INCIDENT 2026-08-21 08:33:19 trigger: php_rss=1659MB ================================================================== load: 1.49 1.52 1.44 15/712 544878 ncpu:10 mem_avail: 4906MB/11729MB (41.8%) swap_used:2916MB swapout:808/s blocked(D):0 running:22 iowait:0.2% steal:0.0% php: 13 procs / 1659MB heaviest user: madalice (12 procs, 1659MB) apache: 90 procs tcp_estab: 82 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2707 madalice 11 1522 nobody 88 1364 root 240 1017 netdata 8 263 mailman 20 97 cpanellogin 1 70 evolution 9 64 kurri 4 49 lowrange 3 43 dovenull 6 26 wp-toolkit 6 19 named 1 15 zabbix 1 14 kamcool 1 11 candyfabcom 1 11 nscd 1 7 dovecot 3 7 mailnull 1 5 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 11 1542 evolution 2 51 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5243 MB Active(file): 3670 MB Inactive(file): 843 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 466 MB CommitLimit: 9960 MB Committed_AS: 10061 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 267385 root 07:22:03 5972 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2772068 11.1 Ssl 6-00:42:44 /usr/sbin/mariadbd 544788 544769 madalice 243320 71.6 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 212288 2.5 Ssl 52-22:23:26 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 544791 544777 madalice 206348 62.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 319520 311538 root 203172 0.0 S 05:55:35 spamd child 544832 544798 madalice 186388 83.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 544831 544799 madalice 182068 82.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 544830 544795 madalice 175984 79.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 311538 1 root 173568 0.0 Ss 06:10:34 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 319521 311538 root 165448 0.0 S 05:55:35 spamd child 544837 544802 madalice 155228 65.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 149192 0.0 Ss 6-00:42:47 /usr/lib/systemd/systemd-journald 544841 544804 madalice 147052 60.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 544838 544803 madalice 138516 58.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 544835 544801 madalice 117708 46.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 544844 544806 madalice 107216 80.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 544847 544807 madalice 80956 42.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 517511 1353308 cpanellogin 72036 0.0 S 34:02 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 544873 544808 evolution 66976 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 42892 0.0 Sl 52-22:23:25 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41956 0.0 Ss 30-05:51:56 cpsrvd (SSL) - waiting for connections 1469 1 root 38028 0.1 Ss 52-22:23:25 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 32400 0.1 Sl 52-22:23:21 /usr/libexec/netdata/plugins.d/go.d.plugin 1 310731 1 root 29648 0.0 Ss 06:11:06 lfd - sleeping 1463 1 root 25656 0.0 Ss 52-22:23:25 tailwatchd 541770 1276780 nobody 22244 0.1 S 03:46 /usr/sbin/httpd -k start 542614 1276780 nobody 20524 0.0 S 02:51 /usr/sbin/httpd -k start 542631 1276780 nobody 20156 0.0 S 02:50 /usr/sbin/httpd -k start 533641 3828812 lowrange 20044 0.0 S 14:43 dovecot/imap 542629 1276780 nobody 20032 0.0 S 02:50 /usr/sbin/httpd -k start 541758 1276780 nobody 19980 0.0 S 03:47 /usr/sbin/httpd -k start 543552 1276780 nobody 19764 0.0 S 01:48 /usr/sbin/httpd -k start 543550 1276780 nobody 19596 0.0 S 01:48 /usr/sbin/httpd -k start 543527 1276780 nobody 19412 0.0 S 01:49 /usr/sbin/httpd -k start 543073 1276780 nobody 19356 0.0 S 02:18 /usr/sbin/httpd -k start 543545 1276780 nobody 19304 0.0 S 01:48 /usr/sbin/httpd -k start 544453 1276780 nobody 19036 0.0 S 00:31 /usr/sbin/httpd -k start 543549 1276780 nobody 18984 0.0 S 01:48 /usr/sbin/httpd -k start 543488 1276780 nobody 18848 0.0 S 01:50 /usr/sbin/httpd -k start 542865 1276780 nobody 18760 0.0 S 02:32 /usr/sbin/httpd -k start 543548 1276780 nobody 18752 0.0 S 01:48 /usr/sbin/httpd -k start 544754 1276780 nobody 18732 0.0 S 00:05 /usr/sbin/httpd -k start 544779 1276780 nobody 18716 0.0 S 00:04 /usr/sbin/httpd -k start 544270 1276780 nobody 18696 0.0 S 00:48 /usr/sbin/httpd -k start 543078 1276780 nobody 18664 0.0 S 02:17 /usr/sbin/httpd -k start 544467 1276780 nobody 18528 0.1 S 00:30 /usr/sbin/httpd -k start 544757 1276780 nobody 18500 0.0 S 00:05 /usr/sbin/httpd -k start 544770 1276780 nobody 18500 0.5 S 00:04 /usr/sbin/httpd -k start 544781 1276780 nobody 18424 0.2 S 00:04 /usr/sbin/httpd -k start 544783 1276780 nobody 18336 0.0 S 00:04 /usr/sbin/httpd -k start 544745 1276780 nobody 18320 0.0 S 00:06 /usr/sbin/httpd -k start 544268 1276780 nobody 18296 0.0 S 00:48 /usr/sbin/httpd -k start 544780 1276780 nobody 18228 0.0 S 00:04 /usr/sbin/httpd -k start 544778 1276780 nobody 18096 0.2 S 00:04 /usr/sbin/httpd -k start 543076 1276780 nobody 18072 0.0 S 02:17 /usr/sbin/httpd -k start 185104 2431 netdata 18032 2.1 Sl 8-11:59:44 /usr/libexec/netdata/plugins.d/apps.plugin 1 543523 1276780 nobody 17720 0.0 S 01:49 /usr/sbin/httpd -k start 544260 1276780 nobody 17572 0.0 S 00:49 /usr/sbin/httpd -k start 544466 1276780 nobody 17300 0.0 S 00:30 /usr/sbin/httpd -k start 544261 1276780 nobody 17168 0.0 S 00:49 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 121 D - [kswapd0] --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 20013706 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 611 evolution/portal.evolutionerp.com.au-ssl_log 83 whiz/whizengineering.com.au-ssl_log 20 madalice/madalice.com.au-ssl_log 6 corpkicks/corporatekicks.com.au-ssl_log 1 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 240 203.54.180.238 182 150.228.243.81 122 103.104.165.99 57 180.181.236.49 45 103.104.164.114 32 182.239.240.254 20 195.178.110.31 9 147.161.215.75 8 120.19.166.194 2 40.77.167.48 2 206.83.119.57 2 175.36.227.212 2 114.119.137.101 1 66.249.73.171 1 65.181.14.55 --- top request paths across all vhosts (last 3 min) --- 183 POST /functions.php 123 GET /app/ajax.php 87 GET /index.php 64 POST /plugins/csvexporter/plugin.php 33 POST /inveditsave.php 25 GET /factory_session_checker.php 24 GET /heartbeat.php 18 POST /clienteditsave.php 14 POST /app/ajax/selectFilterSingle.php 13 POST /app/ajax.php 12 GET /factory_session_processed_qty.php 12 GET /factory_session_joiner.php 11 POST //functions.php 11 GET /app/templates/ajax.php 9 POST /app/ajax/selectFilter.php 9 HEAD /index.php 8 POST /logsave.php 5 POST /quoteditsave.php 5 GET /store/hand-painted-nike-af1-snake-rose-white/ 4 POST /reqSave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 183 POST /functions.php 123 GET /app/ajax.php 82 GET /index.php 64 POST /plugins/csvexporter/plugin.php 33 POST /inveditsave.php 18 POST /clienteditsave.php 14 POST /app/ajax/selectFilterSingle.php 13 POST /app/ajax.php 11 POST //functions.php 11 GET /app/templates/ajax.php 9 POST /app/ajax/selectFilter.php 9 HEAD /index.php -- last 10 requests -- 203.54.180.238 - - [21/Aug/2026:08:33:18 +1000] "POST /app/ajax.php?call=projectFlagForReview HTTP/1.1" 200 1337 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, lik 203.54.180.238 - - [21/Aug/2026:08:33:18 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=reqedit&id=9871" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 103.104.165.99 - - [21/Aug/2026:08:33:18 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?modules=projects&page=deliveries&runsheet_date=2026-08-24&branch=1" "Mozilla 150.228.243.81 - - [21/Aug/2026:08:33:18 +1000] "GET /index.php?page=invedit&id=2362&tab=generaltab HTTP/1.1" 200 34708 "https://my.evolutionerp.com.au/index.php?page=invedit&id=2362&tab=generaltab" "Mozilla/5.0 (Windows 150.228.243.81 - - [21/Aug/2026:08:33:19 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invedit&id=2362&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [21/Aug/2026:08:33:19 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Ch 150.228.243.81 - - [21/Aug/2026:08:33:19 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvedit%26id%3D2362%26tab%3Dgeneraltab&call=getUserSetting&caller=ajaxSubmitLocal&seq=12570570450 HTTP/1.1" 200 109 "https://my. 175.36.227.212 - - [21/Aug/2026:08:33:20 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 975 "https://my.evolutionerp.com.au/index.php?page=opportunityedit&opportunityid=8508" "Mozilla/5.0 (Windows NT 10.0; Win6 147.161.215.75 - - [21/Aug/2026:08:33:20 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=report&file=testTagRetest3&date=2026-01-01" "Mozilla/5.0 (Windows NT 10 203.54.180.238 - - [21/Aug/2026:08:33:20 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Sa == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 25 GET /factory_session_checker.php 24 GET /heartbeat.php 12 GET /factory_session_processed_qty.php 12 GET /factory_session_joiner.php 5 GET /index.php 3 GET /uploadsave.php 1 POST /portal/register 1 POST /inventory.php -- last 10 requests -- 203.54.180.238 - - [21/Aug/2026:08:32:50 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [21/Aug/2026:08:32:50 +1000] "GET /factory_session_joiner.php?id=34780 HTTP/1.1" 200 92 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [21/Aug/2026:08:32:51 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [21/Aug/2026:08:32:56 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [21/Aug/2026:08:32:56 +1000] "GET /heartbeat.php?sentAt=1787265176&bytes=106,135,128,152&_=1787230386527 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [21/Aug/2026:08:32:57 +1000] "GET /heartbeat.php?sentAt=1787265178&bytes=106,135,128,154&_=1787256895501 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [21/Aug/2026:08:33:00 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [21/Aug/2026:08:33:00 +1000] "GET /factory_session_joiner.php?id=34780 HTTP/1.1" 200 92 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [21/Aug/2026:08:33:01 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [21/Aug/2026:08:33:06 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == whiz/whizengineering.com.au-ssl_log == -- top paths -- 2 GET / 1 GET /test.php 1 GET /stripe/.env 1 GET /.stripe/ 1 GET /.env.tmp 1 GET /.env.save 1 GET /.env.php.bak 1 GET /.env.php 1 GET /.env.old 1 GET /.env.local 1 GET /.env.bak 1 GET /.env.backup -- last 10 requests -- 195.178.110.31 - - [21/Aug/2026:08:32:42 +1000] "GET /.env.aws HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" 195.178.110.31 - - [21/Aug/2026:08:32:42 +1000] "GET /.env.save HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 195.178.110.31 - - [21/Aug/2026:08:32:43 +1000] "GET /.env.local HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 195.178.110.31 - - [21/Aug/2026:08:32:43 +1000] "GET /backend/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 195.178.110.31 - - [21/Aug/2026:08:32:43 +1000] "GET /test.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 195.178.110.31 - - [21/Aug/2026:08:32:43 +1000] "GET /.env.backup HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" 195.178.110.31 - - [21/Aug/2026:08:32:44 +1000] "GET /.env.old HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 195.178.110.31 - - [21/Aug/2026:08:32:44 +1000] "GET /.env.tmp HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" 195.178.110.31 - - [21/Aug/2026:08:32:44 +1000] "GET /.env.php.bak HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 195.178.110.31 - - [21/Aug/2026:08:32:45 +1000] "GET /.env.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" --- last 30 samples (run-up to this incident) --- 2026-08-21 08:30:50 L1=1.33 run=1 blk=0 avail=6450 (55.0%) swpO=0 conn=1 myRSS=2719 php=0 phpRSS=0 ap=42 tcp=49 topuser=- 2026-08-21 08:30:58 L1=1.23 run=1 blk=0 avail=6266 (53.4%) swpO=0 conn=2 myRSS=2719 php=1 phpRSS=263 ap=35 tcp=34 topuser=madalice 2026-08-21 08:31:00 L1=1.29 run=3 blk=0 avail=6470 (55.2%) swpO=0 conn=1 myRSS=2719 php=0 phpRSS=0 ap=33 tcp=47 topuser=- 2026-08-21 08:31:08 L1=1.19 run=1 blk=0 avail=6473 (55.2%) swpO=0 conn=2 myRSS=2725 php=0 phpRSS=0 ap=39 tcp=41 topuser=- 2026-08-21 08:31:10 L1=1.17 run=1 blk=0 avail=6489 (55.3%) swpO=0 conn=1 myRSS=2725 php=0 phpRSS=0 ap=37 tcp=39 topuser=- 2026-08-21 08:31:18 L1=1.16 run=3 blk=0 avail=6470 (55.2%) swpO=0 conn=2 myRSS=2725 php=1 phpRSS=65 ap=32 tcp=44 topuser=evolution 2026-08-21 08:31:20 L1=1.14 run=4 blk=0 avail=6436 (54.9%) swpO=0 conn=1 myRSS=2725 php=2 phpRSS=137 ap=32 tcp=44 topuser=evolution 2026-08-21 08:31:28 L1=1.37 run=2 blk=0 avail=6448 (55.0%) swpO=1 conn=2 myRSS=2725 php=5 phpRSS=226 ap=29 tcp=43 topuser=evolution 2026-08-21 08:31:30 L1=1.58 run=7 blk=0 avail=6378 (54.4%) swpO=1 conn=1 myRSS=2725 php=3 phpRSS=202 ap=35 tcp=53 topuser=olympic 2026-08-21 08:31:39 L1=1.54 run=3 blk=0 avail=6168 (52.6%) swpO=0 conn=3 myRSS=2726 php=9 phpRSS=453 ap=54 tcp=47 topuser=evolution 2026-08-21 08:31:41 L1=1.65 run=1 blk=0 avail=6384 (54.4%) swpO=0 conn=1 myRSS=2726 php=1 phpRSS=25 ap=52 tcp=49 topuser=alison 2026-08-21 08:31:49 L1=1.60 run=2 blk=0 avail=6463 (55.1%) swpO=0 conn=3 myRSS=2726 php=1 phpRSS=42 ap=44 tcp=44 topuser=evolution 2026-08-21 08:31:51 L1=1.55 run=3 blk=0 avail=6353 (54.2%) swpO=0 conn=1 myRSS=2726 php=2 phpRSS=196 ap=42 tcp=49 topuser=madalice 2026-08-21 08:31:59 L1=1.59 run=3 blk=0 avail=6445 (55.0%) swpO=0 conn=3 myRSS=2726 php=2 phpRSS=147 ap=36 tcp=42 topuser=alison 2026-08-21 08:32:01 L1=1.70 run=1 blk=0 avail=6545 (55.8%) swpO=0 conn=1 myRSS=2726 php=0 phpRSS=0 ap=34 tcp=43 topuser=- 2026-08-21 08:32:09 L1=1.65 run=1 blk=0 avail=6535 (55.7%) swpO=0 conn=3 myRSS=2726 php=0 phpRSS=0 ap=35 tcp=43 topuser=- 2026-08-21 08:32:11 L1=1.67 run=2 blk=0 avail=6531 (55.7%) swpO=0 conn=1 myRSS=2726 php=1 phpRSS=23 ap=35 tcp=43 topuser=evolution 2026-08-21 08:32:19 L1=1.54 run=3 blk=0 avail=6332 (54.0%) swpO=0 conn=3 myRSS=2726 php=2 phpRSS=264 ap=36 tcp=39 topuser=madalice 2026-08-21 08:32:21 L1=1.42 run=2 blk=0 avail=6530 (55.7%) swpO=0 conn=1 myRSS=2726 php=1 phpRSS=41 ap=36 tcp=40 topuser=evolution 2026-08-21 08:32:29 L1=1.30 run=2 blk=0 avail=6567 (56.0%) swpO=0 conn=3 myRSS=2726 php=1 phpRSS=41 ap=30 tcp=38 topuser=evolution 2026-08-21 08:32:31 L1=1.20 run=2 blk=0 avail=6479 (55.2%) swpO=0 conn=1 myRSS=2726 php=2 phpRSS=138 ap=31 tcp=50 topuser=evolution 2026-08-21 08:32:39 L1=1.18 run=2 blk=0 avail=6484 (55.3%) swpO=0 conn=1 myRSS=2726 php=1 phpRSS=65 ap=36 tcp=49 topuser=evolution 2026-08-21 08:32:41 L1=1.17 run=1 blk=0 avail=6522 (55.6%) swpO=0 conn=1 myRSS=2726 php=0 phpRSS=0 ap=36 tcp=51 topuser=- 2026-08-21 08:32:49 L1=1.15 run=3 blk=0 avail=6490 (55.3%) swpO=0 conn=1 myRSS=2726 php=4 phpRSS=183 ap=32 tcp=47 topuser=evolution 2026-08-21 08:32:51 L1=1.30 run=1 blk=0 avail=6547 (55.8%) swpO=0 conn=1 myRSS=2726 php=1 phpRSS=9 ap=35 tcp=46 topuser=evolution 2026-08-21 08:32:59 L1=1.20 run=1 blk=0 avail=6570 (56.0%) swpO=0 conn=1 myRSS=2726 php=0 phpRSS=0 ap=31 tcp=40 topuser=- 2026-08-21 08:33:01 L1=1.10 run=1 blk=0 avail=6576 (56.1%) swpO=0 conn=1 myRSS=2726 php=0 phpRSS=0 ap=30 tcp=43 topuser=- 2026-08-21 08:33:09 L1=1.09 run=3 blk=0 avail=6590 (56.2%) swpO=0 conn=1 myRSS=2726 php=2 phpRSS=68 ap=27 tcp=39 topuser=evolution 2026-08-21 08:33:11 L1=1.01 run=3 blk=0 avail=6508 (55.5%) swpO=0 conn=1 myRSS=2726 php=2 phpRSS=155 ap=27 tcp=41 topuser=madalice 2026-08-21 08:33:19 L1=1.49 run=22 blk=0 avail=4906 (41.8%) swpO=808 conn=12 myRSS=2713 php=13 phpRSS=1659 ap=90 tcp=82 topuser=madalice