INCIDENT 2026-08-15 06:58:13 trigger: php_rss=1627MB ================================================================== load: 1.45 1.45 1.03 20/642 2543601 ncpu:10 mem_avail: 5856MB/11729MB (49.9%) swap_used:1373MB swapout:0/s blocked(D):0 running:16 iowait:0.1% steal:0.0% php: 12 procs / 1627MB heaviest user: madalice (12 procs, 1627MB) apache: 51 procs tcp_estab: 66 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2162 madalice 13 1846 root 238 885 nobody 50 638 netdata 8 266 cpanellogin 1 64 kurri 4 50 dovenull 6 28 lowrange 2 26 wp-toolkit 6 20 mailman 20 14 vinesit 1 12 infinium 1 12 zabbix 1 11 dovecot 3 8 named 1 6 nscd 1 4 evolution 4 3 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 12 1620 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3184 MB Active(file): 1542 MB Inactive(file): 979 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 398 MB CommitLimit: 9960 MB Committed_AS: 8866 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2342983 root 05:46:58 4700 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 1420296 1 mysql 2214120 10.1 Ssl 1-05:19:13 /usr/sbin/mariadbd 2543530 2541800 madalice 266100 111 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 217924 2.5 Ssl 46-20:48:16 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2543527 2543521 madalice 204088 60.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2390233 2382613 root 181128 0.0 S 04:22:36 spamd child 2543545 2543539 madalice 172220 73.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2382613 1 root 153944 0.0 Ss 04:35:02 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2543546 2543535 madalice 152316 128 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2543548 2543537 madalice 150204 123 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2543549 2543534 madalice 136004 106 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2543550 2543536 madalice 124360 97.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2543547 2543541 madalice 112200 82.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2543543 2543538 madalice 108656 39.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2390234 2382613 root 108536 0.0 S 04:22:36 spamd child 159820 1 root 102856 0.0 Ss 25-21:11:24 /usr/lib/systemd/systemd-journald 2543571 2543561 madalice 71544 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2525318 1353308 cpanellogin 66292 0.1 S 30:01 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 2223 1201 root 50736 0.0 Sl 46-20:48:15 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41224 0.0 Ss 24-04:16:46 cpsrvd (SSL) - waiting for connections 1469 1 root 40940 0.1 Ss 46-20:48:15 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2543588 1469 root 38316 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 32364 0.1 Sl 46-20:48:11 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2381704 1 root 29540 0.0 Ss 04:36:01 lfd - sleeping 2534347 1276780 nobody 22036 0.0 S 15:20 /usr/sbin/httpd -k start 2538210 1276780 nobody 21136 0.0 S 07:55 /usr/sbin/httpd -k start 2539124 1276780 nobody 20036 0.0 S 06:18 /usr/sbin/httpd -k start 2541749 1276780 nobody 19024 0.0 S 02:58 /usr/sbin/httpd -k start 2541698 1276780 nobody 18916 0.0 S 02:59 /usr/sbin/httpd -k start 2539105 1276780 nobody 18868 0.0 S 06:19 /usr/sbin/httpd -k start 2541624 1276780 nobody 18820 0.0 S 03:01 /usr/sbin/httpd -k start 2541790 1276780 nobody 18820 0.0 S 02:57 /usr/sbin/httpd -k start 2540706 1276780 nobody 18808 0.0 S 03:34 /usr/sbin/httpd -k start 2540146 1276780 nobody 18672 0.0 S 04:52 /usr/sbin/httpd -k start 2538217 1276780 nobody 18212 0.0 S 07:54 /usr/sbin/httpd -k start 2541623 1276780 nobody 17968 0.0 S 03:01 /usr/sbin/httpd -k start 2541618 1276780 nobody 17964 0.0 S 03:01 /usr/sbin/httpd -k start 2541738 1276780 nobody 17816 0.0 S 02:58 /usr/sbin/httpd -k start 2539168 1276780 nobody 17552 0.0 S 06:16 /usr/sbin/httpd -k start 2539073 1276780 nobody 17428 0.0 S 06:20 /usr/sbin/httpd -k start 2543522 1276780 nobody 17296 0.3 S 00:03 /usr/sbin/httpd -k start 2543523 1276780 nobody 17260 0.6 S 00:03 /usr/sbin/httpd -k start 2543513 1276780 nobody 17208 0.2 S 00:04 /usr/sbin/httpd -k start 2541800 1276780 nobody 17080 0.0 S 02:57 /usr/sbin/httpd -k start 2543506 1276780 nobody 17024 0.4 S 00:05 /usr/sbin/httpd -k start 2543514 1276780 nobody 17016 0.2 S 00:04 /usr/sbin/httpd -k start 2543540 1276780 nobody 16916 0.0 S 00:02 /usr/sbin/httpd -k start 2543536 1276780 nobody 15140 0.0 S 00:02 /usr/sbin/httpd -k start 2543535 1276780 nobody 15076 0.0 S 00:02 /usr/sbin/httpd -k start 2543538 1276780 nobody 15052 0.0 S 00:02 /usr/sbin/httpd -k start 2543534 1276780 nobody 15020 0.0 S 00:02 /usr/sbin/httpd -k start 2543539 1276780 nobody 15016 0.0 S 00:02 /usr/sbin/httpd -k start 2543561 1276780 nobody 15000 0.0 S 00:01 /usr/sbin/httpd -k start 2543537 1276780 nobody 14924 0.0 S 00:02 /usr/sbin/httpd -k start 2543541 1276780 nobody 14912 0.0 S 00:02 /usr/sbin/httpd -k start 185104 2431 netdata 14860 2.0 Sl 2-10:24:34 /usr/libexec/netdata/plugins.d/apps.plugin 1 2543521 1276780 nobody 14788 0.0 S 00:03 /usr/sbin/httpd -k start 2542721 1471 root 14572 0.0 S 01:09 cPhulkd - processor - http socket 2540574 3828812 lowrange 14356 0.0 S 03:45 dovecot/pop3 1601939 1471 root 14160 0.0 S 23:45:16 cPhulkd - dbprocessor 1463 1 root 13964 0.0 Ss 46-20:48:15 tailwatchd --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4012654 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min lowrange/lowrange.com.au-ssl_log 90 madalice/madalice.com.au-ssl_log 43 evolution/portal.evolutionerp.com.au-ssl_log 17 tubesupplies/tubesupplies.com.au-ssl_log 2 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 89 20.228.229.148 29 20.203.183.135 17 203.54.180.238 2 91.92.243.243 1 79.51.176.114 1 45.81.146.56 1 43.119.100.187 1 40.77.167.51 1 39.34.166.223 1 2a03:2880:f802:a:: 1 27.4.1.136 1 185.228.112.36 1 181.224.42.128 1 177.200.157.101 1 177.137.210.11 --- top request paths across all vhosts (last 3 min) --- 17 GET /heartbeat.php 2 POST /wp-login.php 2 GET /xx.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /this_is_a_new_hello_world.php 2 GET /222.php 2 GET /1.php 1 POST /xmlrpc.php 1 POST / 1 GET /yj09.php 1 GET /xxxx.php 1 GET /xxw.php 1 GET /x7.php 1 GET /wto.php 1 GET /wsd.php 1 GET /ws45.php 1 GET /ws38.php 1 GET /ws37.php 1 GET /ws36.php 1 GET /ws34.php --- busiest 3 vhosts: top paths + last 10 requests --- == lowrange/lowrange.com.au-ssl_log == -- top paths -- 1 POST /xmlrpc.php 1 GET /xxxx.php 1 GET /xxw.php 1 GET /xx.php 1 GET /x7.php 1 GET /wto.php 1 GET /wsd.php 1 GET /ws45.php 1 GET /ws38.php 1 GET /ws37.php 1 GET /ws36.php 1 GET /ws34.php -- last 10 requests -- 20.228.229.148 - - [15/Aug/2026:06:57:54 +1000] "GET /card.php HTTP/1.1" 401 36 "-" "-" 20.228.229.148 - - [15/Aug/2026:06:57:54 +1000] "GET /size.php HTTP/1.1" 401 36 "-" "-" 20.228.229.148 - - [15/Aug/2026:06:57:55 +1000] "GET /class629.php HTTP/1.1" 401 36 "-" "-" 20.228.229.148 - - [15/Aug/2026:06:57:55 +1000] "GET /file9.php HTTP/1.1" 401 36 "-" "-" 20.228.229.148 - - [15/Aug/2026:06:57:55 +1000] "GET /moon.php HTTP/1.1" 401 36 "-" "-" 20.228.229.148 - - [15/Aug/2026:06:57:56 +1000] "GET /file18.php HTTP/1.1" 401 36 "-" "-" 20.228.229.148 - - [15/Aug/2026:06:57:56 +1000] "GET /file21.php HTTP/1.1" 401 36 "-" "-" 20.228.229.148 - - [15/Aug/2026:06:57:57 +1000] "GET /xxw.php HTTP/1.1" 401 36 "-" "-" 20.228.229.148 - - [15/Aug/2026:06:57:57 +1000] "GET /racs3.php HTTP/1.1" 401 36 "-" "-" 20.228.229.148 - - [15/Aug/2026:06:57:58 +1000] "GET /wsd.php HTTP/1.1" 401 36 "-" "-" == madalice/madalice.com.au-ssl_log == -- top paths -- 1 POST / 1 GET /yj09.php 1 GET /xx.php 1 GET /wp-ws68.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /this_is_a_new_hello_world.php 1 GET /the-latest-trends-in-air-force-1-customization/ 1 GET /tag/school/ 1 GET /tag/corporate/ 1 GET /tag/business/ 1 GET /tag/branding/ 1 GET /tag/art/ -- last 10 requests -- 40.77.167.51 - - [15/Aug/2026:06:56:53 +1000] "GET /store/hand-painted-nike-af1-badguy/ HTTP/1.1" 404 30546 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.ht 103.86.56.87 - - [15/Aug/2026:06:58:08 +1000] "GET /the-latest-trends-in-air-force-1-customization/ HTTP/1.1" 200 32590 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1 177.200.157.101 - - [15/Aug/2026:06:58:08 +1000] "GET /store/pink-af1s/?srsltid=AfmBOoqjXVGCY-G_UCoEwemcRDH5nBbSZgLQL-s8Di8ieLhELa322HLE HTTP/1.1" 200 49669 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi 45.81.146.56 - - [15/Aug/2026:06:58:08 +1000] "GET /tag/school/ HTTP/1.1" 200 28971 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" 185.228.112.36 - - [15/Aug/2026:06:58:08 +1000] "GET /tag/business/ HTTP/1.1" 200 29309 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" 79.51.176.114 - - [15/Aug/2026:06:58:08 +1000] "GET /customize-christmas-sneakers-australia/ HTTP/1.1" 200 32575 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0. 39.34.166.223 - - [15/Aug/2026:06:58:08 +1000] "GET /store/cat-and-mouse-af1/ HTTP/1.1" 200 47903 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 177.137.210.11 - - [15/Aug/2026:06:58:09 +1000] "GET /tag/branding/ HTTP/1.1" 200 29306 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" 103.186.23.210 - - [15/Aug/2026:06:58:09 +1000] "GET /tag/corporate/ HTTP/1.1" 200 29314 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" 137.255.39.53 - - [15/Aug/2026:06:58:09 +1000] "GET /store/rainbow-drippy-nike-swooshes-custom-af1/ HTTP/1.1" 200 46641 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 17 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [15/Aug/2026:06:56:35 +1000] "GET /heartbeat.php?sentAt=1786740996&bytes=106,127,129,4&_=1786712385117 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:06:56:43 +1000] "GET /heartbeat.php?sentAt=1786741003&bytes=106,127,129,11&_=1786683795150 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:06:56:45 +1000] "GET /heartbeat.php?sentAt=1786741006&bytes=106,127,129,14&_=1786712385118 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:06:56:53 +1000] "GET /heartbeat.php?sentAt=1786741013&bytes=106,127,129,21&_=1786683795151 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:06:56:55 +1000] "GET /heartbeat.php?sentAt=1786741016&bytes=106,127,129,24&_=1786712385119 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:06:57:03 +1000] "GET /heartbeat.php?sentAt=1786741023&bytes=106,127,129,31&_=1786683795152 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:06:57:05 +1000] "GET /heartbeat.php?sentAt=1786741026&bytes=106,127,129,34&_=1786712385120 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:06:57:13 +1000] "GET /heartbeat.php?sentAt=1786741033&bytes=106,127,129,41&_=1786683795153 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:06:57:15 +1000] "GET /heartbeat.php?sentAt=1786741036&bytes=106,127,129,44&_=1786712385121 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:06:57:23 +1000] "GET /heartbeat.php?sentAt=1786741043&bytes=106,127,129,51&_=1786683795154 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-08-15 06:55:45 L1=5.19 run=4 blk=0 avail=6256 (53.3%) swpO=0 conn=23 myRSS=2162 php=2 phpRSS=261 ap=126 tcp=38 topuser=madalice 2026-08-15 06:55:52 L1=4.85 run=2 blk=0 avail=6448 (55.0%) swpO=0 conn=2 myRSS=2162 php=1 phpRSS=82 ap=119 tcp=39 topuser=otterfencing 2026-08-15 06:55:55 L1=4.46 run=2 blk=0 avail=6442 (54.9%) swpO=0 conn=23 myRSS=2162 php=1 phpRSS=100 ap=116 tcp=36 topuser=otterfencing 2026-08-15 06:56:02 L1=4.19 run=2 blk=0 avail=6509 (55.5%) swpO=0 conn=2 myRSS=2162 php=1 phpRSS=87 ap=109 tcp=31 topuser=otterfencing 2026-08-15 06:56:05 L1=3.85 run=3 blk=0 avail=6516 (55.6%) swpO=0 conn=2 myRSS=2162 php=1 phpRSS=102 ap=106 tcp=31 topuser=otterfencing 2026-08-15 06:56:12 L1=3.70 run=2 blk=0 avail=6531 (55.7%) swpO=0 conn=2 myRSS=2162 php=1 phpRSS=133 ap=99 tcp=35 topuser=otterfencing 2026-08-15 06:56:15 L1=3.56 run=2 blk=0 avail=6539 (55.8%) swpO=0 conn=2 myRSS=2162 php=1 phpRSS=149 ap=96 tcp=38 topuser=otterfencing 2026-08-15 06:56:22 L1=3.36 run=2 blk=0 avail=6582 (56.1%) swpO=0 conn=2 myRSS=2162 php=1 phpRSS=166 ap=88 tcp=33 topuser=otterfencing 2026-08-15 06:56:25 L1=3.09 run=1 blk=0 avail=6734 (57.4%) swpO=0 conn=2 myRSS=2162 php=0 phpRSS=0 ap=86 tcp=33 topuser=- 2026-08-15 06:56:33 L1=2.84 run=2 blk=0 avail=6749 (57.5%) swpO=0 conn=2 myRSS=2162 php=1 phpRSS=67 ap=78 tcp=32 topuser=alison 2026-08-15 06:56:35 L1=2.69 run=1 blk=0 avail=6804 (58.0%) swpO=0 conn=2 myRSS=2162 php=0 phpRSS=0 ap=76 tcp=33 topuser=- 2026-08-15 06:56:43 L1=2.48 run=1 blk=0 avail=6857 (58.5%) swpO=0 conn=2 myRSS=2162 php=0 phpRSS=0 ap=68 tcp=30 topuser=- 2026-08-15 06:56:45 L1=2.28 run=1 blk=0 avail=6873 (58.6%) swpO=0 conn=2 myRSS=2162 php=0 phpRSS=0 ap=66 tcp=29 topuser=- 2026-08-15 06:56:53 L1=2.10 run=1 blk=0 avail=6932 (59.1%) swpO=0 conn=1 myRSS=2162 php=0 phpRSS=0 ap=58 tcp=31 topuser=- 2026-08-15 06:56:55 L1=2.01 run=2 blk=0 avail=6715 (57.3%) swpO=0 conn=2 myRSS=2162 php=1 phpRSS=260 ap=56 tcp=36 topuser=madalice 2026-08-15 06:57:03 L1=1.85 run=3 blk=0 avail=6998 (59.7%) swpO=0 conn=1 myRSS=2162 php=1 phpRSS=40 ap=48 tcp=37 topuser=evolution 2026-08-15 06:57:05 L1=1.86 run=1 blk=0 avail=6861 (58.5%) swpO=0 conn=3 myRSS=2162 php=2 phpRSS=218 ap=46 tcp=39 topuser=tubesupplies 2026-08-15 06:57:13 L1=1.71 run=3 blk=1 avail=6683 (57.0%) swpO=0 conn=1 myRSS=2162 php=5 phpRSS=531 ap=38 tcp=37 topuser=infinium 2026-08-15 06:57:15 L1=1.73 run=1 blk=0 avail=6992 (59.6%) swpO=0 conn=3 myRSS=2162 php=1 phpRSS=80 ap=36 tcp=34 topuser=infinium 2026-08-15 06:57:23 L1=1.60 run=1 blk=0 avail=7105 (60.6%) swpO=0 conn=1 myRSS=2162 php=1 phpRSS=40 ap=30 tcp=39 topuser=evolution 2026-08-15 06:57:25 L1=1.47 run=1 blk=0 avail=7116 (60.7%) swpO=0 conn=3 myRSS=2162 php=0 phpRSS=0 ap=30 tcp=36 topuser=- 2026-08-15 06:57:33 L1=1.35 run=1 blk=0 avail=7139 (60.9%) swpO=0 conn=1 myRSS=2162 php=1 phpRSS=39 ap=28 tcp=32 topuser=evolution 2026-08-15 06:57:35 L1=1.24 run=1 blk=0 avail=7166 (61.1%) swpO=0 conn=3 myRSS=2162 php=0 phpRSS=0 ap=26 tcp=31 topuser=- 2026-08-15 06:57:43 L1=1.14 run=1 blk=0 avail=7157 (61.0%) swpO=0 conn=1 myRSS=2162 php=1 phpRSS=40 ap=25 tcp=31 topuser=evolution 2026-08-15 06:57:45 L1=1.05 run=2 blk=0 avail=7176 (61.2%) swpO=0 conn=3 myRSS=2162 php=1 phpRSS=10 ap=23 tcp=32 topuser=evolution 2026-08-15 06:57:53 L1=1.05 run=3 blk=0 avail=7162 (61.1%) swpO=0 conn=2 myRSS=2162 php=1 phpRSS=40 ap=23 tcp=32 topuser=evolution 2026-08-15 06:57:55 L1=1.04 run=3 blk=0 avail=6966 (59.4%) swpO=0 conn=3 myRSS=2162 php=2 phpRSS=270 ap=23 tcp=32 topuser=madalice 2026-08-15 06:58:03 L1=0.96 run=1 blk=0 avail=7185 (61.3%) swpO=0 conn=2 myRSS=2162 php=1 phpRSS=40 ap=20 tcp=29 topuser=evolution 2026-08-15 06:58:05 L1=0.88 run=1 blk=1 avail=7183 (61.2%) swpO=0 conn=2 myRSS=2162 php=1 phpRSS=40 ap=20 tcp=29 topuser=evolution 2026-08-15 06:58:13 L1=1.45 run=16 blk=0 avail=5856 (49.9%) swpO=0 conn=12 myRSS=2162 php=12 phpRSS=1627 ap=51 tcp=66 topuser=madalice