INCIDENT 2026-08-20 11:33:41 trigger: php_rss=1562MB mysql_conn=15 ================================================================== load: 3.87 2.45 2.12 15/767 3758415 ncpu:10 mem_avail: 4837MB/11729MB (41.2%) swap_used:2867MB swapout:0/s blocked(D):0 running:19 iowait:0.8% steal:0.0% php: 14 procs / 1562MB heaviest user: madalice (9 procs, 1338MB) apache: 137 procs tcp_estab: 76 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2678 nobody 136 2272 madalice 9 1421 root 243 802 netdata 8 261 evolution 10 183 aaa 2 111 cpanellogin 1 106 mailman 20 102 lowrange 4 81 dovenull 6 26 infinium 2 24 wp-toolkit 6 17 zabbix 1 15 mailnull 2 12 alison 1 12 named 1 11 kurri 1 11 candyfabcom 1 11 cpanelphpmyadmin 1 8 --- php workers by user --- USER PROCS RSS_MB madalice 9 1461 evolution 4 141 aaa 2 114 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4725 MB Active(file): 2771 MB Inactive(file): 1119 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 390 MB CommitLimit: 9960 MB Committed_AS: 11233 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3248642 root 10:22:25 2784 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2742848 11.2 Ssl 5-03:43:05 /usr/sbin/mariadbd 3758306 3757771 madalice 241612 107 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 208228 2.5 Ssl 52-01:23:47 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3758357 3757776 madalice 194404 90.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3298114 3290507 root 186916 0.1 S 08:58:06 spamd child 3758363 3757847 madalice 175460 85.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3758359 3757843 madalice 174968 89.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3758334 3757836 madalice 168616 90.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3758367 3757851 madalice 164448 71.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3758368 3757850 madalice 164408 70.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3758360 3757842 madalice 162032 77.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3758369 3757852 madalice 158552 75.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3298115 3290507 root 145128 0.0 S 08:58:06 spamd child 2575382 1 root 111736 0.0 Ss 5-03:43:08 /usr/lib/systemd/systemd-journald 3740443 1353308 cpanellogin 108932 0.0 S 18:05 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 3758384 3757862 aaa 66616 39.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3758383 3757858 aaa 61508 32.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3290507 1 root 49220 0.0 Ss 09:10:55 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2223 1201 root 47244 0.0 Rl 52-01:23:46 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3748894 3828812 lowrange 47048 0.0 S 09:07 dovecot/imap 3758374 3757698 evolution 43464 8.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 41844 0.0 Ss 29-08:52:17 cpsrvd (SSL) - waiting for connections 1469 1 root 41628 0.1 Ss 52-01:23:46 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3758381 3756917 evolution 40872 4.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3758382 3757811 evolution 39388 4.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 32524 0.1 Sl 52-01:23:42 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3758449 3757777 evolution 22920 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3754668 1276780 nobody 22248 0.0 S 03:39 /usr/sbin/httpd -k start 3755141 1276780 nobody 21976 0.0 S 03:02 /usr/sbin/httpd -k start 3754692 1276780 nobody 21652 0.0 S 03:35 /usr/sbin/httpd -k start 3754666 1276780 nobody 21624 0.1 S 03:39 /usr/sbin/httpd -k start 3753868 1276780 nobody 21600 0.0 S 04:30 /usr/sbin/httpd -k start 3747060 1276780 nobody 21504 0.0 S 10:46 /usr/sbin/httpd -k start 3753588 1276780 nobody 21472 0.0 S 04:47 /usr/sbin/httpd -k start 3755792 1276780 nobody 21464 0.1 S 02:26 /usr/sbin/httpd -k start 3749236 1276780 nobody 21240 0.0 S 08:47 /usr/sbin/httpd -k start 3752307 1276780 nobody 21208 0.0 S 05:44 /usr/sbin/httpd -k start 3755391 1276780 nobody 20920 0.0 S 02:45 /usr/sbin/httpd -k start 3756196 1276780 nobody 20548 0.0 S 02:03 /usr/sbin/httpd -k start 3749086 1276780 nobody 20456 0.0 S 08:54 /usr/sbin/httpd -k start 3756188 1276780 nobody 20396 0.0 S 02:03 /usr/sbin/httpd -k start 3756156 1276780 nobody 20248 0.0 S 02:05 /usr/sbin/httpd -k start 3755615 1276780 nobody 20232 0.0 S 02:33 /usr/sbin/httpd -k start 3755140 1276780 nobody 20000 0.0 S 03:02 /usr/sbin/httpd -k start 3756167 1276780 nobody 19892 0.0 S 02:04 /usr/sbin/httpd -k start 3757336 1276780 nobody 19888 0.0 S 01:00 /usr/sbin/httpd -k start 3756917 1276780 nobody 19800 0.0 S 01:26 /usr/sbin/httpd -k start 3756916 1276780 nobody 19744 0.0 S 01:26 /usr/sbin/httpd -k start 3756895 1276780 nobody 19728 0.0 S 01:27 /usr/sbin/httpd -k start 3756915 1276780 nobody 19680 0.0 S 01:26 /usr/sbin/httpd -k start 1463 1 root 19628 0.0 Ss 52-01:23:46 tailwatchd 3756898 1276780 nobody 19548 0.0 S 01:27 /usr/sbin/httpd -k start 3756172 1276780 nobody 19428 0.0 S 02:04 /usr/sbin/httpd -k start 3756182 1276780 nobody 19372 0.0 S 02:03 /usr/sbin/httpd -k start 3755342 1276780 nobody 19312 0.0 S 02:49 /usr/sbin/httpd -k start 3756086 1276780 nobody 19240 0.0 S 02:10 /usr/sbin/httpd -k start 3756136 1276780 nobody 18980 0.0 S 02:06 /usr/sbin/httpd -k start 3757887 1276780 nobody 18800 0.0 S 00:23 /usr/sbin/httpd -k start 3757779 1276780 nobody 18740 0.0 S 00:26 /usr/sbin/httpd -k start 3757890 1276780 nobody 18716 0.0 S 00:23 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 16935142 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 1175 evolution/portal.evolutionerp.com.au-ssl_log 134 madalice/madalice.com.au-ssl_log 76 otter2/otterfencing.net.au 46 vinesit/vinesit.com.au-ssl_log 46 candyfabcom/candyfab.com.au-ssl_log 45 evolution/evolutionerp.com.au-ssl_log 3 corpkicks/corporatekicks.com.au-ssl_log 2 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 344 203.54.180.238 264 180.181.236.49 254 103.104.165.99 179 103.104.164.114 160 182.239.240.254 104 158.158.34.183 46 74.249.206.207 45 20.226.112.14 33 150.228.243.234 31 1.144.107.82 13 165.225.233.109 12 2001:8004:14b3:854f:344b:1ac8:7204:4a50 6 147.161.213.78 5 120.150.225.142 5 101.182.108.127 --- top request paths across all vhosts (last 3 min) --- 385 POST /functions.php 299 GET /app/ajax.php 118 GET /index.php 63 GET /heartbeat.php 52 POST /app/ajax.php 48 POST /app/ajax/selectFilterSingle.php 42 POST /app/ajax/selectFilter.php 40 POST /clienteditsave.php 37 POST /plugins/csvexporter/plugin.php 30 GET /factory_session_checker.php 27 POST /quoteditsave.php 26 POST /jobeditsave.php 16 POST /logsave.php 15 GET /factory_session_processed_qty.php 15 GET /factory_session_joiner.php 14 GET //app/ajax.php 13 POST /inveditsave.php 7 POST /wp-admin/admin-ajax.php 6 GET / 4 POST /print.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 385 POST /functions.php 299 GET /app/ajax.php 112 GET /index.php 52 POST /app/ajax.php 48 POST /app/ajax/selectFilterSingle.php 42 POST /app/ajax/selectFilter.php 40 POST /clienteditsave.php 37 POST /plugins/csvexporter/plugin.php 27 POST /quoteditsave.php 26 POST /jobeditsave.php 16 POST /logsave.php 14 GET //app/ajax.php -- last 10 requests -- 203.54.180.238 - - [20/Aug/2026:11:33:38 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 203.54.180.238 - - [20/Aug/2026:11:33:38 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=activities&date=2026-08-21&focus=29284" "Mozilla/5.0 (Windows NT 10.0; 103.104.164.114 - - [20/Aug/2026:11:33:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4479&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; 180.181.236.49 - - [20/Aug/2026:11:33:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 6992 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=51088" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 103.104.164.114 - - [20/Aug/2026:11:33:39 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 15761 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4479&tab=maintab" "Mozilla/5.0 (Windows NT 1 203.54.180.238 - - [20/Aug/2026:11:33:40 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=invedit&id=901&tab=purchasetab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 103.104.165.99 - - [20/Aug/2026:11:33:40 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 203.54.180.238 - - [20/Aug/2026:11:33:40 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=pickingedit&pickingid=37784" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 103.104.165.99 - - [20/Aug/2026:11:33:40 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12021&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 180.181.236.49 - - [20/Aug/2026:11:33:39 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 15304 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=51088" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 63 GET /heartbeat.php 30 GET /factory_session_checker.php 15 GET /factory_session_processed_qty.php 15 GET /factory_session_joiner.php 6 GET /index.php 2 POST /factory_functions.php 1 GET /api/deliveries.php 1 GET /api/api-check.php 1 GET / -- last 10 requests -- 203.54.180.238 - - [20/Aug/2026:11:33:25 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [20/Aug/2026:11:33:24 +1000] "GET /heartbeat.php?sentAt=1787189604&bytes=106,134,89,100&_=1787186029468 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=5" 203.54.180.238 - - [20/Aug/2026:11:33:25 +1000] "GET /heartbeat.php?sentAt=1787189604&bytes=106,134,89,100&_=1787174401214 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [20/Aug/2026:11:33:28 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 127 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [20/Aug/2026:11:33:29 +1000] "GET /factory_session_joiner.php?id=34748 HTTP/1.1" 200 92 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [20/Aug/2026:11:33:30 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [20/Aug/2026:11:33:31 +1000] "GET /heartbeat.php?sentAt=1787189611&bytes=106,134,89,107&_=1787143291752 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [20/Aug/2026:11:33:33 +1000] "GET /heartbeat.php?sentAt=1787189613&bytes=106,134,89,109&_=1787188179095 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [20/Aug/2026:11:33:34 +1000] "GET /heartbeat.php?sentAt=1787189614&bytes=106,134,89,110&_=1787186029469 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=5" 203.54.180.238 - - [20/Aug/2026:11:33:35 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == madalice/madalice.com.au-ssl_log == -- top paths -- 7 POST /wp-admin/admin-ajax.php 2 GET /wp-json/wc-admin/options 2 GET / 1 POST / 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /ws77.php 1 GET /ws37.php 1 GET /wp-trackback.php 1 GET /wp-themes.php 1 GET /wp-json/wc-analytics/products/reviews -- last 10 requests -- 2001:8004:14b3:854f:344b:1ac8:7204:4a50 - - [20/Aug/2026:11:33:23 +1000] "GET /wp-json/wc-analytics/orders?page=1&per_page=1&status%5B0%5D=processing&status%5B1%5D=on-hold&_fields%5B0%5D=id&_locale=user HTTP/1.1" 200 18 2001:8004:14b3:854f:344b:1ac8:7204:4a50 - - [20/Aug/2026:11:33:23 +1000] "GET /wp-json/wc-analytics/products/count-low-in-stock?status=publish&page=1&per_page=1&_locale=user HTTP/1.1" 200 17 "https://madalice.com.au/wp-a 2001:8004:14b3:854f:344b:1ac8:7204:4a50 - - [20/Aug/2026:11:33:24 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 77 "https://madalice.com.au/wp-admin/post.php?post=34616&action=edit" "Mozilla/5.0 (Windows NT 10.0; W 158.158.34.183 - - [20/Aug/2026:11:33:23 +1000] "GET /1index.php HTTP/1.1" 404 30569 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 2001:8004:14b3:854f:344b:1ac8:7204:4a50 - - [20/Aug/2026:11:33:24 +1000] "GET /wp-json/wc-admin/options?options=woocommerce_admin_transient_notices_queue%2Cwoocommerce_admin_install_timestamp&_locale=user HTTP/1.1" 200 7 2001:8004:14b3:854f:344b:1ac8:7204:4a50 - - [20/Aug/2026:11:33:24 +1000] "GET /wp-json/wc-analytics/admin/notes?page=1&per_page=25&type=error%2Cupdate&status=unactioned&_locale=user HTTP/1.1" 200 6 "https://madalice.com. 158.158.34.183 - - [20/Aug/2026:11:33:27 +1000] "GET /autoload_classmap/function.php HTTP/1.1" 404 30578 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 158.158.34.183 - - [20/Aug/2026:11:33:30 +1000] "GET /dvve.php HTTP/1.1" 404 30567 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [20/Aug/2026:11:33:33 +1000] "GET /ws77.php HTTP/1.1" 404 30566 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.34.183 - - [20/Aug/2026:11:33:35 +1000] "GET /.well-known/acme-challenge/index.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/53 --- last 30 samples (run-up to this incident) --- 2026-08-20 11:31:20 L1=1.71 run=3 blk=0 avail=6183 (52.7%) swpO=1 conn=4 myRSS=2736 php=1 phpRSS=193 ap=62 tcp=53 topuser=madalice 2026-08-20 11:31:21 L1=1.65 run=2 blk=1 avail=6339 (54.1%) swpO=1 conn=2 myRSS=2736 php=2 phpRSS=66 ap=61 tcp=50 topuser=evolution 2026-08-20 11:31:30 L1=1.68 run=3 blk=0 avail=6322 (53.9%) swpO=0 conn=4 myRSS=2736 php=1 phpRSS=96 ap=55 tcp=59 topuser=olympic 2026-08-20 11:31:31 L1=1.87 run=4 blk=0 avail=6126 (52.2%) swpO=0 conn=2 myRSS=2736 php=4 phpRSS=360 ap=56 tcp=63 topuser=olympic 2026-08-20 11:31:40 L1=2.35 run=7 blk=0 avail=5993 (51.1%) swpO=0 conn=4 myRSS=2736 php=8 phpRSS=417 ap=89 tcp=88 topuser=evolution 2026-08-20 11:31:41 L1=2.35 run=8 blk=0 avail=5827 (49.7%) swpO=0 conn=7 myRSS=2736 php=6 phpRSS=494 ap=89 tcp=80 topuser=madalice 2026-08-20 11:31:50 L1=2.39 run=4 blk=0 avail=6097 (52.0%) swpO=0 conn=4 myRSS=2737 php=3 phpRSS=203 ap=80 tcp=57 topuser=evolution 2026-08-20 11:31:51 L1=2.39 run=6 blk=0 avail=6017 (51.3%) swpO=0 conn=7 myRSS=2737 php=6 phpRSS=365 ap=79 tcp=63 topuser=evolution 2026-08-20 11:32:00 L1=2.41 run=4 blk=0 avail=6062 (51.7%) swpO=0 conn=4 myRSS=2737 php=3 phpRSS=294 ap=70 tcp=59 topuser=madalice 2026-08-20 11:32:01 L1=2.41 run=5 blk=0 avail=6181 (52.7%) swpO=0 conn=7 myRSS=2737 php=4 phpRSS=202 ap=69 tcp=53 topuser=evolution 2026-08-20 11:32:10 L1=2.26 run=3 blk=0 avail=6062 (51.7%) swpO=0 conn=4 myRSS=2737 php=3 phpRSS=393 ap=60 tcp=46 topuser=madalice 2026-08-20 11:32:11 L1=2.26 run=11 blk=0 avail=6177 (52.7%) swpO=0 conn=7 myRSS=2737 php=3 phpRSS=282 ap=59 tcp=64 topuser=madalice 2026-08-20 11:32:20 L1=2.16 run=5 blk=0 avail=6068 (51.7%) swpO=0 conn=4 myRSS=2737 php=3 phpRSS=318 ap=70 tcp=50 topuser=madalice 2026-08-20 11:32:21 L1=2.16 run=4 blk=0 avail=6194 (52.8%) swpO=0 conn=7 myRSS=2737 php=5 phpRSS=254 ap=69 tcp=55 topuser=evolution 2026-08-20 11:32:30 L1=2.29 run=2 blk=0 avail=6336 (54.0%) swpO=1 conn=4 myRSS=2737 php=1 phpRSS=80 ap=60 tcp=44 topuser=madalice 2026-08-20 11:32:31 L1=2.29 run=2 blk=0 avail=6243 (53.2%) swpO=1 conn=7 myRSS=2737 php=2 phpRSS=211 ap=59 tcp=42 topuser=madalice 2026-08-20 11:32:40 L1=2.71 run=3 blk=0 avail=6179 (52.7%) swpO=0 conn=4 myRSS=2737 php=2 phpRSS=307 ap=52 tcp=60 topuser=corpkicks 2026-08-20 11:32:41 L1=2.71 run=8 blk=0 avail=5881 (50.1%) swpO=0 conn=8 myRSS=2737 php=7 phpRSS=748 ap=53 tcp=62 topuser=corpkicks 2026-08-20 11:32:51 L1=2.53 run=3 blk=0 avail=6261 (53.4%) swpO=1 conn=4 myRSS=2737 php=1 phpRSS=203 ap=51 tcp=45 topuser=madalice 2026-08-20 11:32:52 L1=2.53 run=3 blk=0 avail=6393 (54.5%) swpO=1 conn=8 myRSS=2737 php=2 phpRSS=106 ap=50 tcp=46 topuser=madalice 2026-08-20 11:33:01 L1=2.36 run=2 blk=0 avail=6312 (53.8%) swpO=0 conn=2 myRSS=2737 php=1 phpRSS=160 ap=48 tcp=46 topuser=madalice 2026-08-20 11:33:02 L1=2.36 run=2 blk=0 avail=6350 (54.1%) swpO=0 conn=8 myRSS=2737 php=2 phpRSS=158 ap=47 tcp=44 topuser=madalice 2026-08-20 11:33:11 L1=2.23 run=5 blk=0 avail=5946 (50.7%) swpO=0 conn=2 myRSS=2738 php=5 phpRSS=689 ap=42 tcp=51 topuser=madalice 2026-08-20 11:33:12 L1=2.23 run=5 blk=0 avail=6064 (51.7%) swpO=0 conn=8 myRSS=2738 php=5 phpRSS=561 ap=43 tcp=131 topuser=madalice 2026-08-20 11:33:21 L1=2.04 run=3 blk=0 avail=5640 (48.1%) swpO=0 conn=2 myRSS=2738 php=3 phpRSS=169 ap=153 tcp=259 topuser=evolution 2026-08-20 11:33:22 L1=2.04 run=2 blk=0 avail=5722 (48.8%) swpO=0 conn=8 myRSS=2738 php=0 phpRSS=0 ap=153 tcp=251 topuser=- 2026-08-20 11:33:31 L1=2.62 run=5 blk=0 avail=5742 (49.0%) swpO=1915 conn=2 myRSS=2677 php=3 phpRSS=195 ap=147 tcp=55 topuser=madalice 2026-08-20 11:33:32 L1=2.62 run=2 blk=0 avail=5680 (48.4%) swpO=1915 conn=8 myRSS=2677 php=1 phpRSS=206 ap=146 tcp=45 topuser=madalice 2026-08-20 11:33:41 L1=3.87 run=19 blk=0 avail=4837 (41.2%) swpO=0 conn=15 myRSS=2678 php=14 phpRSS=1562 ap=137 tcp=76 topuser=madalice 2026-08-20 11:33:42 L1=3.87 run=16 blk=0 avail=4347 (37.1%) swpO=0 conn=12 myRSS=2678 php=14 phpRSS=2003 ap=136 tcp=73 topuser=madalice