INCIDENT 2026-08-24 22:17:14 trigger: php_rss=1599MB mysql_conn=18 ================================================================== load: 1.51 1.00 1.02 21/639 1342144 ncpu:10 mem_avail: 5674MB/11729MB (48.4%) swap_used:3945MB swapout:0/s blocked(D):0 running:18 iowait:7.9% steal:0.0% php: 17 procs / 1599MB heaviest user: evolution (16 procs, 1495MB) apache: 24 procs tcp_estab: 43 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2857 evolution 22 1814 root 237 685 nobody 23 355 netdata 8 249 madalice 1 124 mailman 20 92 cpanellogin 1 62 mailnull 3 27 dovenull 6 26 wp-toolkit 6 17 zabbix 1 14 aaa 1 13 infinium 1 12 candyfabcom 1 11 named 1 10 kurri 1 10 dovecot 3 7 nscd 1 6 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB evolution 17 1657 madalice 1 127 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4508 MB Active(file): 1391 MB Inactive(file): 3059 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 423 MB CommitLimit: 9960 MB Committed_AS: 8334 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1277047 root 17:14 3036 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3032611 root 21:05:58 2040 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2925744 10.0 Ssl 9-14:26:41 /usr/sbin/mariadbd 1220 1 netdata 197128 2.5 Ssl 56-12:07:23 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1342096 1342074 evolution 175312 45.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1342100 1341317 evolution 172568 46.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3080744 3075441 root 171972 0.0 S 19:44:38 spamd child 1342102 1341334 evolution 165068 40.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1342105 1342068 evolution 149836 34.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1342101 1341230 evolution 145884 33.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1342095 1325512 madalice 140164 63.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1342104 1342069 evolution 139192 28.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1342098 1342075 evolution 138912 30.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1342116 1325694 evolution 118072 43.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3879330 3075441 root 109940 0.0 S 08:18:25 spamd child 1342103 1341260 evolution 109052 20.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1342108 1342106 evolution 107448 40.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1342110 1341331 evolution 100868 35.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1342107 1342061 evolution 96992 33.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1342109 1341313 evolution 93080 32.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3075441 1 root 89564 0.0 Ss 19:54:17 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1342129 1341341 evolution 74424 16.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1342138 1341328 evolution 68844 12.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1342153 1325700 evolution 67748 12.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3418681 1353308 cpanellogin 64348 0.0 S 12:18:23 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 1342119 1341291 evolution 63472 10.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2223 1201 root 47188 0.0 Sl 56-12:07:22 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 2575382 1 root 43252 0.0 Ss 9-14:26:44 /usr/lib/systemd/systemd-journald 1342154 1342073 evolution 42720 5.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1469 1 root 35588 0.1 Ss 56-12:07:22 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 33976 0.1 Sl 56-12:07:18 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1463 1 root 22496 0.0 Ss 56-12:07:22 tailwatchd 1325512 1276780 nobody 21024 0.1 S 05:24 /usr/sbin/httpd -k start 1353308 1 root 20716 0.0 Ss 33-19:35:53 cpsrvd (SSL) - waiting for connections 3074682 1 root 20340 0.0 Ss 19:54:51 lfd - sleeping 1325700 1276780 nobody 20260 0.0 S 05:07 /usr/sbin/httpd -k start 1325694 1276780 nobody 19236 0.0 S 05:08 /usr/sbin/httpd -k start 1341260 1276780 nobody 18632 0.0 S 01:20 /usr/sbin/httpd -k start 185104 2431 netdata 17976 2.1 Sl 12-01:43:41 /usr/libexec/netdata/plugins.d/apps.plugin 1 1341291 1276780 nobody 17176 0.0 S 01:18 /usr/sbin/httpd -k start 1341230 1276780 nobody 17140 0.0 S 01:21 /usr/sbin/httpd -k start 1341317 1276780 nobody 16828 0.0 S 01:17 /usr/sbin/httpd -k start 1341331 1276780 nobody 16748 0.0 S 01:17 /usr/sbin/httpd -k start 1342069 1276780 nobody 16688 0.1 S 00:07 /usr/sbin/httpd -k start 1341313 1276780 nobody 16668 0.0 S 01:17 /usr/sbin/httpd -k start 1341328 1276780 nobody 16624 0.0 S 01:17 /usr/sbin/httpd -k start 1341341 1276780 nobody 16572 0.0 S 01:17 /usr/sbin/httpd -k start 1341333 1276780 nobody 16564 0.0 S 01:17 /usr/sbin/httpd -k start 1341334 1276780 nobody 16528 0.0 S 01:17 /usr/sbin/httpd -k start 1341322 1276780 nobody 16496 0.0 S 01:17 /usr/sbin/httpd -k start 1342073 1276780 nobody 16324 0.1 S 00:06 /usr/sbin/httpd -k start 1342068 1276780 nobody 16284 0.1 S 00:07 /usr/sbin/httpd -k start 1342061 1276780 nobody 16276 0.1 S 00:08 /usr/sbin/httpd -k start 1342074 1276780 nobody 15648 0.1 S 00:06 /usr/sbin/httpd -k start 1342106 1276780 nobody 15648 0.0 S 00:02 /usr/sbin/httpd -k start 1342075 1276780 nobody 15616 0.1 S 00:06 /usr/sbin/httpd -k start 1471 1 root 15260 0.0 Ss 56-12:07:22 cPhulkd - processor 1204 1 zabbix 14808 0.2 Ssl 56-12:07:23 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1342161 1276780 nobody 14532 0.0 S 00:01 /usr/sbin/httpd -k start 1342162 1276780 nobody 14532 0.0 S 00:01 /usr/sbin/httpd -k start 704625 1471 root 14308 0.0 S 03:16:37 cPhulkd - dbprocessor 1292896 3828812 aaa 13400 0.0 S 13:45 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 28079449 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 28079448 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Writing to net | SELECT option_name, option_value FROM QpCIPREUS_options WHERE autoload IN ( 'yes', 'on', 'auto-on', 'auto' ) | +----------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min candyfabcom/candyfab.com.au-ssl_log 90 whiz/whizengineering.com.au-ssl_log 88 lowrange/lowrange.com.au 55 madalice/madalice.com.au-ssl_log 52 evolution/portal.evolutionerp.com.au-ssl_log 50 evolution/evolutionerp.com.au-ssl_log 17 corpkicks/corporatekicks.com.au-ssl_log 4 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 145 20.151.129.194 88 20.52.41.200 50 203.54.180.238 44 20.220.10.235 16 135.148.46.133 3 49.178.179.215 2 118.127.40.55 1 34.196.51.17 1 207.46.13.168 1 207.46.13.102 1 192.178.7.37 1 114.119.159.70 1 114.119.143.104 1 114.119.140.234 1 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 25 GET /factory_session_checker.php 13 GET /factory_session_processed_qty.php 12 GET /factory_session_joiner.php 4 GET /fling.php 4 GET /admin.php 4 GET / 3 GET /xty.php 3 GET /wp-json/wp/v2/users 3 GET /nofile.php 3 GET /new.php 2 POST /wp-cron.php 2 GET /zoo2.php 2 GET /zoo1.php 2 GET /wp/wp-login.php 2 GET /wp.php 2 GET /wp-login.php 2 GET /wp-content/min.php 2 GET /store/hand-painted-nike-af1-biteme/ 2 GET /simple.php 2 GET /shiny.php --- busiest 3 vhosts: top paths + last 10 requests --- == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 3 GET /admin.php 1 GET /zoo1.php 1 GET /yj09.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp.php 1 GET /w.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-0.php 1 GET /this_is_a_new_hello_world.php 1 GET /system_log.php 1 GET /sky.php -- last 10 requests -- 20.151.129.194 - - [24/Aug/2026:22:16:10 +1000] "GET /site.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [24/Aug/2026:22:16:10 +1000] "GET /cabs.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [24/Aug/2026:22:16:11 +1000] "GET /insc.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [24/Aug/2026:22:16:11 +1000] "GET /file.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [24/Aug/2026:22:16:11 +1000] "GET /dex.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [24/Aug/2026:22:16:12 +1000] "GET /key.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [24/Aug/2026:22:16:12 +1000] "GET /kir.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [24/Aug/2026:22:16:13 +1000] "GET /nofile.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [24/Aug/2026:22:16:13 +1000] "GET /fling.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [24/Aug/2026:22:16:14 +1000] "GET /zoo1.php HTTP/1.1" 401 36 "-" "-" == whiz/whizengineering.com.au-ssl_log == -- top paths -- 1 GET /zoom1.php 1 GET /xx.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /ws81.php 1 GET /ws77.php 1 GET /ws37.php 1 GET /wp-trackback.php 1 GET /wp-the.php 1 GET /wp-themes.php 1 GET /wp-includes/PHPMailer/ -- last 10 requests -- 20.52.41.200 - - [24/Aug/2026:22:16:22 +1000] "GET /wp-includes/css/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [24/Aug/2026:22:16:22 +1000] "GET /xx.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [24/Aug/2026:22:16:23 +1000] "GET /wp-content/about.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [24/Aug/2026:22:16:23 +1000] "GET /wp-includes/assets/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [24/Aug/2026:22:16:23 +1000] "GET /wp-the.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [24/Aug/2026:22:16:24 +1000] "GET /ws81.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [24/Aug/2026:22:16:24 +1000] "GET /3.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [24/Aug/2026:22:16:24 +1000] "GET /a1.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [24/Aug/2026:22:16:24 +1000] "GET /ca5.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [24/Aug/2026:22:16:25 +1000] "GET /install.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == lowrange/lowrange.com.au == -- top paths -- 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /ws85.php 1 GET /wp.php 1 GET /waff.php 1 GET /w3lls.php 1 GET /w3llscc.php 1 GET /vpn.php 1 GET /user3.php 1 GET /t3.php 1 GET /simple.php -- last 10 requests -- 20.151.129.194 - - [24/Aug/2026:22:15:09 +1000] "GET /run.php HTTP/1.1" 404 - "-" "-" 20.151.129.194 - - [24/Aug/2026:22:15:10 +1000] "GET /new.php HTTP/1.1" 403 13 "-" "-" 20.151.129.194 - - [24/Aug/2026:22:15:10 +1000] "GET /inx.php HTTP/1.1" 404 - "-" "-" 20.151.129.194 - - [24/Aug/2026:22:15:10 +1000] "GET /vpn.php HTTP/1.1" 404 - "-" "-" 20.151.129.194 - - [24/Aug/2026:22:15:10 +1000] "GET /shiny.php HTTP/1.1" 404 - "-" "-" 20.151.129.194 - - [24/Aug/2026:22:15:10 +1000] "GET /goods.php HTTP/1.1" 404 - "-" "-" 20.151.129.194 - - [24/Aug/2026:22:15:11 +1000] "GET /user3.php HTTP/1.1" 404 - "-" "-" 20.151.129.194 - - [24/Aug/2026:22:15:11 +1000] "GET /waff.php HTTP/1.1" 404 - "-" "-" 20.151.129.194 - - [24/Aug/2026:22:15:11 +1000] "GET /alfa.php HTTP/1.1" 403 13 "-" "-" 20.151.129.194 - - [24/Aug/2026:22:15:11 +1000] "GET /33.php HTTP/1.1" 404 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-24 22:14:53 L1=0.30 run=2 blk=0 avail=6757 (57.6%) swpO=0 conn=1 myRSS=2856 php=0 phpRSS=0 ap=14 tcp=23 topuser=- 2026-08-24 22:14:54 L1=0.30 run=2 blk=0 avail=6674 (56.9%) swpO=0 conn=1 myRSS=2856 php=1 phpRSS=112 ap=14 tcp=23 topuser=madalice 2026-08-24 22:15:03 L1=0.41 run=5 blk=0 avail=6466 (55.1%) swpO=0 conn=1 myRSS=2856 php=3 phpRSS=350 ap=14 tcp=27 topuser=madalice 2026-08-24 22:15:04 L1=0.41 run=5 blk=0 avail=6512 (55.5%) swpO=0 conn=1 myRSS=2856 php=2 phpRSS=270 ap=14 tcp=27 topuser=madalice 2026-08-24 22:15:13 L1=0.80 run=2 blk=0 avail=6622 (56.5%) swpO=0 conn=1 myRSS=2856 php=2 phpRSS=176 ap=14 tcp=26 topuser=madalice 2026-08-24 22:15:14 L1=0.80 run=3 blk=0 avail=6532 (55.7%) swpO=0 conn=1 myRSS=2856 php=2 phpRSS=267 ap=14 tcp=24 topuser=madalice 2026-08-24 22:15:23 L1=0.83 run=4 blk=0 avail=6415 (54.7%) swpO=0 conn=4 myRSS=2856 php=3 phpRSS=414 ap=14 tcp=25 topuser=madalice 2026-08-24 22:15:24 L1=0.83 run=2 blk=0 avail=6466 (55.1%) swpO=0 conn=1 myRSS=2856 php=2 phpRSS=332 ap=14 tcp=24 topuser=madalice 2026-08-24 22:15:33 L1=0.78 run=3 blk=0 avail=6671 (56.9%) swpO=0 conn=4 myRSS=2856 php=1 phpRSS=100 ap=14 tcp=28 topuser=madalice 2026-08-24 22:15:34 L1=0.78 run=3 blk=0 avail=6569 (56.0%) swpO=0 conn=1 myRSS=2856 php=1 phpRSS=186 ap=15 tcp=27 topuser=madalice 2026-08-24 22:15:43 L1=0.89 run=2 blk=0 avail=6710 (57.2%) swpO=0 conn=4 myRSS=2856 php=0 phpRSS=0 ap=17 tcp=28 topuser=- 2026-08-24 22:15:44 L1=0.89 run=2 blk=0 avail=6651 (56.7%) swpO=0 conn=2 myRSS=2856 php=1 phpRSS=91 ap=17 tcp=28 topuser=madalice 2026-08-24 22:15:53 L1=1.07 run=4 blk=0 avail=6569 (56.0%) swpO=0 conn=4 myRSS=2856 php=1 phpRSS=161 ap=18 tcp=72 topuser=madalice 2026-08-24 22:15:54 L1=1.07 run=4 blk=0 avail=6686 (57.0%) swpO=0 conn=2 myRSS=2856 php=0 phpRSS=0 ap=20 tcp=72 topuser=- 2026-08-24 22:16:03 L1=1.31 run=2 blk=0 avail=6217 (53.0%) swpO=0 conn=4 myRSS=2856 php=1 phpRSS=105 ap=80 tcp=50 topuser=madalice 2026-08-24 22:16:04 L1=1.31 run=3 blk=0 avail=6135 (52.3%) swpO=0 conn=2 myRSS=2856 php=1 phpRSS=193 ap=79 tcp=46 topuser=madalice 2026-08-24 22:16:13 L1=1.26 run=2 blk=0 avail=6178 (52.7%) swpO=0 conn=4 myRSS=2856 php=1 phpRSS=217 ap=70 tcp=28 topuser=corpkicks 2026-08-24 22:16:14 L1=1.26 run=2 blk=0 avail=6311 (53.8%) swpO=0 conn=2 myRSS=2856 php=1 phpRSS=98 ap=69 tcp=28 topuser=madalice 2026-08-24 22:16:23 L1=1.07 run=2 blk=0 avail=6311 (53.8%) swpO=0 conn=2 myRSS=2856 php=1 phpRSS=165 ap=60 tcp=27 topuser=madalice 2026-08-24 22:16:24 L1=1.07 run=1 blk=0 avail=6449 (55.0%) swpO=0 conn=2 myRSS=2856 php=0 phpRSS=0 ap=59 tcp=27 topuser=- 2026-08-24 22:16:33 L1=1.06 run=3 blk=0 avail=6449 (55.0%) swpO=0 conn=2 myRSS=2856 php=1 phpRSS=94 ap=50 tcp=23 topuser=madalice 2026-08-24 22:16:34 L1=1.06 run=2 blk=0 avail=6373 (54.3%) swpO=0 conn=2 myRSS=2856 php=1 phpRSS=177 ap=49 tcp=23 topuser=madalice 2026-08-24 22:16:43 L1=1.05 run=2 blk=0 avail=6581 (56.1%) swpO=0 conn=2 myRSS=2856 php=0 phpRSS=0 ap=40 tcp=21 topuser=- 2026-08-24 22:16:44 L1=1.04 run=3 blk=0 avail=6523 (55.6%) swpO=0 conn=2 myRSS=2856 php=1 phpRSS=95 ap=39 tcp=22 topuser=madalice 2026-08-24 22:16:53 L1=1.04 run=2 blk=0 avail=6528 (55.7%) swpO=0 conn=2 myRSS=2856 php=1 phpRSS=165 ap=30 tcp=20 topuser=madalice 2026-08-24 22:16:54 L1=1.04 run=1 blk=0 avail=6669 (56.9%) swpO=0 conn=2 myRSS=2856 php=0 phpRSS=0 ap=29 tcp=19 topuser=- 2026-08-24 22:17:03 L1=1.03 run=1 blk=0 avail=6723 (57.3%) swpO=0 conn=2 myRSS=2856 php=0 phpRSS=0 ap=20 tcp=22 topuser=- 2026-08-24 22:17:04 L1=1.03 run=2 blk=0 avail=6665 (56.8%) swpO=0 conn=2 myRSS=2856 php=1 phpRSS=96 ap=19 tcp=22 topuser=madalice 2026-08-24 22:17:14 L1=1.51 run=18 blk=0 avail=5674 (48.4%) swpO=0 conn=18 myRSS=2857 php=17 phpRSS=1599 ap=24 tcp=43 topuser=evolution 2026-08-24 22:17:15 L1=3.23 run=25 blk=0 avail=5116 (43.6%) swpO=0 conn=19 myRSS=2857 php=19 phpRSS=2047 ap=26 tcp=46 topuser=evolution