INCIDENT 2026-08-15 09:12:25 trigger: php_rss=1850MB ================================================================== load: 1.25 0.90 1.36 12/662 2625481 ncpu:10 mem_avail: 6973MB/11729MB (59.5%) swap_used:1393MB swapout:0/s blocked(D):0 running:14 iowait:0.0% steal:0.0% php: 11 procs / 1850MB heaviest user: madalice (10 procs, 1759MB) apache: 34 procs tcp_estab: 37 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 10 1987 mysql 1 1209 nobody 33 511 root 240 407 netdata 8 270 evolution 5 106 cpanellogin 1 70 kurri 4 47 mailman 20 27 wp-toolkit 6 21 dovenull 6 21 zabbix 1 17 aaa 1 13 candyfabcom 1 12 mailnull 2 9 dovecot 3 8 nscd 1 5 named 1 5 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 2019 evolution 1 105 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5165 MB Active(file): 3012 MB Inactive(file): 1621 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 290 MB CommitLimit: 9960 MB Committed_AS: 8361 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2342983 root 08:01:10 236 /usr/bin/imunify-agent-proxy 2618577 root 12:24 2924 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 1238468 3.2 Ssl 01:21:46 /usr/sbin/mariadbd 2625438 2624030 madalice 265580 75.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2625439 2625314 madalice 263732 73.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2625437 2622391 madalice 218552 65.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 216688 2.5 Ssl 46-23:02:28 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2625441 2625307 madalice 182448 83.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2625443 2625223 madalice 168924 78.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2625444 2625302 madalice 160928 69.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2390233 2382613 root 153848 0.0 S 06:36:48 spamd child 2625446 2625315 madalice 137672 65.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2625447 2624482 evolution 123724 23.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2573762 1353308 cpanellogin 71892 0.0 S 01:29:35 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 4922 2431 netdata 40568 0.1 Sl 46-23:02:23 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2223 1201 root 39800 0.0 Sl 46-23:02:27 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 2575382 1 root 35428 0.0 Rs 01:21:49 /usr/lib/systemd/systemd-journald 2382613 1 root 23232 0.0 Ss 06:49:14 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2623386 1276780 nobody 20808 0.0 R 03:57 /usr/sbin/httpd -k start 2624483 1276780 nobody 20436 0.0 S 01:34 /usr/sbin/httpd -k start 2625134 1276780 nobody 20376 0.1 S 00:29 /usr/sbin/httpd -k start 1353308 1 root 20184 0.0 Ss 24-06:30:58 cpsrvd (SSL) - waiting for connections 2623457 1276780 nobody 19776 0.0 S 03:48 /usr/sbin/httpd -k start 2623550 1276780 nobody 19608 0.0 S 03:37 /usr/sbin/httpd -k start 2621414 1276780 nobody 19076 0.0 S 07:47 /usr/sbin/httpd -k start 2623212 1276780 nobody 18836 0.0 S 04:21 /usr/sbin/httpd -k start 2624030 1276780 nobody 18276 0.0 S 02:25 /usr/sbin/httpd -k start 2625302 1276780 nobody 18072 0.0 S 00:18 /usr/sbin/httpd -k start 2622391 1276780 nobody 18036 0.0 S 05:52 /usr/sbin/httpd -k start 2623628 1276780 nobody 17880 0.0 S 03:28 /usr/sbin/httpd -k start 2625223 1276780 nobody 17656 0.0 S 00:23 /usr/sbin/httpd -k start 1204 1 zabbix 17560 0.2 Ssl 46-23:02:28 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2624620 1276780 nobody 17368 0.0 S 01:19 /usr/sbin/httpd -k start 2624154 1276780 nobody 17224 0.0 S 02:24 /usr/sbin/httpd -k start 2624153 1276780 nobody 17064 0.0 S 02:24 /usr/sbin/httpd -k start 185104 2431 netdata 16996 2.0 Sl 2-12:38:46 /usr/libexec/netdata/plugins.d/apps.plugin 1 2624488 1276780 nobody 16764 0.0 S 01:33 /usr/sbin/httpd -k start 2624489 1276780 nobody 16296 0.0 S 01:33 /usr/sbin/httpd -k start 2625215 1276780 nobody 16252 0.0 S 00:24 /usr/sbin/httpd -k start 2624482 1276780 nobody 16096 0.2 S 01:35 /usr/sbin/httpd -k start 2625324 1276780 nobody 15692 0.0 S 00:15 /usr/sbin/httpd -k start 2625316 1276780 nobody 15416 0.0 S 00:16 /usr/sbin/httpd -k start 2625234 1276780 nobody 15396 0.0 S 00:22 /usr/sbin/httpd -k start 2625315 1276780 nobody 15316 0.0 S 00:16 /usr/sbin/httpd -k start 2625314 1276780 nobody 15212 0.0 S 00:16 /usr/sbin/httpd -k start 2625308 1276780 nobody 15080 0.0 S 00:17 /usr/sbin/httpd -k start 2625307 1276780 nobody 14852 0.0 S 00:17 /usr/sbin/httpd -k start 2624491 1276780 nobody 14756 0.0 S 01:33 /usr/sbin/httpd -k start 2599582 3828812 aaa 13816 0.0 S 43:50 dovecot/imap 2625329 1276780 nobody 13688 0.0 S 00:15 /usr/sbin/httpd -k start 2625323 1276780 nobody 13684 0.0 S 00:15 /usr/sbin/httpd -k start 2625326 1276780 nobody 13684 0.0 S 00:15 /usr/sbin/httpd -k start 2625327 1276780 nobody 13684 0.0 S 00:15 /usr/sbin/httpd -k start 2625348 3828812 candyfabcom 12404 0.0 S 00:12 dovecot/imap 2617504 3828812 kurri 12364 0.0 S 14:50 dovecot/imap 2608584 3828812 kurri 12228 0.0 S 29:22 dovecot/imap 2611174 3828812 kurri 12112 0.0 S 24:50 dovecot/imap 2608585 3828812 kurri 11876 0.0 S 29:21 dovecot/imap 2625191 1471 root 11724 0.0 S 00:24 cPhulkd - processor - http socket 1469 1 root 11468 0.1 Ss 46-23:02:27 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 (dormant) 2624734 3828812 root 11128 0.0 S 01:03 dovecot/auth -w 1463 1 root 11064 0.0 Ss 46-23:02:27 tailwatchd --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +-------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +-------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 18269 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 18260 | madalice_wp | madalice_wp | Query | 0 | Statistics | SELECT t.*, tt.* FROM AMuqf6qZ_terms AS t INNER JOIN AMuqf6qZ_term_taxonomy AS tt ON t.term_id = tt.term_id WHERE t.term_id IN (472,972,973,1167,814,1005,1019,1132,875,1171,1192,1169,502,1133,1135,1134,974,854) | +-------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min kamcool/kamcool.com.au-ssl_log 45 evolution/wp.evolutionerp.com.au 44 evolution/my.evolutionerp.com.au-ssl_log 33 madalice/madalice.com.au-ssl_log 26 evolution/portal.evolutionerp.com.au-ssl_log 21 corpkicks/corporatekicks.com.au-ssl_log 6 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 45 20.251.112.238 44 135.225.75.187 24 175.36.227.212 21 4.223.171.122 21 203.54.180.238 3 40.77.167.75 2 54.86.66.252 2 157.211.45.212 2 118.127.40.55 1 85.208.96.194 1 49.181.99.221 1 43.167.236.228 1 40.77.167.255 1 34.56.53.225 1 34.196.51.17 --- top request paths across all vhosts (last 3 min) --- 21 GET /heartbeat.php 13 GET /index.php 6 GET /app/ajax.php 5 POST /functions.php 4 POST /plugins/csvexporter/plugin.php 3 POST /clienteditsave.php 3 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 GET /this_is_a_new_hello_world.php 2 POST /wp-cron.php 2 POST /app/ajax/selectFilterSingle.php 2 GET /wto.php 2 GET /ws45.php 2 GET /ws33.php 2 GET /wfile.php 2 GET /wcas.php 2 GET /wb.php 2 GET /vee.php 2 GET /v3.php 2 GET /p.php 2 GET /o.php --- busiest 3 vhosts: top paths + last 10 requests --- == kamcool/kamcool.com.au-ssl_log == -- top paths -- 1 GET /wto.php 1 GET /ws45.php 1 GET /ws33.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wfile.php 1 GET /wcas.php 1 GET /wb.php 1 GET /vee.php 1 GET /v3.php 1 GET /this_is_a_new_hello_world.php 1 GET /p.php 1 GET /o.php -- last 10 requests -- 20.251.112.238 - - [15/Aug/2026:09:12:12 +1000] "GET /inde.php HTTP/1.1" 404 5749 "-" "-" 20.251.112.238 - - [15/Aug/2026:09:12:13 +1000] "GET /1.php HTTP/1.1" 404 5749 "-" "-" 20.251.112.238 - - [15/Aug/2026:09:12:13 +1000] "GET /vee.php HTTP/1.1" 404 5749 "-" "-" 20.251.112.238 - - [15/Aug/2026:09:12:14 +1000] "GET /wcas.php HTTP/1.1" 404 5749 "-" "-" 20.251.112.238 - - [15/Aug/2026:09:12:14 +1000] "GET /k.php HTTP/1.1" 404 5749 "-" "-" 20.251.112.238 - - [15/Aug/2026:09:12:15 +1000] "GET /finny.php HTTP/1.1" 404 5749 "-" "-" 20.251.112.238 - - [15/Aug/2026:09:12:16 +1000] "GET /ws45.php HTTP/1.1" 404 5749 "-" "-" 20.251.112.238 - - [15/Aug/2026:09:12:17 +1000] "GET /build.php HTTP/1.1" 404 5749 "-" "-" 20.251.112.238 - - [15/Aug/2026:09:12:17 +1000] "GET /ws33.php HTTP/1.1" 404 5749 "-" "-" 20.251.112.238 - - [15/Aug/2026:09:12:18 +1000] "GET /klex.php HTTP/1.1" 404 5749 "-" "-" == evolution/wp.evolutionerp.com.au == -- top paths -- 1 GET /wto.php 1 GET /ws45.php 1 GET /ws33.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wfile.php 1 GET /wcas.php 1 GET /wb.php 1 GET /vee.php 1 GET /v3.php 1 GET /this_is_a_new_hello_world.php 1 GET /p.php 1 GET /o.php -- last 10 requests -- 135.225.75.187 - - [15/Aug/2026:09:12:03 +1000] "GET /222.php HTTP/1.1" 403 13 "-" "-" 135.225.75.187 - - [15/Aug/2026:09:12:03 +1000] "GET /inde.php HTTP/1.1" 404 130056 "-" "-" 135.225.75.187 - - [15/Aug/2026:09:12:05 +1000] "GET /1.php HTTP/1.1" 404 130053 "-" "-" 135.225.75.187 - - [15/Aug/2026:09:12:06 +1000] "GET /vee.php HTTP/1.1" 404 130055 "-" "-" 135.225.75.187 - - [15/Aug/2026:09:12:08 +1000] "GET /wcas.php HTTP/1.1" 404 130056 "-" "-" 135.225.75.187 - - [15/Aug/2026:09:12:10 +1000] "GET /k.php HTTP/1.1" 404 130053 "-" "-" 135.225.75.187 - - [15/Aug/2026:09:12:12 +1000] "GET /finny.php HTTP/1.1" 404 130057 "-" "-" 135.225.75.187 - - [15/Aug/2026:09:12:14 +1000] "GET /ws45.php HTTP/1.1" 404 130056 "-" "-" 135.225.75.187 - - [15/Aug/2026:09:12:15 +1000] "GET /build.php HTTP/1.1" 404 130057 "-" "-" 135.225.75.187 - - [15/Aug/2026:09:12:17 +1000] "GET /ws33.php HTTP/1.1" 404 130056 "-" "-" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 13 GET /index.php 6 GET /app/ajax.php 5 POST /functions.php 4 POST /plugins/csvexporter/plugin.php 3 POST /clienteditsave.php 2 POST /app/ajax/selectFilterSingle.php -- last 10 requests -- 175.36.227.212 - - [15/Aug/2026:09:11:54 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=15250&tab=clienteditgeneral" "Mozilla/5.0 (Windows 175.36.227.212 - - [15/Aug/2026:09:11:54 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dclientedit%26clientid%3D15250%26tab%3Dclienteditgeneral&call=getUserSetting&caller=ajaxSubmitLocal&seq=15517276125 HTTP/1.1" 200 40.77.167.75 - - [15/Aug/2026:09:11:55 +1000] "GET /index.php?page=quotedit"eid=33440 HTTP/1.1" 200 5260 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.h 40.77.167.75 - - [15/Aug/2026:09:11:55 +1000] "GET /index.php?page=jobedit&id=26336 HTTP/1.1" 200 5264 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Ch 175.36.227.212 - - [15/Aug/2026:09:11:56 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 51 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=15250&tab=clienteditgeneral" "Mozilla/5.0 (Windows N 54.86.66.252 - - [15/Aug/2026:09:11:57 +1000] "GET /index.php?page=reqedit&id=8856 HTTP/1.1" 200 5257 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1 54.86.66.252 - - [15/Aug/2026:09:11:57 +1000] "GET /index.php?page=purchaseadd&purchaseid=13752 HTTP/1.1" 200 5256 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 184.72.121.156 - - [15/Aug/2026:09:11:57 +1000] "GET /index.php?page=purchaseadd&purchaseid=13752 HTTP/1.1" 200 5260 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8 184.72.115.35 - - [15/Aug/2026:09:11:57 +1000] "GET /index.php?page=purchaseadd&purchaseid=13418 HTTP/1.1" 200 5258 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8. 175.36.227.212 - - [15/Aug/2026:09:11:57 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 120410 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=15250&tab=clienteditgeneral" "Mozilla/5.0 (Wi --- last 30 samples (run-up to this incident) --- 2026-08-15 09:09:57 L1=0.44 run=1 blk=0 avail=8591 (73.2%) swpO=0 conn=1 myRSS=1194 php=0 phpRSS=0 ap=16 tcp=20 topuser=- 2026-08-15 09:10:04 L1=0.64 run=2 blk=0 avail=8453 (72.1%) swpO=0 conn=1 myRSS=1194 php=1 phpRSS=130 ap=19 tcp=24 topuser=olympic 2026-08-15 09:10:07 L1=0.59 run=1 blk=0 avail=8565 (73.0%) swpO=0 conn=1 myRSS=1194 php=0 phpRSS=0 ap=19 tcp=22 topuser=- 2026-08-15 09:10:14 L1=0.54 run=1 blk=0 avail=8572 (73.1%) swpO=0 conn=1 myRSS=1194 php=0 phpRSS=0 ap=19 tcp=20 topuser=- 2026-08-15 09:10:17 L1=0.50 run=1 blk=0 avail=8572 (73.1%) swpO=0 conn=1 myRSS=1194 php=0 phpRSS=0 ap=19 tcp=20 topuser=- 2026-08-15 09:10:24 L1=0.46 run=3 blk=0 avail=8478 (72.3%) swpO=0 conn=1 myRSS=1194 php=1 phpRSS=66 ap=19 tcp=21 topuser=otterfencing 2026-08-15 09:10:27 L1=0.74 run=1 blk=0 avail=8566 (73.0%) swpO=0 conn=1 myRSS=1194 php=0 phpRSS=0 ap=19 tcp=20 topuser=- 2026-08-15 09:10:34 L1=0.68 run=1 blk=0 avail=8587 (73.2%) swpO=0 conn=1 myRSS=1194 php=0 phpRSS=0 ap=16 tcp=20 topuser=- 2026-08-15 09:10:37 L1=0.63 run=1 blk=0 avail=8586 (73.2%) swpO=0 conn=1 myRSS=1194 php=0 phpRSS=0 ap=16 tcp=22 topuser=- 2026-08-15 09:10:44 L1=0.58 run=2 blk=0 avail=8494 (72.4%) swpO=0 conn=1 myRSS=1194 php=1 phpRSS=117 ap=16 tcp=26 topuser=alison 2026-08-15 09:10:47 L1=0.53 run=1 blk=0 avail=8581 (73.2%) swpO=0 conn=1 myRSS=1194 php=0 phpRSS=0 ap=16 tcp=26 topuser=- 2026-08-15 09:10:54 L1=0.57 run=2 blk=0 avail=8375 (71.4%) swpO=0 conn=1 myRSS=1195 php=2 phpRSS=224 ap=23 tcp=33 topuser=tubesupplies 2026-08-15 09:10:57 L1=0.60 run=2 blk=0 avail=8539 (72.8%) swpO=0 conn=1 myRSS=1195 php=0 phpRSS=0 ap=23 tcp=31 topuser=- 2026-08-15 09:11:04 L1=0.56 run=2 blk=0 avail=8433 (71.9%) swpO=0 conn=1 myRSS=1195 php=1 phpRSS=133 ap=23 tcp=30 topuser=evolution 2026-08-15 09:11:07 L1=0.59 run=5 blk=0 avail=7863 (67.0%) swpO=0 conn=1 myRSS=1196 php=6 phpRSS=845 ap=24 tcp=38 topuser=evolution 2026-08-15 09:11:14 L1=0.86 run=3 blk=0 avail=8381 (71.5%) swpO=0 conn=1 myRSS=1197 php=2 phpRSS=205 ap=26 tcp=28 topuser=madalice 2026-08-15 09:11:17 L1=0.88 run=1 blk=0 avail=8521 (72.7%) swpO=0 conn=1 myRSS=1198 php=0 phpRSS=0 ap=25 tcp=29 topuser=- 2026-08-15 09:11:24 L1=0.81 run=2 blk=0 avail=8428 (71.9%) swpO=0 conn=1 myRSS=1205 php=1 phpRSS=106 ap=26 tcp=34 topuser=evolution 2026-08-15 09:11:27 L1=0.90 run=2 blk=0 avail=8332 (71.0%) swpO=0 conn=2 myRSS=1205 php=1 phpRSS=194 ap=27 tcp=33 topuser=madalice 2026-08-15 09:11:34 L1=0.91 run=3 blk=0 avail=8352 (71.2%) swpO=0 conn=3 myRSS=1205 php=2 phpRSS=249 ap=22 tcp=25 topuser=madalice 2026-08-15 09:11:37 L1=0.92 run=3 blk=0 avail=8342 (71.1%) swpO=0 conn=2 myRSS=1206 php=2 phpRSS=248 ap=21 tcp=27 topuser=evolution 2026-08-15 09:11:45 L1=0.92 run=4 blk=0 avail=8489 (72.4%) swpO=0 conn=3 myRSS=1206 php=2 phpRSS=109 ap=21 tcp=29 topuser=madalice 2026-08-15 09:11:47 L1=1.17 run=2 blk=0 avail=8446 (72.0%) swpO=0 conn=2 myRSS=1206 php=1 phpRSS=121 ap=21 tcp=27 topuser=evolution 2026-08-15 09:11:55 L1=1.24 run=4 blk=0 avail=8236 (70.2%) swpO=0 conn=3 myRSS=1207 php=2 phpRSS=360 ap=21 tcp=29 topuser=madalice 2026-08-15 09:11:57 L1=1.14 run=6 blk=0 avail=8417 (71.8%) swpO=0 conn=2 myRSS=1207 php=3 phpRSS=196 ap=22 tcp=35 topuser=madalice 2026-08-15 09:12:05 L1=1.21 run=3 blk=0 avail=8354 (71.2%) swpO=0 conn=3 myRSS=1208 php=2 phpRSS=174 ap=30 tcp=36 topuser=madalice 2026-08-15 09:12:07 L1=1.35 run=3 blk=0 avail=8325 (71.0%) swpO=0 conn=2 myRSS=1208 php=2 phpRSS=202 ap=30 tcp=44 topuser=evolution 2026-08-15 09:12:15 L1=1.48 run=1 blk=1 avail=8373 (71.4%) swpO=0 conn=3 myRSS=1209 php=0 phpRSS=0 ap=43 tcp=32 topuser=- 2026-08-15 09:12:17 L1=1.36 run=2 blk=0 avail=8342 (71.1%) swpO=0 conn=2 myRSS=1209 php=1 phpRSS=75 ap=41 tcp=28 topuser=evolution 2026-08-15 09:12:25 L1=1.25 run=14 blk=0 avail=6973 (59.5%) swpO=0 conn=12 myRSS=1209 php=11 phpRSS=1850 ap=34 tcp=37 topuser=madalice