INCIDENT 2026-08-20 16:31:52 trigger: php_rss=1881MB ================================================================== load: 1.68 1.18 0.95 20/774 4078307 ncpu:10 mem_avail: 4348MB/11729MB (37.1%) swap_used:2862MB swapout:49/s blocked(D):0 running:19 iowait:0.1% steal:0.0% php: 15 procs / 1881MB heaviest user: madalice (10 procs, 1631MB) apache: 152 procs tcp_estab: 102 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2819 nobody 151 2349 madalice 10 1757 root 242 888 netdata 8 263 evolution 11 149 corpkicks 1 102 mailman 20 98 speedlin 1 65 cpanellogin 1 61 dovenull 6 26 wp-toolkit 6 17 zabbix 1 15 alison 1 13 named 1 12 mailnull 2 12 infinium 1 11 kurri 1 10 dovecot 3 7 nscd 1 6 --- php workers by user --- USER PROCS RSS_MB madalice 10 1778 evolution 3 120 corpkicks 1 107 speedlin 1 66 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4907 MB Active(file): 3256 MB Inactive(file): 667 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 380 MB CommitLimit: 9960 MB Committed_AS: 11576 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3248642 root 15:20:36 2852 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2885584 12.0 Ssl 5-08:41:16 /usr/sbin/mariadbd 4078259 4078196 madalice 247636 72.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4078256 4078192 madalice 246320 72.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4078264 4078202 madalice 226564 102 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4078258 4078194 madalice 215116 65.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4078260 4078195 madalice 212344 65.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 211228 2.5 Ssl 52-06:21:58 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2575382 1 root 205068 0.0 Ss 5-08:41:19 /usr/lib/systemd/systemd-journald 4078268 4078190 madalice 203540 93.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4078265 4078165 madalice 199560 89.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4078269 4078193 madalice 181608 79.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3298115 3290507 root 161592 0.0 S 13:56:17 spamd child 3864059 3290507 root 149456 0.0 S 03:32:17 spamd child 4078272 4078205 madalice 129700 104 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4078273 4078189 speedlin 78588 44.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4078274 4076086 madalice 77664 38.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4056337 1353308 cpanellogin 63408 0.0 S 33:35 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 3290507 1 root 49112 0.0 Ss 14:09:06 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4078263 4078203 evolution 43500 3.0 S 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 41976 0.0 Sl 52-06:21:57 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41652 0.0 Ss 29-13:50:28 cpsrvd (SSL) - waiting for connections 4078257 4078187 evolution 40240 1.0 S 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4078276 4078206 evolution 39924 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 39260 0.1 Ss 52-06:21:57 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 34112 0.1 Sl 52-06:21:53 /usr/libexec/netdata/plugins.d/go.d.plugin 1 4076079 1276780 nobody 19100 0.0 S 02:43 /usr/sbin/httpd -k start 4076053 1276780 nobody 19080 0.0 S 02:44 /usr/sbin/httpd -k start 4076088 1276780 nobody 19032 0.0 S 02:43 /usr/sbin/httpd -k start 3289952 1 root 19020 0.0 Ss 14:09:39 lfd - sleeping 4076086 1276780 nobody 18908 0.0 S 02:43 /usr/sbin/httpd -k start 4076832 1276780 nobody 18908 0.0 S 02:05 /usr/sbin/httpd -k start 1463 1 root 18804 0.0 Ss 52-06:21:57 tailwatchd 4076017 1276780 nobody 18548 0.0 S 02:46 /usr/sbin/httpd -k start 4076051 1276780 nobody 18496 0.0 S 02:44 /usr/sbin/httpd -k start 4076078 1276780 nobody 18464 0.0 S 02:43 /usr/sbin/httpd -k start 4076497 1276780 nobody 18408 0.0 S 02:19 /usr/sbin/httpd -k start 4076008 1276780 nobody 18148 0.0 S 02:47 /usr/sbin/httpd -k start 4076496 1276780 nobody 18112 0.0 S 02:19 /usr/sbin/httpd -k start 4076036 1276780 nobody 18040 0.0 S 02:45 /usr/sbin/httpd -k start 4078156 1276780 nobody 17736 0.0 S 00:09 /usr/sbin/httpd -k start 4078128 1276780 nobody 17648 0.0 S 00:10 /usr/sbin/httpd -k start 4076081 1276780 nobody 17540 0.0 S 02:43 /usr/sbin/httpd -k start 4078204 1276780 nobody 17488 0.0 S 00:08 /usr/sbin/httpd -k start 185104 2431 netdata 17332 2.1 Sl 7-19:58:16 /usr/libexec/netdata/plugins.d/apps.plugin 1 4078063 1276780 nobody 17252 0.0 S 00:12 /usr/sbin/httpd -k start 4076877 1276780 nobody 16768 0.0 S 02:03 /usr/sbin/httpd -k start 4078181 1276780 nobody 16684 0.1 S 00:08 /usr/sbin/httpd -k start 4078066 1276780 nobody 16592 0.0 R 00:12 /usr/sbin/httpd -k start 4078125 1276780 nobody 16532 0.0 S 00:10 /usr/sbin/httpd -k start 4076080 1276780 nobody 16428 0.0 S 02:43 /usr/sbin/httpd -k start 4078199 1276780 nobody 16348 0.0 S 00:08 /usr/sbin/httpd -k start 4078206 1276780 nobody 16276 0.0 S 00:08 /usr/sbin/httpd -k start 4078171 1276780 nobody 16256 0.1 S 00:09 /usr/sbin/httpd -k start 4078182 1276780 nobody 16200 0.0 S 00:08 /usr/sbin/httpd -k start 4078180 1276780 nobody 16164 0.1 S 00:08 /usr/sbin/httpd -k start 4078196 1276780 nobody 16136 0.1 S 00:08 /usr/sbin/httpd -k start 4076557 1276780 nobody 16108 0.0 S 02:17 /usr/sbin/httpd -k start 4078188 1276780 nobody 16108 0.0 S 00:08 /usr/sbin/httpd -k start 4078200 1276780 nobody 16108 0.1 S 00:08 /usr/sbin/httpd -k start 4078074 1276780 nobody 16024 0.0 S 00:11 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 4078272 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi --- mariadb processlist (non-sleeping) --- +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 19250985 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 19250826 | madalice_wp | madalice_wp | Query | 0 | Sending data | SELECT option_value FROM AMuqf6qZ_options WHERE option_name LIKE 'wc_square_background_sync_job_%' AND ( option_value LIKE '%\"status\":\"queued\"%' OR option_value LIKE '%\"status\":\"processing\"%' ) ORDER BY option_id ASC LIMIT 1 | +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min candyfabcom/candyfab.com.au-ssl_log 429 evolution/my.evolutionerp.com.au-ssl_log 244 aaa/aaadownunder.com.au-ssl_log 128 corpkicks/2025.corporatekicks.com.au-ssl_log 128 evolution/my.evolutionerp.com.au 91 kamcool/kamcool.com.au-ssl_log 80 corpkicks/2025.corporatekicks.com.au 44 madalice/madalice.com.au-ssl_log 28 corpkicks/corporatekicks.com.au-ssl_log 9 evolution/portal.evolutionerp.com.au-ssl_log 9 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 429 34.77.180.82 394 20.203.138.185 124 20.116.17.175 80 68.155.154.146 55 103.104.164.114 22 203.54.180.238 12 182.239.240.254 11 2001:8004:14b3:854f:344b:1ac8:7204:4a50 10 1.144.107.82 8 103.104.165.99 7 147.161.213.78 6 118.127.40.55 5 20.104.49.167 5 180.181.236.49 4 150.228.243.234 --- top request paths across all vhosts (last 3 min) --- 74 POST /functions.php 20 GET /fetch 17 POST /app/ajax/selectFilter.php 15 POST /wp-admin/admin-ajax.php 10 GET /index.php 9 GET /heartbeat.php 6 GET /flower.php 6 GET /a.php 6 GET /666.php 6 GET /2.php 5 GET /xxxx.php 5 GET /x7.php 5 GET /wto.php 5 GET /wsd.php 5 GET /ws34.php 5 GET /wp-is.php 5 GET /v4.php 5 GET /v3.php 5 GET /sko.php 5 GET /shell.php --- busiest 3 vhosts: top paths + last 10 requests --- == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 20 GET /fetch 3 GET /read 3 GET /@fs/proc/self/environ 3 GET /download 3 GET /debug/default/view 3 GET / 2 GET /webhook 2 GET /screenshot 2 GET /redirect 2 GET /proxy 2 GET /preview 2 GET /pms -- last 10 requests -- 34.77.180.82 - - [20/Aug/2026:16:29:48 +1000] "GET /gradle.properties HTTP/1.1" 401 53 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 34.77.180.82 - - [20/Aug/2026:16:29:48 +1000] "GET /config/master.key HTTP/1.1" 401 53 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 34.77.180.82 - - [20/Aug/2026:16:29:48 +1000] "GET /log/production.log HTTP/1.1" 401 53 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 34.77.180.82 - - [20/Aug/2026:16:29:48 +1000] "GET /logs/app.log HTTP/1.1" 401 53 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 34.77.180.82 - - [20/Aug/2026:16:29:48 +1000] "GET /api/preview?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F HTTP/1.1" 401 53 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Geck 34.77.180.82 - - [20/Aug/2026:16:29:49 +1000] "GET /screenshot?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F HTTP/1.1" 401 53 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +htt 34.77.180.82 - - [20/Aug/2026:16:29:49 +1000] "GET /.netrc HTTP/1.1" 401 53 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 34.77.180.82 - - [20/Aug/2026:16:29:50 +1000] "GET /api/v2/config HTTP/1.1" 401 53 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 34.77.180.82 - - [20/Aug/2026:16:29:50 +1000] "GET /rails/info/properties HTTP/1.1" 401 53 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 34.77.180.82 - - [20/Aug/2026:16:29:50 +1000] "GET /WEB-INF/web.xml HTTP/1.1" 401 53 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 74 POST /functions.php 17 POST /app/ajax/selectFilter.php 10 GET /index.php 3 GET /app/ajax.php 2 POST /purchaseaddsave.php 2 POST /invoiceaddsave.php 2 POST /clienteditsave.php 1 POST /app/ajax/selectFilterSingle.php 1 GET /yellow.php 1 GET /xxxx.php 1 GET /xxx.php 1 GET /xxw.php -- last 10 requests -- 203.54.180.238 - - [20/Aug/2026:16:31:28 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/ 103.104.164.114 - - [20/Aug/2026:16:31:28 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=75 HTTP/1.1" 200 15548 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&tab=maintab" "Mozilla/5.0 (Windows 180.181.236.49 - - [20/Aug/2026:16:31:29 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=1144" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 103.104.164.114 - - [20/Aug/2026:16:31:29 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=75208 HTTP/1.1" 200 839 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&tab=maintab" "Mozilla/5.0 (Windows 103.104.164.114 - - [20/Aug/2026:16:31:34 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=purchasereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 103.104.164.114 - - [20/Aug/2026:16:31:35 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 147.161.213.78 - - [20/Aug/2026:16:31:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=report&file=testTagRetest3" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 147.161.213.78 - - [20/Aug/2026:16:31:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=siteedit&siteid=4418" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 103.104.164.114 - - [20/Aug/2026:16:31:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) App 103.104.165.99 - - [20/Aug/2026:16:31:45 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 2 GET /yup.php 2 GET /wp-temp.php 2 GET /wp-content/cong.php 1 GET /zxz.php 1 GET /zero.php 1 GET /z43agz.php 1 GET /yawa.php 1 GET /yas.php 1 GET /xyn.php 1 GET /xwpg.php 1 GET /x1da.php 1 GET /ws77.php -- last 10 requests -- 20.116.17.175 - - [20/Aug/2026:16:30:22 +1000] "GET /wp-includes/Text/Diff/Engine/about.php HTTP/1.1" 404 5749 "-" "-" 20.116.17.175 - - [20/Aug/2026:16:30:23 +1000] "GET /root.php HTTP/1.1" 404 5749 "-" "-" 20.116.17.175 - - [20/Aug/2026:16:30:23 +1000] "GET /fpwch.php HTTP/1.1" 404 5749 "-" "-" 20.116.17.175 - - [20/Aug/2026:16:30:25 +1000] "GET /mg.php HTTP/1.1" 404 5749 "-" "-" 20.116.17.175 - - [20/Aug/2026:16:30:25 +1000] "GET /reop3.php HTTP/1.1" 404 5749 "-" "-" 20.116.17.175 - - [20/Aug/2026:16:30:26 +1000] "GET /php5.php HTTP/1.1" 404 5749 "-" "-" 20.116.17.175 - - [20/Aug/2026:16:30:27 +1000] "GET /acp.php HTTP/1.1" 404 5749 "-" "-" 20.116.17.175 - - [20/Aug/2026:16:30:27 +1000] "GET /yas.php HTTP/1.1" 404 5749 "-" "-" 20.116.17.175 - - [20/Aug/2026:16:30:27 +1000] "GET /ah25.php HTTP/1.1" 404 5749 "-" "-" 20.116.17.175 - - [20/Aug/2026:16:30:28 +1000] "GET /ano.php HTTP/1.1" 404 5749 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-20 16:29:31 L1=1.01 run=2 blk=0 avail=6253 (53.3%) swpO=0 conn=3 myRSS=2795 php=2 phpRSS=149 ap=72 tcp=75 topuser=corpkicks 2026-08-20 16:29:32 L1=1.01 run=2 blk=0 avail=6249 (53.3%) swpO=0 conn=2 myRSS=2795 php=1 phpRSS=109 ap=73 tcp=104 topuser=corpkicks 2026-08-20 16:29:41 L1=1.24 run=4 blk=0 avail=6088 (51.9%) swpO=123 conn=3 myRSS=2791 php=2 phpRSS=118 ap=99 tcp=70 topuser=madalice 2026-08-20 16:29:42 L1=1.24 run=2 blk=0 avail=6003 (51.2%) swpO=123 conn=2 myRSS=2791 php=1 phpRSS=143 ap=98 tcp=67 topuser=madalice 2026-08-20 16:29:51 L1=1.20 run=4 blk=0 avail=5984 (51.0%) swpO=0 conn=3 myRSS=2791 php=3 phpRSS=255 ap=100 tcp=104 topuser=corpkicks 2026-08-20 16:29:52 L1=1.20 run=4 blk=0 avail=6022 (51.3%) swpO=0 conn=2 myRSS=2791 php=2 phpRSS=205 ap=100 tcp=95 topuser=corpkicks 2026-08-20 16:30:01 L1=1.10 run=2 blk=0 avail=6206 (52.9%) swpO=0 conn=3 myRSS=2791 php=2 phpRSS=71 ap=92 tcp=33 topuser=evolution 2026-08-20 16:30:02 L1=1.10 run=3 blk=1 avail=6090 (51.9%) swpO=0 conn=2 myRSS=2791 php=3 phpRSS=185 ap=91 tcp=33 topuser=evolution 2026-08-20 16:30:11 L1=1.30 run=1 blk=0 avail=6188 (52.8%) swpO=68 conn=4 myRSS=2834 php=2 phpRSS=109 ap=82 tcp=30 topuser=evolution 2026-08-20 16:30:12 L1=1.30 run=3 blk=1 avail=6156 (52.5%) swpO=68 conn=2 myRSS=2837 php=1 phpRSS=69 ap=81 tcp=28 topuser=evolution 2026-08-20 16:30:21 L1=1.10 run=3 blk=0 avail=6076 (51.8%) swpO=0 conn=4 myRSS=2838 php=4 phpRSS=366 ap=72 tcp=31 topuser=corpkicks 2026-08-20 16:30:22 L1=1.10 run=5 blk=0 avail=5906 (50.4%) swpO=45 conn=2 myRSS=2836 php=5 phpRSS=575 ap=71 tcp=32 topuser=corpkicks 2026-08-20 16:30:31 L1=1.39 run=2 blk=0 avail=6083 (51.9%) swpO=318 conn=4 myRSS=2828 php=3 phpRSS=399 ap=61 tcp=34 topuser=madalice 2026-08-20 16:30:32 L1=1.39 run=4 blk=0 avail=6078 (51.8%) swpO=272 conn=4 myRSS=2828 php=3 phpRSS=417 ap=61 tcp=34 topuser=madalice 2026-08-20 16:30:41 L1=1.40 run=2 blk=0 avail=6332 (54.0%) swpO=0 conn=4 myRSS=2828 php=3 phpRSS=224 ap=51 tcp=41 topuser=aaa 2026-08-20 16:30:42 L1=1.40 run=3 blk=0 avail=6468 (55.1%) swpO=0 conn=4 myRSS=2828 php=0 phpRSS=0 ap=51 tcp=38 topuser=- 2026-08-20 16:30:51 L1=1.43 run=3 blk=0 avail=6377 (54.4%) swpO=0 conn=4 myRSS=2828 php=2 phpRSS=184 ap=41 tcp=37 topuser=madalice 2026-08-20 16:30:52 L1=1.43 run=2 blk=0 avail=6342 (54.1%) swpO=0 conn=4 myRSS=2828 php=1 phpRSS=220 ap=41 tcp=35 topuser=madalice 2026-08-20 16:31:01 L1=1.68 run=1 blk=0 avail=6592 (56.2%) swpO=0 conn=4 myRSS=2828 php=1 phpRSS=39 ap=31 tcp=30 topuser=evolution 2026-08-20 16:31:02 L1=1.68 run=1 blk=0 avail=6604 (56.3%) swpO=0 conn=4 myRSS=2828 php=0 phpRSS=0 ap=31 tcp=29 topuser=- 2026-08-20 16:31:11 L1=1.90 run=2 blk=0 avail=6528 (55.7%) swpO=0 conn=2 myRSS=2828 php=2 phpRSS=39 ap=24 tcp=29 topuser=evolution 2026-08-20 16:31:12 L1=1.90 run=2 blk=0 avail=6648 (56.7%) swpO=0 conn=4 myRSS=2828 php=0 phpRSS=0 ap=24 tcp=30 topuser=- 2026-08-20 16:31:21 L1=1.91 run=5 blk=0 avail=6354 (54.2%) swpO=0 conn=2 myRSS=2828 php=2 phpRSS=349 ap=24 tcp=29 topuser=madalice 2026-08-20 16:31:22 L1=1.91 run=2 blk=0 avail=6469 (55.2%) swpO=0 conn=4 myRSS=2828 php=1 phpRSS=216 ap=24 tcp=28 topuser=madalice 2026-08-20 16:31:32 L1=2.07 run=3 blk=0 avail=6304 (53.7%) swpO=0 conn=2 myRSS=2829 php=3 phpRSS=456 ap=21 tcp=30 topuser=corpkicks 2026-08-20 16:31:32 L1=2.07 run=4 blk=0 avail=6239 (53.2%) swpO=0 conn=3 myRSS=2829 php=2 phpRSS=491 ap=21 tcp=29 topuser=corpkicks 2026-08-20 16:31:42 L1=1.98 run=1 blk=0 avail=6576 (56.1%) swpO=0 conn=2 myRSS=2829 php=1 phpRSS=12 ap=36 tcp=140 topuser=corpkicks 2026-08-20 16:31:42 L1=1.98 run=1 blk=0 avail=6572 (56.0%) swpO=0 conn=3 myRSS=2829 php=1 phpRSS=25 ap=39 tcp=137 topuser=corpkicks 2026-08-20 16:31:52 L1=1.68 run=19 blk=0 avail=4348 (37.1%) swpO=49 conn=14 myRSS=2827 php=15 phpRSS=1881 ap=152 tcp=102 topuser=madalice 2026-08-20 16:31:52 L1=1.68 run=14 blk=0 avail=4348 (37.1%) swpO=690 conn=3 myRSS=2813 php=11 phpRSS=1435 ap=151 tcp=93 topuser=madalice