11 +1000] "GET /wp-config.php.bak HTTP/1.1" 404 30544 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-14 13:10:47 L1=1.47 run=2 blk=0 avail=7361 (62.8%) swpO=0 conn=2 myRSS=1895 php=1 phpRSS=40 ap=34 tcp=39 topuser=evolution 2026-08-14 13:10:54 L1=1.43 run=1 blk=0 avail=7353 (62.7%) swpO=0 conn=1 myRSS=1895 php=0 phpRSS=0 ap=41 tcp=38 topuser=- 2026-08-14 13:10:57 L1=1.47 run=1 blk=0 avail=7342 (62.6%) swpO=0 conn=2 myRSS=1895 php=1 phpRSS=40 ap=40 tcp=37 topuser=evolution 2026-08-14 13:11:04 L1=1.60 run=2 blk=0 avail=7332 (62.5%) swpO=0 conn=1 myRSS=1895 php=1 phpRSS=93 ap=35 tcp=33 topuser=madalice 2026-08-14 13:11:07 L1=1.63 run=3 blk=0 avail=7361 (62.8%) swpO=0 conn=2 myRSS=1895 php=2 phpRSS=116 ap=33 tcp=38 topuser=madalice 2026-08-14 13:11:14 L1=1.66 run=2 blk=0 avail=7368 (62.8%) swpO=0 conn=1 myRSS=1895 php=3 phpRSS=142 ap=32 tcp=34 topuser=evolution 2026-08-14 13:11:17 L1=1.61 run=3 blk=0 avail=7347 (62.6%) swpO=0 conn=2 myRSS=1895 php=2 phpRSS=108 ap=35 tcp=43 topuser=evolution 2026-08-14 13:11:25 L1=1.56 run=2 blk=0 avail=7329 (62.5%) swpO=0 conn=1 myRSS=1895 php=1 phpRSS=68 ap=40 tcp=38 topuser=evolution 2026-08-14 13:11:27 L1=1.75 run=4 blk=0 avail=7189 (61.3%) swpO=0 conn=2 myRSS=1895 php=2 phpRSS=228 ap=40 tcp=42 topuser=madalice 2026-08-14 13:11:35 L1=1.77 run=10 blk=0 avail=7122 (60.7%) swpO=0 conn=1 myRSS=1895 php=5 phpRSS=384 ap=43 tcp=55 topuser=tubesupplies 2026-08-14 13:11:37 L1=1.95 run=1 blk=0 avail=7149 (60.9%) swpO=0 conn=2 myRSS=1895 php=0 phpRSS=0 ap=71 tcp=61 topuser=- 2026-08-14 13:11:45 L1=2.12 run=2 blk=0 avail=7198 (61.4%) swpO=0 conn=1 myRSS=1895 php=0 phpRSS=0 ap=65 tcp=38 topuser=- 2026-08-14 13:11:48 L1=2.03 run=2 blk=0 avail=7220 (61.6%) swpO=0 conn=2 myRSS=1895 php=0 phpRSS=0 ap=62 tcp=45 topuser=- 2026-08-14 13:11:55 L1=2.26 run=1 blk=0 avail=7256 (61.9%) swpO=0 conn=1 myRSS=1895 php=0 phpRSS=0 ap=56 tcp=44 topuser=- 2026-08-14 13:11:58 L1=2.16 run=1 blk=0 avail=7276 (62.0%) swpO=0 conn=1 myRSS=1895 php=0 phpRSS=0 ap=53 tcp=39 topuser=- 2026-08-14 13:12:05 L1=2.15 run=3 blk=0 avail=7288 (62.1%) swpO=0 conn=1 myRSS=1895 php=2 phpRSS=83 ap=46 tcp=38 topuser=evolution 2026-08-14 13:12:08 L1=2.46 run=2 blk=0 avail=7294 (62.2%) swpO=0 conn=1 myRSS=1895 php=1 phpRSS=70 ap=43 tcp=43 topuser=evolution 2026-08-14 13:12:15 L1=2.58 run=1 blk=0 avail=7298 (62.2%) swpO=0 conn=1 myRSS=1895 php=1 phpRSS=66 ap=42 tcp=47 topuser=evolution 2026-08-14 13:12:18 L1=2.62 run=2 blk=0 avail=7279 (62.1%) swpO=0 conn=1 myRSS=1895 php=1 phpRSS=74 ap=42 tcp=45 topuser=madalice 2026-08-14 13:12:25 L1=2.73 run=3 blk=0 avail=7318 (62.4%) swpO=0 conn=1 myRSS=1895 php=0 phpRSS=0 ap=47 tcp=43 topuser=- 2026-08-14 13:12:28 L1=2.67 run=2 blk=0 avail=7330 (62.5%) swpO=0 conn=1 myRSS=1895 php=3 phpRSS=74 ap=45 tcp=38 topuser=evolution 2026-08-14 13:12:35 L1=2.45 run=2 blk=0 avail=7296 (62.2%) swpO=0 conn=1 myRSS=1895 php=2 phpRSS=145 ap=37 tcp=37 topuser=aaa 2026-08-14 13:12:38 L1=2.58 run=1 blk=0 avail=7387 (63.0%) swpO=0 conn=1 myRSS=1895 php=0 phpRSS=0 ap=36 tcp=49 topuser=- 2026-08-14 13:12:45 L1=2.37 run=1 blk=0 avail=7370 (62.8%) swpO=0 conn=1 myRSS=1895 php=0 phpRSS=0 ap=40 tcp=26 topuser=- 2026-08-14 13:12:48 L1=2.18 run=1 blk=0 avail=7383 (63.0%) swpO=0 conn=1 myRSS=1895 php=0 phpRSS=0 ap=38 tcp=27 topuser=- 2026-08-14 13:12:55 L1=2.01 run=2 blk=0 avail=7297 (62.2%) swpO=0 conn=1 myRSS=1895 php=2 phpRSS=139 ap=36 tcp=34 topuser=madalice 2026-08-14 13:12:58 L1=2.01 run=2 blk=0 avail=7358 (62.7%) swpO=0 conn=3 myRSS=1895 php=1 phpRSS=65 ap=35 tcp=27 topuser=evolution 2026-08-14 13:13:05 L1=1.85 run=2 blk=0 avail=7380 (62.9%) swpO=0 conn=1 myRSS=1895 php=1 phpRSS=40 ap=35 tcp=37 topuser=evolution 2026-08-14 13:13:08 L1=1.78 run=2 blk=0 avail=7138 (60.9%) swpO=0 conn=3 myRSS=1895 php=2 phpRSS=336 ap=33 tcp=32 topuser=corpkicks 2026-08-14 13:13:15 L1=1.80 run=18 blk=0 avail=5720 (48.8%) swpO=0 conn=15 myRSS=1895 php=14 phpRSS=2149 ap=34 tcp=40 topuser=madalice