INCIDENT 2026-08-15 07:10:16 trigger: php_rss=1773MB mysql_conn=15 ================================================================== load: 2.38 11.42 13.93 19/643 2551109 ncpu:10 mem_avail: 7769MB/11729MB (66.2%) swap_used:1329MB swapout:0/s blocked(D):0 running:19 iowait:0.1% steal:0.0% php: 15 procs / 1773MB heaviest user: madalice (15 procs, 1773MB) apache: 47 procs tcp_estab: 76 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 14 1518 nobody 46 717 mysql 1 547 root 245 538 netdata 8 225 cpanellogin 1 63 mailnull 5 33 dovenull 6 20 mailman 20 19 wp-toolkit 6 18 zabbix 1 11 evolution 5 9 kurri 3 7 dovecot 3 7 named 1 4 cpanelconnecttrack 1 3 polkitd 1 2 dbus 1 2 nscd 1 1 rpc 1 0 --- php workers by user --- USER PROCS RSS_MB madalice 13 1491 evolution 1 39 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 2811 MB Active(file): 1148 MB Inactive(file): 1084 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 194 MB CommitLimit: 9960 MB Committed_AS: 9476 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2342983 root 05:59:01 208 /usr/bin/imunify-agent-proxy 2550360 root 01:02 61084 /opt/imunify360/venv/bin/python3 -m imav.run 2550786 root 00:16 1232 /bin/sh -c bash -c "sleep $((RANDOM % 60))" ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2544865 1 mysql 560380 3.8 Ssl 09:17 /usr/sbin/mariadbd 2551032 2550317 madalice 266308 74.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2551036 2550327 madalice 207488 61.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2551039 2551015 madalice 178472 75.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 170640 2.5 Ssl 46-21:00:19 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2551057 2550311 madalice 139576 55.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2390233 2382613 root 138928 0.0 S 04:34:39 spamd child 2551068 2551022 madalice 108028 75.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2551066 2551016 madalice 104904 70.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2551067 2551019 madalice 98348 59.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2551065 2551028 madalice 95660 56.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2551071 2551027 madalice 91260 48.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2382613 1 root 82984 0.0 Ss 04:47:05 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2551070 2551025 madalice 81564 42.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2551069 2551017 madalice 81280 42.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2551072 2551024 madalice 78600 35.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2551073 2551021 madalice 76376 33.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2525318 1353308 cpanellogin 65500 0.0 S 42:04 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 2550360 1 root 61084 2.2 Ssl 01:02 /opt/imunify360/venv/bin/python3 -m imav.run 2551118 2550998 madalice 60904 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 159820 1 root 58844 0.0 Ss 25-21:23:27 /usr/lib/systemd/systemd-journald 2551127 2551105 madalice 43556 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4922 2431 netdata 42392 0.1 Sl 46-21:00:14 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2551106 2548662 evolution 40748 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2548662 1276780 nobody 23200 0.0 S 03:03 /usr/sbin/httpd -k start 2390234 2382613 root 22324 0.0 S 04:34:39 spamd child 2223 1201 root 22320 0.0 Sl 46-21:00:18 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 21132 0.1 Ss 46-21:00:18 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2381704 1 root 19744 0.0 Ss 04:48:04 lfd - sleeping 2548751 1276780 nobody 19636 0.0 S 03:01 /usr/sbin/httpd -k start 2548676 1276780 nobody 19588 0.0 S 03:02 /usr/sbin/httpd -k start 2550317 1276780 nobody 18636 0.0 S 01:09 /usr/sbin/httpd -k start 2548684 1276780 nobody 18504 0.0 S 03:02 /usr/sbin/httpd -k start 2550311 1276780 nobody 18228 0.0 S 01:10 /usr/sbin/httpd -k start 2550592 1276780 nobody 17700 0.0 S 00:49 /usr/sbin/httpd -k start 2550193 1276780 nobody 17628 0.0 S 01:21 /usr/sbin/httpd -k start 2550584 1276780 nobody 17448 0.0 S 00:50 /usr/sbin/httpd -k start 2550997 1276780 nobody 17448 0.2 S 00:05 /usr/sbin/httpd -k start 2550996 1276780 nobody 17224 0.2 S 00:05 /usr/sbin/httpd -k start 2550990 1276780 nobody 17192 0.1 S 00:06 /usr/sbin/httpd -k start 2551002 1276780 nobody 17188 0.2 S 00:05 /usr/sbin/httpd -k start 2551013 1276780 nobody 17176 0.2 S 00:04 /usr/sbin/httpd -k start 2550991 1276780 nobody 17168 0.3 S 00:06 /usr/sbin/httpd -k start 2551014 1276780 nobody 17132 0.5 S 00:04 /usr/sbin/httpd -k start 2550978 1276780 nobody 17116 0.1 S 00:08 /usr/sbin/httpd -k start 2550327 1276780 nobody 17080 0.0 S 01:08 /usr/sbin/httpd -k start 2550998 1276780 nobody 17020 0.4 S 00:05 /usr/sbin/httpd -k start 2551001 1276780 nobody 17016 0.2 S 00:05 /usr/sbin/httpd -k start 2550045 1276780 nobody 17004 0.0 S 01:34 /usr/sbin/httpd -k start 2550984 1276780 nobody 16952 0.4 S 00:07 /usr/sbin/httpd -k start 2551023 1276780 nobody 16932 0.0 S 00:04 /usr/sbin/httpd -k start 2551003 1276780 nobody 16928 0.0 S 00:05 /usr/sbin/httpd -k start 2550999 1276780 nobody 16900 0.0 S 00:05 /usr/sbin/httpd -k start 2551018 1276780 nobody 16900 0.0 S 00:04 /usr/sbin/httpd -k start 2551020 1276780 nobody 16844 0.0 S 00:04 /usr/sbin/httpd -k start 2551000 1276780 nobody 16676 0.0 S 00:05 /usr/sbin/httpd -k start 2551026 1276780 nobody 16640 0.0 S 00:04 /usr/sbin/httpd -k start 2550591 1276780 nobody 16276 0.0 S 00:49 /usr/sbin/httpd -k start 185104 2431 netdata 16136 2.0 Sl 2-10:36:37 /usr/libexec/netdata/plugins.d/apps.plugin 1 2551017 1276780 nobody 15064 0.0 S 00:04 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +-----+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +-----+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 789 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +-----+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min tubesupplies/tubesupplies.com.au-ssl_log 35 evolution/portal.evolutionerp.com.au-ssl_log 25 madalice/madalice.com.au-ssl_log 23 whiz/whizengineering.com.au-ssl_log 13 speedlin/speedlinefencing.com.au-ssl_log 12 alison/alisonarts.com.au-ssl_log 3 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 35 20.104.49.167 25 203.54.180.238 13 20.110.140.87 7 4.223.164.152 3 65.21.136.254 2 68.67.112.216 2 216.73.216.177 2 207.46.13.92 2 14.226.33.209 1 95.217.152.54 1 93.34.235.74 1 91.106.41.141 1 84.54.70.111 1 81.196.154.48 1 59.152.97.165 --- top request paths across all vhosts (last 3 min) --- 25 GET /heartbeat.php 14 GET / 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /this_is_a_new_hello_world.php 2 GET /oxvrws.php 2 GET /media.php 2 GET /images.php 2 GET /av.php 2 GET /admin.php 1 POST / 1 GET /xx.php 1 GET /.well-known/openid-configuration 1 GET /.well-known/dnt-policy.txt 1 GET /we-customise-shoes-australia/ 1 GET /uplozyu.php 1 GET /uploxe.php 1 GET /uploat.php 1 GET /tag/alison/ 1 GET /system.php 1 GET /sts.php --- busiest 3 vhosts: top paths + last 10 requests --- == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 2 GET /oxvrws.php 1 GET /xx.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /uplozyu.php 1 GET /uploxe.php 1 GET /uploat.php 1 GET /this_is_a_new_hello_world.php 1 GET /system.php 1 GET /sts.php 1 GET /shell20211028.php 1 GET /sf.php 1 GET /QtJwDSjqvyT.php -- last 10 requests -- 20.104.49.167 - - [15/Aug/2026:07:09:20 +1000] "GET /uplozyu.php HTTP/1.1" 404 5750 "-" "-" 20.104.49.167 - - [15/Aug/2026:07:09:20 +1000] "GET /uploxe.php HTTP/1.1" 404 5750 "-" "-" 20.104.49.167 - - [15/Aug/2026:07:09:21 +1000] "GET /shell20211028.php HTTP/1.1" 404 5750 "-" "-" 20.104.49.167 - - [15/Aug/2026:07:09:21 +1000] "GET /dropdown.php HTTP/1.1" 404 5750 "-" "-" 20.104.49.167 - - [15/Aug/2026:07:09:22 +1000] "GET /oxvrws.php HTTP/1.1" 404 5750 "-" "-" 20.104.49.167 - - [15/Aug/2026:07:09:22 +1000] "GET /uploat.php HTTP/1.1" 404 5750 "-" "-" 20.104.49.167 - - [15/Aug/2026:07:09:22 +1000] "GET /oxvrws.php HTTP/1.1" 404 5750 "-" "-" 20.104.49.167 - - [15/Aug/2026:07:09:23 +1000] "GET /sts.php HTTP/1.1" 404 5750 "-" "-" 20.104.49.167 - - [15/Aug/2026:07:09:23 +1000] "GET /system.php HTTP/1.1" 404 5750 "-" "-" 20.104.49.167 - - [15/Aug/2026:07:09:24 +1000] "GET /layout.php HTTP/1.1" 404 5750 "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 25 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [15/Aug/2026:07:09:15 +1000] "GET /heartbeat.php?sentAt=1786741756&bytes=106,127,131,252&_=1786712385193 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [15/Aug/2026:07:09:23 +1000] "GET /heartbeat.php?sentAt=1786741763&bytes=106,127,132,3&_=1786683795226 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:07:09:25 +1000] "GET /heartbeat.php?sentAt=1786741766&bytes=106,127,132,6&_=1786712385194 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:07:09:33 +1000] "GET /heartbeat.php?sentAt=1786741773&bytes=106,127,132,13&_=1786683795227 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:07:09:35 +1000] "GET /heartbeat.php?sentAt=1786741776&bytes=106,127,132,16&_=1786712385195 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:07:09:43 +1000] "GET /heartbeat.php?sentAt=1786741783&bytes=106,127,132,23&_=1786683795228 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:07:09:45 +1000] "GET /heartbeat.php?sentAt=1786741786&bytes=106,127,132,26&_=1786712385196 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:07:09:53 +1000] "GET /heartbeat.php?sentAt=1786741793&bytes=106,127,132,33&_=1786683795229 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:07:09:55 +1000] "GET /heartbeat.php?sentAt=1786741796&bytes=106,127,132,36&_=1786712385197 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:07:10:03 +1000] "GET /heartbeat.php?sentAt=1786741803&bytes=106,127,132,43&_=1786683795230 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" == madalice/madalice.com.au-ssl_log == -- top paths -- 1 POST / 1 GET /we-customise-shoes-australia/ 1 GET /the-ultimate-guide-to-sneaker-care-how-to-keep-your-custom-kicks-looking-fresh/ 1 GET /store/pink-pearl-bauble-af1/ 1 GET /store/nike-af1-ice-cream-sneakers-with-sprinkles/ 1 GET /store/leopard-luxe-adidas-samba-sneakers/ 1 GET /store/kids-af1-sequin-rainbow/ 1 GET /store/custom-wests-tigers-hand-painted-shoes/ 1 GET /store/custom-mushroom-nike-air-force-1-psychedelic-sneakers/ 1 GET /store/custom-ice-cream-sneakers-3d-waffle-cone-sprinkles/ 1 GET /store/croc-charms-spiderman/ 1 GET /store/black-glitter-doc-marten/ -- last 10 requests -- 45.143.30.192 - - [15/Aug/2026:07:10:12 +1000] "GET /custom-bike-blazer-highs/ HTTP/1.1" 200 31012 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.3 190.233.86.129 - - [15/Aug/2026:07:10:12 +1000] "GET /store/pink-pearl-bauble-af1/ HTTP/1.1" 200 47990 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/5 81.196.154.48 - - [15/Aug/2026:07:10:12 +1000] "GET /store/leopard-luxe-adidas-samba-sneakers/ HTTP/1.1" 200 46453 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0. 14.226.33.209 - - [15/Aug/2026:07:10:13 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/single-purple-butterfly-kicks/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebK 176.29.207.9 - - [15/Aug/2026:07:10:12 +1000] "GET /store/kids-af1-sequin-rainbow/ HTTP/1.1" 200 46017 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/5 72.255.7.212 - - [15/Aug/2026:07:10:13 +1000] "GET /canberra-raiders-custom-shoes/ HTTP/1.1" 200 31285 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/5 179.148.85.112 - - [15/Aug/2026:07:10:13 +1000] "GET /the-ultimate-guide-to-sneaker-care-how-to-keep-your-custom-kicks-looking-fresh/ HTTP/1.1" 200 36415 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/5 37.238.103.193 - - [15/Aug/2026:07:10:13 +1000] "GET /store/black-glitter-doc-marten/ HTTP/1.1" 200 46738 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safar 181.123.155.35 - - [15/Aug/2026:07:10:14 +1000] "GET /store/nike-af1-ice-cream-sneakers-with-sprinkles/ HTTP/1.1" 200 47337 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chro 131.100.101.143 - - [15/Aug/2026:07:10:15 +1000] "GET /store/custom-mushroom-nike-air-force-1-psychedelic-sneakers/ HTTP/1.1" 200 47055 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like --- last 30 samples (run-up to this incident) --- 2026-08-15 07:07:54 L1=3.95 run=1 blk=0 avail=9117 (77.7%) swpO=0 conn=24 myRSS=538 php=0 phpRSS=0 ap=45 tcp=17 topuser=- 2026-08-15 07:07:55 L1=3.95 run=1 blk=0 avail=9125 (77.8%) swpO=0 conn=3 myRSS=538 php=0 phpRSS=0 ap=44 tcp=16 topuser=- 2026-08-15 07:08:04 L1=3.50 run=2 blk=0 avail=9085 (77.5%) swpO=0 conn=24 myRSS=538 php=2 phpRSS=167 ap=35 tcp=21 topuser=aaa 2026-08-15 07:08:05 L1=3.50 run=1 blk=0 avail=9197 (78.4%) swpO=0 conn=1 myRSS=538 php=0 phpRSS=0 ap=34 tcp=20 topuser=- 2026-08-15 07:08:14 L1=3.04 run=1 blk=0 avail=9270 (79.0%) swpO=0 conn=24 myRSS=538 php=0 phpRSS=0 ap=25 tcp=20 topuser=- 2026-08-15 07:08:15 L1=3.04 run=1 blk=0 avail=9270 (79.0%) swpO=0 conn=1 myRSS=538 php=0 phpRSS=0 ap=24 tcp=21 topuser=- 2026-08-15 07:08:24 L1=2.57 run=1 blk=0 avail=9309 (79.4%) swpO=0 conn=1 myRSS=538 php=0 phpRSS=0 ap=19 tcp=17 topuser=- 2026-08-15 07:08:25 L1=2.57 run=1 blk=0 avail=9308 (79.4%) swpO=0 conn=1 myRSS=538 php=0 phpRSS=0 ap=19 tcp=16 topuser=- 2026-08-15 07:08:34 L1=2.25 run=1 blk=0 avail=9327 (79.5%) swpO=0 conn=1 myRSS=544 php=0 phpRSS=0 ap=16 tcp=16 topuser=- 2026-08-15 07:08:35 L1=2.25 run=1 blk=0 avail=9327 (79.5%) swpO=0 conn=1 myRSS=544 php=0 phpRSS=0 ap=15 tcp=15 topuser=- 2026-08-15 07:08:44 L1=1.98 run=1 blk=0 avail=9320 (79.5%) swpO=0 conn=1 myRSS=544 php=0 phpRSS=0 ap=16 tcp=19 topuser=- 2026-08-15 07:08:45 L1=1.98 run=1 blk=0 avail=9320 (79.5%) swpO=0 conn=1 myRSS=544 php=0 phpRSS=0 ap=16 tcp=19 topuser=- 2026-08-15 07:08:54 L1=1.67 run=1 blk=0 avail=9315 (79.4%) swpO=0 conn=1 myRSS=545 php=0 phpRSS=0 ap=17 tcp=18 topuser=- 2026-08-15 07:08:55 L1=1.67 run=1 blk=0 avail=9316 (79.4%) swpO=0 conn=1 myRSS=545 php=0 phpRSS=0 ap=17 tcp=21 topuser=- 2026-08-15 07:09:04 L1=1.50 run=2 blk=1 avail=9196 (78.4%) swpO=0 conn=1 myRSS=545 php=1 phpRSS=61 ap=20 tcp=19 topuser=alison 2026-08-15 07:09:05 L1=1.50 run=3 blk=1 avail=9115 (77.7%) swpO=0 conn=3 myRSS=545 php=2 phpRSS=176 ap=20 tcp=20 topuser=alison 2026-08-15 07:09:15 L1=1.57 run=2 blk=0 avail=9193 (78.4%) swpO=0 conn=1 myRSS=545 php=0 phpRSS=0 ap=25 tcp=20 topuser=- 2026-08-15 07:09:15 L1=1.57 run=2 blk=0 avail=9187 (78.3%) swpO=0 conn=3 myRSS=545 php=1 phpRSS=40 ap=24 tcp=22 topuser=evolution 2026-08-15 07:09:25 L1=1.40 run=1 blk=0 avail=9261 (79.0%) swpO=0 conn=1 myRSS=545 php=0 phpRSS=0 ap=18 tcp=24 topuser=- 2026-08-15 07:09:25 L1=1.40 run=1 blk=0 avail=9255 (78.9%) swpO=0 conn=3 myRSS=545 php=2 phpRSS=54 ap=18 tcp=24 topuser=evolution 2026-08-15 07:09:35 L1=1.19 run=1 blk=0 avail=9236 (78.7%) swpO=0 conn=1 myRSS=545 php=0 phpRSS=0 ap=24 tcp=19 topuser=- 2026-08-15 07:09:35 L1=1.19 run=2 blk=0 avail=9231 (78.7%) swpO=0 conn=3 myRSS=545 php=1 phpRSS=40 ap=23 tcp=20 topuser=evolution 2026-08-15 07:09:45 L1=1.01 run=1 blk=0 avail=9259 (78.9%) swpO=0 conn=1 myRSS=545 php=0 phpRSS=0 ap=20 tcp=16 topuser=- 2026-08-15 07:09:45 L1=1.01 run=1 blk=0 avail=9252 (78.9%) swpO=0 conn=3 myRSS=545 php=1 phpRSS=40 ap=20 tcp=19 topuser=evolution 2026-08-15 07:09:55 L1=0.85 run=1 blk=0 avail=9273 (79.1%) swpO=0 conn=1 myRSS=545 php=0 phpRSS=0 ap=18 tcp=17 topuser=- 2026-08-15 07:09:56 L1=0.85 run=2 blk=0 avail=9261 (79.0%) swpO=0 conn=3 myRSS=545 php=1 phpRSS=40 ap=17 tcp=20 topuser=evolution 2026-08-15 07:10:05 L1=0.88 run=2 blk=0 avail=9164 (78.1%) swpO=0 conn=1 myRSS=545 php=1 phpRSS=131 ap=17 tcp=18 topuser=madalice 2026-08-15 07:10:06 L1=0.88 run=2 blk=0 avail=9078 (77.4%) swpO=0 conn=3 myRSS=545 php=2 phpRSS=245 ap=17 tcp=18 topuser=madalice 2026-08-15 07:10:15 L1=2.38 run=15 blk=0 avail=7855 (67.0%) swpO=0 conn=1 myRSS=547 php=9 phpRSS=1388 ap=48 tcp=67 topuser=madalice 2026-08-15 07:10:16 L1=2.38 run=19 blk=0 avail=7769 (66.2%) swpO=0 conn=15 myRSS=547 php=15 phpRSS=1773 ap=47 tcp=76 topuser=madalice