INCIDENT 2026-08-22 20:02:05 trigger: php_rss=1825MB ================================================================== load: 2.45 1.30 1.00 9/645 1955483 ncpu:10 mem_avail: 5282MB/11729MB (45.0%) swap_used:3407MB swapout:0/s blocked(D):0 running:8 iowait:0.0% steal:0.0% php: 13 procs / 1825MB heaviest user: customc (11 procs, 1614MB) apache: 21 procs tcp_estab: 43 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2535 customc 9 1260 root 242 861 nobody 20 336 netdata 8 257 madalice 1 153 mailman 20 93 alison 2 77 cpanellogin 1 74 mailnull 6 42 evolution 8 26 dovenull 6 26 wp-toolkit 6 20 zabbix 1 16 named 1 12 kurri 1 10 aaa 1 10 nscd 1 7 dovecot 3 7 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB customc 9 1176 madalice 1 155 alison 1 66 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4796 MB Active(file): 4127 MB Inactive(file): 713 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 436 MB CommitLimit: 9960 MB Committed_AS: 7746 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1297509 root 18:50:49 2660 /usr/bin/imunify-agent-proxy 1954011 root 02:04 1212 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2596384 10.4 Ssl 7-12:11:30 /usr/sbin/mariadbd 1220 1 netdata 198736 2.5 Ssl 54-09:52:12 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2575382 1 root 182728 0.0 Ss 7-12:11:33 /usr/lib/systemd/systemd-journald 1353014 1343371 root 167488 0.0 S 17:23:43 spamd child 1955439 1946615 madalice 166148 71.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1955443 1955352 customc 152348 62.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1955432 1954427 customc 145748 29.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1955435 1946648 customc 144832 28.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1955436 1953101 customc 144728 28.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1955434 1954191 customc 144256 28.5 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1955433 1954162 customc 140720 29.0 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1955453 1951780 customc 111516 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1343371 1 root 87200 0.0 Ss 17:38:42 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1846716 1343371 root 81612 0.0 S 03:20:24 spamd child 1935081 1353308 cpanellogin 76088 0.1 S 35:45 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 1955454 1934696 alison 72992 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2223 1201 root 55416 0.0 Sl 54-09:52:11 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42200 0.0 Ss 31-17:20:42 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 38564 0.1 Sl 54-09:52:07 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 34820 0.1 Ss 54-09:52:11 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1342210 1 root 24548 0.0 Ss 17:39:42 lfd - sleeping 1934696 1276780 nobody 23904 0.0 S 36:36 /usr/sbin/httpd -k start 1463 1 root 23508 0.0 Ss 54-09:52:11 tailwatchd 1951780 1276780 nobody 22004 0.0 S 06:31 /usr/sbin/httpd -k start 1946615 1276780 nobody 21936 0.0 S 15:03 /usr/sbin/httpd -k start 1946648 1276780 nobody 21892 0.0 S 15:01 /usr/sbin/httpd -k start 1952539 1276780 nobody 21468 0.0 S 04:50 /usr/sbin/httpd -k start 1953101 1276780 nobody 20808 0.0 S 03:25 /usr/sbin/httpd -k start 1954162 1276780 nobody 19756 0.0 S 02:03 /usr/sbin/httpd -k start 1952503 1276780 nobody 19256 0.0 S 04:52 /usr/sbin/httpd -k start 1955351 1276780 nobody 18552 0.2 S 00:10 /usr/sbin/httpd -k start 1955352 1276780 nobody 18244 0.2 S 00:10 /usr/sbin/httpd -k start 185104 2431 netdata 18044 2.1 Sl 9-23:28:30 /usr/libexec/netdata/plugins.d/apps.plugin 1 1954427 1276780 nobody 17988 0.0 S 01:42 /usr/sbin/httpd -k start 1954191 1276780 nobody 17960 0.0 S 02:02 /usr/sbin/httpd -k start 1955361 1276780 nobody 17780 0.1 S 00:09 /usr/sbin/httpd -k start 1955323 1276780 nobody 17716 0.1 S 00:11 /usr/sbin/httpd -k start 1954193 1276780 nobody 17276 0.0 S 02:02 /usr/sbin/httpd -k start 1954411 1276780 nobody 17228 0.0 S 01:44 /usr/sbin/httpd -k start 1204 1 zabbix 16852 0.2 Ssl 54-09:52:12 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1471 1 root 16340 0.0 Ss 54-09:52:11 cPhulkd - processor 1591218 1471 root 16244 0.0 S 11:00:01 cPhulkd - dbprocessor 1955359 1276780 nobody 15700 0.0 S 00:09 /usr/sbin/httpd -k start 1955201 2111716 mailnull 14768 0.0 S 00:30 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1955400 1471 root 14348 0.0 S 00:04 cPhulkd - processor - http socket 2107664 1 named 12860 0.0 Ssl 3-17:39:26 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1908021 3828812 alison 12316 0.0 S 01:22:48 dovecot/imap 1955450 1276780 nobody 11324 0.0 S 00:01 /usr/sbin/httpd -k start 1276780 1 root 11244 0.0 Rs 17-04:30:47 /usr/sbin/httpd -k start 1955042 3828812 aaa 11180 0.0 S 00:49 dovecot/quota-status -p postfix 1955049 3828812 root 10892 0.0 S 00:48 dovecot/auth -w 3668761 3828812 kurri 10808 0.0 S 2-09:47:51 dovecot/imap 2107879 1 root 10028 0.0 Ss 3-17:39:25 queueprocd - waiting up to 60s to process a task 1059098 3828812 dovenull 8096 0.0 S 9-04:29:17 dovecot/imap-login 1466 1 root 7756 0.0 Ss 54-09:52:11 dnsadmin - dormant mode 1059102 3828812 dovenull 7604 0.0 S 9-04:29:17 dovecot/imap-login 918817 27524 root 7568 0.0 Ss 1-04:48:08 sshd: evolution [priv] 1955399 2111716 mailnull 7388 0.0 S 00:04 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1955423 2111716 mailnull 7388 0.0 S 00:03 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2111078 1 nscd 7300 0.0 Ssl 3-17:39:15 /usr/sbin/nscd --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 23164638 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min olympic/olympicfencing.com.au-ssl_log 130 alison/alisonarts.com.au-ssl_log 55 alison/alisonarts.com.au 40 infinium/infinium.net.au-ssl_log 30 kamcool/kamcool.com.au 21 candyfabcom/candyfab.com.au-ssl_log 20 evolution/my.evolutionerp.com.au-ssl_log 16 evolution/portal.evolutionerp.com.au-ssl_log 10 madalice/madalice.com.au-ssl_log 9 speedlin/speedlinefencing.com.au-ssl_log 3 corpkicks/corporatekicks.com.au-ssl_log 2 aaa/aaadownunder.com.au-ssl_log 1 cosgrovecreative/cosgrovecreative.com.au 1 (total vhosts taking traffic: 13) --- top client IPs across all vhosts (last 3 min) --- 130 20.151.141.175 94 68.155.154.236 30 158.158.100.150 21 143.244.57.123 20 143.244.57.86 14 175.36.227.212 10 203.54.180.238 4 51.15.217.215 3 118.127.40.55 1 52.167.144.204 1 43.135.145.77 1 40.77.167.18 1 34.196.51.17 1 2001:bc8:710:7c32:dc00:1ff:fe29:ff2f 1 161.153.60.147 --- top request paths across all vhosts (last 3 min) --- 30 GET /autodiscover/autodiscover.xml 10 GET /heartbeat.php 6 GET / 5 GET /app/ajax.php 3 POST /functions.php 3 GET /wp-content/themes/twentytwentytwo/index.php 3 GET /index.php 3 GET /css/index.php 3 GET /autoload_classmap.php 2 POST /wp-cron.php 2 GET /wpupex.php 2 GET /wp-login.php 2 GET /wp-includes/Text/Diff/Engine/upload.php 2 GET /wp-includes/Requests/about.php 2 GET /wp-includes/js/thickbox/index.php 2 GET /wp-includes/js/plupload/index.php 2 GET /wp-includes/js/jcrop/Jcrop.php 2 GET /wp-includes/js/crop/index.php 2 GET /wp-includes/blocks/query-pagination-numbers/index.php 2 GET /wp-includes/blocks/query-pagination-next/index.php --- busiest 3 vhosts: top paths + last 10 requests --- == olympic/olympicfencing.com.au-ssl_log == -- top paths -- 2 GET /css.php 2 GET /cong.php 2 GET /404.php 2 GET /403.php 1 GET /z60.php 1 GET /xx.php 1 GET /x.php 1 GET /xb.php 1 GET /xaz.php 1 GET /x50.php 1 GET /ww1.php 1 GET /wtz.php -- last 10 requests -- 20.151.141.175 - - [22/Aug/2026:20:00:58 +1000] "GET /xaz.php HTTP/1.1" 404 5749 "-" "-" 20.151.141.175 - - [22/Aug/2026:20:00:59 +1000] "GET /up4.php HTTP/1.1" 404 5749 "-" "-" 20.151.141.175 - - [22/Aug/2026:20:00:59 +1000] "GET /1aa.php HTTP/1.1" 404 5749 "-" "-" 20.151.141.175 - - [22/Aug/2026:20:01:00 +1000] "GET /elp.php HTTP/1.1" 404 5749 "-" "-" 20.151.141.175 - - [22/Aug/2026:20:01:00 +1000] "GET /wtz.php HTTP/1.1" 404 5749 "-" "-" 20.151.141.175 - - [22/Aug/2026:20:01:01 +1000] "GET /galex.php HTTP/1.1" 404 5749 "-" "-" 20.151.141.175 - - [22/Aug/2026:20:01:01 +1000] "GET /xb.php HTTP/1.1" 404 5749 "-" "-" 20.151.141.175 - - [22/Aug/2026:20:01:02 +1000] "GET /ova.php HTTP/1.1" 404 5749 "-" "-" 20.151.141.175 - - [22/Aug/2026:20:01:02 +1000] "GET /vx.php HTTP/1.1" 404 5749 "-" "-" 20.151.141.175 - - [22/Aug/2026:20:01:02 +1000] "GET /rh.php HTTP/1.1" 404 5749 "-" "-" == alison/alisonarts.com.au-ssl_log == -- top paths -- 1 POST / 1 GET /wpupex.php 1 GET /wp-login.php 1 GET /wp-includes/theme-compat/index.php 1 GET /wp-includes/theme-compat/ 1 GET /wp-includes/Text/Diff/Engine/upload.php 1 GET /wp-includes/Requests/about.php 1 GET /wp-includes/js/thickbox/index.php 1 GET /wp-includes/js/thickbox/ 1 GET /wp-includes/js/plupload/index.php 1 GET /wp-includes/js/plupload/ 1 GET /wp-includes/js/jcrop/Jcrop.php -- last 10 requests -- 68.155.154.236 - - [22/Aug/2026:20:01:18 +1000] "GET /dropdown.php HTTP/1.1" 404 49417 "-" "-" 68.155.154.236 - - [22/Aug/2026:20:01:20 +1000] "GET /museu/yhweq.php HTTP/1.1" 404 49417 "-" "-" 68.155.154.236 - - [22/Aug/2026:20:01:22 +1000] "GET /wp-includes/js/thickbox/index.php HTTP/1.1" 301 - "-" "-" 68.155.154.236 - - [22/Aug/2026:20:01:23 +1000] "GET /wp-includes/js/thickbox/ HTTP/1.1" 404 49417 "-" "-" 68.155.154.236 - - [22/Aug/2026:20:01:25 +1000] "GET /tinynologin.php HTTP/1.1" 404 49417 "-" "-" 68.155.154.236 - - [22/Aug/2026:20:01:27 +1000] "GET /wp-includes/js/jcrop/Jcrop.php HTTP/1.1" 404 49417 "-" "-" 68.155.154.236 - - [22/Aug/2026:20:01:29 +1000] "GET /wp-content/themes/twentytwentytwo/index.php HTTP/1.1" 200 - "-" "-" 68.155.154.236 - - [22/Aug/2026:20:01:30 +1000] "GET /wp-content/wp-plugins/aspose-pdf-importer/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 49417 "-" "-" 68.155.154.236 - - [22/Aug/2026:20:01:32 +1000] "GET /wp-admin/gQ2zxmHJ3RF.php HTTP/1.1" 404 49417 "-" "-" 68.155.154.236 - - [22/Aug/2026:20:01:34 +1000] "GET /wp-content/themes/twentytwentyfour/index.php HTTP/1.1" 301 - "-" "-" == alison/alisonarts.com.au == -- top paths -- 1 GET /wpupex.php 1 GET /wp-login.php 1 GET //wp-includes/theme-compat/index.php 1 GET /wp-includes/Text/Diff/Engine/upload.php 1 GET /wp-includes/Requests/about.php 1 GET /wp-includes/js/thickbox/index.php 1 GET /wp-includes/js/plupload/index.php 1 GET /wp-includes/js/jcrop/Jcrop.php 1 GET /wp-includes/js/crop/index.php 1 GET /wp-includes/blocks/query-pagination-numbers/index.php 1 GET /wp-includes/blocks/query-pagination-next/index.php 1 GET /wp-includes/blocks/post-comments-form/index.php -- last 10 requests -- 68.155.154.236 - - [22/Aug/2026:20:01:15 +1000] "GET /wpupex.php HTTP/1.1" 301 284 "-" "-" 68.155.154.236 - - [22/Aug/2026:20:01:17 +1000] "GET //dropdown.php HTTP/1.1" 301 286 "-" "-" 68.155.154.236 - - [22/Aug/2026:20:01:19 +1000] "GET /museu/yhweq.php HTTP/1.1" 301 289 "-" "-" 68.155.154.236 - - [22/Aug/2026:20:01:22 +1000] "GET /wp-includes/js/thickbox/index.php HTTP/1.1" 301 307 "-" "-" 68.155.154.236 - - [22/Aug/2026:20:01:25 +1000] "GET /tinynologin.php HTTP/1.1" 301 289 "-" "-" 68.155.154.236 - - [22/Aug/2026:20:01:27 +1000] "GET /wp-includes/js/jcrop/Jcrop.php HTTP/1.1" 301 304 "-" "-" 68.155.154.236 - - [22/Aug/2026:20:01:29 +1000] "GET /wp-content/themes/twentytwentytwo/index.php HTTP/1.1" 301 317 "-" "-" 68.155.154.236 - - [22/Aug/2026:20:01:30 +1000] "GET /wp-content/wp-plugins/aspose-pdf-importer/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 301 366 "-" "-" 68.155.154.236 - - [22/Aug/2026:20:01:32 +1000] "GET /wp-admin/gQ2zxmHJ3RF.php HTTP/1.1" 301 298 "-" "-" 68.155.154.236 - - [22/Aug/2026:20:01:34 +1000] "GET /wp-content/themes/twentytwentyfour/index.php HTTP/1.1" 301 318 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-22 19:59:40 L1=1.16 run=1 blk=0 avail=6754 (57.6%) swpO=1 conn=1 myRSS=2534 php=0 phpRSS=0 ap=17 tcp=21 topuser=- 2026-08-22 19:59:44 L1=1.07 run=3 blk=0 avail=6565 (56.0%) swpO=1 conn=1 myRSS=2534 php=2 phpRSS=249 ap=17 tcp=24 topuser=madalice 2026-08-22 19:59:50 L1=1.22 run=3 blk=0 avail=6657 (56.8%) swpO=0 conn=1 myRSS=2534 php=1 phpRSS=122 ap=17 tcp=22 topuser=alison 2026-08-22 19:59:54 L1=1.20 run=1 blk=0 avail=6745 (57.5%) swpO=0 conn=1 myRSS=2534 php=0 phpRSS=0 ap=17 tcp=25 topuser=- 2026-08-22 20:00:00 L1=1.19 run=1 blk=0 avail=6744 (57.5%) swpO=0 conn=1 myRSS=2534 php=0 phpRSS=0 ap=17 tcp=27 topuser=- 2026-08-22 20:00:04 L1=1.17 run=5 blk=0 avail=6237 (53.2%) swpO=0 conn=1 myRSS=2535 php=5 phpRSS=594 ap=24 tcp=36 topuser=madalice 2026-08-22 20:00:10 L1=1.16 run=2 blk=0 avail=6562 (56.0%) swpO=0 conn=1 myRSS=2535 php=3 phpRSS=218 ap=24 tcp=26 topuser=evolution 2026-08-22 20:00:14 L1=1.15 run=3 blk=0 avail=6578 (56.1%) swpO=0 conn=1 myRSS=2535 php=3 phpRSS=224 ap=20 tcp=27 topuser=evolution 2026-08-22 20:00:20 L1=1.13 run=2 blk=0 avail=6588 (56.2%) swpO=0 conn=4 myRSS=2535 php=3 phpRSS=216 ap=20 tcp=30 topuser=evolution 2026-08-22 20:00:24 L1=1.20 run=2 blk=0 avail=6546 (55.8%) swpO=0 conn=1 myRSS=2535 php=2 phpRSS=207 ap=24 tcp=29 topuser=alison 2026-08-22 20:00:30 L1=1.25 run=3 blk=0 avail=6433 (54.8%) swpO=0 conn=4 myRSS=2535 php=3 phpRSS=373 ap=22 tcp=29 topuser=madalice 2026-08-22 20:00:35 L1=1.25 run=2 blk=0 avail=6584 (56.1%) swpO=0 conn=3 myRSS=2535 php=2 phpRSS=196 ap=21 tcp=27 topuser=alison 2026-08-22 20:00:40 L1=1.21 run=3 blk=0 avail=6534 (55.7%) swpO=0 conn=4 myRSS=2535 php=3 phpRSS=283 ap=20 tcp=29 topuser=alison 2026-08-22 20:00:45 L1=1.21 run=1 blk=0 avail=6656 (56.7%) swpO=0 conn=3 myRSS=2535 php=2 phpRSS=115 ap=20 tcp=33 topuser=evolution 2026-08-22 20:00:50 L1=1.18 run=2 blk=0 avail=6586 (56.2%) swpO=2 conn=4 myRSS=2535 php=3 phpRSS=241 ap=20 tcp=30 topuser=evolution 2026-08-22 20:00:55 L1=1.18 run=1 blk=0 avail=6668 (56.8%) swpO=2 conn=3 myRSS=2535 php=1 phpRSS=94 ap=20 tcp=29 topuser=evolution 2026-08-22 20:01:00 L1=1.23 run=3 blk=0 avail=6540 (55.8%) swpO=0 conn=4 myRSS=2535 php=3 phpRSS=272 ap=20 tcp=29 topuser=alison 2026-08-22 20:01:05 L1=1.23 run=4 blk=0 avail=6618 (56.4%) swpO=0 conn=3 myRSS=2535 php=2 phpRSS=163 ap=20 tcp=29 topuser=evolution 2026-08-22 20:01:10 L1=1.19 run=2 blk=0 avail=6459 (55.1%) swpO=0 conn=4 myRSS=2535 php=3 phpRSS=356 ap=20 tcp=31 topuser=corpkicks 2026-08-22 20:01:15 L1=1.19 run=2 blk=0 avail=6559 (55.9%) swpO=0 conn=3 myRSS=2535 php=2 phpRSS=240 ap=20 tcp=26 topuser=alison 2026-08-22 20:01:20 L1=1.40 run=5 blk=0 avail=6408 (54.6%) swpO=0 conn=8 myRSS=2535 php=6 phpRSS=488 ap=19 tcp=29 topuser=speedlin 2026-08-22 20:01:25 L1=1.40 run=2 blk=0 avail=6668 (56.9%) swpO=0 conn=3 myRSS=2535 php=1 phpRSS=94 ap=19 tcp=27 topuser=evolution 2026-08-22 20:01:30 L1=1.49 run=4 blk=0 avail=6639 (56.6%) swpO=0 conn=8 myRSS=2535 php=3 phpRSS=198 ap=17 tcp=22 topuser=evolution 2026-08-22 20:01:35 L1=1.61 run=3 blk=0 avail=6613 (56.4%) swpO=0 conn=4 myRSS=2535 php=2 phpRSS=198 ap=17 tcp=25 topuser=alison 2026-08-22 20:01:40 L1=1.81 run=9 blk=0 avail=6383 (54.4%) swpO=0 conn=8 myRSS=2535 php=5 phpRSS=488 ap=17 tcp=27 topuser=olympic 2026-08-22 20:01:45 L1=1.74 run=2 blk=0 avail=6652 (56.7%) swpO=0 conn=4 myRSS=2535 php=2 phpRSS=155 ap=17 tcp=26 topuser=evolution 2026-08-22 20:01:50 L1=1.60 run=1 blk=0 avail=6671 (56.9%) swpO=0 conn=8 myRSS=2535 php=2 phpRSS=135 ap=17 tcp=26 topuser=evolution 2026-08-22 20:01:55 L1=1.87 run=4 blk=0 avail=6285 (53.6%) swpO=0 conn=4 myRSS=2535 php=5 phpRSS=607 ap=18 tcp=32 topuser=evolution 2026-08-22 20:02:00 L1=1.96 run=3 blk=0 avail=6564 (56.0%) swpO=0 conn=8 myRSS=2535 php=3 phpRSS=254 ap=21 tcp=25 topuser=evolution 2026-08-22 20:02:05 L1=2.45 run=8 blk=0 avail=5282 (45.0%) swpO=0 conn=12 myRSS=2535 php=13 phpRSS=1825 ap=21 tcp=43 topuser=customc