INCIDENT 2026-08-22 06:09:01 trigger: php_procs=26 php_rss=2937MB mysql_conn=26 ================================================================== load: 3.95 1.41 1.03 31/732 1481954 ncpu:10 mem_avail: 3941MB/11729MB (33.6%) swap_used:3465MB swapout:779/s blocked(D):0 running:29 iowait:0.4% steal:0.0% php: 26 procs / 2937MB heaviest user: madalice (25 procs, 2897MB) apache: 86 procs tcp_estab: 61 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 25 3052 mysql 1 2465 nobody 85 1324 root 250 1025 netdata 10 257 cpanellogin 1 121 mailman 20 93 mailnull 4 38 infinium 3 35 kurri 3 34 evolution 8 27 dovenull 6 26 wp-toolkit 6 18 zabbix 1 14 named 1 10 nscd 1 7 dovecot 3 7 cpanelconnecttrack 1 3 dbus 1 2 polkitd 1 1 --- php workers by user --- USER PROCS RSS_MB madalice 26 3132 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4733 MB Active(file): 2750 MB Inactive(file): 614 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 541 MB CommitLimit: 9960 MB Committed_AS: 12391 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1297509 root 04:57:45 3132 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2513456 11.0 Ssl 6-22:18:26 /usr/sbin/mariadbd 1481859 1481714 madalice 232420 41.6 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481862 1481823 madalice 232032 55.5 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 200004 2.5 Ssl 53-19:59:08 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1481863 1481833 madalice 190828 62.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481865 1481832 madalice 187356 55.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481866 1481836 madalice 184472 55.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353013 1343371 root 181104 0.0 S 03:30:39 spamd child 1343371 1 root 164396 0.0 Ss 03:45:38 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1353014 1343371 root 156868 0.0 S 03:30:39 spamd child 1481867 1481837 madalice 155192 48.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481872 1481834 madalice 151432 64.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481879 1481842 madalice 148980 61.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481873 1481819 madalice 148520 61.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481884 1481843 madalice 141016 58.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481870 1481752 madalice 139564 57.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481877 1481820 madalice 136316 59.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481878 1481831 madalice 131144 53.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481869 1481835 madalice 126092 36.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481875 1481822 madalice 117444 50.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481876 1481830 madalice 117372 48.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481871 1481821 madalice 116492 49.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1338336 1353308 cpanellogin 115636 0.0 S 03:52:06 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 1481881 1481839 madalice 107540 43.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481868 1481811 madalice 105156 24.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 99164 0.0 Ss 6-22:18:29 /usr/lib/systemd/systemd-journald 1481883 1481841 madalice 97564 31.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481887 1481846 madalice 95968 68.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481880 1481840 madalice 95556 29.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481874 1481829 madalice 94080 28.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481885 1481844 madalice 92060 26.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2223 1201 root 62876 0.0 Sl 53-19:59:07 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1481960 1481766 madalice 57420 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1481947 1481850 madalice 47204 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1469 1 root 41328 0.1 Ss 53-19:59:07 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 39772 0.0 Ss 31-03:27:38 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 35852 0.1 Sl 53-19:59:03 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1342210 1 root 28464 0.0 Ss 03:46:38 lfd - sleeping 1463 1 root 26036 0.0 Ss 53-19:59:07 tailwatchd 1481250 1481230 root 23360 0.1 S 00:59 /usr/sbin/exim -q 1474875 1276780 nobody 22424 0.0 S 12:34 /usr/sbin/httpd -k start 1478339 1276780 nobody 22292 0.0 S 06:37 /usr/sbin/httpd -k start 1477479 1276780 nobody 22268 0.0 S 08:12 /usr/sbin/httpd -k start 1474815 1276780 nobody 21848 0.0 S 12:36 /usr/sbin/httpd -k start 1474833 1276780 nobody 21228 0.0 S 12:35 /usr/sbin/httpd -k start 1480223 1276780 nobody 20840 0.0 S 03:07 /usr/sbin/httpd -k start 1479946 1276780 nobody 20516 0.0 S 03:48 /usr/sbin/httpd -k start 1481253 1481250 mailnull 20448 0.0 S 00:59 /usr/sbin/exim -q 1481918 1481917 root 20276 0.0 D 00:00 /usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/scripts/clean_user_php_sessions 1479941 1276780 nobody 19960 0.0 S 03:49 /usr/sbin/httpd -k start 1480755 1276780 nobody 18488 0.0 S 01:56 /usr/sbin/httpd -k start 1480871 1276780 nobody 18196 0.0 S 01:47 /usr/sbin/httpd -k start 1481482 1276780 nobody 18156 0.0 S 00:22 /usr/sbin/httpd -k start 185104 2431 netdata 17992 2.1 Sl 9-09:35:26 /usr/libexec/netdata/plugins.d/apps.plugin 1 1481804 1276780 nobody 17848 0.1 S 00:08 /usr/sbin/httpd -k start 1481809 1276780 nobody 17848 0.1 S 00:08 /usr/sbin/httpd -k start 1481805 1276780 nobody 17804 0.1 S 00:08 /usr/sbin/httpd -k start 1481810 1276780 nobody 17804 0.1 S 00:08 /usr/sbin/httpd -k start 1481826 1276780 nobody 17792 0.1 S 00:07 /usr/sbin/httpd -k start 1481764 1276780 nobody 17532 0.3 S 00:09 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 23041997 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 23041996 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 97 customc/customcentral.com.au-ssl_log 94 madalice/auction.madalice.com.au-ssl_log 65 evolution/portal.evolutionerp.com.au-ssl_log 19 olympic/olympicfencing.com.au-ssl_log 16 corpkicks/corporatekicks.com.au-ssl_log 2 evolution/my.evolutionerp.com.au-ssl_log 2 aaa/aaadownunder.com.au-ssl_log 1 evolution/evolutionerp.com.au 1 evolution/evolutionerp.com.au-ssl_log 1 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 108 136.108.66.146 95 68.155.154.146 65 20.251.48.93 19 203.54.180.238 7 130.254.112.83 6 147.53.122.236 2 52.167.144.188 2 146.70.194.222 2 118.127.40.55 1 40.88.21.235 1 34.196.51.17 1 209.163.119.204 1 20.226.7.189 1 130.254.112.52 1 114.119.146.16 --- top request paths across all vhosts (last 3 min) --- 19 GET /heartbeat.php 12 GET / 4 GET /xmlrpc.php 3 GET /rclone.conf 3 GET /.git/HEAD 2 POST /wp-cron.php 2 POST /graphql 2 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 2 GET /wp-json 2 GET /store/custom-shoes/ 2 GET /store/custom-shapeshifter/ 2 GET /index.php 2 GET /.git-credentials 2 GET /.git/config 2 GET /dashboard 2 GET /careers/ 2 GET /.aws/credentials 2 GET /.aws/config 2 GET /admin.php 2 GET /accreditations-warrantys/ --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 8 GET / 3 GET /rclone.conf 3 GET /.git/HEAD 2 POST /graphql 2 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 2 GET /wp-json 2 GET /store/custom-shoes/ 2 GET /store/custom-shapeshifter/ 2 GET /.git-credentials 2 GET /.git/config 2 GET /dashboard 2 GET /.aws/credentials -- last 10 requests -- 136.108.66.146 - - [22/Aug/2026:06:08:58 +1000] "GET /login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 136.108.66.146 - - [22/Aug/2026:06:08:57 +1000] "GET /.git-credentials HTTP/1.1" 404 30627 "https://www.madalice.com.au/.git-credentials" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/ 136.108.66.146 - - [22/Aug/2026:06:08:58 +1000] "GET /admin/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 136.108.66.146 - - [22/Aug/2026:06:08:58 +1000] "GET /signin HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 136.108.66.146 - - [22/Aug/2026:06:08:58 +1000] "GET /auth/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 136.108.66.146 - - [22/Aug/2026:06:08:58 +1000] "GET /admin HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 136.108.66.146 - - [22/Aug/2026:06:08:59 +1000] "POST /graphql HTTP/1.1" 404 30638 "https://www.madalice.com.au" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/5 136.108.66.146 - - [22/Aug/2026:06:08:59 +1000] "GET /.git/HEAD HTTP/1.1" 404 184754 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 136.108.66.146 - - [22/Aug/2026:06:08:59 +1000] "GET /console HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 136.108.66.146 - - [22/Aug/2026:06:08:59 +1000] "GET /dashboard HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" == customc/customcentral.com.au-ssl_log == -- top paths -- 1 GET /zup.php 1 GET /z.php 1 GET /zafir1.php 1 GET /xxx.php 1 GET /xmrlpc.php 1 GET /ww2.php 1 GET /ws80.php 1 GET /ws49.php 1 GET /wp/wp-admin/includes/ 1 GET /wp-wordfence-waf.php 1 GET /wp-update.php 1 GET /wp-load.php -- last 10 requests -- 68.155.154.146 - - [22/Aug/2026:06:07:20 +1000] "GET /7logs.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 68.155.154.146 - - [22/Aug/2026:06:07:20 +1000] "GET /ac.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 68.155.154.146 - - [22/Aug/2026:06:07:20 +1000] "GET /assets/images/doc.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 68.155.154.146 - - [22/Aug/2026:06:07:20 +1000] "GET /ctex1.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 68.155.154.146 - - [22/Aug/2026:06:07:21 +1000] "GET /defaults.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 68.155.154.146 - - [22/Aug/2026:06:07:21 +1000] "GET /domains.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 68.155.154.146 - - [22/Aug/2026:06:07:21 +1000] "GET /dropdown.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 68.155.154.146 - - [22/Aug/2026:06:07:21 +1000] "GET /files/index.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 68.155.154.146 - - [22/Aug/2026:06:07:21 +1000] "GET /flower.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 68.155.154.146 - - [22/Aug/2026:06:07:21 +1000] "GET /insc.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/auction.madalice.com.au-ssl_log == -- top paths -- 2 GET /admin.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /ws85.php 1 GET /wpxml.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /this_is_a_new_hello_world.php 1 GET /sure.php 1 GET /sonic.php 1 GET /she11.php 1 GET /sf.php 1 GET /samll.php -- last 10 requests -- 20.251.48.93 - - [22/Aug/2026:06:07:26 +1000] "GET /gray.php HTTP/1.1" 404 - "-" "-" 20.251.48.93 - - [22/Aug/2026:06:07:26 +1000] "GET /puki.php HTTP/1.1" 404 - "-" "-" 20.251.48.93 - - [22/Aug/2026:06:07:27 +1000] "GET /sonic.php HTTP/1.1" 404 - "-" "-" 20.251.48.93 - - [22/Aug/2026:06:07:27 +1000] "GET /pop.php HTTP/1.1" 404 - "-" "-" 20.251.48.93 - - [22/Aug/2026:06:07:27 +1000] "GET /503.php HTTP/1.1" 404 - "-" "-" 20.251.48.93 - - [22/Aug/2026:06:07:28 +1000] "GET /bossu.php HTTP/1.1" 404 - "-" "-" 20.251.48.93 - - [22/Aug/2026:06:07:28 +1000] "GET /504.php HTTP/1.1" 404 - "-" "-" 20.251.48.93 - - [22/Aug/2026:06:07:28 +1000] "GET /admin.php?p= HTTP/1.1" 404 - "-" "-" 20.251.48.93 - - [22/Aug/2026:06:07:29 +1000] "GET /ws85.php?p= HTTP/1.1" 404 - "-" "-" 20.251.48.93 - - [22/Aug/2026:06:07:29 +1000] "GET /db.php/new.php HTTP/1.1" 404 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-22 06:06:40 L1=0.60 run=2 blk=0 avail=6637 (56.6%) swpO=0 conn=3 myRSS=2483 php=2 phpRSS=125 ap=15 tcp=26 topuser=olympic 2026-08-22 06:06:42 L1=0.60 run=1 blk=0 avail=6546 (55.8%) swpO=0 conn=1 myRSS=2483 php=1 phpRSS=181 ap=15 tcp=23 topuser=evolution 2026-08-22 06:06:50 L1=0.58 run=3 blk=0 avail=6650 (56.7%) swpO=0 conn=3 myRSS=2483 php=2 phpRSS=106 ap=15 tcp=24 topuser=olympic 2026-08-22 06:06:52 L1=0.58 run=3 blk=0 avail=6473 (55.2%) swpO=0 conn=1 myRSS=2483 php=2 phpRSS=287 ap=15 tcp=24 topuser=madalice 2026-08-22 06:07:00 L1=0.65 run=3 blk=0 avail=6623 (56.5%) swpO=0 conn=3 myRSS=2483 php=2 phpRSS=138 ap=14 tcp=25 topuser=olympic 2026-08-22 06:07:02 L1=0.65 run=5 blk=0 avail=6315 (53.8%) swpO=0 conn=1 myRSS=2483 php=3 phpRSS=479 ap=14 tcp=29 topuser=corpkicks 2026-08-22 06:07:10 L1=0.84 run=1 blk=0 avail=6685 (57.0%) swpO=0 conn=3 myRSS=2483 php=1 phpRSS=40 ap=15 tcp=25 topuser=evolution 2026-08-22 06:07:12 L1=0.84 run=3 blk=0 avail=6700 (57.1%) swpO=0 conn=2 myRSS=2483 php=1 phpRSS=67 ap=15 tcp=26 topuser=madalice 2026-08-22 06:07:20 L1=0.79 run=1 blk=0 avail=6718 (57.3%) swpO=0 conn=3 myRSS=2483 php=1 phpRSS=40 ap=16 tcp=25 topuser=evolution 2026-08-22 06:07:23 L1=0.79 run=3 blk=0 avail=6628 (56.5%) swpO=0 conn=2 myRSS=2483 php=1 phpRSS=133 ap=16 tcp=27 topuser=olympic 2026-08-22 06:07:30 L1=0.74 run=1 blk=0 avail=6716 (57.3%) swpO=0 conn=2 myRSS=2483 php=1 phpRSS=40 ap=16 tcp=23 topuser=evolution 2026-08-22 06:07:33 L1=0.74 run=1 blk=0 avail=6735 (57.4%) swpO=0 conn=2 myRSS=2483 php=0 phpRSS=0 ap=16 tcp=24 topuser=- 2026-08-22 06:07:40 L1=0.86 run=2 blk=0 avail=6591 (56.2%) swpO=0 conn=2 myRSS=2483 php=2 phpRSS=196 ap=15 tcp=25 topuser=olympic 2026-08-22 06:07:43 L1=0.86 run=2 blk=0 avail=6651 (56.7%) swpO=2 conn=2 myRSS=2483 php=0 phpRSS=0 ap=15 tcp=26 topuser=- 2026-08-22 06:07:50 L1=0.73 run=1 blk=0 avail=6726 (57.3%) swpO=2 conn=2 myRSS=2483 php=1 phpRSS=40 ap=15 tcp=25 topuser=evolution 2026-08-22 06:07:53 L1=0.73 run=2 blk=0 avail=6473 (55.2%) swpO=0 conn=2 myRSS=2483 php=2 phpRSS=322 ap=15 tcp=28 topuser=evolution 2026-08-22 06:08:01 L1=0.61 run=2 blk=0 avail=6725 (57.3%) swpO=0 conn=2 myRSS=2483 php=1 phpRSS=40 ap=15 tcp=24 topuser=evolution 2026-08-22 06:08:03 L1=0.61 run=2 blk=0 avail=6716 (57.3%) swpO=0 conn=2 myRSS=2483 php=0 phpRSS=0 ap=15 tcp=25 topuser=- 2026-08-22 06:08:11 L1=0.52 run=1 blk=0 avail=6708 (57.2%) swpO=0 conn=2 myRSS=2483 php=1 phpRSS=40 ap=15 tcp=23 topuser=evolution 2026-08-22 06:08:13 L1=0.52 run=1 blk=0 avail=6721 (57.3%) swpO=0 conn=1 myRSS=2483 php=0 phpRSS=0 ap=15 tcp=23 topuser=- 2026-08-22 06:08:21 L1=0.44 run=1 blk=0 avail=6704 (57.2%) swpO=0 conn=2 myRSS=2483 php=1 phpRSS=40 ap=15 tcp=24 topuser=evolution 2026-08-22 06:08:23 L1=0.44 run=2 blk=0 avail=6569 (56.0%) swpO=0 conn=1 myRSS=2483 php=1 phpRSS=179 ap=15 tcp=25 topuser=madalice 2026-08-22 06:08:31 L1=0.53 run=5 blk=0 avail=6353 (54.2%) swpO=0 conn=7 myRSS=2483 php=6 phpRSS=540 ap=16 tcp=29 topuser=evolution 2026-08-22 06:08:33 L1=0.53 run=3 blk=0 avail=6702 (57.1%) swpO=0 conn=1 myRSS=2483 php=0 phpRSS=0 ap=16 tcp=27 topuser=- 2026-08-22 06:08:41 L1=0.53 run=2 blk=0 avail=6687 (57.0%) swpO=0 conn=7 myRSS=2483 php=0 phpRSS=0 ap=18 tcp=40 topuser=- 2026-08-22 06:08:43 L1=0.53 run=1 blk=0 avail=6612 (56.4%) swpO=0 conn=1 myRSS=2483 php=0 phpRSS=0 ap=30 tcp=41 topuser=- 2026-08-22 06:08:51 L1=0.45 run=1 blk=0 avail=6590 (56.2%) swpO=0 conn=7 myRSS=2483 php=1 phpRSS=40 ap=31 tcp=65 topuser=evolution 2026-08-22 06:08:53 L1=0.45 run=14 blk=0 avail=5425 (46.3%) swpO=0 conn=1 myRSS=2483 php=11 phpRSS=1392 ap=43 tcp=68 topuser=madalice 2026-08-22 06:09:01 L1=3.95 run=29 blk=0 avail=3941 (33.6%) swpO=779 conn=26 myRSS=2467 php=26 phpRSS=2937 ap=86 tcp=61 topuser=madalice 2026-08-22 06:09:03 L1=3.95 run=34 blk=0 avail=3100 (26.4%) swpO=3698 conn=26 myRSS=2426 php=28 phpRSS=4089 ap=84 tcp=60 topuser=madalice