INCIDENT 2026-08-20 11:02:30 trigger: php_rss=2332MB mysql_conn=16 ================================================================== load: 2.91 1.80 1.75 19/668 3714406 ncpu:10 mem_avail: 4684MB/11729MB (39.9%) swap_used:2734MB swapout:209/s blocked(D):0 running:19 iowait:0.1% steal:0.0% php: 16 procs / 2332MB heaviest user: madalice (12 procs, 2100MB) apache: 45 procs tcp_estab: 48 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2793 madalice 12 2192 nobody 44 758 root 243 671 netdata 8 265 corpkicks 1 116 evolution 9 111 mailman 20 105 cpanellogin 1 65 dovenull 6 27 wp-toolkit 6 25 candyfabcom 2 23 mailnull 2 19 zabbix 1 14 named 1 12 kurri 1 11 dovecot 3 7 nscd 1 6 cpanelconnecttrack 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 12 2218 corpkicks 1 117 evolution 3 96 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5471 MB Active(file): 3401 MB Inactive(file): 833 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 417 MB CommitLimit: 9960 MB Committed_AS: 9641 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3248642 root 09:51:14 4584 /usr/bin/imunify-agent-proxy 3712105 root 02:30 1252 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2854432 11.1 Ssl 5-03:11:54 /usr/sbin/mariadbd 3714350 3713087 madalice 235836 71.0 D 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3714351 3712834 madalice 235744 72.0 D 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3714349 3713735 madalice 220472 69.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3714348 3712885 madalice 217992 74.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 211020 2.5 Ssl 52-00:52:36 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3714357 3711066 madalice 210608 99.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3714352 3710208 madalice 202412 62.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3714356 3712506 madalice 199336 66.0 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3714355 3712330 madalice 196944 68.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3714354 3713712 madalice 194832 66.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3714361 3703971 madalice 185840 83.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3298114 3290507 root 172772 0.0 S 08:26:55 spamd child 3714360 3713730 madalice 166984 73.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3714358 3711477 madalice 151620 68.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 101184 0.0 Ss 5-03:11:57 /usr/lib/systemd/systemd-journald 3685833 1353308 cpanellogin 67436 0.0 S 29:52 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 3298115 3290507 root 59868 0.0 S 08:26:55 spamd child 3290507 1 root 55108 0.0 Ss 08:39:44 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3714370 3713733 evolution 43428 5.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3714369 3713734 evolution 43200 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3714424 3713353 evolution 43152 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 42440 0.0 Sl 52-00:52:35 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42036 0.0 Ss 29-08:21:06 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 34644 0.1 Sl 52-00:52:31 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 27660 0.1 Ss 52-00:52:35 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3709202 1276780 nobody 22932 0.0 S 05:44 /usr/sbin/httpd -k start 3703971 1276780 nobody 22076 0.0 S 10:50 /usr/sbin/httpd -k start 3708974 1276780 nobody 21852 0.0 S 05:53 /usr/sbin/httpd -k start 3711066 1276780 nobody 21720 0.0 S 03:37 /usr/sbin/httpd -k start 3710205 1276780 nobody 21696 0.0 S 04:35 /usr/sbin/httpd -k start 3711466 1276780 nobody 21652 0.0 S 03:10 /usr/sbin/httpd -k start 1463 1 root 21488 0.0 Ss 52-00:52:35 tailwatchd 3710208 1276780 nobody 21384 0.0 S 04:35 /usr/sbin/httpd -k start 3708242 1276780 nobody 20912 0.0 S 06:28 /usr/sbin/httpd -k start 3711477 1276780 nobody 20728 0.0 S 03:09 /usr/sbin/httpd -k start 3712834 1276780 nobody 20576 0.0 S 01:42 /usr/sbin/httpd -k start 3712330 1276780 nobody 20560 0.0 S 02:27 /usr/sbin/httpd -k start 3712886 1276780 nobody 20424 0.1 S 01:40 /usr/sbin/httpd -k start 3713713 1276780 nobody 20324 0.1 S 00:48 /usr/sbin/httpd -k start 3713346 1276780 nobody 20136 0.0 S 01:09 /usr/sbin/httpd -k start 3712884 1276780 nobody 20004 0.0 S 01:40 /usr/sbin/httpd -k start 3712883 1276780 nobody 19752 0.0 S 01:40 /usr/sbin/httpd -k start 3713087 1276780 nobody 19688 0.0 S 01:26 /usr/sbin/httpd -k start 3712304 1276780 nobody 19652 0.0 S 02:28 /usr/sbin/httpd -k start 185104 2431 netdata 19532 2.1 Sl 7-14:28:54 /usr/libexec/netdata/plugins.d/apps.plugin 1 3713730 1276780 nobody 19228 0.0 S 00:47 /usr/sbin/httpd -k start 3711754 1276780 nobody 19204 0.0 S 02:51 /usr/sbin/httpd -k start 3713268 1276780 nobody 19116 0.0 S 01:12 /usr/sbin/httpd -k start 3713353 1276780 nobody 19016 0.0 S 01:09 /usr/sbin/httpd -k start 3713348 1276780 nobody 18796 0.0 S 01:09 /usr/sbin/httpd -k start 3289952 1 root 18696 0.0 Ss 08:40:17 lfd - sleeping 3713734 1276780 nobody 18688 0.1 S 00:47 /usr/sbin/httpd -k start 3713733 1276780 nobody 18608 0.0 S 00:47 /usr/sbin/httpd -k start 3713230 1276780 nobody 18524 0.0 S 01:14 /usr/sbin/httpd -k start 3713712 1276780 nobody 18100 0.0 S 00:48 /usr/sbin/httpd -k start 3713350 1276780 nobody 17868 0.0 S 01:09 /usr/sbin/httpd -k start 3712506 1276780 nobody 17636 0.0 S 02:14 /usr/sbin/httpd -k start 3713594 1276780 nobody 17460 0.0 S 00:54 /usr/sbin/httpd -k start 3713735 1276780 nobody 17136 0.0 S 00:47 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+-------------+-------------+---------+------+----------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+-------------+-------------+---------+------+----------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 16620427 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 16620346 | madalice_wp | madalice_wp | Query | 0 | starting | SELECT option_name, option_value FROM AMuqf6qZ_options WHERE option_name IN ('_transient_forminator_general_data_protection_cleanup','_transient_timeout_forminator_general_data_protection_cleanup') | | 16620342 | madalice_wp | madalice_wp | Query | 0 | | SET SQL_BIG_SELECTS=1 | +----------+-------------+-------------+---------+------+----------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 751 evolution/portal.evolutionerp.com.au-ssl_log 132 bigdeals/bigdeals.com.au-ssl_log 107 coscom/swms.coscom.com.au 104 evolution/support.evolutionerp.com.au 63 aaa/aaadownunder.com.au-ssl_log 17 vinesit/westpanel.vinesit.com.au-ssl_log 5 olympic/olympicfencing.com.au-ssl_log 3 corpkicks/corporatekicks.com.au-ssl_log 2 evolution/evolutionerp.com.au-ssl_log 2 evolution/forms.evolutionerp.com.au-ssl_log 2 vinesit/vinesit.com.au-ssl_log 2 otterfencing/otterfencing.com.au 1 (total vhosts taking traffic: 13) --- top client IPs across all vhosts (last 3 min) --- 427 203.54.180.238 147 103.104.165.99 123 103.104.164.114 104 20.226.36.136 92 168.62.48.100 64 40.74.65.169 61 101.182.108.127 60 150.228.243.234 33 180.181.236.49 21 182.239.240.254 15 74.248.130.103 9 147.161.213.78 9 1.144.107.82 5 4.232.94.69 5 118.127.40.55 --- top request paths across all vhosts (last 3 min) --- 233 POST /functions.php 173 GET /app/ajax.php 70 GET /heartbeat.php 65 GET /index.php 37 POST /plugins/csvexporter/plugin.php 33 POST /app/ajax.php 31 POST /app/ajax/selectFilter.php 28 GET /factory_session_checker.php 27 POST /app/ajax/selectFilterSingle.php 25 POST /quoteditsave.php 22 POST /clienteditsave.php 14 GET /factory_session_processed_qty.php 14 GET /factory_session_joiner.php 13 POST //functions.php 13 GET /plugins/fensa/fensa-ajax.php 10 HEAD /index.php 6 POST /purchaseaddsave.php 6 POST /logsave.php 5 POST /wp-cron.php 5 POST /plugins/pipe/pipetopostsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 233 POST /functions.php 173 GET /app/ajax.php 59 GET /index.php 37 POST /plugins/csvexporter/plugin.php 33 POST /app/ajax.php 31 POST /app/ajax/selectFilter.php 27 POST /app/ajax/selectFilterSingle.php 25 POST /quoteditsave.php 22 POST /clienteditsave.php 13 POST //functions.php 13 GET /plugins/fensa/fensa-ajax.php 10 HEAD /index.php -- last 10 requests -- 203.54.180.238 - - [20/Aug/2026:11:02:27 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=&cursel=&curseltext=&fromMS=1&&nolimit=LIMIT%2050&include=&supplierid=16609&contactid=16609&tid=%25%25&returnobj=item 203.54.180.238 - - [20/Aug/2026:11:02:27 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=19859346298 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 147.161.213.78 - - [20/Aug/2026:11:02:27 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=siteedit&siteid=3628" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 203.54.180.238 - - [20/Aug/2026:11:02:28 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dpurchaseadd%26purchaseid%3D14072&call=getUserSetting&caller=ajaxSubmitLocal&seq=19827759471 HTTP/1.1" 200 164 "https://my.evolut 182.239.240.254 - - [20/Aug/2026:11:02:29 +1000] "POST //functions.php?call=heartbeat HTTP/1.1" 200 983 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=4183" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 203.54.180.238 - - [20/Aug/2026:11:02:29 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78596§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 203.54.180.238 - - [20/Aug/2026:11:02:29 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78594§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 203.54.180.238 - - [20/Aug/2026:11:02:30 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78570" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 103.104.164.114 - - [20/Aug/2026:11:02:31 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=billadd&billid=78" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 203.54.180.238 - - [20/Aug/2026:11:02:29 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 23391 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=14072" "Mozilla/5.0 (Windows NT 10.0; Win64 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 70 GET /heartbeat.php 28 GET /factory_session_checker.php 14 GET /factory_session_processed_qty.php 14 GET /factory_session_joiner.php 6 GET /index.php -- last 10 requests -- 203.54.180.238 - - [20/Aug/2026:11:02:11 +1000] "GET /heartbeat.php?sentAt=1787187731&bytes=106,134,82,19&_=1787143291564 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [20/Aug/2026:11:02:13 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [20/Aug/2026:11:02:13 +1000] "GET /factory_session_joiner.php?id=34754 HTTP/1.1" 200 86 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [20/Aug/2026:11:02:14 +1000] "GET /index.php?page=inventory_picking HTTP/1.1" 200 9372 "https://portal.evolutionerp.com.au/index.php?page=inventory_picking_goods&pickid=37770&seq=6486566132820" "Mozill 203.54.180.238 - - [20/Aug/2026:11:02:15 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [20/Aug/2026:11:02:15 +1000] "GET /heartbeat.php?sentAt=1787187734&bytes=106,134,82,22&_=1787174401027 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [20/Aug/2026:11:02:16 +1000] "GET /heartbeat.php?sentAt=1787187736&bytes=106,134,82,24&_=1787180972988 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [20/Aug/2026:11:02:18 +1000] "GET /heartbeat.php?sentAt=1787187738&bytes=106,134,82,26&_=1787187558286 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=8" 203.54.180.238 - - [20/Aug/2026:11:02:20 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [20/Aug/2026:11:02:19 +1000] "GET /heartbeat.php?sentAt=1787187739&bytes=106,134,82,27&_=1787186029381 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=5" == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 2 GET /file.php 1 GET /zoo1.php 1 GET /wp/wp-includes/index.php 1 GET /wp/wp-content/plugins/classic-editor/js/geido.php 1 GET /wpupex.php 1 GET /wp_motu_4r80b.php 1 GET /wp-mails.php 1 GET /wp-includes/widgets/index.php 1 GET /wp-includes/Text/index.php 1 GET /wp-includes/Text/Diff/470065/index.php 1 GET /wp-includes/SimplePie/Parse/upload.php 1 GET /wp-includes/SimplePie/Content/upload.php -- last 10 requests -- 168.62.48.100 - - [20/Aug/2026:11:01:52 +1000] "GET /wp-includes/index.php HTTP/1.1" 404 5749 "-" "-" 168.62.48.100 - - [20/Aug/2026:11:01:52 +1000] "GET /wp-includes/blocks/media-text/index.php HTTP/1.1" 404 5749 "-" "-" 168.62.48.100 - - [20/Aug/2026:11:01:53 +1000] "GET /wp-content/plugins/essential-addons-for-elementor-lite/vendor/30643/index.php HTTP/1.1" 404 5749 "-" "-" 168.62.48.100 - - [20/Aug/2026:11:01:53 +1000] "GET /.well-known/zip.php HTTP/1.1" 404 5749 "-" "-" 168.62.48.100 - - [20/Aug/2026:11:01:54 +1000] "GET /vendor/nette/utils/index.php HTTP/1.1" 404 5749 "-" "-" 168.62.48.100 - - [20/Aug/2026:11:01:54 +1000] "GET /wp/wp-content/plugins/classic-editor/js/geido.php HTTP/1.1" 404 5749 "-" "-" 168.62.48.100 - - [20/Aug/2026:11:01:54 +1000] "GET /.well-known/acme-challenge/update/wpupex.php HTTP/1.1" 404 5749 "-" "-" 168.62.48.100 - - [20/Aug/2026:11:01:55 +1000] "GET /wp-2019/function.php HTTP/1.1" 404 5749 "-" "-" 168.62.48.100 - - [20/Aug/2026:11:01:55 +1000] "GET /file.php HTTP/1.1" 404 5749 "-" "-" 168.62.48.100 - - [20/Aug/2026:11:01:56 +1000] "GET /myy.php HTTP/1.1" 404 5749 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-20 11:00:02 L1=1.38 run=8 blk=0 avail=6380 (54.4%) swpO=0 conn=1 myRSS=2788 php=3 phpRSS=187 ap=46 tcp=56 topuser=evolution 2026-08-20 11:00:09 L1=1.35 run=2 blk=0 avail=6332 (54.0%) swpO=0 conn=4 myRSS=2788 php=5 phpRSS=243 ap=57 tcp=43 topuser=evolution 2026-08-20 11:00:12 L1=1.56 run=2 blk=0 avail=6415 (54.7%) swpO=0 conn=1 myRSS=2788 php=1 phpRSS=69 ap=54 tcp=48 topuser=evolution 2026-08-20 11:00:19 L1=1.52 run=3 blk=0 avail=6374 (54.3%) swpO=0 conn=4 myRSS=2789 php=5 phpRSS=260 ap=50 tcp=46 topuser=evolution 2026-08-20 11:00:22 L1=1.56 run=4 blk=0 avail=6441 (54.9%) swpO=0 conn=1 myRSS=2789 php=2 phpRSS=123 ap=48 tcp=46 topuser=evolution 2026-08-20 11:00:29 L1=1.43 run=4 blk=0 avail=6445 (54.9%) swpO=0 conn=4 myRSS=2789 php=3 phpRSS=172 ap=45 tcp=44 topuser=evolution 2026-08-20 11:00:32 L1=1.88 run=2 blk=0 avail=6496 (55.4%) swpO=0 conn=2 myRSS=2789 php=1 phpRSS=65 ap=44 tcp=40 topuser=evolution 2026-08-20 11:00:39 L1=1.81 run=1 blk=0 avail=6547 (55.8%) swpO=0 conn=4 myRSS=2789 php=1 phpRSS=40 ap=42 tcp=42 topuser=evolution 2026-08-20 11:00:42 L1=1.66 run=1 blk=0 avail=6568 (56.0%) swpO=0 conn=2 myRSS=2789 php=0 phpRSS=0 ap=40 tcp=38 topuser=- 2026-08-20 11:00:49 L1=1.61 run=5 blk=0 avail=6430 (54.8%) swpO=1 conn=3 myRSS=2789 php=7 phpRSS=338 ap=41 tcp=51 topuser=evolution 2026-08-20 11:00:52 L1=1.80 run=5 blk=0 avail=6512 (55.5%) swpO=1 conn=2 myRSS=2789 php=5 phpRSS=181 ap=47 tcp=56 topuser=evolution 2026-08-20 11:00:59 L1=1.82 run=1 blk=0 avail=6519 (55.6%) swpO=0 conn=3 myRSS=2789 php=1 phpRSS=39 ap=47 tcp=39 topuser=evolution 2026-08-20 11:01:02 L1=1.67 run=2 blk=0 avail=6518 (55.6%) swpO=0 conn=2 myRSS=2789 php=1 phpRSS=67 ap=44 tcp=40 topuser=evolution 2026-08-20 11:01:09 L1=1.62 run=2 blk=0 avail=6324 (53.9%) swpO=0 conn=3 myRSS=2805 php=2 phpRSS=260 ap=45 tcp=38 topuser=corpkicks 2026-08-20 11:01:12 L1=1.57 run=1 blk=0 avail=6523 (55.6%) swpO=0 conn=2 myRSS=2805 php=0 phpRSS=0 ap=44 tcp=39 topuser=- 2026-08-20 11:01:19 L1=1.60 run=2 blk=0 avail=6443 (54.9%) swpO=0 conn=3 myRSS=2806 php=3 phpRSS=157 ap=44 tcp=65 topuser=evolution 2026-08-20 11:01:22 L1=1.55 run=3 blk=0 avail=6197 (52.8%) swpO=0 conn=2 myRSS=2806 php=4 phpRSS=312 ap=58 tcp=66 topuser=olympic 2026-08-20 11:01:29 L1=1.43 run=2 blk=0 avail=6450 (55.0%) swpO=0 conn=3 myRSS=2806 php=1 phpRSS=40 ap=54 tcp=44 topuser=evolution 2026-08-20 11:01:32 L1=1.31 run=2 blk=0 avail=6209 (52.9%) swpO=0 conn=3 myRSS=2806 php=2 phpRSS=327 ap=52 tcp=45 topuser=evolution 2026-08-20 11:01:40 L1=1.29 run=3 blk=0 avail=6438 (54.9%) swpO=0 conn=3 myRSS=2806 php=1 phpRSS=39 ap=53 tcp=48 topuser=evolution 2026-08-20 11:01:42 L1=1.27 run=5 blk=0 avail=6331 (54.0%) swpO=0 conn=3 myRSS=2806 php=3 phpRSS=175 ap=55 tcp=64 topuser=evolution 2026-08-20 11:01:50 L1=1.24 run=3 blk=0 avail=6386 (54.5%) swpO=0 conn=2 myRSS=2806 php=3 phpRSS=81 ap=62 tcp=51 topuser=evolution 2026-08-20 11:01:52 L1=1.14 run=1 blk=0 avail=6433 (54.8%) swpO=0 conn=3 myRSS=2806 php=0 phpRSS=0 ap=60 tcp=48 topuser=- 2026-08-20 11:02:00 L1=1.37 run=3 blk=0 avail=6385 (54.4%) swpO=0 conn=2 myRSS=2806 php=3 phpRSS=187 ap=52 tcp=42 topuser=evolution 2026-08-20 11:02:02 L1=1.42 run=2 blk=0 avail=6451 (55.0%) swpO=0 conn=3 myRSS=2806 php=2 phpRSS=112 ap=50 tcp=40 topuser=evolution 2026-08-20 11:02:10 L1=1.47 run=1 blk=0 avail=6536 (55.7%) swpO=1 conn=2 myRSS=2806 php=1 phpRSS=40 ap=45 tcp=40 topuser=evolution 2026-08-20 11:02:12 L1=1.35 run=2 blk=0 avail=6479 (55.2%) swpO=1 conn=3 myRSS=2806 php=4 phpRSS=187 ap=43 tcp=39 topuser=evolution 2026-08-20 11:02:20 L1=1.56 run=3 blk=0 avail=6257 (53.4%) swpO=0 conn=2 myRSS=2806 php=4 phpRSS=397 ap=43 tcp=41 topuser=madalice 2026-08-20 11:02:23 L1=1.92 run=1 blk=0 avail=6532 (55.7%) swpO=0 conn=3 myRSS=2806 php=0 phpRSS=0 ap=43 tcp=37 topuser=- 2026-08-20 11:02:30 L1=2.91 run=19 blk=0 avail=4684 (39.9%) swpO=209 conn=16 myRSS=2799 php=16 phpRSS=2332 ap=45 tcp=48 topuser=madalice