INCIDENT 2026-08-22 11:15:03 trigger: php_rss=1887MB ================================================================== load: 2.41 1.68 1.29 15/708 1668534 ncpu:10 mem_avail: 5039MB/11729MB (43.0%) swap_used:3722MB swapout:0/s blocked(D):0 running:16 iowait:0.0% steal:0.0% php: 14 procs / 1887MB heaviest user: madalice (13 procs, 1819MB) apache: 78 procs tcp_estab: 73 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2349 madalice 11 1586 nobody 77 1107 root 255 956 netdata 8 252 evolution 9 94 mailman 20 93 cpanellogin 1 67 dovenull 6 26 mailnull 4 20 wp-toolkit 6 17 zabbix 1 14 kurri 1 10 named 1 9 dovecot 3 7 nscd 1 6 cpanelconnecttrack 1 3 dbus 1 2 polkitd 1 1 rpc 1 0 --- php workers by user --- USER PROCS RSS_MB madalice 11 1412 evolution 1 68 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 2746 MB Active(file): 1399 MB Inactive(file): 781 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 401 MB CommitLimit: 9960 MB Committed_AS: 9663 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1297509 root 10:03:47 2660 /usr/bin/imunify-agent-proxy 1668271 root 00:03 1256 /bin/sh -c bash -c "sleep $((RANDOM % 60))" ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2406004 10.8 Ssl 7-03:24:28 /usr/sbin/mariadbd 1668251 1668236 madalice 266824 76.3 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1668254 1668243 madalice 231768 70.3 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 200948 0.0 Ss 7-03:24:31 /usr/lib/systemd/systemd-journald 1220 1 netdata 197544 2.5 Ssl 54-01:05:10 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1353013 1343371 root 185920 0.0 S 08:36:41 spamd child 1668466 1662907 madalice 173800 149 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1668491 1668338 madalice 105248 0.0 S 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1668495 1668346 madalice 103568 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1668494 1668344 madalice 102928 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1343371 1 root 88416 0.0 Ss 08:51:40 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1668493 1668342 madalice 77440 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353014 1343371 root 76892 0.0 S 08:36:41 spamd child 1668504 1668359 madalice 76040 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1668496 1668341 madalice 75204 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1668330 1668259 evolution 70704 10.0 Ss 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 1651764 1353308 cpanellogin 69260 0.0 S 28:01 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 1668252 1668234 madalice 65748 77.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2223 1201 root 54084 0.0 Sl 54-01:05:09 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 40488 0.0 Ss 31-08:33:40 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 35184 0.1 Sl 54-01:05:05 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 34560 0.1 Ss 54-01:05:09 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1668563 1353308 root 34224 0.0 S 00:00 webmaild - serving 127.0.0.1 1342210 1 root 23756 0.0 Ss 08:52:40 lfd - sleeping 1463 1 root 23252 0.0 Ss 54-01:05:09 tailwatchd 1662907 1276780 nobody 21724 0.0 S 07:02 /usr/sbin/httpd -k start 1663840 1276780 nobody 21184 0.0 S 05:44 /usr/sbin/httpd -k start 1663511 1276780 nobody 20936 0.0 S 06:03 /usr/sbin/httpd -k start 1663739 1276780 nobody 20812 0.0 S 05:48 /usr/sbin/httpd -k start 1663881 1276780 nobody 20608 0.0 S 05:43 /usr/sbin/httpd -k start 1663907 1276780 nobody 20348 0.0 S 05:43 /usr/sbin/httpd -k start 1663567 1276780 nobody 20120 0.0 S 06:02 /usr/sbin/httpd -k start 1667040 1276780 nobody 20044 0.0 S 01:55 /usr/sbin/httpd -k start 1663828 1276780 nobody 20028 0.0 S 05:44 /usr/sbin/httpd -k start 1666597 1276780 nobody 19324 0.0 S 02:15 /usr/sbin/httpd -k start 1663882 1276780 nobody 19308 0.0 S 05:43 /usr/sbin/httpd -k start 1663910 1276780 nobody 18480 0.0 S 05:43 /usr/sbin/httpd -k start 1668356 1668352 root 18172 0.5 S 00:02 /usr/local/cpanel/bin/dcpumon 185104 2431 netdata 18040 2.1 Sl 9-14:41:28 /usr/libexec/netdata/plugins.d/apps.plugin 1 1668232 1276780 nobody 17824 0.3 S 00:03 /usr/sbin/httpd -k start 1668234 1276780 nobody 17804 0.0 S 00:03 /usr/sbin/httpd -k start 1668241 1276780 nobody 17804 0.6 S 00:03 /usr/sbin/httpd -k start 1665993 1276780 nobody 17768 0.0 S 03:20 /usr/sbin/httpd -k start 1668239 1276780 nobody 16388 0.0 S 00:03 /usr/sbin/httpd -k start 1668235 1276780 nobody 16344 0.0 S 00:03 /usr/sbin/httpd -k start 1471 1 root 16312 0.0 Ss 54-01:05:09 cPhulkd - processor 1668229 1276780 nobody 16204 0.0 S 00:03 /usr/sbin/httpd -k start 1591218 1471 root 16064 0.0 S 02:12:59 cPhulkd - dbprocessor 1668237 1276780 nobody 16036 0.0 S 00:03 /usr/sbin/httpd -k start 1668157 1276780 nobody 15944 0.1 S 00:06 /usr/sbin/httpd -k start 1668202 1276780 nobody 15924 0.0 S 00:04 /usr/sbin/httpd -k start 1668158 1276780 nobody 15896 0.1 S 00:06 /usr/sbin/httpd -k start 1668204 1276780 nobody 15884 0.2 S 00:04 /usr/sbin/httpd -k start 1668143 1276780 nobody 15880 0.0 S 00:07 /usr/sbin/httpd -k start 1668209 1276780 nobody 15876 0.0 S 00:04 /usr/sbin/httpd -k start 1668344 1276780 nobody 15864 0.0 S 00:02 /usr/sbin/httpd -k start 1668179 1276780 nobody 15860 0.0 S 00:05 /usr/sbin/httpd -k start 1668338 1276780 nobody 15820 0.0 S 00:02 /usr/sbin/httpd -k start 1668180 1276780 nobody 15804 0.0 S 00:05 /usr/sbin/httpd -k start 1668243 1276780 nobody 15804 0.0 S 00:03 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 23080891 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 23080866 | madalice_wp | madalice_wp | Query | 0 | closing tables | UPDATE `AMuqf6qZ_options` SET `option_value` = 'a:530:{s:24:\"^wc-auth/v([1]{1})/(.*)?\";s:63:\"index.php?wc-auth-version=$matches[1]&wc-auth-route=$matches[2]\";s:21:\"^wc/file/transient/?$\";s:33:\"index.php?wc-transient-file-name=\";s:24:\"^wc/file/transient/(.+)$\";s:44:\"index.php?wc-transient- | +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min vinesit/vinesit.com.au-ssl_log 112 kurri/kurrimotorinn.com.au-ssl_log 111 madalice/madalice.com.au-ssl_log 81 aaa/aaadownunder.com.au-ssl_log 30 evolution/portal.evolutionerp.com.au-ssl_log 5 evolution/my.evolutionerp.com.au-ssl_log 4 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 112 20.197.195.76 86 4.232.94.69 76 34.74.82.203 25 20.151.141.175 15 82.102.18.220 13 149.50.107.21 5 203.54.180.238 2 40.77.167.79 2 118.127.40.55 1 216.244.66.236 1 207.46.13.141 1 157.55.39.51 1 114.119.159.70 1 114.119.146.16 1 114.119.143.14 --- top request paths across all vhosts (last 3 min) --- 5 GET /wp-admin/index.php 5 GET /heartbeat.php 5 GET / 4 POST /wp-login.php 4 GET /wp-login.php 4 GET /store/custom-hawthorn-hawks-kids/ 4 GET /index.php 4 GET /403.php 3 GET /css.php 2 POST /wp-cron.php 2 GET /xx.php 2 GET /wp-trackback.php 2 GET /wp-includes/assets/index.php 2 GET /wp-content/plugins/index.php 2 GET /wp-content/plugins/admin.php 2 GET /wp-admin/maint/index.php 2 GET /wp-admin/css/colors/midnight/about.php 2 GET /wp-admin/css/colors/blue/ 2 GET /wp-admin/css/ 2 GET /.well-known/acme-challenge/index.php --- busiest 3 vhosts: top paths + last 10 requests --- == vinesit/vinesit.com.au-ssl_log == -- top paths -- 2 GET /css.php 2 GET /cong.php 2 GET /404.php 2 GET /403.php 1 GET /z60.php 1 GET /xx.php 1 GET /x.php 1 GET /ww1.php 1 GET /wsd.php 1 GET /wrt.php 1 GET /wp-trackback.php 1 GET /wp-includes/style-engine/about.php -- last 10 requests -- 20.197.195.76 - - [22/Aug/2026:11:14:07 +1000] "GET /nox.php HTTP/1.1" 401 36 "-" "-" 20.197.195.76 - - [22/Aug/2026:11:14:08 +1000] "GET /file48.php HTTP/1.1" 401 36 "-" "-" 20.197.195.76 - - [22/Aug/2026:11:14:08 +1000] "GET /info.php HTTP/1.1" 401 36 "-" "-" 20.197.195.76 - - [22/Aug/2026:11:14:09 +1000] "GET /class9.php HTTP/1.1" 401 36 "-" "-" 20.197.195.76 - - [22/Aug/2026:11:14:09 +1000] "GET /la.php HTTP/1.1" 401 36 "-" "-" 20.197.195.76 - - [22/Aug/2026:11:14:10 +1000] "GET /bless11.php HTTP/1.1" 401 36 "-" "-" 20.197.195.76 - - [22/Aug/2026:11:14:11 +1000] "GET /ccou.php HTTP/1.1" 401 36 "-" "-" 20.197.195.76 - - [22/Aug/2026:11:14:11 +1000] "GET /ton.php HTTP/1.1" 401 36 "-" "-" 20.197.195.76 - - [22/Aug/2026:11:14:12 +1000] "GET /403.php HTTP/1.1" 401 36 "-" "-" 20.197.195.76 - - [22/Aug/2026:11:14:13 +1000] "GET /file9.php HTTP/1.1" 401 36 "-" "-" == kurri/kurrimotorinn.com.au-ssl_log == -- top paths -- 2 GET /403.php 1 GET /zoom1.php 1 GET /xx.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /xb.php 1 GET /xaz.php 1 GET /wtz.php 1 GET /ws.php 1 GET /ws81.php 1 GET /ws77.php 1 GET /ws37.php -- last 10 requests -- 4.232.94.69 - - [22/Aug/2026:11:14:47 +1000] "GET /wp-admin/css/index.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.94.69 - - [22/Aug/2026:11:14:47 +1000] "GET /wp-includes/css/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.94.69 - - [22/Aug/2026:11:14:47 +1000] "GET /xx.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.94.69 - - [22/Aug/2026:11:14:48 +1000] "GET /wp-content/about.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.94.69 - - [22/Aug/2026:11:14:48 +1000] "GET /wp-includes/assets/index.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.94.69 - - [22/Aug/2026:11:14:48 +1000] "GET /wp-the.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.94.69 - - [22/Aug/2026:11:14:49 +1000] "GET /ws81.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.94.69 - - [22/Aug/2026:11:14:49 +1000] "GET /3.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.94.69 - - [22/Aug/2026:11:14:49 +1000] "GET /a1.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.94.69 - - [22/Aug/2026:11:14:50 +1000] "GET /ca5.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 5 GET / 4 GET /store/custom-hawthorn-hawks-kids/ 2 GET /rclone.conf 2 GET /.git/HEAD 2 GET /.git/config 2 GET /.aws/credentials 2 GET /.aws/config 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 1 GET /z9x8c7v6b5-debug-trigger-webmail.madalice.com.au -- last 10 requests -- 34.74.82.203 - - [22/Aug/2026:11:15:03 +1000] "GET /config/settings.py HTTP/1.1" 404 3496 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.74.82.203 - - [22/Aug/2026:11:15:03 +1000] "GET /terraform.tfstate HTTP/1.1" 404 3496 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.74.82.203 - - [22/Aug/2026:11:15:03 +1000] "GET /docker-compose.yaml HTTP/1.1" 401 12592 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.74.82.203 - - [22/Aug/2026:11:15:00 +1000] "GET /user/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.74.82.203 - - [22/Aug/2026:11:15:04 +1000] "GET /.ssh/id_rsa HTTP/1.1" 403 13 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.74.82.203 - - [22/Aug/2026:11:15:04 +1000] "GET /core/settings.py HTTP/1.1" 404 3496 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.74.82.203 - - [22/Aug/2026:11:15:04 +1000] "GET /.ssh/id_ed25519 HTTP/1.1" 403 13 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.74.82.203 - - [22/Aug/2026:11:15:04 +1000] "GET /.ssh/id_ecdsa HTTP/1.1" 403 13 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.74.82.203 - - [22/Aug/2026:11:15:04 +1000] "GET /app/settings.py HTTP/1.1" 404 3496 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.74.82.203 - - [22/Aug/2026:11:15:05 +1000] "GET /graphql HTTP/1.1" 404 3496 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" --- last 30 samples (run-up to this incident) --- 2026-08-22 11:12:40 L1=1.09 run=1 blk=0 avail=7066 (60.2%) swpO=0 conn=2 myRSS=2349 php=1 phpRSS=39 ap=16 tcp=23 topuser=evolution 2026-08-22 11:12:43 L1=1.09 run=2 blk=0 avail=7019 (59.8%) swpO=0 conn=2 myRSS=2349 php=1 phpRSS=87 ap=16 tcp=23 topuser=aaa 2026-08-22 11:12:50 L1=0.92 run=4 blk=0 avail=6934 (59.1%) swpO=0 conn=2 myRSS=2349 php=3 phpRSS=226 ap=17 tcp=24 topuser=alison 2026-08-22 11:12:53 L1=0.92 run=3 blk=0 avail=7063 (60.2%) swpO=0 conn=1 myRSS=2349 php=1 phpRSS=43 ap=17 tcp=25 topuser=alison 2026-08-22 11:13:00 L1=0.85 run=3 blk=0 avail=7053 (60.1%) swpO=0 conn=2 myRSS=2349 php=1 phpRSS=39 ap=17 tcp=28 topuser=evolution 2026-08-22 11:13:03 L1=0.85 run=3 blk=0 avail=7032 (60.0%) swpO=0 conn=1 myRSS=2349 php=0 phpRSS=0 ap=17 tcp=27 topuser=- 2026-08-22 11:13:10 L1=0.88 run=2 blk=0 avail=6828 (58.2%) swpO=0 conn=3 myRSS=2349 php=2 phpRSS=267 ap=18 tcp=32 topuser=corpkicks 2026-08-22 11:13:13 L1=0.88 run=1 blk=0 avail=7048 (60.1%) swpO=0 conn=1 myRSS=2349 php=0 phpRSS=0 ap=19 tcp=29 topuser=- 2026-08-22 11:13:20 L1=0.74 run=1 blk=0 avail=7060 (60.2%) swpO=0 conn=3 myRSS=2349 php=1 phpRSS=39 ap=17 tcp=25 topuser=evolution 2026-08-22 11:13:23 L1=0.74 run=2 blk=0 avail=7065 (60.2%) swpO=0 conn=1 myRSS=2349 php=0 phpRSS=0 ap=17 tcp=25 topuser=- 2026-08-22 11:13:30 L1=0.63 run=1 blk=0 avail=7056 (60.2%) swpO=0 conn=3 myRSS=2349 php=1 phpRSS=39 ap=17 tcp=27 topuser=evolution 2026-08-22 11:13:33 L1=0.63 run=1 blk=0 avail=7071 (60.3%) swpO=0 conn=1 myRSS=2349 php=0 phpRSS=0 ap=17 tcp=23 topuser=- 2026-08-22 11:13:40 L1=0.53 run=3 blk=0 avail=7020 (59.9%) swpO=0 conn=3 myRSS=2349 php=2 phpRSS=88 ap=17 tcp=28 topuser=aaa 2026-08-22 11:13:43 L1=0.53 run=4 blk=0 avail=6981 (59.5%) swpO=0 conn=1 myRSS=2349 php=1 phpRSS=79 ap=17 tcp=30 topuser=madalice 2026-08-22 11:13:50 L1=0.52 run=2 blk=0 avail=7050 (60.1%) swpO=0 conn=3 myRSS=2349 php=1 phpRSS=39 ap=17 tcp=22 topuser=evolution 2026-08-22 11:13:53 L1=0.52 run=1 blk=0 avail=7060 (60.2%) swpO=0 conn=1 myRSS=2349 php=0 phpRSS=0 ap=17 tcp=21 topuser=- 2026-08-22 11:14:01 L1=0.44 run=1 blk=0 avail=7060 (60.2%) swpO=0 conn=3 myRSS=2349 php=1 phpRSS=40 ap=16 tcp=22 topuser=evolution 2026-08-22 11:14:03 L1=0.44 run=2 blk=0 avail=6988 (59.6%) swpO=0 conn=1 myRSS=2349 php=1 phpRSS=104 ap=16 tcp=26 topuser=alison 2026-08-22 11:14:11 L1=0.59 run=1 blk=0 avail=7050 (60.1%) swpO=0 conn=2 myRSS=2349 php=1 phpRSS=40 ap=16 tcp=21 topuser=evolution 2026-08-22 11:14:13 L1=0.59 run=1 blk=0 avail=7062 (60.2%) swpO=0 conn=1 myRSS=2349 php=0 phpRSS=0 ap=16 tcp=22 topuser=- 2026-08-22 11:14:21 L1=0.58 run=1 blk=0 avail=7050 (60.1%) swpO=0 conn=2 myRSS=2349 php=1 phpRSS=40 ap=16 tcp=23 topuser=evolution 2026-08-22 11:14:23 L1=0.58 run=1 blk=0 avail=7067 (60.3%) swpO=0 conn=1 myRSS=2349 php=0 phpRSS=0 ap=16 tcp=24 topuser=- 2026-08-22 11:14:31 L1=0.49 run=1 blk=0 avail=7049 (60.1%) swpO=0 conn=2 myRSS=2349 php=1 phpRSS=40 ap=16 tcp=27 topuser=evolution 2026-08-22 11:14:33 L1=0.49 run=2 blk=0 avail=7039 (60.0%) swpO=0 conn=1 myRSS=2349 php=1 phpRSS=52 ap=16 tcp=25 topuser=aaa 2026-08-22 11:14:41 L1=0.49 run=1 blk=0 avail=7048 (60.1%) swpO=0 conn=2 myRSS=2349 php=1 phpRSS=39 ap=16 tcp=20 topuser=evolution 2026-08-22 11:14:43 L1=0.49 run=2 blk=0 avail=6890 (58.7%) swpO=0 conn=1 myRSS=2349 php=1 phpRSS=209 ap=16 tcp=21 topuser=madalice 2026-08-22 11:14:51 L1=0.49 run=1 blk=0 avail=7051 (60.1%) swpO=0 conn=2 myRSS=2349 php=1 phpRSS=39 ap=16 tcp=20 topuser=evolution 2026-08-22 11:14:53 L1=0.49 run=2 blk=0 avail=7043 (60.1%) swpO=0 conn=1 myRSS=2349 php=1 phpRSS=59 ap=16 tcp=22 topuser=madalice 2026-08-22 11:15:01 L1=0.97 run=23 blk=0 avail=5990 (51.1%) swpO=0 conn=2 myRSS=2349 php=13 phpRSS=1224 ap=47 tcp=65 topuser=madalice 2026-08-22 11:15:03 L1=0.97 run=16 blk=0 avail=5039 (43.0%) swpO=0 conn=14 myRSS=2349 php=14 phpRSS=1887 ap=78 tcp=73 topuser=madalice