INCIDENT 2026-08-24 15:07:59 trigger: php_rss=1825MB ================================================================== load: 3.97 3.13 2.70 19/675 4127525 ncpu:10 mem_avail: 4245MB/11729MB (36.2%) swap_used:3501MB swapout:510/s blocked(D):0 running:20 iowait:0.1% steal:0.0% php: 12 procs / 1825MB heaviest user: madalice (11 procs, 1759MB) apache: 36 procs tcp_estab: 52 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3176 madalice 13 1985 root 248 996 nobody 39 616 netdata 8 259 evolution 11 101 mailman 20 92 cpanellogin 1 67 mailnull 6 47 dovenull 6 26 lowrange 2 24 kurri 2 22 wp-toolkit 6 19 zabbix 1 14 named 1 11 dovecot 3 7 nscd 1 6 cpanelconnecttrack 1 3 dbus 1 2 polkitd 1 1 --- php workers by user --- USER PROCS RSS_MB madalice 13 2034 evolution 1 65 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5082 MB Active(file): 2790 MB Inactive(file): 1084 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 391 MB CommitLimit: 9960 MB Committed_AS: 9544 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3032611 root 13:56:43 2968 /usr/bin/imunify-agent-proxy 4093558 root 07:58 3076 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 4127367 root 00:04 52016 /opt/imunify360/venv/bin/python3 /usr/bin/imunify-antivirus imunify-patch subscriptions refresh 4127378 root 00:04 52620 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 3235520 10.1 Ssl 9-07:17:26 /usr/sbin/mariadbd 4127408 4110547 madalice 210856 101 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4127399 4127364 madalice 210820 103 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 209196 2.5 Ssl 56-04:58:08 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 4127407 4127370 madalice 206120 100 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4127411 4125071 madalice 202988 105 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4127410 4127371 madalice 202432 97.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4127400 4127368 madalice 200796 98.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4127406 4127369 madalice 195100 98.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4127427 4108113 madalice 195076 91.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4127398 4127363 madalice 188292 60.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4127420 4126427 madalice 171452 88.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3080744 3075441 root 158812 0.0 S 12:35:23 spamd child 3879330 3075441 root 154608 0.0 S 01:09:10 spamd child 4127442 4127414 madalice 105008 79.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 93676 0.0 Ss 9-07:17:29 /usr/lib/systemd/systemd-journald 3075441 1 root 90504 0.0 Ss 12:45:02 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4127516 4127447 madalice 72268 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3418681 1353308 cpanellogin 68792 0.0 S 05:09:08 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 4127473 4126412 evolution 67692 15.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 63420 0.0 Sl 56-04:58:07 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4127517 4127448 madalice 60424 0.0 S 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4127378 1 root 52980 18.2 Rs 00:04 /opt/imunify360/venv/bin/python3 -m imav.run 4127367 4093558 root 52016 9.7 S 00:04 /opt/imunify360/venv/bin/python3 /usr/bin/imunify-antivirus imunify-patch subscriptions refresh 1469 1 root 42684 0.1 Ss 56-04:58:07 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 31492 0.1 Sl 56-04:58:03 /usr/libexec/netdata/plugins.d/go.d.plugin 1 4127418 1463 root 27588 2.5 S 00:02 tailwatchd - chkservd - mailman check 1353308 1 root 24396 0.0 Ss 33-12:26:38 cpsrvd (SSL) - waiting for connections 1463 1 root 22980 0.0 Ss 56-04:58:07 tailwatchd 4108631 1276780 nobody 22212 0.0 S 05:55 /usr/sbin/httpd -k start 4125837 1276780 nobody 21824 0.1 S 02:06 /usr/sbin/httpd -k start 4125071 1276780 nobody 21232 0.1 S 02:44 /usr/sbin/httpd -k start 3074682 1 root 21096 0.0 Ss 12:45:36 lfd - sleeping 4125857 1276780 nobody 20900 0.1 S 02:04 /usr/sbin/httpd -k start 4110547 1276780 nobody 20800 0.0 S 04:04 /usr/sbin/httpd -k start 4109874 1276780 nobody 20700 0.0 S 04:55 /usr/sbin/httpd -k start 4126010 1276780 nobody 20628 0.1 S 01:58 /usr/sbin/httpd -k start 4126430 1276780 nobody 20184 0.1 S 01:29 /usr/sbin/httpd -k start 4126790 1276780 nobody 20092 0.1 S 01:00 /usr/sbin/httpd -k start 4126718 1276780 nobody 19168 0.0 S 01:03 /usr/sbin/httpd -k start 4125443 1276780 nobody 19108 0.0 S 02:28 /usr/sbin/httpd -k start 4126709 1276780 nobody 19056 0.0 S 01:05 /usr/sbin/httpd -k start 4126412 1276780 nobody 18704 0.0 S 01:30 /usr/sbin/httpd -k start 4126427 1276780 nobody 18472 0.0 S 01:29 /usr/sbin/httpd -k start 4126429 1276780 nobody 18320 0.0 S 01:29 /usr/sbin/httpd -k start 4126738 1276780 nobody 18316 0.0 S 01:02 /usr/sbin/httpd -k start 185104 2431 netdata 18152 2.1 Rl 11-18:34:26 /usr/libexec/netdata/plugins.d/apps.plugin 1 4126745 1276780 nobody 17644 0.0 S 01:01 /usr/sbin/httpd -k start 4126787 1276780 nobody 17496 0.0 S 01:00 /usr/sbin/httpd -k start 4108113 1276780 nobody 17408 0.2 S 06:36 /usr/sbin/httpd -k start 4127223 1276780 nobody 17096 0.1 S 00:20 /usr/sbin/httpd -k start 4126737 1276780 nobody 16888 0.0 S 01:02 /usr/sbin/httpd -k start 4126785 1276780 nobody 16872 0.0 S 01:00 /usr/sbin/httpd -k start 4127353 1276780 nobody 16496 0.0 S 00:06 /usr/sbin/httpd -k start 4127092 1276780 nobody 16476 0.0 S 00:33 /usr/sbin/httpd -k start 4127363 1276780 nobody 16032 0.0 S 00:05 /usr/sbin/httpd -k start 4127368 1276780 nobody 16032 0.0 S 00:04 /usr/sbin/httpd -k start 4127370 1276780 nobody 16032 0.0 S 00:04 /usr/sbin/httpd -k start 4127447 1276780 nobody 16032 1.0 S 00:01 /usr/sbin/httpd -k start 4127364 1276780 nobody 15972 0.0 S 00:05 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 4127569 D - /usr/local/cpanel/scripts/restartsrv_mailman --check --notconfigured-ok --- mariadb processlist (non-sleeping) --- +----------+------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 27512582 | root | 304-1705884103 | Execute | 0 | Creating sort index | SELECT jobs.* from jobs,contacts where jobs.clientid=contacts.clientid AND jobs.review_flag='1' AND jobs.status > 0 order by dateadded desc | | 27512580 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 408 madalice/madalice.com.au-ssl_log 75 evolution/portal.evolutionerp.com.au-ssl_log 71 olytis/tis.com.au-ssl_log 35 evolution/evolutionerp.com.au 16 tubesupplies/tubesupplies.com.au-ssl_log 12 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 248 203.54.180.238 82 182.239.240.254 67 20.151.9.127 60 180.181.236.49 53 103.104.165.99 41 103.104.164.114 35 20.203.141.11 12 20.63.64.130 5 150.228.163.253 3 118.127.40.55 2 40.77.167.32 2 114.119.137.101 1 65.181.13.107 1 52.167.144.191 1 52.167.144.137 --- top request paths across all vhosts (last 3 min) --- 181 POST /functions.php 74 GET /app/ajax.php 34 GET /index.php 24 GET /factory_session_checker.php 23 GET /heartbeat.php 17 POST /app/ajax/selectFilterSingle.php 17 POST /app/ajax/selectFilter.php 16 POST /wp-login.php 15 POST /clienteditsave.php 14 POST /plugins/csvexporter/plugin.php 12 POST /app/ajax.php 12 GET /factory_session_processed_qty.php 12 GET /factory_session_joiner.php 8 POST /inveditsave.php 8 POST //functions.php 7 GET //app/ajax.php 6 POST /purchaseaddsave.php 4 GET /store/hand-painted-nike-af1-sunflower/ 3 POST /mfreqsave.php 3 POST /logsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 181 POST /functions.php 74 GET /app/ajax.php 34 GET /index.php 17 POST /app/ajax/selectFilterSingle.php 17 POST /app/ajax/selectFilter.php 15 POST /clienteditsave.php 14 POST /plugins/csvexporter/plugin.php 12 POST /app/ajax.php 8 POST /inveditsave.php 8 POST //functions.php 7 GET //app/ajax.php 6 POST /purchaseaddsave.php -- last 10 requests -- 203.54.180.238 - - [24/Aug/2026:15:08:01 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=invedit&id=141212&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [24/Aug/2026:15:08:01 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29353&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [24/Aug/2026:15:08:01 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=mfstatus" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 203.54.180.238 - - [24/Aug/2026:15:08:01 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=mfstatus" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 203.54.180.238 - - [24/Aug/2026:15:08:01 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=mfreqedit&id=20778" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 203.54.180.238 - - [24/Aug/2026:15:08:01 +1000] "POST //functions.php?call=heartbeat HTTP/1.1" 200 238 "https://my.evolutionerp.com.au//index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 182.239.240.254 - - [24/Aug/2026:15:08:02 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 103.104.164.114 - - [24/Aug/2026:15:08:02 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 182.239.240.254 - - [24/Aug/2026:15:08:02 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=mfshoporderdetail&id=5545" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 203.54.180.238 - - [24/Aug/2026:15:08:02 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=activities&date=24-08-2026&focus=&company=rural" "Mozilla/5.0 (Windows == madalice/madalice.com.au-ssl_log == -- top paths -- 4 GET /store/hand-painted-nike-af1-sunflower/ 2 POST / 2 GET /wp-login.php 1 POST /wp-admin/admin-ajax.php 1 GET /wp.php 1 GET /wp-includes/wp-includes_function.php 1 GET /wp-includes/wp-class.php 1 GET /wp-includes/widgets/include.php 1 GET /wp-includes/SimplePie/index.php 1 GET /wp-includes/SimplePie/gzdecodes.php 1 GET /wp-includes/SimplePie/ 1 GET /wp-includes/Requests/library/about.php -- last 10 requests -- 20.151.9.127 - - [24/Aug/2026:15:07:58 +1000] "GET /wp-content/plugins/pwnd/1.php HTTP/1.1" 404 30639 "-" "-" 192.144.167.158 - - [24/Aug/2026:15:07:57 +1000] "GET /ip HTTP/1.1" 404 30628 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" 121.37.82.202 - - [24/Aug/2026:15:07:57 +1000] "GET /ip HTTP/1.1" 404 30628 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" 116.204.102.127 - - [24/Aug/2026:15:07:57 +1000] "GET /ip HTTP/1.1" 404 30628 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" 180.153.197.197 - - [24/Aug/2026:15:07:58 +1000] "GET /ip HTTP/1.1" 404 30628 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" 112.65.212.208 - - [24/Aug/2026:15:07:57 +1000] "GET /ip HTTP/1.1" 404 30628 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" 180.153.197.108 - - [24/Aug/2026:15:07:58 +1000] "GET /ip HTTP/1.1" 404 30631 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" 140.206.236.95 - - [24/Aug/2026:15:07:57 +1000] "GET /ip HTTP/1.1" 404 30628 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" 43.138.122.39 - - [24/Aug/2026:15:07:59 +1000] "GET /ip HTTP/1.1" 404 30631 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" 180.153.197.60 - - [24/Aug/2026:15:07:59 +1000] "GET /ip HTTP/1.1" 404 30629 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 24 GET /factory_session_checker.php 23 GET /heartbeat.php 12 GET /factory_session_processed_qty.php 12 GET /factory_session_joiner.php -- last 10 requests -- 203.54.180.238 - - [24/Aug/2026:15:07:43 +1000] "GET /heartbeat.php?sentAt=1787548064&bytes=106,139,209,160&_=1787547586866 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [24/Aug/2026:15:07:47 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [24/Aug/2026:15:07:47 +1000] "GET /factory_session_joiner.php?id=34843 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [24/Aug/2026:15:07:49 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [24/Aug/2026:15:07:49 +1000] "GET /heartbeat.php?sentAt=1787548062&bytes=106,139,209,158&_=1787537939491 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [24/Aug/2026:15:07:54 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [24/Aug/2026:15:07:53 +1000] "GET /heartbeat.php?sentAt=1787548074&bytes=106,139,209,170&_=1787547586867 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [24/Aug/2026:15:07:57 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [24/Aug/2026:15:07:58 +1000] "GET /factory_session_joiner.php?id=34843 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [24/Aug/2026:15:07:59 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 --- last 30 samples (run-up to this incident) --- 2026-08-24 15:05:38 L1=3.00 run=3 blk=0 avail=5682 (48.4%) swpO=0 conn=3 myRSS=3215 php=2 phpRSS=318 ap=38 tcp=49 topuser=madalice 2026-08-24 15:05:41 L1=3.00 run=4 blk=0 avail=5736 (48.9%) swpO=0 conn=3 myRSS=3215 php=3 phpRSS=300 ap=36 tcp=47 topuser=madalice 2026-08-24 15:05:48 L1=2.92 run=8 blk=0 avail=5380 (45.9%) swpO=0 conn=3 myRSS=3215 php=11 phpRSS=876 ap=37 tcp=49 topuser=madalice 2026-08-24 15:05:51 L1=3.00 run=5 blk=0 avail=5684 (48.5%) swpO=0 conn=3 myRSS=3215 php=4 phpRSS=394 ap=37 tcp=45 topuser=madalice 2026-08-24 15:05:59 L1=3.08 run=4 blk=0 avail=5618 (47.9%) swpO=0 conn=3 myRSS=3215 php=3 phpRSS=392 ap=40 tcp=51 topuser=madalice 2026-08-24 15:06:01 L1=3.16 run=3 blk=0 avail=5652 (48.2%) swpO=0 conn=3 myRSS=3215 php=2 phpRSS=286 ap=47 tcp=58 topuser=madalice 2026-08-24 15:06:09 L1=3.15 run=2 blk=0 avail=5818 (49.6%) swpO=0 conn=2 myRSS=3215 php=2 phpRSS=92 ap=47 tcp=49 topuser=madalice 2026-08-24 15:06:11 L1=3.05 run=4 blk=0 avail=5757 (49.1%) swpO=0 conn=3 myRSS=3215 php=3 phpRSS=218 ap=44 tcp=46 topuser=madalice 2026-08-24 15:06:19 L1=2.97 run=4 blk=0 avail=5622 (47.9%) swpO=0 conn=2 myRSS=3215 php=3 phpRSS=402 ap=38 tcp=34 topuser=madalice 2026-08-24 15:06:21 L1=2.89 run=4 blk=0 avail=5597 (47.7%) swpO=0 conn=3 myRSS=3215 php=3 phpRSS=463 ap=35 tcp=35 topuser=madalice 2026-08-24 15:06:29 L1=3.30 run=3 blk=0 avail=5555 (47.4%) swpO=0 conn=2 myRSS=3215 php=4 phpRSS=526 ap=35 tcp=54 topuser=madalice 2026-08-24 15:06:31 L1=3.28 run=3 blk=0 avail=5357 (45.7%) swpO=0 conn=3 myRSS=3215 php=3 phpRSS=617 ap=47 tcp=57 topuser=madalice 2026-08-24 15:06:39 L1=3.33 run=4 blk=0 avail=5858 (49.9%) swpO=217 conn=2 myRSS=3210 php=2 phpRSS=148 ap=42 tcp=48 topuser=madalice 2026-08-24 15:06:42 L1=3.39 run=2 blk=0 avail=5940 (50.6%) swpO=197 conn=2 myRSS=3210 php=1 phpRSS=63 ap=39 tcp=50 topuser=madalice 2026-08-24 15:06:49 L1=3.20 run=3 blk=0 avail=5779 (49.3%) swpO=0 conn=2 myRSS=3210 php=2 phpRSS=297 ap=33 tcp=43 topuser=madalice 2026-08-24 15:06:52 L1=3.10 run=3 blk=0 avail=5816 (49.6%) swpO=0 conn=2 myRSS=3210 php=2 phpRSS=283 ap=30 tcp=42 topuser=madalice 2026-08-24 15:06:59 L1=3.17 run=11 blk=0 avail=5721 (48.8%) swpO=0 conn=2 myRSS=3211 php=7 phpRSS=461 ap=36 tcp=48 topuser=madalice 2026-08-24 15:07:02 L1=3.24 run=5 blk=0 avail=5752 (49.0%) swpO=0 conn=2 myRSS=3211 php=4 phpRSS=347 ap=45 tcp=55 topuser=madalice 2026-08-24 15:07:09 L1=3.06 run=2 blk=0 avail=5844 (49.8%) swpO=0 conn=3 myRSS=3211 php=2 phpRSS=198 ap=41 tcp=38 topuser=madalice 2026-08-24 15:07:12 L1=2.89 run=2 blk=0 avail=5884 (50.2%) swpO=0 conn=2 myRSS=3211 php=1 phpRSS=148 ap=38 tcp=36 topuser=madalice 2026-08-24 15:07:19 L1=2.74 run=2 blk=0 avail=6000 (51.2%) swpO=0 conn=3 myRSS=3211 php=2 phpRSS=107 ap=31 tcp=37 topuser=madalice 2026-08-24 15:07:22 L1=2.60 run=2 blk=0 avail=6036 (51.5%) swpO=0 conn=2 myRSS=3211 php=1 phpRSS=56 ap=29 tcp=36 topuser=madalice 2026-08-24 15:07:29 L1=2.96 run=2 blk=0 avail=5870 (50.1%) swpO=0 conn=3 myRSS=3211 php=2 phpRSS=256 ap=27 tcp=38 topuser=madalice 2026-08-24 15:07:32 L1=2.80 run=4 blk=0 avail=5889 (50.2%) swpO=0 conn=2 myRSS=3211 php=1 phpRSS=205 ap=27 tcp=35 topuser=madalice 2026-08-24 15:07:39 L1=2.65 run=4 blk=0 avail=5799 (49.4%) swpO=0 conn=3 myRSS=3211 php=4 phpRSS=408 ap=25 tcp=38 topuser=madalice 2026-08-24 15:07:42 L1=2.76 run=3 blk=0 avail=5799 (49.4%) swpO=0 conn=3 myRSS=3211 php=2 phpRSS=334 ap=26 tcp=37 topuser=madalice 2026-08-24 15:07:49 L1=2.34 run=1 blk=0 avail=6062 (51.7%) swpO=0 conn=3 myRSS=3211 php=1 phpRSS=39 ap=26 tcp=35 topuser=evolution 2026-08-24 15:07:52 L1=2.34 run=1 blk=0 avail=6074 (51.8%) swpO=0 conn=3 myRSS=3211 php=0 phpRSS=0 ap=26 tcp=34 topuser=- 2026-08-24 15:07:59 L1=3.97 run=20 blk=0 avail=4245 (36.2%) swpO=510 conn=13 myRSS=3195 php=12 phpRSS=1825 ap=36 tcp=52 topuser=madalice 2026-08-24 15:08:02 L1=3.97 run=25 blk=0 avail=4774 (40.7%) swpO=3041 conn=10 myRSS=3126 php=12 phpRSS=1345 ap=41 tcp=64 topuser=madalice