INCIDENT 2026-08-22 06:10:04 trigger: mysql_conn=18 ================================================================== load: 4.19 2.25 1.36 2/651 1483390 ncpu:10 mem_avail: 6660MB/11729MB (56.8%) swap_used:3590MB swapout:0/s blocked(D):0 running:2 iowait:0.3% steal:0.0% php: 2 procs / 132MB heaviest user: evolution (2 procs, 132MB) apache: 27 procs tcp_estab: 48 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2415 root 255 1025 nobody 26 401 netdata 8 254 evolution 10 165 cpanellogin 1 98 mailman 20 93 infinium 3 35 kurri 3 34 mailnull 3 31 dovenull 6 26 wp-toolkit 6 17 zabbix 1 14 named 1 9 nscd 1 7 dovecot 3 7 cpanelconnecttrack 1 3 dbus 1 2 polkitd 1 1 rpc 1 0 --- php workers by user --- USER PROCS RSS_MB evolution 2 141 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 2566 MB Active(file): 1958 MB Inactive(file): 709 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 444 MB CommitLimit: 9960 MB Committed_AS: 6934 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1297509 root 04:58:48 3120 /usr/bin/imunify-agent-proxy 1483209 root 00:03 1292 /bin/sh -c bash -c "sleep $((RANDOM % 60))" ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2472960 11.0 Ssl 6-22:19:29 /usr/sbin/mariadbd 1220 1 netdata 200504 2.5 Ssl 53-20:00:11 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1353013 1343371 root 178684 0.0 S 03:31:42 spamd child 1343371 1 root 147624 0.0 Ss 03:46:41 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1353014 1343371 root 136788 0.0 S 03:31:42 spamd child 1483362 1481752 evolution 111128 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1338336 1353308 cpanellogin 101264 0.0 S 03:53:09 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 2575382 1 root 100000 0.0 Ss 6-22:19:32 /usr/lib/systemd/systemd-journald 2223 1201 root 61816 0.0 Sl 53-20:00:10 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1483356 1481823 evolution 41948 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 40736 0.1 Ss 53-20:00:10 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 39520 0.0 Ss 31-03:28:41 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 35676 0.1 Sl 53-20:00:06 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1342210 1 root 27360 0.0 Ss 03:47:41 lfd - sleeping 1463 1 root 25864 0.0 Ss 53-20:00:10 tailwatchd 1481250 1481230 root 23360 0.0 S 02:02 /usr/sbin/exim -q 1481253 1481250 mailnull 20448 0.0 S 02:02 /usr/sbin/exim -q 1481752 1276780 nobody 20264 0.0 S 01:13 /usr/sbin/httpd -k start 1481765 1276780 nobody 19532 0.0 S 01:12 /usr/sbin/httpd -k start 1481839 1276780 nobody 19316 0.0 S 01:10 /usr/sbin/httpd -k start 1481822 1276780 nobody 19192 0.1 S 01:10 /usr/sbin/httpd -k start 1481751 1276780 nobody 19160 0.0 S 01:13 /usr/sbin/httpd -k start 1481749 1276780 nobody 18608 0.0 S 01:13 /usr/sbin/httpd -k start 1481577 1276780 nobody 18556 0.0 S 01:22 /usr/sbin/httpd -k start 1481819 1276780 nobody 18516 0.0 S 01:10 /usr/sbin/httpd -k start 1481766 1276780 nobody 18328 0.1 S 01:12 /usr/sbin/httpd -k start 1481832 1276780 nobody 18280 0.0 S 01:10 /usr/sbin/httpd -k start 1483236 1483227 root 18232 0.3 S 00:03 /usr/local/cpanel/bin/dcpumon 1481764 1276780 nobody 18156 0.0 S 01:12 /usr/sbin/httpd -k start 1481840 1276780 nobody 18120 0.0 S 01:10 /usr/sbin/httpd -k start 1481762 1276780 nobody 18052 0.0 S 01:12 /usr/sbin/httpd -k start 185104 2431 netdata 17808 2.1 Sl 9-09:36:29 /usr/libexec/netdata/plugins.d/apps.plugin 1 1481823 1276780 nobody 17244 0.0 S 01:10 /usr/sbin/httpd -k start 1481844 1276780 nobody 16968 0.1 S 01:10 /usr/sbin/httpd -k start 1478339 1276780 nobody 16508 0.0 S 07:40 /usr/sbin/httpd -k start 1470084 1471 root 16420 0.0 S 20:03 cPhulkd - dbprocessor 1481801 1276780 nobody 16416 0.0 S 01:11 /usr/sbin/httpd -k start 1481849 1276780 nobody 16160 0.0 S 01:10 /usr/sbin/httpd -k start 1471 1 root 15676 0.0 Ss 53-20:00:10 cPhulkd - processor 1474875 1276780 nobody 15276 0.0 S 13:37 /usr/sbin/httpd -k start 1480223 1276780 nobody 14600 0.0 S 04:10 /usr/sbin/httpd -k start 1204 1 zabbix 14492 0.2 Ssl 53-20:00:11 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1481549 1276780 nobody 13744 0.0 S 01:23 /usr/sbin/httpd -k start 1482747 1471 root 13720 0.0 S 00:35 cPhulkd - processor - http socket 1483137 1471 root 13376 0.0 S 00:09 cPhulkd - processor - http socket 1483138 1471 root 13376 0.0 S 00:09 cPhulkd - processor - http socket 1481824 1276780 nobody 13164 0.0 S 01:10 /usr/sbin/httpd -k start 1480871 1276780 nobody 13068 0.0 S 02:50 /usr/sbin/httpd -k start 1194867 3828812 kurri 12556 0.0 S 07:47:14 dovecot/imap 1441358 3828812 infinium 12432 0.0 S 01:09:02 dovecot/imap 1483139 1471 root 12388 0.0 S 00:09 cPhulkd - processor - http socket 1483187 3828812 kurri 12172 0.0 S 00:05 dovecot/imap 1477385 3828812 infinium 12140 0.0 S 09:26 dovecot/imap 1481057 3828812 infinium 12100 0.0 S 02:24 dovecot/imap 1481230 2111716 root 11544 0.0 S 02:02 /usr/sbin/exim -q 1483364 1276780 nobody 11324 0.0 S 00:00 /usr/sbin/httpd -k start 1276780 1 root 11244 0.0 Ss 16-14:38:46 /usr/sbin/httpd -k start 1482595 3828812 root 10912 0.0 S 00:49 dovecot/auth -w 3668761 3828812 kurri 10808 0.0 S 1-19:55:50 dovecot/imap 2107664 1 named 10116 0.0 Ssl 3-03:47:25 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 23042085 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 161 speedlin/speedlinefencing.com.au-ssl_log 128 evolution/portal.evolutionerp.com.au-ssl_log 19 (total vhosts taking traffic: 3) --- top client IPs across all vhosts (last 3 min) --- 143 136.108.66.146 128 20.106.102.5 19 203.54.180.238 3 2603:3001:34a1:8000:5cba:6501:7557:265a 2 188.245.49.234 2 114.119.130.40 1 66.42.61.105 1 5.161.69.178 1 5.161.106.94 1 49.13.217.108 1 40.88.21.235 1 20.226.7.189 1 188.245.61.191 1 178.156.128.204 1 114.119.146.16 --- top request paths across all vhosts (last 3 min) --- 19 GET /heartbeat.php 9 GET / 5 GET /store/custom-shapeshifter/ 4 POST /wp-load.php 4 GET /dashboard 3 POST /v1/graphql 3 POST /graphql 3 POST /api/graphql 3 POST / 3 GET /wp-json 3 GET /user/login 3 GET /signin 3 GET /rclone.conf 3 GET /manage 3 GET /login 3 GET /.git/HEAD 3 GET /.git-credentials 3 GET /.git/config 3 GET /console 3 GET /auth/login --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 9 GET / 5 GET /store/custom-shapeshifter/ 4 POST /wp-load.php 4 GET /dashboard 3 POST /v1/graphql 3 POST /graphql 3 POST /api/graphql 3 POST / 3 GET /wp-json 3 GET /user/login 3 GET /signin 3 GET /rclone.conf -- last 10 requests -- 114.119.130.40 - - [22/Aug/2026:06:09:21 +1000] "GET /store/custom-shapeshifter/?wcpr_rating=2&wcpr_verified=1&wcpr_page=2 HTTP/1.1" 404 30651 "https://madalice.com.au/store/custom-shapeshifter/?wcpr_rating=4&wcpr_verifi 5.161.69.178 - - [22/Aug/2026:06:09:22 +1000] "POST /wp-load.php?cdac8b=56498 HTTP/1.1" 200 1 "https://madalice.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 178.156.128.204 - - [22/Aug/2026:06:09:25 +1000] "POST /wp-load.php?14047b=50844 HTTP/1.1" 200 1 "https://madalice.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0 5.161.106.94 - - [22/Aug/2026:06:09:28 +1000] "POST /index.php?b96a1f=60126 HTTP/1.1" 200 36635 "https://madalice.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0. 66.42.61.105 - - [22/Aug/2026:06:09:32 +1000] "POST /?b63024=64748 HTTP/1.1" 200 36633 "https://madalice.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/ 188.245.49.234 - - [22/Aug/2026:06:09:36 +1000] "POST /wp-load.php?686866=85168 HTTP/1.1" 200 1 "https://madalice.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0. 188.245.61.191 - - [22/Aug/2026:06:09:39 +1000] "POST /wp-load.php?9bfe48=39515 HTTP/1.1" 200 1 "https://madalice.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0. 49.13.217.108 - - [22/Aug/2026:06:09:42 +1000] "POST /index.php?41ac5e=8447 HTTP/1.1" 200 36638 "https://madalice.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0. 188.245.49.234 - - [22/Aug/2026:06:09:45 +1000] "POST /?d22b1e=71092 HTTP/1.1" 200 36630 "https://madalice.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safar 114.119.140.234 - - [22/Aug/2026:06:09:46 +1000] "GET /store/custom-shapeshifter/?wcpr_rating=1&rating=4&wcpr_verified=1&wcpr_page=4 HTTP/1.1" 404 30655 "https://madalice.com.au/store/custom-shapeshifter/?wcpr_rating=1&r == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 2 GET /wp.php 1 GET /yanz.php 1 GET /xxx.php 1 GET /x.php 1 GET /xper1.php 1 GET /xex.php 1 GET /wp-xx.php 1 GET /wp-the.php 1 GET /wp-slss.php 1 GET /wp-sing.php 1 GET /wp-login.php 1 GET /wplogbak.php -- last 10 requests -- 20.106.102.5 - - [22/Aug/2026:06:09:56 +1000] "GET /t.php HTTP/1.1" 404 5750 "-" "-" 20.106.102.5 - - [22/Aug/2026:06:09:56 +1000] "GET /manage.php HTTP/1.1" 404 5750 "-" "-" 20.106.102.5 - - [22/Aug/2026:06:09:56 +1000] "GET /011i.php HTTP/1.1" 404 5750 "-" "-" 20.106.102.5 - - [22/Aug/2026:06:09:57 +1000] "GET /wp-includes/images/wlw/wp-login.php HTTP/1.1" 404 5750 "-" "-" 20.106.102.5 - - [22/Aug/2026:06:09:57 +1000] "GET /wp-admin/network/shell.php HTTP/1.1" 404 5750 "-" "-" 20.106.102.5 - - [22/Aug/2026:06:09:57 +1000] "GET /item.php HTTP/1.1" 404 5750 "-" "-" 20.106.102.5 - - [22/Aug/2026:06:09:57 +1000] "GET /vxrl.php HTTP/1.1" 404 5750 "-" "-" 20.106.102.5 - - [22/Aug/2026:06:09:58 +1000] "GET /wp-admin/chosen.php HTTP/1.1" 404 5750 "-" "-" 20.106.102.5 - - [22/Aug/2026:06:09:58 +1000] "GET /wp-includes/index.php HTTP/1.1" 404 5750 "-" "-" 20.106.102.5 - - [22/Aug/2026:06:09:58 +1000] "GET /about/function.php HTTP/1.1" 404 5750 "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 19 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [22/Aug/2026:06:08:43 +1000] "GET /heartbeat.php?sentAt=1787342923&bytes=106,136,176,75&_=1787316952880 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [22/Aug/2026:06:08:51 +1000] "GET /heartbeat.php?sentAt=1787342930&bytes=106,136,176,82&_=1787283561992 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [22/Aug/2026:06:08:54 +1000] "GET /heartbeat.php?sentAt=1787342933&bytes=106,136,176,85&_=1787316952881 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [22/Aug/2026:06:09:00 +1000] "GET /heartbeat.php?sentAt=1787342940&bytes=106,136,176,92&_=1787283561993 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [22/Aug/2026:06:09:03 +1000] "GET /heartbeat.php?sentAt=1787342943&bytes=106,136,176,95&_=1787316952882 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [22/Aug/2026:06:09:10 +1000] "GET /heartbeat.php?sentAt=1787342950&bytes=106,136,176,102&_=1787283561994 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [22/Aug/2026:06:09:13 +1000] "GET /heartbeat.php?sentAt=1787342953&bytes=106,136,176,105&_=1787316952883 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [22/Aug/2026:06:09:20 +1000] "GET /heartbeat.php?sentAt=1787342960&bytes=106,136,176,112&_=1787283561995 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [22/Aug/2026:06:09:23 +1000] "GET /heartbeat.php?sentAt=1787342963&bytes=106,136,176,115&_=1787316952884 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [22/Aug/2026:06:09:30 +1000] "GET /heartbeat.php?sentAt=1787342970&bytes=106,136,176,122&_=1787283561996 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 --- last 30 samples (run-up to this incident) --- 2026-08-22 06:07:33 L1=0.74 run=1 blk=0 avail=6735 (57.4%) swpO=0 conn=2 myRSS=2483 php=0 phpRSS=0 ap=16 tcp=24 topuser=- 2026-08-22 06:07:40 L1=0.86 run=2 blk=0 avail=6591 (56.2%) swpO=0 conn=2 myRSS=2483 php=2 phpRSS=196 ap=15 tcp=25 topuser=olympic 2026-08-22 06:07:43 L1=0.86 run=2 blk=0 avail=6651 (56.7%) swpO=2 conn=2 myRSS=2483 php=0 phpRSS=0 ap=15 tcp=26 topuser=- 2026-08-22 06:07:50 L1=0.73 run=1 blk=0 avail=6726 (57.3%) swpO=2 conn=2 myRSS=2483 php=1 phpRSS=40 ap=15 tcp=25 topuser=evolution 2026-08-22 06:07:53 L1=0.73 run=2 blk=0 avail=6473 (55.2%) swpO=0 conn=2 myRSS=2483 php=2 phpRSS=322 ap=15 tcp=28 topuser=evolution 2026-08-22 06:08:01 L1=0.61 run=2 blk=0 avail=6725 (57.3%) swpO=0 conn=2 myRSS=2483 php=1 phpRSS=40 ap=15 tcp=24 topuser=evolution 2026-08-22 06:08:03 L1=0.61 run=2 blk=0 avail=6716 (57.3%) swpO=0 conn=2 myRSS=2483 php=0 phpRSS=0 ap=15 tcp=25 topuser=- 2026-08-22 06:08:11 L1=0.52 run=1 blk=0 avail=6708 (57.2%) swpO=0 conn=2 myRSS=2483 php=1 phpRSS=40 ap=15 tcp=23 topuser=evolution 2026-08-22 06:08:13 L1=0.52 run=1 blk=0 avail=6721 (57.3%) swpO=0 conn=1 myRSS=2483 php=0 phpRSS=0 ap=15 tcp=23 topuser=- 2026-08-22 06:08:21 L1=0.44 run=1 blk=0 avail=6704 (57.2%) swpO=0 conn=2 myRSS=2483 php=1 phpRSS=40 ap=15 tcp=24 topuser=evolution 2026-08-22 06:08:23 L1=0.44 run=2 blk=0 avail=6569 (56.0%) swpO=0 conn=1 myRSS=2483 php=1 phpRSS=179 ap=15 tcp=25 topuser=madalice 2026-08-22 06:08:31 L1=0.53 run=5 blk=0 avail=6353 (54.2%) swpO=0 conn=7 myRSS=2483 php=6 phpRSS=540 ap=16 tcp=29 topuser=evolution 2026-08-22 06:08:33 L1=0.53 run=3 blk=0 avail=6702 (57.1%) swpO=0 conn=1 myRSS=2483 php=0 phpRSS=0 ap=16 tcp=27 topuser=- 2026-08-22 06:08:41 L1=0.53 run=2 blk=0 avail=6687 (57.0%) swpO=0 conn=7 myRSS=2483 php=0 phpRSS=0 ap=18 tcp=40 topuser=- 2026-08-22 06:08:43 L1=0.53 run=1 blk=0 avail=6612 (56.4%) swpO=0 conn=1 myRSS=2483 php=0 phpRSS=0 ap=30 tcp=41 topuser=- 2026-08-22 06:08:51 L1=0.45 run=1 blk=0 avail=6590 (56.2%) swpO=0 conn=7 myRSS=2483 php=1 phpRSS=40 ap=31 tcp=65 topuser=evolution 2026-08-22 06:08:53 L1=0.45 run=14 blk=0 avail=5425 (46.3%) swpO=0 conn=1 myRSS=2483 php=11 phpRSS=1392 ap=43 tcp=68 topuser=madalice 2026-08-22 06:09:01 L1=3.95 run=29 blk=0 avail=3941 (33.6%) swpO=779 conn=26 myRSS=2467 php=26 phpRSS=2937 ap=86 tcp=61 topuser=madalice 2026-08-22 06:09:03 L1=3.95 run=34 blk=0 avail=3100 (26.4%) swpO=3698 conn=26 myRSS=2426 php=28 phpRSS=4089 ap=84 tcp=60 topuser=madalice 2026-08-22 06:09:14 L1=7.39 run=23 blk=1 avail=3548 (30.3%) swpO=2171 conn=18 myRSS=2414 php=19 phpRSS=3403 ap=74 tcp=71 topuser=madalice 2026-08-22 06:09:22 L1=7.88 run=4 blk=0 avail=6334 (54.0%) swpO=2527 conn=3 myRSS=2415 php=2 phpRSS=259 ap=65 tcp=49 topuser=madalice 2026-08-22 06:09:24 L1=7.88 run=4 blk=0 avail=6444 (54.9%) swpO=0 conn=18 myRSS=2415 php=2 phpRSS=150 ap=63 tcp=42 topuser=evolution 2026-08-22 06:09:32 L1=6.82 run=2 blk=0 avail=6564 (56.0%) swpO=0 conn=3 myRSS=2415 php=1 phpRSS=68 ap=55 tcp=33 topuser=madalice 2026-08-22 06:09:34 L1=6.82 run=2 blk=1 avail=6416 (54.7%) swpO=0 conn=18 myRSS=2415 php=2 phpRSS=245 ap=53 tcp=36 topuser=madalice 2026-08-22 06:09:42 L1=5.85 run=3 blk=0 avail=6584 (56.1%) swpO=0 conn=2 myRSS=2415 php=1 phpRSS=80 ap=45 tcp=38 topuser=madalice 2026-08-22 06:09:44 L1=5.85 run=2 blk=0 avail=6451 (55.0%) swpO=0 conn=18 myRSS=2415 php=2 phpRSS=260 ap=43 tcp=36 topuser=madalice 2026-08-22 06:09:53 L1=4.95 run=2 blk=0 avail=6704 (57.2%) swpO=0 conn=2 myRSS=2415 php=0 phpRSS=0 ap=35 tcp=34 topuser=- 2026-08-22 06:09:54 L1=4.95 run=1 blk=0 avail=6703 (57.1%) swpO=0 conn=18 myRSS=2415 php=1 phpRSS=40 ap=33 tcp=35 topuser=evolution 2026-08-22 06:10:03 L1=4.19 run=2 blk=0 avail=6736 (57.4%) swpO=0 conn=2 myRSS=2415 php=0 phpRSS=0 ap=26 tcp=43 topuser=- 2026-08-22 06:10:04 L1=4.19 run=2 blk=0 avail=6660 (56.8%) swpO=0 conn=18 myRSS=2415 php=2 phpRSS=132 ap=27 tcp=48 topuser=evolution