INCIDENT 2026-08-18 07:20:02 trigger: php_rss=1823MB ================================================================== load: 0.28 0.58 0.82 17/674 1187095 ncpu:10 mem_avail: 5165MB/11729MB (44.0%) swap_used:2070MB swapout:657/s blocked(D):0 running:20 iowait:0.3% steal:0.0% php: 11 procs / 1823MB heaviest user: madalice (9 procs, 1783MB) apache: 30 procs tcp_estab: 47 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2575 madalice 9 1923 root 249 969 nobody 29 431 netdata 9 252 evolution 9 82 cpanellogin 1 62 dovenull 6 27 kurri 2 22 mailnull 3 21 wp-toolkit 6 20 zabbix 1 14 mailman 20 14 lowrange 1 12 nscd 1 8 dovecot 3 8 cpanelphpmyadmin 1 8 named 1 5 polkitd 1 2 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 9 1943 evolution 1 39 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5676 MB Active(file): 3806 MB Inactive(file): 888 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 455 MB CommitLimit: 9960 MB Committed_AS: 8615 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 955450 root 06:08:46 9352 /usr/bin/imunify-agent-proxy 1173801 root 20:01 1292 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 1186985 root 00:01 1268 /bin/sh -c bash -c "sleep $((RANDOM % 60))" ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2629684 6.8 Ssl 2-23:29:25 /usr/sbin/mariadbd 1186954 1185826 madalice 248828 89.6 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186955 1184533 madalice 245508 86.3 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186951 1186275 madalice 242036 94.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186952 1184539 madalice 237000 87.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186959 1186100 madalice 218952 84.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186957 1185373 madalice 218920 84.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1186958 1186088 madalice 207020 81.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 200856 2.5 Ssl 49-21:10:07 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1186961 1186375 madalice 195156 77.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1000360 998750 root 183768 0.0 S 04:55:13 spamd child 998750 1 root 172760 0.0 Ss 04:57:18 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1000361 998750 root 154068 0.0 S 04:55:13 spamd child 2575382 1 root 123424 0.0 Ss 2-23:29:28 /usr/lib/systemd/systemd-journald 1169592 1353308 cpanellogin 63532 0.0 S 25:37 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 1353308 1 root 42044 0.0 Ss 27-04:38:37 cpsrvd (SSL) - waiting for connections 1187037 1187012 evolution 40876 4.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 38860 0.0 Sl 49-21:10:06 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 33460 0.1 Sl 49-21:10:02 /usr/libexec/netdata/plugins.d/go.d.plugin 1 998083 1 root 30736 0.0 Ss 04:57:51 lfd - sleeping 1463 1 root 26396 0.0 Ss 49-21:10:06 tailwatchd 1469 1 root 24128 0.1 Ss 49-21:10:06 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1182293 1276780 nobody 21572 0.0 S 06:25 /usr/sbin/httpd -k start 1184081 1276780 nobody 20836 0.1 S 04:12 /usr/sbin/httpd -k start 1184539 1276780 nobody 19868 0.0 S 03:37 /usr/sbin/httpd -k start 1185880 1276780 nobody 19732 0.1 S 01:39 /usr/sbin/httpd -k start 1186100 1276780 nobody 19636 0.1 S 01:13 /usr/sbin/httpd -k start 1184533 1276780 nobody 19216 0.0 S 03:37 /usr/sbin/httpd -k start 1185373 1276780 nobody 19204 0.0 S 02:30 /usr/sbin/httpd -k start 1186098 1276780 nobody 18772 0.1 S 01:13 /usr/sbin/httpd -k start 1186375 1276780 nobody 18600 0.0 S 00:48 /usr/sbin/httpd -k start 1186275 1276780 nobody 18412 0.0 S 01:01 /usr/sbin/httpd -k start 1186474 1276780 nobody 18400 0.1 S 00:40 /usr/sbin/httpd -k start 1186204 1276780 nobody 17836 0.0 S 01:04 /usr/sbin/httpd -k start 1185826 1276780 nobody 17816 0.0 S 01:45 /usr/sbin/httpd -k start 1186088 1276780 nobody 17660 0.0 S 01:14 /usr/sbin/httpd -k start 1186214 1276780 nobody 17468 0.0 S 01:03 /usr/sbin/httpd -k start 1186043 1276780 nobody 17068 0.0 S 01:20 /usr/sbin/httpd -k start 1471 1 root 17044 0.0 Ss 49-21:10:06 cPhulkd - processor 1109893 1471 root 16944 0.0 S 01:54:46 cPhulkd - dbprocessor 1186409 1276780 nobody 16912 0.0 S 00:47 /usr/sbin/httpd -k start 185104 2431 netdata 15960 2.0 Sl 5-10:46:25 /usr/libexec/netdata/plugins.d/apps.plugin 1 1186410 1276780 nobody 15920 0.1 S 00:47 /usr/sbin/httpd -k start 1186699 1471 root 15844 0.0 S 00:19 cPhulkd - processor - http socket 1186960 1276780 nobody 15356 0.0 S 00:03 /usr/sbin/httpd -k start 1186592 1276780 nobody 14888 0.0 S 00:29 /usr/sbin/httpd -k start 1186965 1276780 nobody 14856 0.0 S 00:02 /usr/sbin/httpd -k start 1204 1 zabbix 14820 0.2 Ssl 49-21:10:07 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1186964 1276780 nobody 14764 0.5 S 00:02 /usr/sbin/httpd -k start 1187012 1276780 nobody 14568 0.0 S 00:01 /usr/sbin/httpd -k start 1187008 1187007 root 14096 1.0 S 00:01 /usr/local/cpanel/bin/dcpumon 1187013 1276780 nobody 13624 0.0 S 00:01 /usr/sbin/httpd -k start 1187014 1276780 nobody 13624 0.0 S 00:01 /usr/sbin/httpd -k start 1187009 1276780 nobody 13468 1.0 S 00:01 /usr/sbin/httpd -k start 900056 3828812 lowrange 12716 0.0 S 07:33:16 dovecot/imap 1185517 1276780 nobody 12424 0.0 S 02:15 /usr/sbin/httpd -k start 1168043 3828812 kurri 12012 0.0 S 28:43 dovecot/imap 1186901 3828812 root 11088 0.0 S 00:11 dovecot/auth -w 3816866 3828812 kurri 10968 0.0 S 1-13:29:03 dovecot/imap 281734 1 mailnull 10584 0.0 Ss 9-04:57:55 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 5291113 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 195 olympic/seb-mobile-auth.olympicfencing.com.au-ssl_log 168 evolution/portal.evolutionerp.com.au-ssl_log 80 coscom/coscom.com.au-ssl_log 70 kamcool/kamcool.com.au-ssl_log 19 madalice/madalice.com.au-ssl_log 5 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 168 18.212.221.152 101 103.104.165.99 70 20.226.112.14 68 182.239.240.254 40 203.54.180.238 31 180.181.236.49 19 20.80.111.3 15 116.91.221.198 10 1.145.73.14 4 203.31.118.167 2 114.119.130.40 2 103.104.164.114 1 52.167.144.20 1 43.162.103.165 1 40.77.167.74 --- top request paths across all vhosts (last 3 min) --- 70 GET /autodiscover/autodiscover.xml 60 POST /functions.php 34 GET /heartbeat.php 34 GET /app/ajax.php 24 POST /app/ajax/selectFilter.php 22 GET /factory_session_checker.php 15 GET /index.php 12 GET /factory_session_processed_qty.php 12 GET /factory_session_joiner.php 9 GET / 8 POST /app/ajax/selectFilterSingle.php 8 POST /app/ajax.php 6 POST /purchaseaddsave.php 6 POST /inveditsave.php 5 POST /plugins/csvexporter/plugin.php 5 POST /opportunityeditsave.php 4 POST /quoteditsave.php 4 POST / 3 POST /clienteditsave.php 2 POST /login.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 60 POST /functions.php 34 GET /app/ajax.php 24 POST /app/ajax/selectFilter.php 15 GET /index.php 8 POST /app/ajax/selectFilterSingle.php 8 POST /app/ajax.php 7 GET / 6 POST /purchaseaddsave.php 6 POST /inveditsave.php 5 POST /plugins/csvexporter/plugin.php 5 POST /opportunityeditsave.php 4 POST /quoteditsave.php -- last 10 requests -- 103.104.165.99 - - [18/Aug/2026:07:19:45 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36703" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 103.104.165.99 - - [18/Aug/2026:07:19:47 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12029" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 103.104.165.99 - - [18/Aug/2026:07:19:47 +1000] "GET /index.php?page=invedit&id=9894 HTTP/1.1" 200 36400 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 103.104.165.99 - - [18/Aug/2026:07:19:48 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invedit&id=9894&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; 103.104.165.99 - - [18/Aug/2026:07:19:48 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvedit%26id%3D9894%26tab%3Dgeneraltab&call=getUserSetting&caller=ajaxSubmitLocal&seq=11311326870 HTTP/1.1" 200 109 "https://my. 103.104.164.114 - - [18/Aug/2026:07:19:49 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=1610§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 203.31.118.167 - - [18/Aug/2026:07:19:49 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 103.104.165.99 - - [18/Aug/2026:07:19:49 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=invedit&id=9894&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 103.104.165.99 - - [18/Aug/2026:07:19:56 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 103.104.165.99 - - [18/Aug/2026:07:19:59 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like == olympic/seb-mobile-auth.olympicfencing.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /www/.env 1 GET /wp/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /web/.env 1 GET /vendor/.env 1 GET /v3/.env 1 GET /v2/.env 1 GET /v1/.env 1 GET /uploads/.env 1 GET /transactional/.env -- last 10 requests -- 18.212.221.152 - - [18/Aug/2026:07:19:25 +1000] "GET /_phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.212.221.152 - - [18/Aug/2026:07:19:25 +1000] "GET /old_phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.212.221.152 - - [18/Aug/2026:07:19:25 +1000] "GET /server-info.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.212.221.152 - - [18/Aug/2026:07:19:25 +1000] "GET /server-status.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.212.221.152 - - [18/Aug/2026:07:19:26 +1000] "GET /_profiler/phpinfo HTTP/1.1" 404 - "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.212.221.152 - - [18/Aug/2026:07:19:26 +1000] "GET /_environment HTTP/1.1" 404 - "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.212.221.152 - - [18/Aug/2026:07:19:26 +1000] "GET /webroot/index.php/_environment HTTP/1.1" 404 - "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.212.221.152 - - [18/Aug/2026:07:19:26 +1000] "GET /mail/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.212.221.152 - - [18/Aug/2026:07:19:26 +1000] "GET /cpanel/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.212.221.152 - - [18/Aug/2026:07:19:27 +1000] "GET /hosting/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 34 GET /heartbeat.php 22 GET /factory_session_checker.php 12 GET /factory_session_processed_qty.php 12 GET /factory_session_joiner.php -- last 10 requests -- 203.54.180.238 - - [18/Aug/2026:07:19:41 +1000] "GET /heartbeat.php?sentAt=1787001581&bytes=106,131,122,237&_=1787000191662 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=1 103.104.165.99 - - [18/Aug/2026:07:19:43 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 130 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 103.104.165.99 - - [18/Aug/2026:07:19:43 +1000] "GET /factory_session_joiner.php?id=1707 HTTP/1.1" 200 76 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [18/Aug/2026:07:19:42 +1000] "GET /heartbeat.php?sentAt=1787001583&bytes=106,131,122,239&_=1786999429053 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 103.104.165.99 - - [18/Aug/2026:07:19:46 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [18/Aug/2026:07:19:47 +1000] "GET /heartbeat.php?sentAt=1787001587&bytes=106,131,122,243&_=1786971216243 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 103.104.165.99 - - [18/Aug/2026:07:19:51 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [18/Aug/2026:07:19:51 +1000] "GET /heartbeat.php?sentAt=1787001591&bytes=106,131,122,247&_=1787000191663 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=1 103.104.165.99 - - [18/Aug/2026:07:19:53 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 130 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 103.104.165.99 - - [18/Aug/2026:07:19:53 +1000] "GET /factory_session_joiner.php?id=1707 HTTP/1.1" 200 76 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb --- last 30 samples (run-up to this incident) --- 2026-08-18 07:17:35 L1=0.80 run=1 blk=0 avail=6696 (57.1%) swpO=0 conn=1 myRSS=2595 php=0 phpRSS=0 ap=26 tcp=30 topuser=- 2026-08-18 07:17:41 L1=0.74 run=2 blk=0 avail=6715 (57.2%) swpO=0 conn=2 myRSS=2595 php=1 phpRSS=21 ap=21 tcp=28 topuser=evolution 2026-08-18 07:17:45 L1=0.76 run=3 blk=0 avail=6506 (55.5%) swpO=0 conn=1 myRSS=2595 php=1 phpRSS=256 ap=21 tcp=28 topuser=madalice 2026-08-18 07:17:51 L1=0.78 run=2 blk=0 avail=6710 (57.2%) swpO=0 conn=2 myRSS=2595 php=1 phpRSS=39 ap=22 tcp=26 topuser=evolution 2026-08-18 07:17:55 L1=0.80 run=3 blk=0 avail=6683 (57.0%) swpO=0 conn=2 myRSS=2595 php=1 phpRSS=67 ap=22 tcp=25 topuser=evolution 2026-08-18 07:18:01 L1=0.73 run=1 blk=0 avail=6705 (57.2%) swpO=0 conn=2 myRSS=2595 php=1 phpRSS=39 ap=22 tcp=29 topuser=evolution 2026-08-18 07:18:05 L1=0.68 run=2 blk=0 avail=6712 (57.2%) swpO=0 conn=2 myRSS=2595 php=0 phpRSS=0 ap=23 tcp=24 topuser=- 2026-08-18 07:18:11 L1=0.70 run=1 blk=0 avail=6716 (57.3%) swpO=0 conn=2 myRSS=2595 php=1 phpRSS=39 ap=22 tcp=24 topuser=evolution 2026-08-18 07:18:15 L1=0.64 run=1 blk=0 avail=6727 (57.4%) swpO=0 conn=2 myRSS=2595 php=0 phpRSS=0 ap=21 tcp=29 topuser=- 2026-08-18 07:18:21 L1=0.67 run=3 blk=0 avail=6673 (56.9%) swpO=0 conn=2 myRSS=2595 php=2 phpRSS=106 ap=22 tcp=29 topuser=evolution 2026-08-18 07:18:25 L1=0.62 run=1 blk=0 avail=6702 (57.1%) swpO=0 conn=2 myRSS=2595 php=0 phpRSS=0 ap=25 tcp=29 topuser=- 2026-08-18 07:18:31 L1=0.65 run=2 blk=0 avail=6673 (56.9%) swpO=0 conn=2 myRSS=2595 php=2 phpRSS=98 ap=24 tcp=27 topuser=madalice 2026-08-18 07:18:35 L1=0.68 run=2 blk=0 avail=6726 (57.3%) swpO=0 conn=2 myRSS=2595 php=0 phpRSS=0 ap=23 tcp=24 topuser=- 2026-08-18 07:18:41 L1=0.62 run=1 blk=0 avail=6728 (57.4%) swpO=0 conn=2 myRSS=2595 php=1 phpRSS=39 ap=20 tcp=24 topuser=evolution 2026-08-18 07:18:45 L1=0.57 run=1 blk=0 avail=6736 (57.4%) swpO=0 conn=2 myRSS=2595 php=0 phpRSS=0 ap=21 tcp=27 topuser=- 2026-08-18 07:18:51 L1=0.61 run=2 blk=0 avail=6681 (57.0%) swpO=0 conn=2 myRSS=2595 php=2 phpRSS=51 ap=28 tcp=29 topuser=evolution 2026-08-18 07:18:55 L1=0.56 run=2 blk=0 avail=6684 (57.0%) swpO=0 conn=1 myRSS=2595 php=1 phpRSS=42 ap=27 tcp=33 topuser=evolution 2026-08-18 07:19:01 L1=0.51 run=1 blk=0 avail=6673 (56.9%) swpO=0 conn=2 myRSS=2595 php=1 phpRSS=39 ap=28 tcp=40 topuser=evolution 2026-08-18 07:19:05 L1=0.47 run=2 blk=0 avail=6674 (56.9%) swpO=0 conn=1 myRSS=2595 php=0 phpRSS=0 ap=29 tcp=26 topuser=- 2026-08-18 07:19:11 L1=0.43 run=2 blk=0 avail=6627 (56.5%) swpO=0 conn=2 myRSS=2595 php=2 phpRSS=146 ap=25 tcp=32 topuser=tubesupplies 2026-08-18 07:19:15 L1=0.40 run=1 blk=0 avail=6689 (57.0%) swpO=0 conn=1 myRSS=2595 php=0 phpRSS=0 ap=27 tcp=40 topuser=- 2026-08-18 07:19:21 L1=0.37 run=2 blk=0 avail=6609 (56.3%) swpO=0 conn=2 myRSS=2595 php=2 phpRSS=96 ap=31 tcp=38 topuser=evolution 2026-08-18 07:19:25 L1=0.50 run=2 blk=0 avail=6606 (56.3%) swpO=0 conn=1 myRSS=2595 php=1 phpRSS=66 ap=31 tcp=43 topuser=evolution 2026-08-18 07:19:32 L1=0.46 run=1 blk=0 avail=6653 (56.7%) swpO=0 conn=2 myRSS=2595 php=1 phpRSS=39 ap=30 tcp=37 topuser=evolution 2026-08-18 07:19:35 L1=0.42 run=1 blk=0 avail=6662 (56.8%) swpO=0 conn=1 myRSS=2595 php=0 phpRSS=0 ap=31 tcp=29 topuser=- 2026-08-18 07:19:42 L1=0.39 run=1 blk=0 avail=6650 (56.7%) swpO=0 conn=2 myRSS=2595 php=1 phpRSS=39 ap=31 tcp=34 topuser=evolution 2026-08-18 07:19:45 L1=0.36 run=3 blk=0 avail=6540 (55.8%) swpO=0 conn=1 myRSS=2595 php=1 phpRSS=129 ap=31 tcp=32 topuser=madalice 2026-08-18 07:19:52 L1=0.33 run=1 blk=0 avail=6658 (56.8%) swpO=0 conn=2 myRSS=2595 php=1 phpRSS=39 ap=29 tcp=34 topuser=evolution 2026-08-18 07:19:55 L1=0.30 run=1 blk=0 avail=6681 (57.0%) swpO=0 conn=1 myRSS=2595 php=0 phpRSS=0 ap=27 tcp=26 topuser=- 2026-08-18 07:20:02 L1=0.28 run=20 blk=0 avail=5165 (44.0%) swpO=657 conn=11 myRSS=2582 php=11 phpRSS=1823 ap=30 tcp=47 topuser=madalice