INCIDENT 2026-08-27 20:51:58 trigger: php_rss=1563MB ================================================================== load: 1.36 1.28 1.17 17/669 3544038 ncpu:10 mem_avail: 7335MB/13777MB (53.2%) swap_used:2418MB swapout:0/s blocked(D):0 running:15 iowait:0.1% steal:0.0% php: 14 procs / 1563MB heaviest user: evolution (12 procs, 1475MB) apache: 23 procs tcp_estab: 38 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2848 evolution 14 1204 root 242 777 nobody 30 474 netdata 8 259 cpanellogin 1 79 aaa 1 52 mailman 20 47 dovenull 6 44 wp-toolkit 6 18 dovecot 3 17 zabbix 1 15 kurri 1 7 named 1 6 nscd 1 5 cpanelconnecttrack 1 3 mailnull 1 2 dbus 1 2 chrony 1 1 rpc 1 0 --- php workers by user --- USER PROCS RSS_MB evolution 8 1036 aaa 1 54 root 1 42 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5663 MB Active(file): 4511 MB Inactive(file): 1408 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 472 MB CommitLimit: 10984 MB Committed_AS: 7719 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3565593 root 19:40:42 2844 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2916728 16.3 Ssl 2-17:20:42 /usr/sbin/mariadbd 1220 1 netdata 206328 2.5 Ssl 59-10:42:08 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1910875 3797563 root 171360 0.1 S 07:38:06 spamd child 3543995 3543970 evolution 165508 77.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3543996 3543971 evolution 150236 67.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3543989 3510521 evolution 145920 62.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3543991 3543982 evolution 144652 65.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3846467 3797563 root 125684 0.0 S 18:16:24 spamd child 3543998 3515324 evolution 96236 31.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3544000 3542557 evolution 87548 25.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2805458 1353308 cpanellogin 81908 0.0 S 03:32:30 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 3797563 1 root 78660 0.0 Ss 18:29:02 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2575382 1 root 72680 0.0 Ss 12-13:01:29 /usr/lib/systemd/systemd-journald 3544001 3527287 aaa 60476 26.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2223 1201 root 44708 0.0 Sl 59-10:42:07 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3066250 1 root 43124 0.0 Ss 02:20:33 php-fpm: master process (/opt/cpanel/ea-php82/root/etc/php-fpm.conf) 1353308 1 root 41240 0.0 Ss 36-18:10:38 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 32956 0.1 Sl 59-10:42:03 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3527732 3066150 nobody 23992 0.0 S 03:36 /usr/sbin/httpd -k start 3511301 3066150 nobody 23796 0.1 S 07:32 /usr/sbin/httpd -k start 3527807 3066150 nobody 23692 0.0 S 03:29 /usr/sbin/httpd -k start 3542557 3066150 nobody 23552 0.0 S 01:36 /usr/sbin/httpd -k start 3527303 3066150 nobody 23052 0.2 S 04:28 /usr/sbin/httpd -k start 3515324 3066150 nobody 23016 0.1 S 06:54 /usr/sbin/httpd -k start 3527287 3066150 nobody 21176 0.0 S 04:31 /usr/sbin/httpd -k start 1469 1 root 20760 0.1 Ss 59-10:42:07 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3542558 3066150 nobody 20544 0.0 S 01:36 /usr/sbin/httpd -k start 3510521 3066150 nobody 20504 0.1 S 08:34 /usr/sbin/httpd -k start 3542541 3066150 nobody 20312 0.0 S 01:37 /usr/sbin/httpd -k start 3542506 3066150 nobody 20220 0.0 S 01:39 /usr/sbin/httpd -k start 185104 2431 netdata 20036 2.1 Sl 15-00:18:26 /usr/libexec/netdata/plugins.d/apps.plugin 1 3543654 3066150 nobody 19540 0.0 S 00:27 /usr/sbin/httpd -k start 3542630 3066150 nobody 18824 0.2 S 01:33 /usr/sbin/httpd -k start 3543984 3066150 nobody 18388 0.0 S 00:01 /usr/sbin/httpd -k start 3543985 3066150 nobody 18320 0.0 S 00:01 /usr/sbin/httpd -k start 3543983 3066150 nobody 18300 0.0 S 00:01 /usr/sbin/httpd -k start 3543965 3066150 nobody 18192 0.0 S 00:03 /usr/sbin/httpd -k start 3543970 3066150 nobody 17324 0.0 S 00:02 /usr/sbin/httpd -k start 3543971 3066150 nobody 17324 0.0 S 00:02 /usr/sbin/httpd -k start 3543982 3066150 nobody 17308 0.0 S 00:01 /usr/sbin/httpd -k start 3544025 3066150 nobody 16004 0.0 S 00:00 /usr/sbin/httpd -k start 1204 1 zabbix 15516 0.2 Ssl 59-10:42:08 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3066150 1 root 14172 0.0 Ss 02:20:36 /usr/sbin/httpd -k start 1463 1 root 14168 0.0 Ss 59-10:42:07 tailwatchd 3528375 3828812 root 12972 0.0 S 02:28 dovecot/auth -w 254033 1471 root 12112 0.0 S 15:13:54 cPhulkd - dbprocessor 3544076 3542541 evolution 11984 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1780156 3828812 dovenull 10652 0.0 S 2-20:19:08 dovecot/imap-login 1471 1 root 10596 0.0 Ss 59-10:42:07 cPhulkd - processor 1780152 3828812 dovenull 10396 0.0 S 2-20:19:08 dovecot/imap-login 3543935 1471 root 10316 0.0 S 00:04 cPhulkd - processor - http socket 3544022 3066150 nobody 9948 0.0 S 00:00 /usr/sbin/httpd -k start 1780159 3828812 dovenull 8916 0.0 S 2-20:19:08 dovecot/pop3-login 2937469 1 root 8900 0.0 Ss 1-18:29:25 queueprocd - waiting up to 60s to process a task 1780154 3828812 dovenull 8748 0.0 S 2-20:19:08 dovecot/pop3-login 2975982 27524 root 8748 0.0 Ss 02:42:17 sshd: root [priv] 2012778 27524 root 8636 0.0 Ss 07:13:17 sshd: root [priv] 3085116 2012787 root 8524 0.0 S+ 02:12:43 vim /var/cpanel/userdata/madalice/madalice.com.au.php-fpm.yaml 3544023 3066150 nobody 8404 0.0 S 00:00 /usr/sbin/httpd -k start 1780162 3828812 dovecot 8280 0.0 S 2-20:19:08 dovecot/auth --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 13952582 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 13952581 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 333 customc/customcentral.com.au-ssl_log 100 evolution/wp.evolutionerp.com.au 88 evolution/my.evolutionerp.com.au-ssl_log 81 otter2/otterfencing.net.au-ssl_log 76 candyfabcom/candyfab.com.au-ssl_log 46 alison/alisonarts.com.au-ssl_log 32 evolution/portal.evolutionerp.com.au-ssl_log 28 madalice/madalice.com.au-ssl_log 20 coscom/coscom.com.au-ssl_log 16 evolution/evolutionerp.com.au-ssl_log 9 (total vhosts taking traffic: 11) --- top client IPs across all vhosts (last 3 min) --- 332 137.59.87.138 88 4.223.171.219 78 20.240.128.207 76 52.139.37.240 76 115.128.106.35 59 82.102.18.190 46 20.220.227.7 28 203.54.180.238 13 121.200.5.167 7 34.74.219.24 3 175.36.227.212 3 118.127.40.55 2 114.119.137.101 2 114.119.130.40 1 91.92.243.239 --- top request paths across all vhosts (last 3 min) --- 135 GET /api/getItem/LWFB2001KG 119 GET /api/getItem/LWPG2001KG 78 GET /api/getItem/LWPB2001KG 42 GET /app/ajax.php 28 GET /heartbeat.php 16 GET / 11 GET /index.php 10 POST /functions.php 7 POST /app/ajax.php 5 POST / 4 POST /app/ajax/selectFilterSingle.php 3 POST /app/ajax/selectFilter.php 3 GET /makeasmtp.php 3 GET /mac.php 3 GET /autodiscover/autodiscover.xml 3 GET /admin.php 2 POST /wp-cron.php 2 POST /quoteditsave.php 2 POST /opportunityeditsave.php 2 GET //xmlrpc.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 135 GET /api/getItem/LWFB2001KG 119 GET /api/getItem/LWPG2001KG 78 GET /api/getItem/LWPB2001KG 1 GET / -- last 10 requests -- 137.59.87.138 - - [27/Aug/2026:20:51:40 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 63 "-" "RestSharp/106.13.0.0" 137.59.87.138 - - [27/Aug/2026:20:51:41 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 63 "-" "RestSharp/106.13.0.0" 209.50.173.255 - - [27/Aug/2026:20:51:41 +1000] "GET / HTTP/1.1" 200 40 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0" 137.59.87.138 - - [27/Aug/2026:20:51:41 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 63 "-" "RestSharp/106.13.0.0" 137.59.87.138 - - [27/Aug/2026:20:51:42 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 63 "-" "RestSharp/106.13.0.0" 137.59.87.138 - - [27/Aug/2026:20:51:42 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 63 "-" "RestSharp/106.13.0.0" 137.59.87.138 - - [27/Aug/2026:20:51:43 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 63 "-" "RestSharp/106.13.0.0" 137.59.87.138 - - [27/Aug/2026:20:51:43 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 63 "-" "RestSharp/106.13.0.0" 137.59.87.138 - - [27/Aug/2026:20:51:44 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 63 "-" "RestSharp/106.13.0.0" 137.59.87.138 - - [27/Aug/2026:20:51:44 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 63 "-" "RestSharp/106.13.0.0" == customc/customcentral.com.au-ssl_log == -- top paths -- 2 POST /wp-cron.php 2 GET / 1 GET /zup.php73 1 GET /x.php 1 GET //xmlrpc.php 1 GET /xleet.php 1 GET /wso.php 1 GET /ws83.php 1 GET /ws54.php 1 GET //wp/wp-includes/wlwmanifest.xml 1 GET /wp.php 1 GET /wp-login.php -- last 10 requests -- 82.102.18.190 - - [27/Aug/2026:20:50:25 +1000] "GET //site/wp-includes/wlwmanifest.xml HTTP/1.1" 401 40189 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari 20.240.128.207 - - [27/Aug/2026:20:50:25 +1000] "GET /wp-admin/js/index.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 82.102.18.190 - - [27/Aug/2026:20:50:26 +1000] "GET //cms/wp-includes/wlwmanifest.xml HTTP/1.1" 404 5749 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/5 20.240.128.207 - - [27/Aug/2026:20:50:26 +1000] "GET /wso.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 82.102.18.190 - - [27/Aug/2026:20:50:26 +1000] "GET //sito/wp-includes/wlwmanifest.xml HTTP/1.1" 401 40189 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari 20.240.128.207 - - [27/Aug/2026:20:50:27 +1000] "GET /zup.php73 HTTP/1.1" 404 15089 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [27/Aug/2026:20:50:28 +1000] "GET /k.php HTTP/1.1" 404 15085 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [27/Aug/2026:20:50:29 +1000] "GET /wp-blink.php HTTP/1.1" 404 15092 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [27/Aug/2026:20:50:31 +1000] "GET /randkeyword.PhP7 HTTP/1.1" 404 15094 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [27/Aug/2026:20:50:32 +1000] "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1" 404 15107 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 == evolution/wp.evolutionerp.com.au == -- top paths -- 3 GET /admin.php 2 GET /xiugai.php 2 GET /makeasmtp.php 2 GET /ccc.php 2 GET /ba.php 2 GET /11.php 1 GET /yj09.php 1 GET /xamp.php 1 GET /wp.php 1 GET /w.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-0.php -- last 10 requests -- 4.223.171.219 - - [27/Aug/2026:20:51:29 +1000] "GET /inx.php HTTP/1.1" 404 131436 "-" "-" 4.223.171.219 - - [27/Aug/2026:20:51:30 +1000] "GET /reviall.php HTTP/1.1" 404 131440 "-" "-" 4.223.171.219 - - [27/Aug/2026:20:51:31 +1000] "GET /11.php?p= HTTP/1.1" 301 - "-" "-" 4.223.171.219 - - [27/Aug/2026:20:51:32 +1000] "GET /11.php HTTP/1.1" 404 131435 "-" "-" 4.223.171.219 - - [27/Aug/2026:20:51:33 +1000] "GET /File.php HTTP/1.1" 404 131437 "-" "-" 4.223.171.219 - - [27/Aug/2026:20:51:34 +1000] "GET /fi22.php HTTP/1.1" 404 131437 "-" "-" 4.223.171.219 - - [27/Aug/2026:20:51:35 +1000] "GET /3PJcpMFsD8B.php HTTP/1.1" 404 131444 "-" "-" 4.223.171.219 - - [27/Aug/2026:20:51:36 +1000] "GET /a3ampzmbipnkpxeqhqpsanCdefault.php HTTP/1.1" 404 131463 "-" "-" 4.223.171.219 - - [27/Aug/2026:20:51:37 +1000] "GET /4PJcpMFsD8B.php HTTP/1.1" 404 131444 "-" "-" 4.223.171.219 - - [27/Aug/2026:20:51:38 +1000] "GET /i99z7zzbwtpteujvv6s8hiCdefault.php HTTP/1.1" 404 131463 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-27 20:49:34 L1=0.89 run=2 blk=0 avail=8577 (62.3%) swpO=0 conn=3 myRSS=2848 php=1 phpRSS=42 ap=17 tcp=21 topuser=root 2026-08-27 20:49:37 L1=0.98 run=3 blk=0 avail=8386 (60.9%) swpO=0 conn=2 myRSS=2848 php=3 phpRSS=296 ap=17 tcp=19 topuser=evolution 2026-08-27 20:49:44 L1=1.14 run=1 blk=0 avail=8570 (62.2%) swpO=0 conn=3 myRSS=2848 php=1 phpRSS=42 ap=17 tcp=21 topuser=root 2026-08-27 20:49:47 L1=1.05 run=4 blk=0 avail=8328 (60.4%) swpO=0 conn=2 myRSS=2848 php=4 phpRSS=378 ap=17 tcp=20 topuser=evolution 2026-08-27 20:49:54 L1=1.21 run=4 blk=0 avail=8524 (61.9%) swpO=0 conn=3 myRSS=2848 php=3 phpRSS=146 ap=17 tcp=22 topuser=customc 2026-08-27 20:49:57 L1=1.27 run=2 blk=0 avail=8513 (61.8%) swpO=0 conn=2 myRSS=2848 php=2 phpRSS=120 ap=17 tcp=21 topuser=evolution 2026-08-27 20:50:04 L1=1.33 run=2 blk=0 avail=8558 (62.1%) swpO=0 conn=3 myRSS=2848 php=1 phpRSS=42 ap=17 tcp=22 topuser=root 2026-08-27 20:50:08 L1=1.30 run=2 blk=0 avail=8567 (62.2%) swpO=0 conn=1 myRSS=2848 php=1 phpRSS=42 ap=17 tcp=18 topuser=root 2026-08-27 20:50:14 L1=1.28 run=2 blk=0 avail=8421 (61.1%) swpO=0 conn=1 myRSS=2848 php=2 phpRSS=228 ap=17 tcp=20 topuser=customc 2026-08-27 20:50:18 L1=1.50 run=2 blk=0 avail=8535 (62.0%) swpO=0 conn=1 myRSS=2848 php=2 phpRSS=111 ap=17 tcp=22 topuser=customc 2026-08-27 20:50:24 L1=1.50 run=3 blk=0 avail=8458 (61.4%) swpO=0 conn=1 myRSS=2848 php=3 phpRSS=188 ap=21 tcp=29 topuser=customc 2026-08-27 20:50:28 L1=1.50 run=4 blk=0 avail=8458 (61.4%) swpO=0 conn=1 myRSS=2848 php=2 phpRSS=120 ap=24 tcp=26 topuser=evolution 2026-08-27 20:50:34 L1=1.35 run=2 blk=0 avail=8444 (61.3%) swpO=0 conn=1 myRSS=2848 php=2 phpRSS=147 ap=24 tcp=29 topuser=customc 2026-08-27 20:50:38 L1=1.35 run=2 blk=0 avail=8417 (61.1%) swpO=0 conn=1 myRSS=2848 php=2 phpRSS=165 ap=24 tcp=22 topuser=infinium 2026-08-27 20:50:44 L1=1.58 run=1 blk=0 avail=8519 (61.8%) swpO=0 conn=1 myRSS=2848 php=1 phpRSS=42 ap=23 tcp=27 topuser=root 2026-08-27 20:50:48 L1=1.58 run=3 blk=0 avail=8363 (60.7%) swpO=0 conn=1 myRSS=2848 php=3 phpRSS=259 ap=23 tcp=23 topuser=tubesupplies 2026-08-27 20:50:54 L1=1.64 run=4 blk=0 avail=8421 (61.1%) swpO=0 conn=1 myRSS=2848 php=3 phpRSS=217 ap=22 tcp=26 topuser=evolution 2026-08-27 20:50:58 L1=1.64 run=4 blk=0 avail=8302 (60.3%) swpO=0 conn=1 myRSS=2848 php=4 phpRSS=365 ap=21 tcp=25 topuser=evolution 2026-08-27 20:51:04 L1=1.86 run=6 blk=0 avail=8465 (61.4%) swpO=0 conn=1 myRSS=2848 php=2 phpRSS=136 ap=20 tcp=23 topuser=evolution 2026-08-27 20:51:08 L1=1.86 run=3 blk=0 avail=8520 (61.8%) swpO=0 conn=2 myRSS=2848 php=2 phpRSS=118 ap=18 tcp=19 topuser=corpkicks 2026-08-27 20:51:14 L1=1.65 run=1 blk=0 avail=8585 (62.3%) swpO=0 conn=1 myRSS=2848 php=1 phpRSS=42 ap=16 tcp=19 topuser=root 2026-08-27 20:51:18 L1=1.65 run=1 blk=0 avail=8584 (62.3%) swpO=0 conn=2 myRSS=2848 php=1 phpRSS=42 ap=16 tcp=17 topuser=root 2026-08-27 20:51:24 L1=1.47 run=2 blk=0 avail=8565 (62.2%) swpO=0 conn=1 myRSS=2848 php=3 phpRSS=136 ap=15 tcp=19 topuser=evolution 2026-08-27 20:51:28 L1=1.47 run=2 blk=0 avail=8522 (61.9%) swpO=0 conn=2 myRSS=2848 php=2 phpRSS=150 ap=15 tcp=19 topuser=evolution 2026-08-27 20:51:34 L1=1.48 run=2 blk=0 avail=8479 (61.5%) swpO=0 conn=1 myRSS=2848 php=2 phpRSS=187 ap=16 tcp=20 topuser=evolution 2026-08-27 20:51:38 L1=1.48 run=1 blk=0 avail=8593 (62.4%) swpO=0 conn=2 myRSS=2848 php=1 phpRSS=42 ap=16 tcp=18 topuser=root 2026-08-27 20:51:44 L1=1.33 run=1 blk=0 avail=8592 (62.4%) swpO=0 conn=1 myRSS=2848 php=1 phpRSS=42 ap=16 tcp=22 topuser=root 2026-08-27 20:51:48 L1=1.33 run=2 blk=0 avail=8515 (61.8%) swpO=0 conn=2 myRSS=2848 php=2 phpRSS=148 ap=16 tcp=19 topuser=evolution 2026-08-27 20:51:54 L1=1.36 run=5 blk=0 avail=8493 (61.6%) swpO=0 conn=1 myRSS=2848 php=2 phpRSS=172 ap=16 tcp=24 topuser=evolution 2026-08-27 20:51:58 L1=1.36 run=15 blk=0 avail=7335 (53.2%) swpO=0 conn=12 myRSS=2848 php=14 phpRSS=1563 ap=23 tcp=38 topuser=evolution