INCIDENT 2026-08-18 11:49:08 trigger: php_rss=1822MB mysql_conn=19 ================================================================== load: 4.98 3.21 2.57 15/701 1454943 ncpu:10 mem_avail: 5149MB/11729MB (43.9%) swap_used:2255MB swapout:0/s blocked(D):0 running:16 iowait:0.1% steal:0.0% php: 15 procs / 1822MB heaviest user: madalice (9 procs, 1536MB) apache: 57 procs tcp_estab: 77 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2634 madalice 9 1613 nobody 56 903 root 235 895 evolution 14 352 netdata 8 256 cpanellogin 1 62 kurri 5 58 mailnull 4 31 dovenull 6 27 wp-toolkit 6 18 zabbix 1 14 mailman 20 13 alison 1 12 dovecot 3 8 nscd 1 7 named 1 4 dbus 1 2 cpanelconnecttrack 1 2 polkitd 1 1 --- php workers by user --- USER PROCS RSS_MB madalice 9 1632 evolution 6 295 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5577 MB Active(file): 4008 MB Inactive(file): 714 MB Dirty: 3 MB Writeback: 0 MB SReclaimable: 332 MB CommitLimit: 9960 MB Committed_AS: 9928 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 955450 root 10:37:52 4188 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2697244 8.6 Ssl 3-03:58:31 /usr/sbin/mariadbd 1454800 1452649 madalice 287104 61.0 S 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1454847 1454028 madalice 215156 95.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1454849 1453357 madalice 210052 96.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 209020 0.0 Ss 3-03:58:34 /usr/lib/systemd/systemd-journald 1220 1 netdata 199624 2.5 Ssl 50-01:39:13 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1454848 1454044 madalice 198944 94.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1454850 1450976 madalice 194188 91.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1454853 1454010 madalice 190396 86.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1454851 1454366 madalice 188812 87.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1000360 998750 root 179788 0.1 S 09:24:19 spamd child 1454856 1452622 madalice 179692 82.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 998750 1 root 125612 0.0 Ss 09:26:24 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1000361 998750 root 100404 0.0 S 09:24:19 spamd child 1454884 1454877 madalice 72668 31.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1454819 1454052 evolution 67784 5.0 S 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1454875 1454859 evolution 67120 15.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1411280 1353308 cpanellogin 64164 0.0 S 45:42 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 1454836 1454362 evolution 44036 1.0 S 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1454901 1447455 evolution 43288 5.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 42124 0.0 Ss 27-09:07:43 cpsrvd (SSL) - waiting for connections 2223 1201 root 40120 0.0 Sl 50-01:39:12 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1454886 1453762 evolution 39316 2.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 38872 0.1 Sl 50-01:39:08 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1454831 1454830 evolution 37124 2.0 Sl 00:03 /usr/local/bin/wkhtmltopdf --enable-local-file-access --encoding utf-8 --title DISPATCH --header-html /home/evolution/my.evolutionerp.c 1454978 1469 root 25776 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 998083 1 root 23460 0.0 Ss 09:26:57 lfd - sleeping 1463 1 root 21916 0.0 Ss 50-01:39:12 tailwatchd 1469 1 root 20960 0.1 Ss 50-01:39:12 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1443540 1276780 nobody 20888 0.0 S 11:46 /usr/sbin/httpd -k start 1452622 1276780 nobody 20260 0.0 S 02:28 /usr/sbin/httpd -k start 1450655 1276780 nobody 20016 0.0 S 04:28 /usr/sbin/httpd -k start 1450981 1276780 nobody 20000 0.0 S 04:08 /usr/sbin/httpd -k start 1447455 1276780 nobody 19920 0.0 S 08:02 /usr/sbin/httpd -k start 1448909 1276780 nobody 19596 0.0 S 06:47 /usr/sbin/httpd -k start 1450643 1276780 nobody 19416 0.1 S 04:29 /usr/sbin/httpd -k start 1450280 1276780 nobody 19296 0.0 S 04:56 /usr/sbin/httpd -k start 1451638 1276780 nobody 19200 0.0 S 03:29 /usr/sbin/httpd -k start 1453376 1276780 nobody 19016 0.0 S 01:38 /usr/sbin/httpd -k start 1452208 1276780 nobody 18712 0.0 S 02:50 /usr/sbin/httpd -k start 1452623 1276780 nobody 18644 0.0 S 02:28 /usr/sbin/httpd -k start 1452649 1276780 nobody 18528 0.0 S 02:26 /usr/sbin/httpd -k start 1454049 1276780 nobody 18324 0.1 S 00:45 /usr/sbin/httpd -k start 1453392 1276780 nobody 18272 0.0 S 01:37 /usr/sbin/httpd -k start 1454010 1276780 nobody 18120 0.0 S 00:47 /usr/sbin/httpd -k start 1454024 1276780 nobody 18092 0.0 S 00:46 /usr/sbin/httpd -k start 1454346 1276780 nobody 18092 0.0 S 00:29 /usr/sbin/httpd -k start 1450976 1276780 nobody 18052 0.0 S 04:08 /usr/sbin/httpd -k start 1453357 1276780 nobody 17768 0.0 S 01:40 /usr/sbin/httpd -k start 1454054 1276780 nobody 17732 0.0 S 00:45 /usr/sbin/httpd -k start 1454044 1276780 nobody 17544 0.0 S 00:45 /usr/sbin/httpd -k start 1454362 1276780 nobody 17484 0.0 S 00:28 /usr/sbin/httpd -k start 1453367 1276780 nobody 17468 0.0 S 01:39 /usr/sbin/httpd -k start 1454028 1276780 nobody 17332 0.1 S 00:46 /usr/sbin/httpd -k start 1454029 1276780 nobody 17312 0.0 S 00:46 /usr/sbin/httpd -k start 1453990 1276780 nobody 17072 0.0 S 00:49 /usr/sbin/httpd -k start 1454000 1276780 nobody 17028 0.0 S 00:48 /usr/sbin/httpd -k start 1454369 1276780 nobody 16980 0.0 S 00:28 /usr/sbin/httpd -k start 1454367 1276780 nobody 16976 0.1 S 00:28 /usr/sbin/httpd -k start 1453385 1276780 nobody 16920 0.0 S 01:37 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+----------------------+---------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+----------------------+---------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 7385103 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 7385102 | root | 85-1559715131 | Execute | 0 | Sending data | SELECT sum(cost*qty) as cost, sum(round(cast(adjPrice as decimal(15,4))*qty,2)) as total from quoteitems where quoteid='36760' and status='1' | | 7385100 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+----------------------+---------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 607 evolution/portal.evolutionerp.com.au-ssl_log 213 cosgrovecreative/cosgrovecreative.com.au-ssl_log 87 madalice/madalice.com.au-ssl_log 58 aaa/aaadownunder.com.au-ssl_log 9 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 503 203.54.180.238 88 103.104.164.114 87 40.80.82.167 52 1.145.96.168 45 103.104.165.99 42 2001:8004:14b3:854f:bd6c:e4b0:f36b:9f9d 33 20.24.67.246 28 147.161.213.78 23 180.181.236.49 21 116.91.221.198 14 116.91.223.246 12 182.239.240.254 4 66.249.65.169 2 193.82.239.232 2 165.225.233.109 --- top request paths across all vhosts (last 3 min) --- 191 POST /functions.php 132 GET /app/ajax.php 72 GET /factory_session_checker.php 50 POST /app/ajax.php 49 GET /index.php 36 GET /heartbeat.php 36 GET /factory_session_processed_qty.php 36 GET /factory_session_joiner.php 23 POST /app/ajax/selectFilter.php 21 POST /app/ajax/selectFilterSingle.php 20 POST /wp-admin/admin-ajax.php 20 POST /plugins/csvexporter/plugin.php 18 POST /quoteditsave.php 10 GET /plugins/fensa/fensa-ajax.php 10 GET //app/ajax.php 8 POST /clienteditsave.php 6 POST /opportunityeditsave.php 6 POST /itemModify.php 6 POST / 6 GET /wp-json/wc-admin/options --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 191 POST /functions.php 132 GET /app/ajax.php 50 POST /app/ajax.php 49 GET /index.php 23 POST /app/ajax/selectFilter.php 21 POST /app/ajax/selectFilterSingle.php 20 POST /plugins/csvexporter/plugin.php 18 POST /quoteditsave.php 10 GET /plugins/fensa/fensa-ajax.php 10 GET //app/ajax.php 8 POST /clienteditsave.php 6 POST /opportunityeditsave.php -- last 10 requests -- 182.239.240.254 - - [18/Aug/2026:11:49:06 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 103.104.164.114 - - [18/Aug/2026:11:49:06 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Ddispatchedit%26dispatchid%3D60&call=getUserSetting&caller=ajaxSubmitLocal&seq=18264687932 HTTP/1.1" 200 165 "https://my.evoluti 203.54.180.238 - - [18/Aug/2026:11:49:05 +1000] "POST /quoteditsave.php?call=checkForBOMAlternates&id=7660 HTTP/1.1" 200 39 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78493§ionid=0" "Mozilla/5.0 203.54.180.238 - - [18/Aug/2026:11:49:03 +1000] "GET /index.php?page=jobedit&id=29401 HTTP/1.1" 200 438658 "https://my.evolutionerp.com.au/index.php?page=mfreqedit&id=20802" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) App 203.54.180.238 - - [18/Aug/2026:11:49:05 +1000] "POST /logsave.php?call=getHistory&id=29401&module=job HTTP/1.1" 200 1013 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29401" "Mozilla/5.0 (Windows NT 10.0; Wi 203.54.180.238 - - [18/Aug/2026:11:49:06 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29401" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 203.54.180.238 - - [18/Aug/2026:11:49:05 +1000] "POST /clienteditsave.php?clientid=12257&call=getCategoryDiscounts HTTP/1.1" 200 780 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29401" "Mozilla/5.0 (Windows 147.161.213.78 - - [18/Aug/2026:11:49:06 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=report&file=testTagRetest3" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 203.54.180.238 - - [18/Aug/2026:11:49:05 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29401" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 203.54.180.238 - - [18/Aug/2026:11:49:06 +1000] "GET /app/ajax.php?cn=&furi=true&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=11086808118 HTTP/1.1" 200 200 "https://my.evolutionerp.com.au/index.php?page=jobedit&id == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 72 GET /factory_session_checker.php 36 GET /heartbeat.php 36 GET /factory_session_processed_qty.php 36 GET /factory_session_joiner.php 1 GET /xx.php 1 GET /wpxml.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /thoms.php 1 GET /this_is_a_new_hello_world.php 1 GET /sf.php 1 GET /puc.php 1 GET /ops.php -- last 10 requests -- 203.54.180.238 - - [18/Aug/2026:11:48:57 +1000] "GET /heartbeat.php?sentAt=1787017737&bytes=106,131,186,9&_=1786971217858 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [18/Aug/2026:11:48:58 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 127 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [18/Aug/2026:11:48:58 +1000] "GET /factory_session_joiner.php?id=34671 HTTP/1.1" 200 79 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [18/Aug/2026:11:48:57 +1000] "GET /heartbeat.php?sentAt=1787017735&bytes=106,131,186,7&_=1787002018605 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [18/Aug/2026:11:48:58 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [18/Aug/2026:11:48:59 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [18/Aug/2026:11:48:59 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 123 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [18/Aug/2026:11:48:59 +1000] "GET /factory_session_joiner.php?id=34681 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [18/Aug/2026:11:48:59 +1000] "GET /heartbeat.php?sentAt=1787017739&bytes=106,131,186,11&_=1787017199326 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=8" 203.54.180.238 - - [18/Aug/2026:11:49:01 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 3 GET /admin.php 1 GET /yj09.php 1 GET /x.php 1 GET /wp-temp.php 1 GET /wp.php 1 GET /wp-manager.php 1 GET /wp-includes/Text/Diff/Engine/about.php 1 GET /wp-includes/Text/ 1 GET /wp-includes/sodium_compat/ 1 GET /wp-includes/Requests/ 1 GET /wp-includes/l10n/ 1 GET /wp-includes/js/jquery/ -- last 10 requests -- 40.80.82.167 - - [18/Aug/2026:11:49:04 +1000] "GET /simple.php HTTP/1.1" 401 36 "-" "-" 40.80.82.167 - - [18/Aug/2026:11:49:05 +1000] "GET /hypo.php HTTP/1.1" 401 36 "-" "-" 40.80.82.167 - - [18/Aug/2026:11:49:05 +1000] "GET /wp-admin/css/colors/blue/ HTTP/1.1" 401 36 "-" "-" 40.80.82.167 - - [18/Aug/2026:11:49:05 +1000] "GET /chosen.php HTTP/1.1" 401 36 "-" "-" 40.80.82.167 - - [18/Aug/2026:11:49:06 +1000] "GET /wp-includes/block-bindings/ HTTP/1.1" 401 36 "-" "-" 40.80.82.167 - - [18/Aug/2026:11:49:06 +1000] "GET /als.php HTTP/1.1" 401 36 "-" "-" 40.80.82.167 - - [18/Aug/2026:11:49:06 +1000] "GET /nox.php HTTP/1.1" 401 36 "-" "-" 40.80.82.167 - - [18/Aug/2026:11:49:07 +1000] "GET /file59.php HTTP/1.1" 401 36 "-" "-" 40.80.82.167 - - [18/Aug/2026:11:49:07 +1000] "GET /admin.php HTTP/1.1" 401 36 "-" "-" 40.80.82.167 - - [18/Aug/2026:11:49:07 +1000] "GET /aa2.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-18 11:46:47 L1=3.00 run=8 blk=0 avail=6214 (53.0%) swpO=0 conn=4 myRSS=2646 php=6 phpRSS=410 ap=57 tcp=56 topuser=evolution 2026-08-18 11:46:47 L1=3.00 run=10 blk=0 avail=6217 (53.0%) swpO=0 conn=5 myRSS=2646 php=5 phpRSS=353 ap=57 tcp=56 topuser=evolution 2026-08-18 11:46:57 L1=3.16 run=8 blk=0 avail=5673 (48.4%) swpO=0 conn=4 myRSS=2646 php=8 phpRSS=1041 ap=52 tcp=65 topuser=madalice 2026-08-18 11:46:57 L1=3.16 run=8 blk=0 avail=5663 (48.3%) swpO=0 conn=5 myRSS=2646 php=8 phpRSS=1053 ap=52 tcp=65 topuser=madalice 2026-08-18 11:47:07 L1=2.82 run=2 blk=0 avail=6343 (54.1%) swpO=0 conn=4 myRSS=2646 php=3 phpRSS=158 ap=62 tcp=56 topuser=evolution 2026-08-18 11:47:07 L1=2.82 run=2 blk=0 avail=6333 (54.0%) swpO=0 conn=5 myRSS=2646 php=3 phpRSS=168 ap=62 tcp=56 topuser=corpkicks 2026-08-18 11:47:17 L1=2.68 run=2 blk=0 avail=6396 (54.5%) swpO=0 conn=4 myRSS=2646 php=4 phpRSS=188 ap=52 tcp=54 topuser=evolution 2026-08-18 11:47:17 L1=2.68 run=3 blk=0 avail=6374 (54.3%) swpO=0 conn=4 myRSS=2646 php=4 phpRSS=210 ap=52 tcp=54 topuser=evolution 2026-08-18 11:47:27 L1=2.64 run=3 blk=0 avail=6459 (55.1%) swpO=0 conn=4 myRSS=2646 php=3 phpRSS=152 ap=44 tcp=57 topuser=evolution 2026-08-18 11:47:27 L1=2.64 run=3 blk=0 avail=6451 (55.0%) swpO=0 conn=4 myRSS=2646 php=4 phpRSS=195 ap=44 tcp=57 topuser=evolution 2026-08-18 11:47:37 L1=2.47 run=2 blk=0 avail=6397 (54.5%) swpO=0 conn=4 myRSS=2646 php=3 phpRSS=149 ap=55 tcp=67 topuser=evolution 2026-08-18 11:47:37 L1=2.47 run=2 blk=0 avail=6397 (54.5%) swpO=0 conn=4 myRSS=2646 php=3 phpRSS=150 ap=54 tcp=66 topuser=evolution 2026-08-18 11:47:47 L1=2.39 run=3 blk=0 avail=6194 (52.8%) swpO=0 conn=4 myRSS=2646 php=4 phpRSS=410 ap=53 tcp=42 topuser=madalice 2026-08-18 11:47:48 L1=2.39 run=4 blk=0 avail=6195 (52.8%) swpO=0 conn=4 myRSS=2646 php=4 phpRSS=417 ap=52 tcp=41 topuser=madalice 2026-08-18 11:47:58 L1=2.87 run=1 blk=0 avail=6499 (55.4%) swpO=0 conn=4 myRSS=2646 php=2 phpRSS=81 ap=45 tcp=53 topuser=evolution 2026-08-18 11:47:58 L1=2.87 run=3 blk=0 avail=6509 (55.5%) swpO=0 conn=4 myRSS=2646 php=1 phpRSS=40 ap=45 tcp=53 topuser=evolution 2026-08-18 11:48:08 L1=2.58 run=1 blk=0 avail=6277 (53.5%) swpO=0 conn=4 myRSS=2646 php=2 phpRSS=322 ap=45 tcp=44 topuser=madalice 2026-08-18 11:48:08 L1=2.58 run=2 blk=0 avail=6277 (53.5%) swpO=0 conn=4 myRSS=2646 php=2 phpRSS=322 ap=45 tcp=44 topuser=madalice 2026-08-18 11:48:18 L1=2.81 run=4 blk=0 avail=6394 (54.5%) swpO=0 conn=4 myRSS=2646 php=3 phpRSS=260 ap=41 tcp=41 topuser=madalice 2026-08-18 11:48:18 L1=2.81 run=5 blk=0 avail=6389 (54.5%) swpO=0 conn=3 myRSS=2646 php=3 phpRSS=262 ap=41 tcp=41 topuser=madalice 2026-08-18 11:48:28 L1=3.72 run=1 blk=0 avail=6404 (54.6%) swpO=0 conn=4 myRSS=2646 php=1 phpRSS=39 ap=69 tcp=60 topuser=evolution 2026-08-18 11:48:28 L1=3.72 run=1 blk=0 avail=6404 (54.6%) swpO=0 conn=3 myRSS=2646 php=1 phpRSS=39 ap=69 tcp=60 topuser=evolution 2026-08-18 11:48:38 L1=4.81 run=7 blk=0 avail=5877 (50.1%) swpO=432 conn=4 myRSS=2633 php=5 phpRSS=573 ap=60 tcp=71 topuser=madalice 2026-08-18 11:48:38 L1=4.81 run=6 blk=0 avail=6027 (51.4%) swpO=432 conn=3 myRSS=2633 php=4 phpRSS=560 ap=60 tcp=71 topuser=madalice 2026-08-18 11:48:48 L1=4.62 run=1 blk=0 avail=6401 (54.6%) swpO=0 conn=4 myRSS=2633 php=1 phpRSS=39 ap=68 tcp=37 topuser=evolution 2026-08-18 11:48:48 L1=4.62 run=2 blk=0 avail=6401 (54.6%) swpO=0 conn=3 myRSS=2633 php=1 phpRSS=39 ap=68 tcp=39 topuser=evolution 2026-08-18 11:48:58 L1=4.37 run=2 blk=0 avail=6247 (53.3%) swpO=0 conn=4 myRSS=2633 php=2 phpRSS=304 ap=58 tcp=44 topuser=madalice 2026-08-18 11:48:58 L1=4.37 run=5 blk=0 avail=6247 (53.3%) swpO=0 conn=3 myRSS=2633 php=2 phpRSS=305 ap=58 tcp=44 topuser=madalice 2026-08-18 11:49:08 L1=4.98 run=16 blk=0 avail=5149 (43.9%) swpO=0 conn=19 myRSS=2634 php=15 phpRSS=1822 ap=57 tcp=77 topuser=madalice 2026-08-18 11:49:08 L1=4.98 run=13 blk=0 avail=5116 (43.6%) swpO=0 conn=16 myRSS=2634 php=15 phpRSS=1852 ap=57 tcp=75 topuser=madalice