INCIDENT 2026-08-24 15:37:54 trigger: php_rss=1885MB ================================================================== load: 2.79 1.77 1.80 9/700 39078 ncpu:10 mem_avail: 4365MB/11729MB (37.2%) swap_used:3646MB swapout:506/s blocked(D):2 running:15 iowait:0.9% steal:0.0% php: 13 procs / 1885MB heaviest user: madalice (7 procs, 1648MB) apache: 90 procs tcp_estab: 82 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3090 nobody 88 1383 root 237 821 madalice 5 747 netdata 8 257 mailman 20 92 evolution 7 63 cpanellogin 1 63 aaa 3 35 dovenull 6 26 mailnull 3 22 kurri 2 22 wp-toolkit 6 18 zabbix 1 14 lowrange 1 12 named 1 11 dovecot 3 7 nscd 1 6 cpanelconnecttrack 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 4 726 evolution 4 75 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4447 MB Active(file): 3366 MB Inactive(file): 747 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 382 MB CommitLimit: 9960 MB Committed_AS: 8498 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3032611 root 14:26:38 2396 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 3164720 10.1 Ssl 9-07:47:21 /usr/sbin/mariadbd 38994 38979 madalice 262656 115 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 38996 38977 madalice 217720 106 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 207116 2.5 Ssl 56-05:28:03 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3080744 3075441 root 158916 0.0 S 13:05:18 spamd child 3879330 3075441 root 154608 0.0 S 01:39:05 spamd child 2575382 1 root 103432 0.0 Ss 9-07:47:24 /usr/lib/systemd/systemd-journald 3075441 1 root 90484 0.0 Ss 13:14:57 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3418681 1353308 cpanellogin 64612 0.0 S 05:39:03 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 2223 1201 root 63372 0.0 Sl 56-05:28:02 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 39084 23614 evolution 42784 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 39856 0.1 Ss 56-05:28:02 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 39092 23622 evolution 39500 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 39100 5368 evolution 39480 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 39083 38812 evolution 39236 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 39116 23595 evolution 37996 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 31220 0.1 Sl 56-05:27:58 /usr/libexec/netdata/plugins.d/go.d.plugin 1 5368 1276780 nobody 24336 0.0 S 09:39 /usr/sbin/httpd -k start 1463 1 root 23340 0.0 Ss 56-05:28:02 tailwatchd 20056 1276780 nobody 21916 0.0 S 07:40 /usr/sbin/httpd -k start 23788 1276780 nobody 21404 0.0 S 02:53 /usr/sbin/httpd -k start 1353308 1 root 21328 0.0 Ss 33-12:56:33 cpsrvd (SSL) - waiting for connections 23234 1276780 nobody 21252 0.0 S 03:25 /usr/sbin/httpd -k start 3074682 1 root 20812 0.0 Ss 13:15:31 lfd - sleeping 23595 1276780 nobody 20664 0.0 S 02:58 /usr/sbin/httpd -k start 22610 1276780 nobody 20292 0.0 S 04:26 /usr/sbin/httpd -k start 23253 1276780 nobody 20276 0.0 S 03:24 /usr/sbin/httpd -k start 22992 1276780 nobody 19536 0.0 S 03:50 /usr/sbin/httpd -k start 37881 1276780 nobody 19424 0.0 S 01:52 /usr/sbin/httpd -k start 37823 1276780 nobody 19368 0.0 S 01:54 /usr/sbin/httpd -k start 37864 1276780 nobody 19256 0.0 S 01:53 /usr/sbin/httpd -k start 23622 1276780 nobody 19248 0.0 S 02:57 /usr/sbin/httpd -k start 23644 1276780 nobody 18760 0.0 S 02:57 /usr/sbin/httpd -k start 23614 1276780 nobody 18168 0.0 S 02:57 /usr/sbin/httpd -k start 185104 2431 netdata 18112 2.1 Sl 11-19:04:21 /usr/libexec/netdata/plugins.d/apps.plugin 1 38975 1276780 nobody 17712 0.0 S 00:03 /usr/sbin/httpd -k start 38971 1276780 nobody 17552 0.0 S 00:03 /usr/sbin/httpd -k start 23233 1276780 nobody 17520 0.0 S 03:25 /usr/sbin/httpd -k start 23015 1276780 nobody 17472 0.0 S 03:48 /usr/sbin/httpd -k start 37882 1276780 nobody 17456 0.0 S 01:52 /usr/sbin/httpd -k start 23582 1276780 nobody 17404 0.0 S 02:59 /usr/sbin/httpd -k start 38974 1276780 nobody 17404 0.0 S 00:03 /usr/sbin/httpd -k start 38810 1276780 nobody 17076 0.0 S 00:20 /usr/sbin/httpd -k start 37860 1276780 nobody 16916 0.0 S 01:53 /usr/sbin/httpd -k start 37890 1276780 nobody 16896 0.0 S 01:52 /usr/sbin/httpd -k start 38945 1276780 nobody 16780 0.0 S 00:04 /usr/sbin/httpd -k start 38982 1276780 nobody 16776 0.0 S 00:03 /usr/sbin/httpd -k start 23638 1276780 nobody 16544 0.0 S 02:57 /usr/sbin/httpd -k start 38979 1276780 nobody 16380 0.0 S 00:03 /usr/sbin/httpd -k start 38970 1276780 nobody 16288 0.3 S 00:03 /usr/sbin/httpd -k start 38984 1276780 nobody 16256 0.0 S 00:03 /usr/sbin/httpd -k start 38813 1276780 nobody 16232 0.1 S 00:19 /usr/sbin/httpd -k start 38841 1276780 nobody 16216 0.0 S 00:14 /usr/sbin/httpd -k start 38812 1276780 nobody 16028 0.1 S 00:19 /usr/sbin/httpd -k start 38969 1276780 nobody 15964 0.0 S 00:03 /usr/sbin/httpd -k start 38978 1276780 nobody 15904 0.0 S 00:03 /usr/sbin/httpd -k start 38923 1276780 nobody 15860 0.0 S 00:06 /usr/sbin/httpd -k start 38927 1276780 nobody 15860 0.0 S 00:05 /usr/sbin/httpd -k start 38940 1276780 nobody 15860 0.0 S 00:04 /usr/sbin/httpd -k start 38941 1276780 nobody 15860 0.0 S 00:04 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 27703575 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 473 tubesupplies/tubesupplies.com.au-ssl_log 102 tubesupplies/tubesupplies.com.au 60 madalice/madalice.com.au-ssl_log 26 evolution/portal.evolutionerp.com.au-ssl_log 23 evolution/evolutionerp.com.au 12 corpkicks/corporatekicks.com.au-ssl_log 2 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 174 203.54.180.238 156 172.182.200.96 156 103.104.165.99 114 180.181.236.49 19 182.239.240.254 14 103.104.164.114 10 150.228.163.253 7 58.111.236.173 4 2001:8004:14b3:854f:74b5:2cd9:2b7:278e 4 118.127.40.55 3 52.167.144.19 3 114.119.159.70 2 91.92.243.249 2 91.92.243.243 2 52.167.144.176 --- top request paths across all vhosts (last 3 min) --- 190 POST /functions.php 59 GET /app/ajax.php 54 POST /app/ajax.php 36 GET /index.php 27 POST /plugins/csvexporter/plugin.php 23 GET /heartbeat.php 21 POST /app/ajax/selectFilter.php 16 POST /wp-login.php 14 POST /quoteditsave.php 12 POST //functions.php 10 POST /clienteditsave.php 7 POST /plugins/fencecosting/plugin.php 7 POST /logsave.php 7 POST /app/ajax/selectFilterSingle.php 7 GET / 6 POST /plugins/pipe/pipetopostsave.php 5 POST /timesheets.php 4 POST /itemModify.php 4 POST /inveditsave.php 4 GET /store/hand-painted-nike-af1-chelsea/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 190 POST /functions.php 59 GET /app/ajax.php 54 POST /app/ajax.php 36 GET /index.php 27 POST /plugins/csvexporter/plugin.php 21 POST /app/ajax/selectFilter.php 14 POST /quoteditsave.php 12 POST //functions.php 10 POST /clienteditsave.php 7 POST /plugins/fencecosting/plugin.php 7 POST /logsave.php 7 POST /app/ajax/selectFilterSingle.php -- last 10 requests -- 203.54.180.238 - - [24/Aug/2026:15:37:53 +1000] "GET /app/ajax.php?cn=&furi=true&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=17458507066 HTTP/1.1" 200 75 "https://my.evolutionerp.com.au/index.php?page=jobedit&id= 203.54.180.238 - - [24/Aug/2026:15:37:54 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobedit%26id%3D29340&call=getUserSetting&caller=ajaxSubmitLocal&seq=15937114111 HTTP/1.1" 200 159 "https://my.evolutionerp.com.a 203.54.180.238 - - [24/Aug/2026:15:37:54 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Djobedit%26id%3D29340&call=getUserSetting&caller=ajaxSubmitLocal&seq=11834204011 HTTP/1.1" 200 112 "https://my. 203.54.180.238 - - [24/Aug/2026:15:37:54 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29398" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 203.54.180.238 - - [24/Aug/2026:15:37:54 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 4317 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29340" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 203.54.180.238 - - [24/Aug/2026:15:37:54 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=19403000147 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 203.54.180.238 - - [24/Aug/2026:15:37:54 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29398" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 203.54.180.238 - - [24/Aug/2026:15:37:54 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=14122072456 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 203.54.180.238 - - [24/Aug/2026:15:37:54 +1000] "GET /app/ajax.php?cn=&furi=true&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=13065615991 HTTP/1.1" 200 75 "https://my.evolutionerp.com.au/index.php?page=jobedit&id= 203.54.180.238 - - [24/Aug/2026:15:37:55 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobedit%26id%3D29398&call=getUserSetting&caller=ajaxSubmitLocal&seq=13118081463 HTTP/1.1" 200 160 "https://my.evolutionerp.com.a == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 4 POST /wp-login.php 2 POST /wp-cron.php 2 GET /info.php 1 GET /x.php 1 GET /x/index.php 1 GET /x/ 1 GET /wpupex.php 1 GET /wp-includes/sitemaps/about.php 1 GET /wp-includes/SimplePie/index.php 1 GET /wp-includes/SimplePie/Content/Type/index.php 1 GET /wp-includes/SimplePie/Content/Type/ 1 GET /wp-includes/SimplePie/ -- last 10 requests -- 172.182.200.96 - - [24/Aug/2026:15:36:55 +1000] "GET /info.php HTTP/1.1" 403 13 "-" "-" 172.182.200.96 - - [24/Aug/2026:15:36:55 +1000] "GET /modules/ets_whatsapp/security.php HTTP/1.1" 404 152096 "-" "-" 172.182.200.96 - - [24/Aug/2026:15:36:57 +1000] "GET /wp-includes/blocks/gallery/index.php HTTP/1.1" 301 - "-" "-" 172.182.200.96 - - [24/Aug/2026:15:36:59 +1000] "GET /wp-includes/blocks/gallery/ HTTP/1.1" 200 3050 "-" "-" 172.182.200.96 - - [24/Aug/2026:15:36:59 +1000] "GET /SzATuRit63g.php HTTP/1.1" 404 152094 "-" "-" 172.182.200.96 - - [24/Aug/2026:15:37:01 +1000] "GET /wp-includes/js/tinymce/index.php HTTP/1.1" 301 - "-" "-" 172.182.200.96 - - [24/Aug/2026:15:37:02 +1000] "GET /wp-includes/js/tinymce/ HTTP/1.1" 200 2466 "-" "-" 172.182.200.96 - - [24/Aug/2026:15:37:03 +1000] "GET /wp-admin/gQ2zxmHJ3RF.php HTTP/1.1" 404 152094 "-" "-" 172.182.200.96 - - [24/Aug/2026:15:37:05 +1000] "GET /wp-includes/blocks/query-pagination-numbers/index.php HTTP/1.1" 301 - "-" "-" 172.182.200.96 - - [24/Aug/2026:15:37:06 +1000] "GET /wp-includes/blocks/query-pagination-numbers/ HTTP/1.1" 200 1636 "-" "-" == tubesupplies/tubesupplies.com.au == -- top paths -- 1 GET /x.php 1 GET /x/index.php 1 GET /wpupex.php 1 GET /wp-includes/sitemaps/about.php 1 GET /wp-includes/SimplePie/index.php 1 GET /wp-includes/SimplePie/Content/Type/index.php 1 GET /wp-includes/rest-api/fields/index.php 1 GET /wp-includes/PHPMailer/index.php 1 GET /wp-includes/js/crop/index.php 1 GET /wp-includes/IXR/Ipv6.php 1 GET /wp-includes/Ipv6.php 1 GET /wp-includes/index.php -- last 10 requests -- 172.182.200.96 - - [24/Aug/2026:15:36:39 +1000] "GET /wp-includes/blocks/media-text/index.php HTTP/1.1" 301 315 "-" "-" 172.182.200.96 - - [24/Aug/2026:15:36:40 +1000] "GET /worksec.php HTTP/1.1" 301 287 "-" "-" 172.182.200.96 - - [24/Aug/2026:15:36:42 +1000] "GET /wp-includes/IXR/Ipv6.php HTTP/1.1" 301 300 "-" "-" 172.182.200.96 - - [24/Aug/2026:15:36:44 +1000] "GET /wp-admin/upgrade.php HTTP/1.1" 301 296 "-" "-" 172.182.200.96 - - [24/Aug/2026:15:36:45 +1000] "GET /wp-content/plugins/cp-pro/js.php HTTP/1.1" 301 308 "-" "-" 172.182.200.96 - - [24/Aug/2026:15:36:47 +1000] "GET /shell20211028.php HTTP/1.1" 301 293 "-" "-" 172.182.200.96 - - [24/Aug/2026:15:36:50 +1000] "GET /wp-content/wp-plugins/aspose-pdf-importer/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 301 368 "-" "-" 172.182.200.96 - - [24/Aug/2026:15:36:52 +1000] "GET /wp-includes/certificates/index.php HTTP/1.1" 301 310 "-" "-" 172.182.200.96 - - [24/Aug/2026:15:36:53 +1000] "GET /wp-admin/css/colors/coffee/index.php HTTP/1.1" 301 312 "-" "-" 172.182.200.96 - - [24/Aug/2026:15:36:55 +1000] "GET /info.php HTTP/1.1" 301 284 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-24 15:35:32 L1=1.98 run=2 blk=0 avail=5595 (47.7%) swpO=0 conn=2 myRSS=3106 php=1 phpRSS=167 ap=98 tcp=47 topuser=madalice 2026-08-24 15:35:34 L1=1.98 run=3 blk=0 avail=5654 (48.2%) swpO=0 conn=3 myRSS=3106 php=2 phpRSS=147 ap=96 tcp=46 topuser=tubesupplies 2026-08-24 15:35:42 L1=1.75 run=2 blk=0 avail=5786 (49.3%) swpO=0 conn=2 myRSS=3107 php=1 phpRSS=62 ap=88 tcp=48 topuser=tubesupplies 2026-08-24 15:35:44 L1=1.75 run=1 blk=0 avail=5823 (49.6%) swpO=0 conn=3 myRSS=3107 php=1 phpRSS=39 ap=86 tcp=46 topuser=evolution 2026-08-24 15:35:52 L1=1.56 run=4 blk=0 avail=5789 (49.4%) swpO=0 conn=2 myRSS=3107 php=2 phpRSS=180 ap=77 tcp=41 topuser=tubesupplies 2026-08-24 15:35:54 L1=1.56 run=3 blk=0 avail=5742 (49.0%) swpO=0 conn=3 myRSS=3107 php=3 phpRSS=261 ap=76 tcp=40 topuser=madalice 2026-08-24 15:36:02 L1=1.71 run=2 blk=0 avail=5819 (49.6%) swpO=0 conn=2 myRSS=3107 php=0 phpRSS=0 ap=102 tcp=102 topuser=- 2026-08-24 15:36:04 L1=1.71 run=4 blk=0 avail=5509 (47.0%) swpO=0 conn=3 myRSS=3107 php=3 phpRSS=327 ap=102 tcp=51 topuser=tubesupplies 2026-08-24 15:36:12 L1=1.84 run=2 blk=0 avail=5769 (49.2%) swpO=0 conn=2 myRSS=3107 php=1 phpRSS=65 ap=93 tcp=35 topuser=tubesupplies 2026-08-24 15:36:14 L1=1.84 run=9 blk=0 avail=5682 (48.4%) swpO=0 conn=3 myRSS=3107 php=4 phpRSS=246 ap=92 tcp=39 topuser=evolution 2026-08-24 15:36:22 L1=2.26 run=3 blk=0 avail=5730 (48.9%) swpO=0 conn=2 myRSS=3107 php=2 phpRSS=198 ap=83 tcp=40 topuser=tubesupplies 2026-08-24 15:36:24 L1=2.26 run=4 blk=0 avail=5773 (49.2%) swpO=0 conn=3 myRSS=3107 php=2 phpRSS=146 ap=82 tcp=43 topuser=tubesupplies 2026-08-24 15:36:33 L1=1.99 run=2 blk=0 avail=5818 (49.6%) swpO=0 conn=2 myRSS=3107 php=1 phpRSS=80 ap=73 tcp=38 topuser=tubesupplies 2026-08-24 15:36:34 L1=1.99 run=2 blk=0 avail=5876 (50.1%) swpO=0 conn=3 myRSS=3107 php=2 phpRSS=130 ap=72 tcp=36 topuser=tubesupplies 2026-08-24 15:36:43 L1=1.84 run=2 blk=0 avail=5998 (51.1%) swpO=0 conn=2 myRSS=3107 php=1 phpRSS=38 ap=63 tcp=51 topuser=tubesupplies 2026-08-24 15:36:44 L1=1.84 run=1 blk=0 avail=5996 (51.1%) swpO=0 conn=3 myRSS=3107 php=1 phpRSS=39 ap=62 tcp=51 topuser=evolution 2026-08-24 15:36:53 L1=1.63 run=3 blk=0 avail=5826 (49.7%) swpO=0 conn=3 myRSS=3107 php=2 phpRSS=308 ap=53 tcp=38 topuser=madalice 2026-08-24 15:36:54 L1=1.63 run=3 blk=0 avail=5967 (50.9%) swpO=0 conn=3 myRSS=3107 php=3 phpRSS=200 ap=52 tcp=52 topuser=tubesupplies 2026-08-24 15:37:03 L1=2.17 run=2 blk=0 avail=5953 (50.8%) swpO=1 conn=3 myRSS=3107 php=3 phpRSS=271 ap=43 tcp=47 topuser=madalice 2026-08-24 15:37:04 L1=2.17 run=7 blk=0 avail=5640 (48.1%) swpO=1 conn=3 myRSS=3107 php=5 phpRSS=631 ap=42 tcp=51 topuser=madalice 2026-08-24 15:37:13 L1=2.06 run=2 blk=0 avail=6171 (52.6%) swpO=0 conn=3 myRSS=3107 php=1 phpRSS=61 ap=35 tcp=31 topuser=tubesupplies 2026-08-24 15:37:14 L1=2.06 run=1 blk=0 avail=6200 (52.9%) swpO=0 conn=3 myRSS=3107 php=1 phpRSS=39 ap=34 tcp=30 topuser=evolution 2026-08-24 15:37:23 L1=1.91 run=2 blk=0 avail=6183 (52.7%) swpO=0 conn=3 myRSS=3107 php=1 phpRSS=111 ap=25 tcp=36 topuser=tubesupplies 2026-08-24 15:37:24 L1=1.91 run=3 blk=0 avail=6170 (52.6%) swpO=0 conn=3 myRSS=3107 php=2 phpRSS=152 ap=24 tcp=39 topuser=tubesupplies 2026-08-24 15:37:33 L1=1.77 run=1 blk=0 avail=6279 (53.5%) swpO=0 conn=3 myRSS=3107 php=0 phpRSS=0 ap=24 tcp=38 topuser=- 2026-08-24 15:37:34 L1=1.77 run=1 blk=0 avail=6264 (53.4%) swpO=0 conn=3 myRSS=3107 php=1 phpRSS=39 ap=24 tcp=42 topuser=evolution 2026-08-24 15:37:43 L1=1.57 run=4 blk=0 avail=6101 (52.0%) swpO=0 conn=3 myRSS=3107 php=1 phpRSS=195 ap=28 tcp=34 topuser=madalice 2026-08-24 15:37:44 L1=1.57 run=3 blk=0 avail=6134 (52.3%) swpO=0 conn=3 myRSS=3107 php=3 phpRSS=216 ap=28 tcp=36 topuser=madalice 2026-08-24 15:37:53 L1=1.64 run=12 blk=0 avail=5192 (44.3%) swpO=0 conn=9 myRSS=3108 php=13 phpRSS=1052 ap=91 tcp=87 topuser=madalice 2026-08-24 15:37:54 L1=1.64 run=15 blk=2 avail=4365 (37.2%) swpO=506 conn=5 myRSS=3090 php=13 phpRSS=1885 ap=90 tcp=82 topuser=madalice