INCIDENT 2026-08-24 12:46:52 trigger: php_rss=1955MB mysql_conn=19 ================================================================== load: 4.00 2.22 2.06 28/709 3630092 ncpu:10 mem_avail: 4424MB/11729MB (37.7%) swap_used:3519MB swapout:1438/s blocked(D):0 running:21 iowait:0.1% steal:0.0% php: 19 procs / 1955MB heaviest user: alison (17 procs, 1756MB) apache: 85 procs tcp_estab: 119 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3115 alison 20 1816 nobody 84 1466 root 238 794 netdata 8 261 madalice 1 143 mailman 20 92 cpanellogin 1 79 mailnull 4 30 evolution 8 26 dovenull 6 26 wp-toolkit 6 20 zabbix 1 14 named 1 11 kurri 1 10 nscd 1 7 dovecot 3 7 cpanelconnecttrack 1 3 dbus 1 2 polkitd 1 1 --- php workers by user --- USER PROCS RSS_MB alison 18 1838 madalice 1 145 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4963 MB Active(file): 2824 MB Inactive(file): 1242 MB Dirty: 3 MB Writeback: 0 MB SReclaimable: 404 MB CommitLimit: 9960 MB Committed_AS: 11044 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3032611 root 11:35:36 3276 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 3176792 9.8 Ssl 9-04:56:19 /usr/sbin/mariadbd 1220 1 netdata 208160 2.5 Ssl 56-02:37:01 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3080743 3075441 root 182276 0.1 S 10:14:16 spamd child 3630034 3629989 alison 160064 74.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3630024 3629993 madalice 153720 66.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3630032 3629984 alison 143932 64.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3080744 3075441 root 140828 0.0 S 10:14:16 spamd child 3630030 3629982 alison 139744 61.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3630033 3629985 alison 134296 60.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3630037 3629994 alison 132528 52.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3630031 3629983 alison 130928 62.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3630041 3629996 alison 126936 50.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3630040 3629992 alison 124716 54.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3630036 3629987 alison 123764 49.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3630035 3629990 alison 120060 45.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3630051 3630047 alison 119904 101 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3630044 3628455 alison 106088 41.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3630046 3614114 alison 105980 92.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3075441 1 root 93968 0.0 Ss 10:23:55 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3630058 3629680 alison 90564 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3630057 3628753 alison 80852 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3418681 1353308 cpanellogin 80684 0.0 S 02:48:01 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 3630049 3614057 alison 77900 49.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3630097 3629681 alison 58928 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3630090 3628751 alison 55372 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 46040 0.0 Ss 9-04:56:22 /usr/lib/systemd/systemd-journald 2223 1201 root 43944 0.0 Sl 56-02:37:00 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3630106 3614610 evolution 43748 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 41640 0.1 Ss 56-02:37:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 39480 0.0 Ss 33-10:05:31 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 32648 0.1 Sl 56-02:36:56 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1463 1 root 23332 0.0 Ss 56-02:37:00 tailwatchd 3614114 1276780 nobody 22324 0.0 S 02:42 /usr/sbin/httpd -k start 3596092 1276780 nobody 21992 0.0 S 07:12 /usr/sbin/httpd -k start 3612869 1276780 nobody 21968 0.0 S 04:04 /usr/sbin/httpd -k start 3613407 1276780 nobody 21944 0.0 S 03:29 /usr/sbin/httpd -k start 3595676 1276780 nobody 21740 0.0 S 07:34 /usr/sbin/httpd -k start 3074682 1 root 21628 0.0 Ss 10:24:29 lfd - sleeping 3614091 1276780 nobody 21528 0.1 S 02:43 /usr/sbin/httpd -k start 3614622 1276780 nobody 21484 0.0 S 02:06 /usr/sbin/httpd -k start 3614454 1276780 nobody 21124 0.0 S 02:18 /usr/sbin/httpd -k start 3628460 1276780 nobody 21088 0.1 S 01:35 /usr/sbin/httpd -k start 3614057 1276780 nobody 21068 0.0 S 02:44 /usr/sbin/httpd -k start 3614488 1276780 nobody 21012 0.0 S 02:14 /usr/sbin/httpd -k start 3614463 1276780 nobody 21000 0.0 S 02:17 /usr/sbin/httpd -k start 3628444 1276780 nobody 20960 0.0 S 01:37 /usr/sbin/httpd -k start 3611313 1276780 nobody 20928 0.0 S 05:45 /usr/sbin/httpd -k start 3614610 1276780 nobody 20880 0.0 S 02:07 /usr/sbin/httpd -k start 3628751 1276780 nobody 20796 0.0 S 01:20 /usr/sbin/httpd -k start 3614111 1276780 nobody 20668 0.0 S 02:42 /usr/sbin/httpd -k start 3611317 1276780 nobody 20512 0.0 S 05:45 /usr/sbin/httpd -k start 3611873 1276780 nobody 20480 0.0 S 05:12 /usr/sbin/httpd -k start 3629683 1276780 nobody 20384 0.0 S 00:23 /usr/sbin/httpd -k start 3628454 1276780 nobody 19912 0.0 S 01:36 /usr/sbin/httpd -k start 3628753 1276780 nobody 19860 0.0 S 01:20 /usr/sbin/httpd -k start 3614324 1276780 nobody 19812 0.0 S 02:27 /usr/sbin/httpd -k start 3628458 1276780 nobody 19764 0.0 S 01:35 /usr/sbin/httpd -k start 3629317 1276780 nobody 19724 0.0 S 00:50 /usr/sbin/httpd -k start 3628455 1276780 nobody 19692 0.0 S 01:36 /usr/sbin/httpd -k start 3613714 1276780 nobody 19616 0.0 S 03:04 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 26476809 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 767 evolution/portal.evolutionerp.com.au-ssl_log 376 aaa/aaadownunder.com.au-ssl_log 186 aaa/aaadownunder.com.au 148 alison/alisonarts.com.au 66 alison/alisonarts.com.au-ssl_log 53 kamcool/kamcool.com.au-ssl_log 44 lecsafec/portal.lecsafe.com.au-ssl_log 17 evolution/staging.evolutionerp.com.au-ssl_log 9 madalice/madalice.com.au-ssl_log 8 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 767 203.54.180.238 310 68.155.154.236 182 103.104.165.99 79 103.104.164.114 59 182.239.240.254 44 68.155.153.139 33 185.226.196.18 29 185.226.196.20 29 185.226.196.19 29 185.226.196.17 26 110.174.119.207 17 45.148.10.123 17 150.228.163.253 15 1.144.107.82 9 118.127.40.55 --- top request paths across all vhosts (last 3 min) --- 250 POST /functions.php 169 GET /factory_session_checker.php 152 GET /app/ajax.php 86 GET /factory_session_joiner.php 85 GET /factory_session_processed_qty.php 76 GET /index.php 67 POST /quoteditsave.php 40 POST /plugins/csvexporter/plugin.php 36 POST /app/ajax/selectFilter.php 26 POST /app/ajax/selectFilterSingle.php 25 POST /app/ajax.php 19 POST /plugins/pipe/pipetopostsave.php 18 POST /itemModify.php 17 GET /plugins/fensa/fensa-ajax.php 17 GET /heartbeat.php 16 HEAD /index.php 12 POST /clienteditsave.php 12 POST / 9 GET / 7 POST /purchaseaddsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 241 POST /functions.php 152 GET /app/ajax.php 67 POST /quoteditsave.php 59 GET /index.php 40 POST /plugins/csvexporter/plugin.php 36 POST /app/ajax/selectFilter.php 26 POST /app/ajax/selectFilterSingle.php 25 POST /app/ajax.php 19 POST /plugins/pipe/pipetopostsave.php 18 POST /itemModify.php 17 GET /plugins/fensa/fensa-ajax.php 16 HEAD /index.php -- last 10 requests -- 103.104.165.99 - - [24/Aug/2026:12:46:50 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 282 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=5124&tab=quotestab" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 103.104.165.99 - - [24/Aug/2026:12:46:50 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=5124&tab=quotestab" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 203.54.180.238 - - [24/Aug/2026:12:46:50 +1000] "POST /inveditsave.php?call=fetch_inventory HTTP/1.1" 200 8091 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 182.239.240.254 - - [24/Aug/2026:12:46:51 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=4048&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; x 203.54.180.238 - - [24/Aug/2026:12:46:52 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 150.228.163.253 - - [24/Aug/2026:12:46:53 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invedit&id=1260&tab=purchasetab" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [24/Aug/2026:12:46:52 +1000] "GET /index.php?page=invoicereg HTTP/1.1" 200 14746 "https://my.evolutionerp.com.au/index.php?page=dispatch" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ( 182.239.240.254 - - [24/Aug/2026:12:46:53 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 203.54.180.238 - - [24/Aug/2026:12:46:53 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=14095" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 65.181.13.107 - - [24/Aug/2026:12:46:53 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=6935" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 169 GET /factory_session_checker.php 86 GET /factory_session_joiner.php 85 GET /factory_session_processed_qty.php 17 GET /index.php 17 GET /heartbeat.php 1 POST /factory_functions.php 1 GET /vapidPublicKey -- last 10 requests -- 203.54.180.238 - - [24/Aug/2026:12:46:51 +1000] "GET /factory_session_joiner.php?id=34817 HTTP/1.1" 200 94 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [24/Aug/2026:12:46:50 +1000] "GET /heartbeat.php?sentAt=1787539602&bytes=106,139,176,146&_=1787537938645 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [24/Aug/2026:12:46:51 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 129 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [24/Aug/2026:12:46:51 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [24/Aug/2026:12:46:52 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 123 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [24/Aug/2026:12:46:52 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [24/Aug/2026:12:46:52 +1000] "GET /factory_session_joiner.php?id=34829 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [24/Aug/2026:12:46:52 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [24/Aug/2026:12:46:53 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [24/Aug/2026:12:46:53 +1000] "GET /factory_session_joiner.php?id=34831 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 3 POST /wp-login.php 3 POST /wp-cron.php 3 GET /wp-login.php 2 GET /wp-includes/theme-compat/index.php 2 GET /wp-includes/Text/Diff/index.php 2 GET /wp-includes/js/tinymce/index.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /wp-content/index.php 2 GET /info.php 2 GET /index/function.php 2 GET /images/security.php 2 GET /2.php -- last 10 requests -- 68.155.154.236 - - [24/Aug/2026:12:46:32 +1000] "GET /wp-includes/js/tinymce/index.php HTTP/1.1" 404 - "-" "-" 68.155.154.236 - - [24/Aug/2026:12:46:32 +1000] "GET /wp-admin/gQ2zxmHJ3RF.php HTTP/1.1" 404 - "-" "-" 68.155.154.236 - - [24/Aug/2026:12:46:33 +1000] "GET /wp-includes/blocks/query-pagination-numbers/index.php HTTP/1.1" 404 - "-" "-" 68.155.154.236 - - [24/Aug/2026:12:46:33 +1000] "GET /kgoc6awap3napxxxdCdefault.php HTTP/1.1" 404 - "-" "-" 68.155.154.236 - - [24/Aug/2026:12:46:33 +1000] "GET /wp-content/themes/twentytwentytwo/index.php HTTP/1.1" 200 - "-" "-" 68.155.154.236 - - [24/Aug/2026:12:46:34 +1000] "GET /test.php HTTP/1.1" 404 - "-" "-" 68.155.154.236 - - [24/Aug/2026:12:46:34 +1000] "GET /wp-load.php HTTP/1.1" 200 - "-" "-" 68.155.154.236 - - [24/Aug/2026:12:46:35 +1000] "GET /inputs.php HTTP/1.1" 404 - "-" "-" 68.155.154.236 - - [24/Aug/2026:12:46:36 +1000] "GET /wp-admin/css/wp-login.php HTTP/1.1" 404 - "-" "-" 68.155.154.236 - - [24/Aug/2026:12:46:36 +1000] "GET /wp-includes/Requests/about.php HTTP/1.1" 404 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-24 12:44:30 L1=1.99 run=5 blk=0 avail=5986 (51.0%) swpO=0 conn=2 myRSS=3153 php=1 phpRSS=39 ap=43 tcp=48 topuser=evolution 2026-08-24 12:44:32 L1=1.99 run=2 blk=0 avail=5968 (50.9%) swpO=0 conn=1 myRSS=3153 php=1 phpRSS=66 ap=43 tcp=52 topuser=evolution 2026-08-24 12:44:40 L1=1.83 run=7 blk=0 avail=5792 (49.4%) swpO=0 conn=2 myRSS=3153 php=5 phpRSS=318 ap=49 tcp=59 topuser=evolution 2026-08-24 12:44:42 L1=1.83 run=5 blk=0 avail=5919 (50.5%) swpO=0 conn=1 myRSS=3153 php=4 phpRSS=165 ap=49 tcp=52 topuser=evolution 2026-08-24 12:44:50 L1=2.01 run=2 blk=0 avail=5863 (50.0%) swpO=0 conn=2 myRSS=3153 php=2 phpRSS=110 ap=56 tcp=62 topuser=evolution 2026-08-24 12:44:52 L1=2.01 run=2 blk=0 avail=5840 (49.8%) swpO=0 conn=1 myRSS=3153 php=1 phpRSS=106 ap=55 tcp=54 topuser=alison 2026-08-24 12:45:00 L1=1.78 run=3 blk=0 avail=5900 (50.3%) swpO=0 conn=3 myRSS=3153 php=4 phpRSS=192 ap=48 tcp=42 topuser=madalice 2026-08-24 12:45:02 L1=1.78 run=4 blk=0 avail=5751 (49.0%) swpO=0 conn=1 myRSS=3153 php=3 phpRSS=312 ap=46 tcp=44 topuser=madalice 2026-08-24 12:45:10 L1=1.73 run=1 blk=0 avail=5969 (50.9%) swpO=0 conn=3 myRSS=3153 php=2 phpRSS=109 ap=41 tcp=47 topuser=evolution 2026-08-24 12:45:12 L1=1.73 run=1 blk=0 avail=5984 (51.0%) swpO=0 conn=1 myRSS=3153 php=1 phpRSS=69 ap=41 tcp=46 topuser=evolution 2026-08-24 12:45:20 L1=1.69 run=3 blk=0 avail=5564 (47.4%) swpO=0 conn=3 myRSS=3153 php=4 phpRSS=480 ap=56 tcp=59 topuser=corpkicks 2026-08-24 12:45:22 L1=1.69 run=7 blk=0 avail=5523 (47.1%) swpO=0 conn=3 myRSS=3153 php=5 phpRSS=329 ap=55 tcp=66 topuser=alison 2026-08-24 12:45:30 L1=1.90 run=9 blk=0 avail=5769 (49.2%) swpO=0 conn=3 myRSS=3153 php=4 phpRSS=260 ap=53 tcp=71 topuser=alison 2026-08-24 12:45:32 L1=1.90 run=4 blk=0 avail=5870 (50.0%) swpO=0 conn=3 myRSS=3153 php=1 phpRSS=66 ap=56 tcp=69 topuser=evolution 2026-08-24 12:45:40 L1=2.23 run=4 blk=0 avail=5679 (48.4%) swpO=0 conn=3 myRSS=3153 php=3 phpRSS=290 ap=60 tcp=55 topuser=tubesupplies 2026-08-24 12:45:42 L1=2.23 run=1 blk=0 avail=5891 (50.2%) swpO=0 conn=3 myRSS=3153 php=0 phpRSS=0 ap=59 tcp=49 topuser=- 2026-08-24 12:45:50 L1=2.12 run=1 blk=0 avail=5938 (50.6%) swpO=0 conn=3 myRSS=3153 php=1 phpRSS=13 ap=52 tcp=51 topuser=evolution 2026-08-24 12:45:52 L1=2.12 run=3 blk=0 avail=5775 (49.2%) swpO=0 conn=3 myRSS=3153 php=3 phpRSS=264 ap=51 tcp=59 topuser=aaa 2026-08-24 12:46:00 L1=2.02 run=6 blk=0 avail=5887 (50.2%) swpO=0 conn=6 myRSS=3153 php=5 phpRSS=190 ap=50 tcp=58 topuser=evolution 2026-08-24 12:46:02 L1=2.02 run=1 blk=0 avail=5943 (50.7%) swpO=0 conn=3 myRSS=3153 php=0 phpRSS=0 ap=50 tcp=65 topuser=- 2026-08-24 12:46:10 L1=1.79 run=2 blk=0 avail=5867 (50.0%) swpO=0 conn=6 myRSS=3153 php=1 phpRSS=111 ap=52 tcp=55 topuser=alison 2026-08-24 12:46:12 L1=1.79 run=4 blk=0 avail=5918 (50.5%) swpO=0 conn=3 myRSS=3153 php=2 phpRSS=92 ap=52 tcp=55 topuser=lecsafec 2026-08-24 12:46:20 L1=1.67 run=3 blk=0 avail=5944 (50.7%) swpO=0 conn=6 myRSS=3153 php=0 phpRSS=0 ap=48 tcp=55 topuser=- 2026-08-24 12:46:22 L1=1.67 run=5 blk=0 avail=5851 (49.9%) swpO=0 conn=3 myRSS=3153 php=2 phpRSS=168 ap=48 tcp=52 topuser=alison 2026-08-24 12:46:30 L1=1.95 run=4 blk=0 avail=5858 (49.9%) swpO=0 conn=6 myRSS=3153 php=1 phpRSS=66 ap=55 tcp=57 topuser=evolution 2026-08-24 12:46:32 L1=1.95 run=5 blk=0 avail=5763 (49.1%) swpO=0 conn=3 myRSS=3153 php=6 phpRSS=305 ap=55 tcp=56 topuser=evolution 2026-08-24 12:46:40 L1=1.88 run=6 blk=0 avail=5803 (49.5%) swpO=0 conn=6 myRSS=3154 php=4 phpRSS=213 ap=53 tcp=52 topuser=evolution 2026-08-24 12:46:42 L1=1.88 run=3 blk=0 avail=5867 (50.0%) swpO=0 conn=3 myRSS=3154 php=1 phpRSS=79 ap=51 tcp=53 topuser=alison 2026-08-24 12:46:50 L1=1.83 run=9 blk=0 avail=5323 (45.4%) swpO=904 conn=6 myRSS=3133 php=4 phpRSS=510 ap=82 tcp=122 topuser=alison 2026-08-24 12:46:52 L1=1.83 run=21 blk=0 avail=4424 (37.7%) swpO=1438 conn=19 myRSS=3119 php=19 phpRSS=1955 ap=85 tcp=119 topuser=alison