INCIDENT 2026-08-24 21:22:51 trigger: php_rss=1529MB ================================================================== load: 1.84 1.54 1.31 25/631 1161162 ncpu:10 mem_avail: 5191MB/11729MB (44.3%) swap_used:3602MB swapout:11/s blocked(D):0 running:17 iowait:0.2% steal:0.0% php: 14 procs / 1529MB heaviest user: madalice (13 procs, 1468MB) apache: 21 procs tcp_estab: 44 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3126 madalice 15 1763 root 233 917 nobody 21 368 netdata 8 262 mailman 20 92 evolution 5 84 cpanellogin 1 63 dovenull 6 26 mailnull 3 23 wp-toolkit 6 18 zabbix 1 14 infinium 1 12 kurri 1 11 named 1 10 alison 1 9 dovecot 3 7 nscd 1 6 cpanelconnecttrack 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 15 1790 evolution 1 72 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5441 MB Active(file): 3965 MB Inactive(file): 624 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 391 MB CommitLimit: 9960 MB Committed_AS: 9223 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3032611 root 20:11:35 2448 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 3187004 10.0 Ssl 9-13:32:18 /usr/sbin/mariadbd 1161107 1144870 madalice 248196 112 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1161108 1144881 madalice 225988 106 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 215516 0.0 Ss 9-13:32:21 /usr/lib/systemd/systemd-journald 1220 1 netdata 209720 2.5 Ssl 56-11:13:00 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1161112 1144679 madalice 182760 92.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1161111 1129255 madalice 182316 80.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1161110 1144877 madalice 180948 88.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3080744 3075441 root 175876 0.0 S 18:50:15 spamd child 1161113 1129168 madalice 171808 84.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3879330 3075441 root 150712 0.0 S 07:24:02 spamd child 1161122 1144864 madalice 131048 106 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1161121 1160521 madalice 117768 92.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1161123 1160004 madalice 112132 82.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1161120 1144256 madalice 110588 102 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1161126 1161058 evolution 95536 42.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3075441 1 root 89968 0.0 Ss 18:59:54 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1161127 1161124 madalice 77284 39.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1161128 1161125 madalice 74460 38.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1161146 1160005 madalice 68624 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1161147 1145427 madalice 68364 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3418681 1353308 cpanellogin 65116 0.0 S 11:24:00 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 2223 1201 root 55100 0.0 Sl 56-11:12:59 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1161159 1161115 madalice 55004 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1469 1 root 40796 0.1 Ss 56-11:12:59 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 33764 0.1 Sl 56-11:12:55 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1463 1 root 23164 0.0 Ss 56-11:12:59 tailwatchd 1129168 1276780 nobody 22632 0.0 S 07:51 /usr/sbin/httpd -k start 1112588 1276780 nobody 22584 0.0 S 13:02 /usr/sbin/httpd -k start 1144877 1276780 nobody 22168 0.1 S 03:56 /usr/sbin/httpd -k start 1353308 1 root 21840 0.0 Ss 33-18:41:30 cpsrvd (SSL) - waiting for connections 1129255 1276780 nobody 21384 0.1 S 07:50 /usr/sbin/httpd -k start 3074682 1 root 21228 0.0 Ss 19:00:28 lfd - sleeping 1144869 1276780 nobody 20848 0.0 S 03:57 /usr/sbin/httpd -k start 1144256 1276780 nobody 20676 0.0 S 04:56 /usr/sbin/httpd -k start 1144679 1276780 nobody 20580 0.0 S 04:19 /usr/sbin/httpd -k start 1144881 1276780 nobody 20400 0.0 S 03:56 /usr/sbin/httpd -k start 1144870 1276780 nobody 20360 0.0 S 03:57 /usr/sbin/httpd -k start 1144864 1276780 nobody 20352 0.0 S 03:58 /usr/sbin/httpd -k start 1160005 1276780 nobody 20240 0.0 S 01:48 /usr/sbin/httpd -k start 1145427 1276780 nobody 20044 0.0 S 03:18 /usr/sbin/httpd -k start 1160004 1276780 nobody 19592 0.3 S 01:48 /usr/sbin/httpd -k start 1161156 1112588 nobody 18528 0.0 S 00:00 /usr/local/cpanel/cgi-sys/autodiscover.cgi 185104 2431 netdata 18072 2.1 Rl 12-00:49:18 /usr/libexec/netdata/plugins.d/apps.plugin 1 1160521 1276780 nobody 17220 0.0 S 01:03 /usr/sbin/httpd -k start 1471 1 root 17092 0.0 Ss 56-11:12:59 cPhulkd - processor 704625 1471 root 16864 0.0 S 02:22:14 cPhulkd - dbprocessor 1161058 1276780 nobody 16636 0.1 S 00:08 /usr/sbin/httpd -k start 1161115 1276780 nobody 16584 0.5 S 00:02 /usr/sbin/httpd -k start 1161124 1276780 nobody 15668 0.0 S 00:01 /usr/sbin/httpd -k start 1161125 1276780 nobody 15620 0.0 S 00:01 /usr/sbin/httpd -k start 1204 1 zabbix 14692 0.2 Ssl 56-11:13:00 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1063114 3828812 infinium 12460 0.0 S 29:41 dovecot/imap 1276780 1 root 12004 0.0 Ss 19-05:51:35 /usr/sbin/httpd -k start 72234 3828812 kurri 11712 0.0 S 05:35:51 dovecot/imap 2107664 1 named 11236 0.0 Ssl 5-19:00:14 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 2111716 1 mailnull 11224 0.0 Ss 5-18:59:52 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1144165 3828812 root 10956 0.0 S 05:07 dovecot/auth -w 1160461 3828812 alison 9956 0.0 S 01:10 dovecot/quota-status -p postfix 1161190 1276780 nobody 9620 0.0 S 00:00 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 28074062 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/evolutionerp.com.au-ssl_log 264 madalice/madalice.com.au-ssl_log 73 alison/alisonarts.com.au-ssl_log 71 evolution/portal.evolutionerp.com.au-ssl_log 55 infinium/infinium.net.au-ssl_log 11 evolution/my.evolutionerp.com.au-ssl_log 6 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 262 161.118.199.50 68 20.203.162.73 58 20.63.219.114 55 203.54.180.238 11 20.48.147.90 7 134.209.147.251 3 118.127.40.55 2 69.165.75.140 2 40.77.167.157 2 175.36.227.212 2 114.119.130.40 1 91.92.243.239 1 52.167.144.143 1 2a03:2880:f802:1d:: 1 129.146.77.150 --- top request paths across all vhosts (last 3 min) --- 107 GET /wp-login.php 105 GET /wp-admin/index.php 53 POST /wp-login.php 27 GET /factory_session_checker.php 14 GET /factory_session_processed_qty.php 14 GET /factory_session_joiner.php 11 GET /autodiscover/autodiscover.xml 4 GET /index.php 3 POST /functions.php 3 GET /admin.php 2 POST /wp-cron.php 2 GET /wp/wp-login.php 2 GET /store/hand-painted-nike-af1-single-butterfly/ 2 GET /blog/wp-login.php 2 GET /als.php 1 POST /wp-comments-post.php 1 POST /wp-admin/admin-ajax.php 1 GET /ztv.php 1 GET /zk.php 1 GET /yj09.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 105 GET /wp-login.php 105 GET /wp-admin/index.php 52 POST /wp-login.php 2 POST /wp-cron.php -- last 10 requests -- 161.118.199.50 - - [24/Aug/2026:21:22:43 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Fevolutionerp.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 11850 "https://evolutionerp.com.au/wp-login.php" "Mozilla/5.0 161.118.199.50 - - [24/Aug/2026:21:22:44 +1000] "POST /wp-login.php HTTP/1.1" 200 11767 "https://evolutionerp.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) C 161.118.199.50 - - [24/Aug/2026:21:22:45 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://evolutionerp.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) 161.118.199.50 - - [24/Aug/2026:21:22:45 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Fevolutionerp.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 11850 "https://evolutionerp.com.au/wp-login.php" "Mozilla/5.0 161.118.199.50 - - [24/Aug/2026:21:22:46 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://evolutionerp.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) 161.118.199.50 - - [24/Aug/2026:21:22:47 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Fevolutionerp.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 11850 "https://evolutionerp.com.au/wp-login.php" "Mozilla/5.0 161.118.199.50 - - [24/Aug/2026:21:22:47 +1000] "POST /wp-login.php HTTP/1.1" 200 11767 "https://evolutionerp.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) 161.118.199.50 - - [24/Aug/2026:21:22:48 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://evolutionerp.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko 161.118.199.50 - - [24/Aug/2026:21:22:49 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Fevolutionerp.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 11850 "https://evolutionerp.com.au/wp-login.php" "Mozilla/5.0 161.118.199.50 - - [24/Aug/2026:21:22:49 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://evolutionerp.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko == madalice/madalice.com.au-ssl_log == -- top paths -- 2 GET /wp/wp-login.php 2 GET /wp-login.php 2 GET /store/hand-painted-nike-af1-single-butterfly/ 2 GET /blog/wp-login.php 1 POST /wp-admin/admin-ajax.php 1 GET /ztv.php 1 GET /zk.php 1 GET /xmlrpc.php 1 GET /wsoshell.php 1 GET /wp-securitiy.php 1 GET /wp-miiss.php 1 GET /wp-json/wp/v2/users -- last 10 requests -- 20.63.219.114 - - [24/Aug/2026:21:22:19 +1000] "GET /old-index.php HTTP/1.1" 404 30637 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.219.114 - - [24/Aug/2026:21:22:21 +1000] "GET /wp-content/1.php HTTP/1.1" 404 30636 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 114.119.137.101 - - [24/Aug/2026:21:22:39 +1000] "GET /store/swarovski-crystal-am90/?amp%3Brating=3&wcpr_verified=1&wcpr_page=2 HTTP/1.1" 200 45333 "https://madalice.com.au/store/swarovski-crystal-am90/?amp%3Brating=3&wc 134.209.147.251 - - [24/Aug/2026:21:22:41 +1000] "GET /blog/wp-login.php HTTP/1.1" 404 30631 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" 134.209.147.251 - - [24/Aug/2026:21:22:42 +1000] "GET /wp-login.php HTTP/1.1" 200 4022 "http://madalice.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0. 134.209.147.251 - - [24/Aug/2026:21:22:42 +1000] "GET /wp/wp-login.php HTTP/1.1" 404 30630 "http://madalice.com.au/wp/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome 134.209.147.251 - - [24/Aug/2026:21:22:44 +1000] "GET /wp-login.php HTTP/1.1" 200 4022 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" 134.209.147.251 - - [24/Aug/2026:21:22:44 +1000] "GET /blog/wp-login.php HTTP/1.1" 404 30631 "http://madalice.com.au/blog/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Ch 134.209.147.251 - - [24/Aug/2026:21:22:44 +1000] "GET /wp/wp-login.php HTTP/1.1" 404 30630 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" 134.209.147.251 - - [24/Aug/2026:21:22:46 +1000] "GET /wp-json/wp/v2/users?per_page=100 HTTP/1.1" 401 94 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.3 == alison/alisonarts.com.au-ssl_log == -- top paths -- 3 GET /admin.php 1 POST /wp-login.php 1 POST /wp-comments-post.php 1 GET /yj09.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp.php 1 GET /w.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-0.php 1 GET /this_is_a_new_hello_world.php 1 GET /system_log.php -- last 10 requests -- 20.203.162.73 - - [24/Aug/2026:21:21:26 +1000] "GET /f35.php HTTP/1.1" 401 36 "-" "-" 20.203.162.73 - - [24/Aug/2026:21:21:26 +1000] "GET /aaa.php HTTP/1.1" 401 36 "-" "-" 20.203.162.73 - - [24/Aug/2026:21:21:27 +1000] "GET /gecko.php HTTP/1.1" 401 36 "-" "-" 20.203.162.73 - - [24/Aug/2026:21:21:28 +1000] "GET /xiugai.php HTTP/1.1" 401 36 "-" "-" 20.203.162.73 - - [24/Aug/2026:21:21:28 +1000] "GET /adminner.php HTTP/1.1" 401 36 "-" "-" 20.203.162.73 - - [24/Aug/2026:21:21:29 +1000] "GET /file1221.php HTTP/1.1" 401 36 "-" "-" 20.203.162.73 - - [24/Aug/2026:21:21:29 +1000] "GET /inx.php HTTP/1.1" 401 36 "-" "-" 20.203.162.73 - - [24/Aug/2026:21:21:30 +1000] "GET /reviall.php HTTP/1.1" 401 36 "-" "-" 20.203.162.73 - - [24/Aug/2026:21:21:31 +1000] "GET /11.php HTTP/1.1" 401 36 "-" "-" 20.203.162.73 - - [24/Aug/2026:21:21:31 +1000] "GET /File.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-24 21:20:28 L1=1.84 run=2 blk=0 avail=6214 (53.0%) swpO=0 conn=2 myRSS=3133 php=1 phpRSS=80 ap=18 tcp=30 topuser=evolution 2026-08-24 21:20:31 L1=1.85 run=6 blk=0 avail=5880 (50.1%) swpO=1 conn=2 myRSS=3133 php=4 phpRSS=508 ap=18 tcp=29 topuser=madalice 2026-08-24 21:20:38 L1=1.87 run=3 blk=0 avail=5973 (50.9%) swpO=1 conn=2 myRSS=3133 php=2 phpRSS=170 ap=18 tcp=23 topuser=evolution 2026-08-24 21:20:41 L1=1.72 run=3 blk=0 avail=6047 (51.6%) swpO=0 conn=2 myRSS=3133 php=2 phpRSS=288 ap=18 tcp=23 topuser=madalice 2026-08-24 21:20:48 L1=1.66 run=4 blk=0 avail=5975 (50.9%) swpO=0 conn=2 myRSS=3133 php=3 phpRSS=386 ap=18 tcp=27 topuser=olympic 2026-08-24 21:20:51 L1=1.69 run=3 blk=0 avail=5966 (50.9%) swpO=0 conn=2 myRSS=3133 php=3 phpRSS=379 ap=18 tcp=24 topuser=madalice 2026-08-24 21:20:58 L1=1.63 run=3 blk=0 avail=6109 (52.1%) swpO=0 conn=2 myRSS=3133 php=2 phpRSS=220 ap=18 tcp=26 topuser=alison 2026-08-24 21:21:01 L1=1.66 run=4 blk=0 avail=6052 (51.6%) swpO=0 conn=3 myRSS=3133 php=2 phpRSS=277 ap=18 tcp=26 topuser=madalice 2026-08-24 21:21:09 L1=2.01 run=5 blk=0 avail=5815 (49.6%) swpO=0 conn=2 myRSS=3133 php=2 phpRSS=264 ap=21 tcp=29 topuser=corpkicks 2026-08-24 21:21:11 L1=2.09 run=4 blk=0 avail=5927 (50.5%) swpO=0 conn=3 myRSS=3133 php=2 phpRSS=379 ap=21 tcp=24 topuser=madalice 2026-08-24 21:21:19 L1=2.00 run=2 blk=0 avail=6235 (53.2%) swpO=0 conn=2 myRSS=3133 php=1 phpRSS=42 ap=20 tcp=28 topuser=madalice 2026-08-24 21:21:21 L1=2.00 run=3 blk=0 avail=5951 (50.7%) swpO=0 conn=3 myRSS=3133 php=2 phpRSS=358 ap=20 tcp=27 topuser=madalice 2026-08-24 21:21:29 L1=1.93 run=6 blk=0 avail=6041 (51.5%) swpO=0 conn=3 myRSS=3133 php=2 phpRSS=278 ap=20 tcp=22 topuser=madalice 2026-08-24 21:21:31 L1=1.93 run=3 blk=0 avail=6025 (51.4%) swpO=0 conn=3 myRSS=3133 php=2 phpRSS=284 ap=20 tcp=22 topuser=madalice 2026-08-24 21:21:39 L1=1.78 run=2 blk=0 avail=6148 (52.4%) swpO=0 conn=3 myRSS=3133 php=1 phpRSS=174 ap=19 tcp=27 topuser=madalice 2026-08-24 21:21:41 L1=1.78 run=7 blk=0 avail=6176 (52.7%) swpO=0 conn=3 myRSS=3133 php=2 phpRSS=178 ap=19 tcp=25 topuser=madalice 2026-08-24 21:21:49 L1=1.98 run=4 blk=0 avail=5896 (50.3%) swpO=2 conn=3 myRSS=3133 php=4 phpRSS=495 ap=20 tcp=27 topuser=tubesupplies 2026-08-24 21:21:51 L1=1.98 run=3 blk=0 avail=6110 (52.1%) swpO=2 conn=3 myRSS=3133 php=2 phpRSS=237 ap=20 tcp=24 topuser=madalice 2026-08-24 21:21:59 L1=1.90 run=3 blk=0 avail=6121 (52.2%) swpO=0 conn=3 myRSS=3133 php=2 phpRSS=233 ap=20 tcp=21 topuser=madalice 2026-08-24 21:22:01 L1=1.90 run=3 blk=0 avail=6196 (52.8%) swpO=0 conn=2 myRSS=3133 php=1 phpRSS=133 ap=20 tcp=19 topuser=madalice 2026-08-24 21:22:09 L1=1.92 run=6 blk=0 avail=5982 (51.0%) swpO=0 conn=3 myRSS=3133 php=3 phpRSS=421 ap=18 tcp=22 topuser=madalice 2026-08-24 21:22:11 L1=1.92 run=3 blk=0 avail=6147 (52.4%) swpO=0 conn=2 myRSS=3133 php=2 phpRSS=220 ap=18 tcp=23 topuser=evolution 2026-08-24 21:22:19 L1=1.78 run=3 blk=0 avail=5998 (51.1%) swpO=0 conn=3 myRSS=3133 php=3 phpRSS=400 ap=18 tcp=24 topuser=madalice 2026-08-24 21:22:21 L1=1.78 run=3 blk=0 avail=6078 (51.8%) swpO=0 conn=2 myRSS=3133 php=2 phpRSS=270 ap=18 tcp=22 topuser=madalice 2026-08-24 21:22:29 L1=1.66 run=2 blk=0 avail=6194 (52.8%) swpO=0 conn=2 myRSS=3133 php=1 phpRSS=146 ap=18 tcp=19 topuser=evolution 2026-08-24 21:22:31 L1=1.66 run=1 blk=0 avail=6316 (53.9%) swpO=0 conn=2 myRSS=3133 php=0 phpRSS=0 ap=18 tcp=17 topuser=- 2026-08-24 21:22:39 L1=1.64 run=4 blk=0 avail=6240 (53.2%) swpO=0 conn=2 myRSS=3133 php=2 phpRSS=137 ap=17 tcp=20 topuser=evolution 2026-08-24 21:22:41 L1=1.64 run=5 blk=0 avail=6054 (51.6%) swpO=0 conn=2 myRSS=3133 php=3 phpRSS=356 ap=17 tcp=21 topuser=madalice 2026-08-24 21:22:49 L1=1.84 run=4 blk=0 avail=6285 (53.6%) swpO=0 conn=2 myRSS=3133 php=1 phpRSS=57 ap=18 tcp=22 topuser=evolution 2026-08-24 21:22:51 L1=1.84 run=17 blk=0 avail=5191 (44.3%) swpO=11 conn=14 myRSS=3133 php=14 phpRSS=1529 ap=21 tcp=44 topuser=madalice