INCIDENT 2026-08-15 21:54:51 trigger: php_rss=1622MB ================================================================== load: 1.76 0.70 0.57 17/662 3065248 ncpu:10 mem_avail: 6199MB/11729MB (52.9%) swap_used:1142MB swapout:29/s blocked(D):0 running:17 iowait:0.0% steal:0.0% php: 12 procs / 1622MB heaviest user: madalice (11 procs, 1539MB) apache: 35 procs tcp_estab: 63 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2032 madalice 12 1766 root 233 703 nobody 34 477 netdata 8 276 speedlin 1 87 cpanellogin 1 63 kurri 5 59 dovenull 6 29 mailman 20 27 wp-toolkit 6 22 zabbix 1 17 lowrange 1 13 infinium 1 12 alison 1 12 nscd 1 8 dovecot 3 8 named 1 7 mailnull 2 7 evolution 4 4 --- php workers by user --- USER PROCS RSS_MB madalice 12 1628 speedlin 1 92 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5824 MB Active(file): 4542 MB Inactive(file): 715 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 480 MB CommitLimit: 9960 MB Committed_AS: 8861 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2342983 root 20:43:36 3212 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2081392 2.5 Ssl 14:04:12 /usr/sbin/mariadbd 3065200 3065197 madalice 260808 74.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3065201 3065196 madalice 259428 73.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 221344 2.5 Ssl 47-11:44:54 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3065202 3065198 madalice 207448 94.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3065211 3064070 madalice 175012 76.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3065212 3064068 madalice 162084 67.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2390234 2382613 root 159924 0.0 S 19:19:14 spamd child 2856464 2382613 root 155004 0.0 S 06:09:56 spamd child 3065214 3065203 madalice 149076 121 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3065213 3063637 madalice 147848 60.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3065216 3064413 madalice 107892 75.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 102148 0.0 Ss 14:04:15 /usr/lib/systemd/systemd-journald 3065215 3064411 speedlin 97548 63.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3065218 3064409 madalice 81088 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3065217 3065122 madalice 73956 31.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3055575 1353308 cpanellogin 65208 0.0 S 18:28 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 3065245 3063664 madalice 46768 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2223 1201 root 42628 0.0 Sl 47-11:44:53 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42132 0.0 Ss 24-19:13:24 cpsrvd (SSL) - waiting for connections 1469 1 root 41600 0.1 Ss 47-11:44:53 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 36216 0.1 Sl 47-11:44:49 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2382613 1 root 26152 0.0 Ss 19:31:40 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3059793 1276780 nobody 21704 0.0 S 10:54 /usr/sbin/httpd -k start 3063664 1276780 nobody 20988 0.0 S 03:19 /usr/sbin/httpd -k start 3064410 1276780 nobody 20576 0.0 S 01:32 /usr/sbin/httpd -k start 3063637 1276780 nobody 20564 0.0 S 03:20 /usr/sbin/httpd -k start 3064411 1276780 nobody 19488 0.0 S 01:32 /usr/sbin/httpd -k start 3064068 1276780 nobody 18908 0.0 S 02:26 /usr/sbin/httpd -k start 3064191 1276780 nobody 18828 0.0 S 02:02 /usr/sbin/httpd -k start 3062077 1276780 nobody 18500 0.0 S 06:41 /usr/sbin/httpd -k start 1204 1 zabbix 18352 0.2 Ssl 47-11:44:54 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3064070 1276780 nobody 18016 0.0 S 02:24 /usr/sbin/httpd -k start 3064409 1276780 nobody 17784 0.0 S 01:33 /usr/sbin/httpd -k start 3064413 1276780 nobody 17700 0.0 S 01:31 /usr/sbin/httpd -k start 3064193 1276780 nobody 17676 0.0 S 02:01 /usr/sbin/httpd -k start 1471 1 root 17204 0.0 Ss 47-11:44:53 cPhulkd - processor 2962454 1471 root 17116 0.0 S 03:01:41 cPhulkd - dbprocessor 3065187 1276780 nobody 17044 0.2 S 00:04 /usr/sbin/httpd -k start 3065186 1276780 nobody 17032 0.5 S 00:04 /usr/sbin/httpd -k start 3065195 1276780 nobody 16940 0.6 S 00:03 /usr/sbin/httpd -k start 3063838 1276780 nobody 16816 0.0 S 02:56 /usr/sbin/httpd -k start 3064934 1276780 nobody 16776 0.0 S 00:41 /usr/sbin/httpd -k start 3064415 1276780 nobody 16708 0.0 S 01:31 /usr/sbin/httpd -k start 185104 2431 netdata 16556 2.0 Sl 3-01:21:12 /usr/libexec/netdata/plugins.d/apps.plugin 1 3065122 1276780 nobody 16160 0.0 S 00:11 /usr/sbin/httpd -k start 3064931 1276780 nobody 15676 0.0 S 00:44 /usr/sbin/httpd -k start 3065198 1276780 nobody 14912 0.0 S 00:03 /usr/sbin/httpd -k start 3065197 1276780 nobody 14908 0.0 S 00:03 /usr/sbin/httpd -k start 3065203 1276780 nobody 14860 0.0 S 00:02 /usr/sbin/httpd -k start 3065196 1276780 nobody 14800 0.3 S 00:03 /usr/sbin/httpd -k start 3065204 1276780 nobody 13672 0.0 S 00:02 /usr/sbin/httpd -k start 3065205 1276780 nobody 13672 0.0 S 00:02 /usr/sbin/httpd -k start 3065206 1276780 nobody 13672 0.0 S 00:02 /usr/sbin/httpd -k start 3065207 1276780 nobody 13672 0.0 S 00:02 /usr/sbin/httpd -k start 3065208 1276780 nobody 13672 0.0 S 00:02 /usr/sbin/httpd -k start 3065210 1276780 nobody 13672 0.0 S 00:02 /usr/sbin/httpd -k start 3065209 1276780 nobody 13668 0.0 S 00:02 /usr/sbin/httpd -k start 1463 1 root 13416 0.0 Ss 47-11:44:53 tailwatchd 3063770 3828812 lowrange 13360 0.0 S 03:06 dovecot/pop3 --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 150937 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/apps.evolutionerp.com.au-ssl_log 86 evolution/apps.evolutionerp.com.au 85 evolution/portal.evolutionerp.com.au-ssl_log 54 evolution/portal.evolutionerp.com.au 29 madalice/madalice.com.au-ssl_log 17 tubesupplies/tubesupplies.com.au-ssl_log 17 evolution/my.evolutionerp.com.au-ssl_log 5 customc/customcentral.com.au-ssl_log 2 vinesit/vinesit.com.au 2 aaa/aaadownunder.com.au-ssl_log 1 customc/customcentral.com.au 1 vinesit/vinesit.com.au-ssl_log 1 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 171 20.104.85.180 58 20.186.30.159 25 203.54.180.238 16 172.206.67.244 5 82.102.18.126 3 66.249.75.97 2 216.73.216.26 2 157.55.39.195 2 118.127.40.55 1 93.38.26.151 1 83.99.206.39 1 74.244.135.60 1 66.249.77.41 1 66.249.65.171 1 66.249.65.169 --- top request paths across all vhosts (last 3 min) --- 25 GET /heartbeat.php 4 GET /wp-content/plugins/hellopress/wp_filemanager.php 4 GET /this_is_a_new_hello_world.php 4 GET /sf.php 4 GET /classwithtostring.php 4 GET /admin.php 4 GET /222.php 4 GET /1.php 3 GET /robots.txt 3 GET /aa.php 2 POST /wp-cron.php 2 GET /zxz.php 2 GET /yj09.php 2 GET /xx.php 2 GET /www.php 2 GET /wso.php 2 GET /wp-ws68.php 2 GET /wp-login.php 2 GET /wp-includes/rest-api/ 2 GET /wp-includes/pomo/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/apps.evolutionerp.com.au-ssl_log == -- top paths -- 1 GET /zxz.php 1 GET /www.php 1 GET /wso.php 1 GET /wp-login.php 1 GET /wp-includes/rest-api/ 1 GET /wp-includes/pomo/ 1 GET /wp-includes/js/tinymce/plugins/compat3x/css/ 1 GET /wp-includes/js/ 1 GET /wp-includes/images/smilies/ 1 GET /wp-includes/images/ 1 GET /wp-includes/ID3/index.php 1 GET /wp-includes/ID3/ -- last 10 requests -- 20.104.85.180 - - [15/Aug/2026:21:53:58 +1000] "GET /index/function.php HTTP/1.1" 404 - "-" "-" 20.104.85.180 - - [15/Aug/2026:21:53:58 +1000] "GET /edit.php HTTP/1.1" 404 - "-" "-" 20.104.85.180 - - [15/Aug/2026:21:53:58 +1000] "GET /wp-includes/rest-api/ HTTP/1.1" 404 - "-" "-" 20.104.85.180 - - [15/Aug/2026:21:53:59 +1000] "GET /wp-content/themes/twentytwenty/404.php HTTP/1.1" 404 - "-" "-" 20.104.85.180 - - [15/Aug/2026:21:53:59 +1000] "GET /wp-good.php HTTP/1.1" 404 - "-" "-" 20.104.85.180 - - [15/Aug/2026:21:54:00 +1000] "GET /wp-admin/js/widgets/ HTTP/1.1" 404 - "-" "-" 20.104.85.180 - - [15/Aug/2026:21:54:00 +1000] "GET /wp-admin/css/colors/midnight/ HTTP/1.1" 404 - "-" "-" 20.104.85.180 - - [15/Aug/2026:21:54:00 +1000] "GET /tes.php HTTP/1.1" 404 - "-" "-" 20.104.85.180 - - [15/Aug/2026:21:54:01 +1000] "GET /files/index.php HTTP/1.1" 404 - "-" "-" 20.104.85.180 - - [15/Aug/2026:21:54:01 +1000] "GET /wp-content/uploads/index.php HTTP/1.1" 403 12 "-" "-" == evolution/apps.evolutionerp.com.au == -- top paths -- 1 GET /zxz.php 1 GET /www.php 1 GET /wso.php 1 GET /wp-login.php 1 GET /wp-includes/rest-api/ 1 GET /wp-includes/pomo/ 1 GET /wp-includes/js/tinymce/plugins/compat3x/css/ 1 GET /wp-includes/js/ 1 GET /wp-includes/images/smilies/ 1 GET /wp-includes/images/ 1 GET /wp-includes/ID3/index.php 1 GET /wp-includes/ID3/ -- last 10 requests -- 20.104.85.180 - - [15/Aug/2026:21:53:57 +1000] "GET /sf.php HTTP/1.1" 301 287 "-" "-" 20.104.85.180 - - [15/Aug/2026:21:53:57 +1000] "GET /index/function.php HTTP/1.1" 301 299 "-" "-" 20.104.85.180 - - [15/Aug/2026:21:53:58 +1000] "GET /edit.php HTTP/1.1" 301 289 "-" "-" 20.104.85.180 - - [15/Aug/2026:21:53:58 +1000] "GET /wp-includes/rest-api/ HTTP/1.1" 301 302 "-" "-" 20.104.85.180 - - [15/Aug/2026:21:53:59 +1000] "GET /wp-content/themes/twentytwenty/404.php HTTP/1.1" 301 319 "-" "-" 20.104.85.180 - - [15/Aug/2026:21:53:59 +1000] "GET /wp-good.php HTTP/1.1" 301 292 "-" "-" 20.104.85.180 - - [15/Aug/2026:21:53:59 +1000] "GET /wp-admin/js/widgets/ HTTP/1.1" 301 301 "-" "-" 20.104.85.180 - - [15/Aug/2026:21:54:00 +1000] "GET /wp-admin/css/colors/midnight/ HTTP/1.1" 301 310 "-" "-" 20.104.85.180 - - [15/Aug/2026:21:54:00 +1000] "GET /tes.php HTTP/1.1" 301 288 "-" "-" 20.104.85.180 - - [15/Aug/2026:21:54:01 +1000] "GET /files/index.php HTTP/1.1" 301 296 "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 25 GET /heartbeat.php 1 GET /yj09.php 1 GET /xx.php 1 GET /wp-ws68.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /this_is_a_new_hello_world.php 1 GET /sf.php 1 GET /scxy.php 1 GET /ops.php 1 GET /media.php 1 GET /mac.php 1 GET /images.php -- last 10 requests -- 203.54.180.238 - - [15/Aug/2026:21:53:15 +1000] "GET /heartbeat.php?sentAt=1786794796&bytes=106,128,83,44&_=1786712390497 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:21:53:22 +1000] "GET /heartbeat.php?sentAt=1786794803&bytes=106,128,83,51&_=1786683800530 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:21:53:25 +1000] "GET /heartbeat.php?sentAt=1786794806&bytes=106,128,83,54&_=1786712390498 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:21:53:32 +1000] "GET /heartbeat.php?sentAt=1786794813&bytes=106,128,83,61&_=1786683800531 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:21:53:35 +1000] "GET /heartbeat.php?sentAt=1786794816&bytes=106,128,83,64&_=1786712390499 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:21:53:42 +1000] "GET /heartbeat.php?sentAt=1786794823&bytes=106,128,83,71&_=1786683800532 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:21:53:45 +1000] "GET /heartbeat.php?sentAt=1786794826&bytes=106,128,83,74&_=1786712390500 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:21:53:52 +1000] "GET /heartbeat.php?sentAt=1786794833&bytes=106,128,83,81&_=1786683800533 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:21:53:55 +1000] "GET /heartbeat.php?sentAt=1786794836&bytes=106,128,83,84&_=1786712390501 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [15/Aug/2026:21:54:02 +1000] "GET /heartbeat.php?sentAt=1786794843&bytes=106,128,83,91&_=1786683800534 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-08-15 21:52:25 L1=0.59 run=4 blk=0 avail=7327 (62.5%) swpO=0 conn=2 myRSS=2032 php=3 phpRSS=269 ap=19 tcp=32 topuser=tubesupplies 2026-08-15 21:52:31 L1=0.54 run=1 blk=0 avail=7497 (63.9%) swpO=0 conn=1 myRSS=2032 php=0 phpRSS=0 ap=21 tcp=26 topuser=- 2026-08-15 21:52:35 L1=0.49 run=1 blk=0 avail=7495 (63.9%) swpO=0 conn=2 myRSS=2032 php=1 phpRSS=40 ap=19 tcp=31 topuser=evolution 2026-08-15 21:52:41 L1=0.45 run=1 blk=0 avail=7509 (64.0%) swpO=0 conn=1 myRSS=2032 php=0 phpRSS=0 ap=19 tcp=26 topuser=- 2026-08-15 21:52:45 L1=0.42 run=2 blk=0 avail=7504 (64.0%) swpO=0 conn=2 myRSS=2032 php=2 phpRSS=76 ap=18 tcp=24 topuser=evolution 2026-08-15 21:52:51 L1=0.38 run=2 blk=0 avail=7432 (63.4%) swpO=0 conn=1 myRSS=2032 php=1 phpRSS=101 ap=21 tcp=31 topuser=madalice 2026-08-15 21:52:55 L1=0.35 run=1 blk=0 avail=7486 (63.8%) swpO=0 conn=2 myRSS=2032 php=1 phpRSS=40 ap=21 tcp=30 topuser=evolution 2026-08-15 21:53:01 L1=0.32 run=1 blk=0 avail=7534 (64.2%) swpO=0 conn=1 myRSS=2032 php=0 phpRSS=0 ap=17 tcp=25 topuser=- 2026-08-15 21:53:05 L1=0.46 run=1 blk=0 avail=7519 (64.1%) swpO=0 conn=2 myRSS=2032 php=1 phpRSS=40 ap=17 tcp=28 topuser=evolution 2026-08-15 21:53:11 L1=0.58 run=2 blk=0 avail=7308 (62.3%) swpO=0 conn=1 myRSS=2032 php=1 phpRSS=258 ap=17 tcp=28 topuser=madalice 2026-08-15 21:53:15 L1=0.54 run=2 blk=0 avail=7519 (64.1%) swpO=0 conn=2 myRSS=2032 php=1 phpRSS=40 ap=17 tcp=29 topuser=evolution 2026-08-15 21:53:21 L1=0.49 run=1 blk=0 avail=7481 (63.8%) swpO=0 conn=1 myRSS=2032 php=0 phpRSS=0 ap=25 tcp=35 topuser=- 2026-08-15 21:53:26 L1=0.53 run=3 blk=0 avail=7248 (61.8%) swpO=0 conn=2 myRSS=2032 php=3 phpRSS=321 ap=25 tcp=38 topuser=corpkicks 2026-08-15 21:53:31 L1=0.65 run=1 blk=0 avail=7463 (63.6%) swpO=0 conn=1 myRSS=2032 php=0 phpRSS=0 ap=25 tcp=34 topuser=- 2026-08-15 21:53:36 L1=0.60 run=2 blk=0 avail=7392 (63.0%) swpO=0 conn=2 myRSS=2032 php=1 phpRSS=40 ap=24 tcp=34 topuser=evolution 2026-08-15 21:53:41 L1=0.55 run=2 blk=0 avail=7483 (63.8%) swpO=0 conn=1 myRSS=2032 php=0 phpRSS=0 ap=24 tcp=26 topuser=- 2026-08-15 21:53:46 L1=0.51 run=1 blk=0 avail=7497 (63.9%) swpO=0 conn=2 myRSS=2032 php=1 phpRSS=40 ap=21 tcp=29 topuser=evolution 2026-08-15 21:53:51 L1=0.47 run=3 blk=0 avail=7515 (64.1%) swpO=0 conn=1 myRSS=2032 php=0 phpRSS=0 ap=21 tcp=28 topuser=- 2026-08-15 21:53:56 L1=0.43 run=1 blk=0 avail=7505 (64.0%) swpO=0 conn=2 myRSS=2032 php=1 phpRSS=40 ap=20 tcp=28 topuser=evolution 2026-08-15 21:54:01 L1=0.39 run=2 blk=0 avail=7398 (63.1%) swpO=0 conn=3 myRSS=2032 php=2 phpRSS=174 ap=20 tcp=29 topuser=aaa 2026-08-15 21:54:06 L1=0.36 run=2 blk=0 avail=7498 (63.9%) swpO=0 conn=2 myRSS=2032 php=1 phpRSS=40 ap=20 tcp=31 topuser=evolution 2026-08-15 21:54:11 L1=0.33 run=1 blk=0 avail=7503 (64.0%) swpO=0 conn=3 myRSS=2032 php=0 phpRSS=0 ap=22 tcp=33 topuser=- 2026-08-15 21:54:16 L1=0.31 run=2 blk=0 avail=7357 (62.7%) swpO=0 conn=2 myRSS=2032 php=2 phpRSS=206 ap=22 tcp=30 topuser=corpkicks 2026-08-15 21:54:21 L1=0.44 run=2 blk=0 avail=7412 (63.2%) swpO=0 conn=3 myRSS=2032 php=1 phpRSS=121 ap=22 tcp=31 topuser=corpkicks 2026-08-15 21:54:26 L1=0.41 run=2 blk=0 avail=7499 (63.9%) swpO=0 conn=2 myRSS=2032 php=1 phpRSS=40 ap=21 tcp=24 topuser=evolution 2026-08-15 21:54:31 L1=0.37 run=3 blk=0 avail=7532 (64.2%) swpO=0 conn=3 myRSS=2032 php=0 phpRSS=0 ap=19 tcp=28 topuser=- 2026-08-15 21:54:36 L1=0.34 run=2 blk=0 avail=7516 (64.1%) swpO=0 conn=2 myRSS=2032 php=1 phpRSS=40 ap=19 tcp=29 topuser=evolution 2026-08-15 21:54:41 L1=0.47 run=1 blk=0 avail=7522 (64.1%) swpO=0 conn=3 myRSS=2032 php=0 phpRSS=0 ap=20 tcp=30 topuser=- 2026-08-15 21:54:46 L1=0.44 run=2 blk=0 avail=7443 (63.5%) swpO=0 conn=2 myRSS=2032 php=2 phpRSS=141 ap=20 tcp=28 topuser=speedlin 2026-08-15 21:54:51 L1=1.76 run=17 blk=0 avail=6199 (52.9%) swpO=29 conn=13 myRSS=2032 php=12 phpRSS=1622 ap=35 tcp=63 topuser=madalice