INCIDENT 2026-08-15 04:48:47 trigger: php_rss=1507MB ================================================================== load: 2.92 1.01 0.93 9/669 2468515 ncpu:10 mem_avail: 5405MB/11729MB (46.1%) swap_used:1150MB swapout:1/s blocked(D):0 running:14 iowait:0.1% steal:0.0% php: 10 procs / 1507MB heaviest user: madalice (9 procs, 1467MB) apache: 85 procs tcp_estab: 108 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2294 madalice 9 1531 nobody 84 1310 root 235 875 netdata 8 263 kurri 5 62 cpanellogin 1 61 evolution 5 43 dovenull 6 28 wp-toolkit 6 20 mailman 20 14 infinium 1 13 lowrange 1 12 zabbix 1 11 mailnull 2 10 dovecot 3 8 named 1 7 nscd 1 4 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 9 1541 evolution 1 39 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3972 MB Active(file): 2898 MB Inactive(file): 611 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 505 MB CommitLimit: 9960 MB Committed_AS: 9549 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2342983 root 03:37:31 5296 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 1420296 1 mysql 2349472 10.8 Ssl 1-03:09:46 /usr/sbin/mariadbd 2468460 2468336 madalice 256824 75.6 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2468465 2468356 madalice 248380 105 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2468466 2468361 madalice 224372 107 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2468467 2468357 madalice 220168 104 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 214956 2.5 Ssl 46-18:38:49 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2468468 2468252 madalice 195820 85.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2390233 2382613 root 184228 0.0 S 02:13:09 spamd child 2382613 1 root 173944 0.0 Ss 02:25:35 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2468473 2468469 madalice 172280 143 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2468474 2468471 madalice 170984 143 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2390234 2382613 root 160260 0.0 S 02:13:09 spamd child 2468485 2468478 madalice 72844 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2468486 2468150 madalice 65092 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2446242 1353308 cpanellogin 63052 0.0 S 33:54 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 159820 1 root 61244 0.0 Ss 25-19:01:57 /usr/lib/systemd/systemd-journald 2223 1201 root 53972 0.0 Sl 46-18:38:48 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41000 0.0 Ss 24-02:07:19 cpsrvd (SSL) - waiting for connections 1469 1 root 40824 0.1 Ss 46-18:38:48 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2468484 2468480 evolution 40800 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 33100 0.1 Sl 46-18:38:44 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2381704 1 root 32376 0.0 Ss 02:26:34 lfd - sleeping 2459873 1276780 nobody 21528 0.0 S 14:57 /usr/sbin/httpd -k start 2465942 1276780 nobody 21032 0.0 S 04:50 /usr/sbin/httpd -k start 2462778 1276780 nobody 20420 0.0 S 10:09 /usr/sbin/httpd -k start 2465947 1276780 nobody 18888 0.0 S 04:49 /usr/sbin/httpd -k start 2467940 1276780 nobody 18576 0.0 S 01:05 /usr/sbin/httpd -k start 2468315 1276780 nobody 18328 0.2 S 00:13 /usr/sbin/httpd -k start 2468150 1276780 nobody 18316 0.0 S 00:36 /usr/sbin/httpd -k start 2466352 1276780 nobody 18288 0.0 S 03:57 /usr/sbin/httpd -k start 2467207 1276780 nobody 18288 0.0 S 02:40 /usr/sbin/httpd -k start 2468338 1276780 nobody 18184 0.1 S 00:12 /usr/sbin/httpd -k start 2468308 1276780 nobody 17600 0.0 S 00:13 /usr/sbin/httpd -k start 2468306 1276780 nobody 17472 0.1 S 00:13 /usr/sbin/httpd -k start 2468314 1276780 nobody 17408 0.0 S 00:13 /usr/sbin/httpd -k start 2468343 1276780 nobody 17404 0.0 S 00:12 /usr/sbin/httpd -k start 2468299 1276780 nobody 17396 0.1 S 00:14 /usr/sbin/httpd -k start 2468309 1276780 nobody 17396 0.1 S 00:13 /usr/sbin/httpd -k start 2468304 1276780 nobody 17392 0.1 S 00:14 /usr/sbin/httpd -k start 2468345 1276780 nobody 17368 0.1 S 00:12 /usr/sbin/httpd -k start 2468298 1276780 nobody 17332 0.1 S 00:14 /usr/sbin/httpd -k start 2468335 1276780 nobody 17332 0.0 S 00:12 /usr/sbin/httpd -k start 2468332 1276780 nobody 17328 0.0 S 00:12 /usr/sbin/httpd -k start 2468307 1276780 nobody 17324 0.0 S 00:13 /usr/sbin/httpd -k start 2468312 1276780 nobody 17284 0.0 S 00:13 /usr/sbin/httpd -k start 2468318 1276780 nobody 17144 0.0 S 00:13 /usr/sbin/httpd -k start 2468336 1276780 nobody 17136 0.0 S 00:12 /usr/sbin/httpd -k start 2468317 1276780 nobody 17044 0.0 S 00:13 /usr/sbin/httpd -k start 2468287 1276780 nobody 17020 0.0 S 00:16 /usr/sbin/httpd -k start 2468348 1276780 nobody 17016 0.0 S 00:12 /usr/sbin/httpd -k start 2467171 1276780 nobody 16992 0.0 S 02:45 /usr/sbin/httpd -k start 2467939 1276780 nobody 16960 0.0 S 01:05 /usr/sbin/httpd -k start 2468334 1276780 nobody 16936 0.0 S 00:12 /usr/sbin/httpd -k start 2468457 1276780 nobody 16872 0.0 S 00:03 /usr/sbin/httpd -k start 2468331 1276780 nobody 16864 0.0 S 00:12 /usr/sbin/httpd -k start 2468352 1276780 nobody 16320 0.0 S 00:12 /usr/sbin/httpd -k start 2468300 1276780 nobody 16300 0.0 S 00:14 /usr/sbin/httpd -k start 2468353 1276780 nobody 16152 0.0 S 00:12 /usr/sbin/httpd -k start 2468355 1276780 nobody 16088 0.0 S 00:12 /usr/sbin/httpd -k start 2468359 1276780 nobody 16088 0.0 S 00:12 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4003894 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 52 evolution/portal.evolutionerp.com.au-ssl_log 22 whiz/whizengineering.com.au 17 customc/customcentral.com.au-ssl_log 9 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 42 8.231.169.217 22 203.54.180.238 17 85.204.70.116 3 216.189.145.184 3 146.70.194.220 2 118.127.40.55 2 114.119.146.16 1 92.205.173.214 1 92.112.162.145 1 84.233.195.151 1 83.53.251.98 1 51.210.214.170 1 50.17.193.48 1 47.128.37.42 1 17.22.253.219 --- top request paths across all vhosts (last 3 min) --- 22 GET /heartbeat.php 8 GET / 3 POST / 2 POST /wp-cron.php 2 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 2 GET /user/login 2 GET /signin 2 GET /rclone.conf 2 GET /portal 2 GET /login 2 GET /.git/HEAD 2 GET /.git-credentials 2 GET /.gitconfig 2 GET /.git/config 2 GET /dashboard 2 GET /console 2 GET /auth/login 2 GET /app 2 GET /admin/login 2 GET /admin --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 4 GET / 3 POST / 2 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 2 GET /user/login 2 GET /signin 2 GET /rclone.conf 2 GET /portal 2 GET /login 2 GET /.git/HEAD 2 GET /.git-credentials 2 GET /.gitconfig 2 GET /.git/config -- last 10 requests -- 8.231.169.217 - - [15/Aug/2026:04:48:41 +1000] "GET /auth/login HTTP/1.1" 404 30558 "https://www.madalice.com.au/auth/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mob 8.231.169.217 - - [15/Aug/2026:04:48:40 +1000] "GET /admin HTTP/1.1" 302 1 "https://www.madalice.com.au/admin" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537 8.231.169.217 - - [15/Aug/2026:04:48:40 +1000] "GET /account HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36" 8.231.169.217 - - [15/Aug/2026:04:48:41 +1000] "GET /dashboard HTTP/1.1" 302 1 "https://www.madalice.com.au/dashboard" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Sa 8.231.169.217 - - [15/Aug/2026:04:48:43 +1000] "GET /my HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36" 8.231.169.217 - - [15/Aug/2026:04:48:42 +1000] "GET /app HTTP/1.1" 404 30552 "https://www.madalice.com.au/app" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537 8.231.169.217 - - [15/Aug/2026:04:48:43 +1000] "GET /portal HTTP/1.1" 404 30546 "https://www.madalice.com.au/portal" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safa 8.231.169.217 - - [15/Aug/2026:04:48:43 +1000] "GET /console HTTP/1.1" 404 30544 "https://www.madalice.com.au/console" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Sa 8.231.169.217 - - [15/Aug/2026:04:48:43 +1000] "GET /wp-login.php HTTP/1.1" 200 3750 "https://madalice.com.au/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safa 8.231.169.217 - - [15/Aug/2026:04:48:44 +1000] "POST /api/graphql HTTP/1.1" 404 30566 "https://www.madalice.com.au" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safar == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 22 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [15/Aug/2026:04:47:03 +1000] "GET /heartbeat.php?sentAt=1786733223&bytes=106,127,98,167&_=1786683794372 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:04:47:05 +1000] "GET /heartbeat.php?sentAt=1786733226&bytes=106,127,98,170&_=1786712384340 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:04:47:13 +1000] "GET /heartbeat.php?sentAt=1786733233&bytes=106,127,98,177&_=1786683794373 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:04:47:15 +1000] "GET /heartbeat.php?sentAt=1786733236&bytes=106,127,98,180&_=1786712384341 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:04:47:23 +1000] "GET /heartbeat.php?sentAt=1786733243&bytes=106,127,98,187&_=1786683794374 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:04:47:25 +1000] "GET /heartbeat.php?sentAt=1786733246&bytes=106,127,98,190&_=1786712384342 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:04:47:33 +1000] "GET /heartbeat.php?sentAt=1786733253&bytes=106,127,98,197&_=1786683794375 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:04:47:35 +1000] "GET /heartbeat.php?sentAt=1786733256&bytes=106,127,98,200&_=1786712384343 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:04:47:43 +1000] "GET /heartbeat.php?sentAt=1786733263&bytes=106,127,98,207&_=1786683794376 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:04:47:45 +1000] "GET /heartbeat.php?sentAt=1786733266&bytes=106,127,98,210&_=1786712384344 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" == whiz/whizengineering.com.au == -- top paths -- 3 GET / 1 GET /xmlrpc.php 1 GET /wp/wp-includes/wlwmanifest.xml 1 GET /wp-includes/wlwmanifest.xml 1 GET /wp1/wp-includes/wlwmanifest.xml 1 GET /wordpress/wp-includes/wlwmanifest.xml 1 GET /web/wp-includes/wlwmanifest.xml 1 GET /website/wp-includes/wlwmanifest.xml 1 GET /test/wp-includes/wlwmanifest.xml 1 GET /shop/wp-includes/wlwmanifest.xml 1 GET /news/wp-includes/wlwmanifest.xml 1 GET /media/wp-includes/wlwmanifest.xml -- last 10 requests -- 85.204.70.116 - - [15/Aug/2026:04:47:31 +1000] "GET /wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari 85.204.70.116 - - [15/Aug/2026:04:47:32 +1000] "GET /website/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/5 85.204.70.116 - - [15/Aug/2026:04:47:32 +1000] "GET /wp/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 85.204.70.116 - - [15/Aug/2026:04:47:32 +1000] "GET /news/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537. 85.204.70.116 - - [15/Aug/2026:04:47:33 +1000] "GET /2018/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537. 85.204.70.116 - - [15/Aug/2026:04:47:33 +1000] "GET /2019/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537. 85.204.70.116 - - [15/Aug/2026:04:47:33 +1000] "GET /shop/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537. 85.204.70.116 - - [15/Aug/2026:04:47:34 +1000] "GET /wp1/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.3 85.204.70.116 - - [15/Aug/2026:04:47:34 +1000] "GET /test/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537. 85.204.70.116 - - [15/Aug/2026:04:47:34 +1000] "GET /media/wp-includes/wlwmanifest.xml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537 --- last 30 samples (run-up to this incident) --- 2026-08-15 04:46:19 L1=0.54 run=1 blk=0 avail=7090 (60.5%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=17 tcp=27 topuser=- 2026-08-15 04:46:26 L1=0.49 run=1 blk=0 avail=7085 (60.4%) swpO=0 conn=4 myRSS=2294 php=1 phpRSS=39 ap=16 tcp=23 topuser=evolution 2026-08-15 04:46:29 L1=0.45 run=1 blk=0 avail=7094 (60.5%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=16 tcp=21 topuser=- 2026-08-15 04:46:36 L1=0.58 run=2 blk=0 avail=7085 (60.4%) swpO=0 conn=4 myRSS=2294 php=1 phpRSS=39 ap=16 tcp=23 topuser=evolution 2026-08-15 04:46:39 L1=0.53 run=4 blk=0 avail=6967 (59.4%) swpO=1 conn=1 myRSS=2294 php=2 phpRSS=193 ap=16 tcp=23 topuser=tubesupplies 2026-08-15 04:46:46 L1=0.49 run=2 blk=0 avail=7082 (60.4%) swpO=1 conn=4 myRSS=2294 php=1 phpRSS=39 ap=16 tcp=22 topuser=evolution 2026-08-15 04:46:49 L1=0.45 run=1 blk=0 avail=7092 (60.5%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=16 tcp=24 topuser=- 2026-08-15 04:46:56 L1=0.41 run=1 blk=0 avail=7081 (60.4%) swpO=0 conn=4 myRSS=2294 php=1 phpRSS=39 ap=16 tcp=21 topuser=evolution 2026-08-15 04:47:00 L1=0.38 run=1 blk=0 avail=7104 (60.6%) swpO=1 conn=1 myRSS=2294 php=0 phpRSS=0 ap=15 tcp=20 topuser=- 2026-08-15 04:47:06 L1=0.35 run=2 blk=0 avail=7098 (60.5%) swpO=1 conn=4 myRSS=2294 php=1 phpRSS=39 ap=14 tcp=22 topuser=evolution 2026-08-15 04:47:10 L1=0.40 run=1 blk=0 avail=7100 (60.5%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=15 tcp=23 topuser=- 2026-08-15 04:47:16 L1=0.37 run=1 blk=0 avail=7095 (60.5%) swpO=0 conn=2 myRSS=2294 php=1 phpRSS=39 ap=14 tcp=21 topuser=evolution 2026-08-15 04:47:20 L1=0.34 run=1 blk=0 avail=7106 (60.6%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=14 tcp=20 topuser=- 2026-08-15 04:47:26 L1=0.31 run=2 blk=0 avail=7097 (60.5%) swpO=0 conn=2 myRSS=2294 php=1 phpRSS=39 ap=14 tcp=23 topuser=evolution 2026-08-15 04:47:30 L1=0.29 run=1 blk=0 avail=7111 (60.6%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=14 tcp=20 topuser=- 2026-08-15 04:47:36 L1=0.26 run=1 blk=0 avail=7094 (60.5%) swpO=0 conn=2 myRSS=2294 php=1 phpRSS=39 ap=14 tcp=23 topuser=evolution 2026-08-15 04:47:40 L1=0.24 run=4 blk=0 avail=6963 (59.4%) swpO=0 conn=1 myRSS=2294 php=2 phpRSS=205 ap=14 tcp=26 topuser=madalice 2026-08-15 04:47:46 L1=0.22 run=1 blk=0 avail=7078 (60.3%) swpO=0 conn=2 myRSS=2294 php=1 phpRSS=39 ap=17 tcp=23 topuser=evolution 2026-08-15 04:47:50 L1=0.28 run=1 blk=0 avail=7098 (60.5%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=17 tcp=21 topuser=- 2026-08-15 04:47:56 L1=0.34 run=2 blk=0 avail=7045 (60.1%) swpO=0 conn=2 myRSS=2294 php=2 phpRSS=119 ap=15 tcp=22 topuser=customc 2026-08-15 04:48:00 L1=0.31 run=1 blk=0 avail=7105 (60.6%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=15 tcp=23 topuser=- 2026-08-15 04:48:06 L1=0.37 run=3 blk=0 avail=6814 (58.1%) swpO=0 conn=2 myRSS=2294 php=3 phpRSS=377 ap=15 tcp=24 topuser=madalice 2026-08-15 04:48:10 L1=0.42 run=1 blk=0 avail=7104 (60.6%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=15 tcp=24 topuser=- 2026-08-15 04:48:16 L1=0.47 run=1 blk=0 avail=7088 (60.4%) swpO=0 conn=2 myRSS=2294 php=1 phpRSS=39 ap=16 tcp=21 topuser=evolution 2026-08-15 04:48:20 L1=0.43 run=1 blk=0 avail=7096 (60.5%) swpO=0 conn=1 myRSS=2294 php=0 phpRSS=0 ap=16 tcp=20 topuser=- 2026-08-15 04:48:26 L1=0.39 run=2 blk=0 avail=7048 (60.1%) swpO=0 conn=2 myRSS=2294 php=2 phpRSS=116 ap=14 tcp=23 topuser=madalice 2026-08-15 04:48:30 L1=0.44 run=10 blk=0 avail=6443 (54.9%) swpO=0 conn=9 myRSS=2294 php=8 phpRSS=898 ap=15 tcp=49 topuser=madalice 2026-08-15 04:48:36 L1=0.89 run=15 blk=0 avail=5620 (47.9%) swpO=0 conn=2 myRSS=2294 php=13 phpRSS=1463 ap=77 tcp=83 topuser=madalice 2026-08-15 04:48:40 L1=1.78 run=16 blk=0 avail=5591 (47.7%) swpO=0 conn=9 myRSS=2294 php=14 phpRSS=1371 ap=74 tcp=58 topuser=madalice 2026-08-15 04:48:47 L1=2.92 run=14 blk=0 avail=5405 (46.1%) swpO=1 conn=10 myRSS=2294 php=10 phpRSS=1507 ap=85 tcp=108 topuser=madalice