INCIDENT 2026-08-15 17:56:55 trigger: php_rss=2181MB ================================================================== load: 1.75 1.22 1.23 20/660 2931281 ncpu:10 mem_avail: 5948MB/11729MB (50.7%) swap_used:1135MB swapout:0/s blocked(D):0 running:21 iowait:0.0% steal:0.0% php: 13 procs / 2181MB heaviest user: madalice (13 procs, 2181MB) apache: 32 procs tcp_estab: 40 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 13 2324 mysql 1 1788 root 234 597 nobody 31 504 netdata 8 282 kurri 5 59 evolution 5 46 dovenull 6 29 mailman 20 27 alison 2 25 wp-toolkit 6 22 zabbix 1 17 cpanellogin 1 16 aaa 1 13 nscd 1 8 dovecot 3 8 named 1 7 dbus 1 3 cpanelconnecttrack 1 3 polkitd 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 13 2362 evolution 1 42 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6476 MB Active(file): 3944 MB Inactive(file): 1536 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 388 MB CommitLimit: 9960 MB Committed_AS: 9130 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2342983 root 16:45:39 3212 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 1831172 2.7 Ssl 10:06:15 /usr/sbin/mariadbd 2931238 2930349 madalice 254728 119 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2931243 2930424 madalice 246820 104 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2931235 2927469 madalice 241792 115 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2931242 2930359 madalice 237456 103 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2931233 2930450 madalice 230712 124 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 220448 2.5 Ssl 47-07:46:57 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2931241 2930344 madalice 196604 88.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2931234 2929908 madalice 182116 88.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2931236 2930360 madalice 178060 81.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2931244 2930386 madalice 169248 71.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2931245 2930439 madalice 162572 70.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2390234 2382613 root 159596 0.0 S 15:21:17 spamd child 2856464 2382613 root 149664 0.0 S 02:11:59 spamd child 2931237 2930379 madalice 146308 63.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2931240 2930437 madalice 144856 59.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2931239 2930345 madalice 135760 59.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2931276 2929508 evolution 61780 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2223 1201 root 42396 0.0 Sl 47-07:46:56 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 41708 0.1 Sl 47-07:46:52 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 41564 0.1 Ss 47-07:46:56 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 41372 0.0 Ss 24-15:15:27 cpsrvd (SSL) - waiting for connections 2382613 1 root 26152 0.0 Ss 15:33:43 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2575382 1 root 19748 0.0 Ss 10:06:18 /usr/lib/systemd/systemd-journald 2928986 1276780 nobody 19420 0.0 S 04:04 /usr/sbin/httpd -k start 2927469 1276780 nobody 18884 0.1 S 06:28 /usr/sbin/httpd -k start 2930404 1276780 nobody 18544 0.0 S 01:25 /usr/sbin/httpd -k start 2924272 1276780 nobody 18528 0.0 S 12:49 /usr/sbin/httpd -k start 2930349 1276780 nobody 18372 0.0 S 01:27 /usr/sbin/httpd -k start 2930391 1276780 nobody 18340 0.0 S 01:25 /usr/sbin/httpd -k start 2930386 1276780 nobody 18328 0.0 S 01:25 /usr/sbin/httpd -k start 2928431 1276780 nobody 18260 0.0 S 05:14 /usr/sbin/httpd -k start 1204 1 zabbix 18188 0.2 Ssl 47-07:46:57 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2930359 1276780 nobody 18184 0.0 S 01:26 /usr/sbin/httpd -k start 2930393 1276780 nobody 18168 0.0 S 01:25 /usr/sbin/httpd -k start 2930356 1276780 nobody 18144 0.0 S 01:26 /usr/sbin/httpd -k start 2930392 1276780 nobody 18124 0.0 S 01:25 /usr/sbin/httpd -k start 2930379 1276780 nobody 18076 0.0 S 01:25 /usr/sbin/httpd -k start 2930422 1276780 nobody 18056 0.0 S 01:24 /usr/sbin/httpd -k start 2930437 1276780 nobody 17964 0.0 S 01:24 /usr/sbin/httpd -k start 2930365 1276780 nobody 17880 0.0 S 01:26 /usr/sbin/httpd -k start 2927407 1276780 nobody 17824 0.0 S 06:35 /usr/sbin/httpd -k start 2927509 1276780 nobody 17760 0.0 S 06:25 /usr/sbin/httpd -k start 2930339 1276780 nobody 17684 0.0 S 01:28 /usr/sbin/httpd -k start 2928954 1276780 nobody 17572 0.0 S 04:08 /usr/sbin/httpd -k start 2930439 1276780 nobody 17520 0.0 S 01:24 /usr/sbin/httpd -k start 2930345 1276780 nobody 17356 0.0 S 01:27 /usr/sbin/httpd -k start 2930450 1276780 nobody 17312 0.0 S 01:24 /usr/sbin/httpd -k start 2930344 1276780 nobody 17192 0.0 S 01:27 /usr/sbin/httpd -k start 2930360 1276780 nobody 17148 0.0 S 01:26 /usr/sbin/httpd -k start 185104 2431 netdata 17032 2.0 Sl 2-21:23:15 /usr/libexec/netdata/plugins.d/apps.plugin 1 2929908 1276780 nobody 16772 0.0 S 02:09 /usr/sbin/httpd -k start 2928885 1353308 cpanellogin 16672 0.0 S 04:16 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 2929508 1276780 nobody 16180 0.0 S 02:58 /usr/sbin/httpd -k start 2930425 1276780 nobody 15876 0.0 S 01:24 /usr/sbin/httpd -k start 2930424 1276780 nobody 15584 0.2 S 01:24 /usr/sbin/httpd -k start 2920427 3828812 aaa 13980 0.0 S 19:00 dovecot/imap 1463 1 root 13380 0.0 Ss 47-07:46:56 tailwatchd 2899408 3828812 alison 13200 0.0 S 58:11 dovecot/imap 2915552 3828812 alison 12900 0.0 S 27:39 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+-------------+-------------+---------+------+------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+-------------+-------------+---------+------+------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 120337 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 120329 | madalice_wp | madalice_wp | Query | 0 | Waiting for table level lock | SELECT option_value FROM AMuqf6qZ_options WHERE option_name = 'woocommerce_customer_verify_email_settings' LIMIT 1 | +--------+-------------+-------------+---------+------+------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/evolutionerp.com.au-ssl_log 195 tubesupplies/tubesupplies.com.au 91 tubesupplies/tubesupplies.com.au-ssl_log 68 evolution/portal.evolutionerp.com.au-ssl_log 34 madalice/madalice.com.au-ssl_log 10 aaa/aaadownunder.com.au-ssl_log 1 corpkicks/corporatekicks.com.au-ssl_log 1 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 189 62.60.130.235 105 4.232.93.83 51 172.161.0.2 34 203.54.180.238 6 2600:1900:4120:ceed:0:838:: 6 118.127.40.55 2 85.208.96.208 1 92.222.108.115 1 91.92.243.249 1 52.167.144.227 1 34.196.51.17 1 185.191.171.19 1 185.191.171.12 1 112.200.204.53 --- top request paths across all vhosts (last 3 min) --- 63 POST /wp-login.php 62 GET /wp-login.php 61 GET /wp-admin/index.php 34 GET /heartbeat.php 6 GET / 5 POST /wp-cron.php 4 GET /x.php 4 GET /xml.php 4 GET /wps.php 4 GET /wp-content/plugins/hellopress/wp_filemanager.php 4 GET /wp-content/plugins/admin.php 4 GET /wp-config.php 4 GET /wp-admin/setup-config.php 4 GET /track.php 4 GET /this_is_a_new_hello_world.php 4 GET /themes.php 4 GET /sd.php 4 GET /r.php 4 GET /hehe.php 4 GET /god.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 62 POST /wp-login.php 61 GET /wp-login.php 61 GET /wp-admin/index.php 5 GET / 2 POST /wp-cron.php 2 GET /robots.txt 1 GET /author/cesar/ 1 GET /author/alisonc/ -- last 10 requests -- 62.60.130.235 - - [15/Aug/2026:17:56:34 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://evolutionerp.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) C 62.60.130.235 - - [15/Aug/2026:17:56:36 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Fevolutionerp.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 11849 "https://evolutionerp.com.au/wp-login.php" "Mozilla/5.0 62.60.130.235 - - [15/Aug/2026:17:56:36 +1000] "POST /wp-login.php HTTP/1.1" 200 11766 "https://evolutionerp.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/9 62.60.130.235 - - [15/Aug/2026:17:56:37 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://evolutionerp.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) 62.60.130.235 - - [15/Aug/2026:17:56:38 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Fevolutionerp.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 11849 "https://evolutionerp.com.au/wp-login.php" "Mozilla/5.0 62.60.130.235 - - [15/Aug/2026:17:56:39 +1000] "POST /wp-login.php HTTP/1.1" 200 11766 "https://evolutionerp.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) 118.127.40.55 - - [15/Aug/2026:17:56:40 +1000] "POST /wp-cron.php?doing_wp_cron=1786780600.6306951045989990234375 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://evolutionerp.com.au" 62.60.130.235 - - [15/Aug/2026:17:56:39 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://evolutionerp.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/9 62.60.130.235 - - [15/Aug/2026:17:56:41 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Fevolutionerp.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 11849 "https://evolutionerp.com.au/wp-login.php" "Mozilla/5.0 62.60.130.235 - - [15/Aug/2026:17:56:42 +1000] "POST /wp-login.php HTTP/1.1" 200 11766 "https://evolutionerp.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94 == tubesupplies/tubesupplies.com.au == -- top paths -- 2 GET /xwx1.php 2 GET /xrp.php 2 GET /x.php 2 GET /xml.php 2 GET /wp-the.php 2 GET /wps.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /wp-content/plugins/admin.php 2 GET /wp-config.php 2 GET /wp-admin/setup-config.php 2 GET /track.php 2 GET /this_is_a_new_hello_world.php -- last 10 requests -- 172.161.0.2 - - [15/Aug/2026:17:56:28 +1000] "GET /wp-the.php HTTP/1.1" 301 291 "-" "-" 4.232.93.83 - - [15/Aug/2026:17:56:30 +1000] "GET /wyzer3.php HTTP/1.1" 301 286 "-" "-" 172.161.0.2 - - [15/Aug/2026:17:56:30 +1000] "GET /inso.php HTTP/1.1" 301 289 "-" "-" 4.232.93.83 - - [15/Aug/2026:17:56:33 +1000] "GET /25.php HTTP/1.1" 301 282 "-" "-" 172.161.0.2 - - [15/Aug/2026:17:56:33 +1000] "GET /f.php HTTP/1.1" 301 286 "-" "-" 4.232.93.83 - - [15/Aug/2026:17:56:35 +1000] "GET //ws77.php HTTP/1.1" 301 284 "-" "-" 172.161.0.2 - - [15/Aug/2026:17:56:36 +1000] "GET //403.php HTTP/1.1" 301 288 "-" "-" 4.232.93.83 - - [15/Aug/2026:17:56:38 +1000] "GET /wp-login.php HTTP/1.1" 301 288 "-" "-" 172.161.0.2 - - [15/Aug/2026:17:56:38 +1000] "GET /82.php HTTP/1.1" 301 287 "-" "-" 4.232.93.83 - - [15/Aug/2026:17:56:40 +1000] "GET /xxw.php HTTP/1.1" 301 283 "-" "-" == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 3 POST /wp-cron.php 2 GET /x.php 2 GET /xml.php 2 GET /wps.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /wp-content/plugins/admin.php 2 GET /wp-config.php 2 GET /wp-admin/setup-config.php 2 GET /track.php 2 GET /this_is_a_new_hello_world.php 2 GET /themes.php 2 GET /ss.php -- last 10 requests -- 172.161.0.2 - - [15/Aug/2026:17:55:56 +1000] "GET /track.php HTTP/1.1" 404 151455 "-" "-" 4.232.93.83 - - [15/Aug/2026:17:55:57 +1000] "GET /panel.php HTTP/1.1" 404 151396 "-" "-" 172.161.0.2 - - [15/Aug/2026:17:55:59 +1000] "GET /wp-config.php HTTP/1.1" 403 12 "-" "-" 172.161.0.2 - - [15/Aug/2026:17:55:59 +1000] "GET /admin-footer.php HTTP/1.1" 404 151455 "-" "-" 4.232.93.83 - - [15/Aug/2026:17:56:00 +1000] "GET /drykl.php HTTP/1.1" 404 151395 "-" "-" 172.161.0.2 - - [15/Aug/2026:17:56:02 +1000] "GET /bscclapb.php HTTP/1.1" 404 151454 "-" "-" 4.232.93.83 - - [15/Aug/2026:17:56:02 +1000] "GET /about.php HTTP/1.1" 404 151393 "-" "-" 4.232.93.83 - - [15/Aug/2026:17:56:05 +1000] "GET /jga.php HTTP/1.1" 404 151400 "-" "-" 172.161.0.2 - - [15/Aug/2026:17:56:05 +1000] "GET /ss.php HTTP/1.1" 404 151449 "-" "-" 118.127.40.55 - - [15/Aug/2026:17:56:06 +1000] "POST /wp-cron.php?doing_wp_cron=1786780566.3043489456176757812500 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://tubesupplies.com.au" --- last 30 samples (run-up to this incident) --- 2026-08-15 17:54:30 L1=0.91 run=3 blk=0 avail=7760 (66.2%) swpO=0 conn=1 myRSS=1787 php=1 phpRSS=105 ap=18 tcp=27 topuser=tubesupplies 2026-08-15 17:54:34 L1=0.91 run=1 blk=0 avail=7835 (66.8%) swpO=0 conn=1 myRSS=1787 php=0 phpRSS=0 ap=18 tcp=25 topuser=- 2026-08-15 17:54:40 L1=0.92 run=1 blk=0 avail=7838 (66.8%) swpO=0 conn=1 myRSS=1787 php=0 phpRSS=0 ap=18 tcp=26 topuser=- 2026-08-15 17:54:44 L1=0.85 run=3 blk=0 avail=7801 (66.5%) swpO=0 conn=1 myRSS=1787 php=1 phpRSS=73 ap=18 tcp=27 topuser=evolution 2026-08-15 17:54:50 L1=0.86 run=3 blk=0 avail=7667 (65.4%) swpO=0 conn=1 myRSS=1787 php=2 phpRSS=224 ap=19 tcp=31 topuser=tubesupplies 2026-08-15 17:54:54 L1=0.87 run=3 blk=0 avail=7738 (66.0%) swpO=0 conn=2 myRSS=1787 php=1 phpRSS=117 ap=19 tcp=30 topuser=evolution 2026-08-15 17:55:00 L1=0.80 run=2 blk=0 avail=7737 (66.0%) swpO=0 conn=2 myRSS=1787 php=1 phpRSS=111 ap=19 tcp=32 topuser=tubesupplies 2026-08-15 17:55:04 L1=0.82 run=1 blk=0 avail=7815 (66.6%) swpO=0 conn=2 myRSS=1787 php=0 phpRSS=0 ap=19 tcp=32 topuser=- 2026-08-15 17:55:10 L1=0.91 run=2 blk=1 avail=7793 (66.4%) swpO=0 conn=2 myRSS=1787 php=1 phpRSS=55 ap=19 tcp=33 topuser=tubesupplies 2026-08-15 17:55:14 L1=0.84 run=3 blk=0 avail=7769 (66.2%) swpO=0 conn=2 myRSS=1787 php=1 phpRSS=93 ap=19 tcp=28 topuser=tubesupplies 2026-08-15 17:55:20 L1=0.93 run=3 blk=0 avail=7723 (65.8%) swpO=0 conn=2 myRSS=1787 php=2 phpRSS=157 ap=18 tcp=32 topuser=tubesupplies 2026-08-15 17:55:24 L1=1.02 run=3 blk=0 avail=7813 (66.6%) swpO=0 conn=2 myRSS=1787 php=1 phpRSS=44 ap=18 tcp=34 topuser=tubesupplies 2026-08-15 17:55:30 L1=0.94 run=2 blk=0 avail=7322 (62.4%) swpO=0 conn=2 myRSS=1787 php=1 phpRSS=57 ap=81 tcp=104 topuser=tubesupplies 2026-08-15 17:55:34 L1=1.10 run=2 blk=0 avail=7079 (60.4%) swpO=0 conn=2 myRSS=1787 php=1 phpRSS=107 ap=111 tcp=79 topuser=tubesupplies 2026-08-15 17:55:40 L1=1.33 run=4 blk=0 avail=6695 (57.1%) swpO=0 conn=2 myRSS=1788 php=4 phpRSS=607 ap=104 tcp=44 topuser=madalice 2026-08-15 17:55:44 L1=1.47 run=3 blk=0 avail=7090 (60.4%) swpO=0 conn=2 myRSS=1788 php=2 phpRSS=169 ap=101 tcp=37 topuser=tubesupplies 2026-08-15 17:55:50 L1=1.51 run=1 blk=0 avail=7252 (61.8%) swpO=0 conn=2 myRSS=1788 php=0 phpRSS=0 ap=94 tcp=30 topuser=- 2026-08-15 17:55:54 L1=1.47 run=8 blk=0 avail=6848 (58.4%) swpO=0 conn=7 myRSS=1788 php=6 phpRSS=633 ap=91 tcp=34 topuser=madalice 2026-08-15 17:56:01 L1=1.43 run=4 blk=0 avail=7122 (60.7%) swpO=0 conn=4 myRSS=1788 php=3 phpRSS=311 ap=84 tcp=33 topuser=madalice 2026-08-15 17:56:04 L1=1.48 run=2 blk=0 avail=7317 (62.4%) swpO=0 conn=7 myRSS=1788 php=1 phpRSS=73 ap=81 tcp=33 topuser=evolution 2026-08-15 17:56:11 L1=1.44 run=3 blk=0 avail=7346 (62.6%) swpO=0 conn=4 myRSS=1788 php=2 phpRSS=137 ap=74 tcp=26 topuser=tubesupplies 2026-08-15 17:56:14 L1=1.48 run=2 blk=0 avail=7400 (63.1%) swpO=0 conn=7 myRSS=1788 php=1 phpRSS=71 ap=71 tcp=27 topuser=tubesupplies 2026-08-15 17:56:21 L1=1.69 run=2 blk=0 avail=7454 (63.5%) swpO=0 conn=4 myRSS=1788 php=1 phpRSS=73 ap=64 tcp=27 topuser=tubesupplies 2026-08-15 17:56:24 L1=1.55 run=2 blk=0 avail=7118 (60.7%) swpO=0 conn=7 myRSS=1788 php=2 phpRSS=456 ap=61 tcp=30 topuser=corpkicks 2026-08-15 17:56:31 L1=1.67 run=3 blk=0 avail=7444 (63.5%) swpO=0 conn=4 myRSS=1788 php=2 phpRSS=182 ap=54 tcp=30 topuser=evolution 2026-08-15 17:56:34 L1=1.69 run=3 blk=0 avail=7369 (62.8%) swpO=0 conn=7 myRSS=1788 php=1 phpRSS=136 ap=51 tcp=32 topuser=tubesupplies 2026-08-15 17:56:41 L1=1.88 run=4 blk=0 avail=7353 (62.7%) swpO=0 conn=4 myRSS=1788 php=3 phpRSS=368 ap=44 tcp=37 topuser=evolution 2026-08-15 17:56:44 L1=1.89 run=3 blk=0 avail=7513 (64.1%) swpO=0 conn=7 myRSS=1788 php=2 phpRSS=206 ap=41 tcp=32 topuser=tubesupplies 2026-08-15 17:56:51 L1=1.82 run=2 blk=0 avail=7597 (64.8%) swpO=0 conn=4 myRSS=1788 php=1 phpRSS=22 ap=34 tcp=27 topuser=tubesupplies 2026-08-15 17:56:55 L1=1.75 run=21 blk=0 avail=5948 (50.7%) swpO=0 conn=14 myRSS=1788 php=13 phpRSS=2181 ap=32 tcp=40 topuser=madalice