INCIDENT 2026-08-28 06:26:21 trigger: php_rss=1521MB ================================================================== load: 2.28 1.53 1.28 5/600 1400336 ncpu:10 mem_avail: 8525MB/13777MB (61.9%) swap_used:467MB swapout:0/s blocked(D):0 running:5 iowait:0.0% steal:0.0% php: 12 procs / 1521MB heaviest user: madalice (6 procs, 1006MB) apache: 39 procs tcp_estab: 46 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1391 root 248 1197 madalice 6 1010 nobody 38 680 mailman 20 412 tubesupplies 2 234 evolution 6 229 netdata 7 225 wp-toolkit 3 130 cpanellogin 1 101 mailnull 5 84 dovenull 6 68 infinium 4 56 alison 1 56 named 1 43 dovecot 3 28 kurri 2 27 zabbix 1 26 polkitd 1 24 lowrange 1 13 --- php workers by user --- USER PROCS RSS_MB madalice 6 1014 tubesupplies 2 235 evolution 2 218 alison 1 59 root 1 30 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6598 MB Active(file): 4700 MB Inactive(file): 2215 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 759 MB CommitLimit: 10984 MB Committed_AS: 8450 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 04:07:41 14324 /usr/bin/imunify-agent-proxy 1297560 root 26:20 3120 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 1424952 3.5 Ssl 04:07:10 /usr/sbin/mariadbd 1399240 510022 madalice 248460 20.5 R 01:03 php-fpm: pool madalice_com_au 529388 527476 root 180808 0.0 S 04:02:03 spamd child 508924 1 netdata 179300 1.9 Ssl 04:06:39 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1400280 1399529 evolution 178276 84.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 529389 527476 root 170000 0.0 S 04:02:03 spamd child 1399640 510022 madalice 161568 16.3 S 00:57 php-fpm: pool madalice_com_au 1399243 510022 madalice 161428 17.9 S 01:03 php-fpm: pool madalice_com_au 527476 1 root 161392 0.0 Ss 04:03:42 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1399245 510022 madalice 158628 18.1 S 01:03 php-fpm: pool madalice_com_au 1399246 510022 madalice 158340 18.0 S 01:03 php-fpm: pool madalice_com_au 1399642 510022 madalice 158340 14.8 S 00:57 php-fpm: pool madalice_com_au 1400276 1399344 tubesupplies 137168 54.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1400282 1399603 tubesupplies 110808 84.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 973642 1353308 cpanellogin 104076 0.0 S 02:03:49 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 938582 1 wp-toolkit 75032 0.0 Ss 02:14:13 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 509236 509098 root 71400 0.0 Sl 04:06:36 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1400307 1385113 alison 60368 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4180059 4180015 evolution 50000 0.0 Ss 06:26:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 938585 1 wp-toolkit 49472 0.0 Ss 02:14:13 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 508634 1 named 44724 0.0 Ssl 04:06:44 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1353308 1 root 42280 0.0 Ss 37-03:45:02 cpsrvd (SSL) - waiting for connections 509098 1 root 40444 0.0 Ss 04:06:37 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion 1469 1 root 40048 0.1 Ss 59-20:16:31 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 938444 1 root 38376 0.0 Ss 02:14:16 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 526869 1 root 32752 0.0 Ss 04:04:05 lfd - sleeping 481558 1 root 31980 0.1 Ssl 04:09:03 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 510022 1 root 31316 0.0 Ss 04:06:32 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 27428 0.2 Ssl 04:07:53 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 509266 1 root 25792 0.0 Ss 04:06:36 /usr/lib/systemd/systemd-journald 508591 1 polkitd 24728 0.0 Ssl 04:06:44 /usr/lib/polkit-1/polkitd --no-debug 1463 1 root 24548 0.0 Ss 59-20:16:31 tailwatchd 1368272 506832 nobody 23152 0.0 S 06:28 /usr/sbin/httpd -k start 508863 508814 mailman 22240 0.0 S 04:06:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 508851 508814 mailman 22224 0.0 S 04:06:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 508857 508814 mailman 22224 0.0 S 04:06:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 508856 508814 mailman 22148 0.0 S 04:06:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508855 508814 mailman 22116 0.0 S 04:06:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 508864 508814 mailman 22072 0.0 S 04:06:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 508867 508814 mailman 22056 0.0 S 04:06:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 508858 508814 mailman 22036 0.0 S 04:06:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s 508861 508814 mailman 22036 0.0 S 04:06:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 508860 508814 mailman 21964 0.0 S 04:06:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 508865 508814 mailman 21964 0.0 S 04:06:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 508850 508814 mailman 21952 0.0 S 04:06:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:0:2 -s 508854 508814 mailman 21940 0.0 S 04:06:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 508852 508814 mailman 21936 0.0 S 04:06:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s 1399529 506832 nobody 21884 0.1 S 01:01 /usr/sbin/httpd -k start 508866 508814 mailman 21832 0.0 S 04:06:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 508853 508814 mailman 21804 0.0 S 04:06:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 508849 508814 mailman 21768 0.0 S 04:06:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=ArchRunner:0:1 -s 508859 508814 mailman 21764 0.0 S 04:06:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 508862 508814 mailman 21764 0.0 S 04:06:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 1399612 506832 nobody 21516 0.1 S 00:58 /usr/sbin/httpd -k start 1399617 506832 nobody 21456 0.1 S 00:58 /usr/sbin/httpd -k start 1384290 506832 nobody 21228 0.0 S 02:59 /usr/sbin/httpd -k start 1399583 506832 nobody 20616 0.0 S 00:59 /usr/sbin/httpd -k start 1399585 506832 nobody 20608 0.0 S 00:59 /usr/sbin/httpd -k start 1399344 506832 nobody 20524 0.0 S 01:02 /usr/sbin/httpd -k start 1385113 506832 nobody 20496 0.1 S 01:37 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 75177 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min olympic/olympicfencing.com.au-ssl_log 154 evolution/portal.evolutionerp.com.au-ssl_log 112 kamcool/kamcool.com.au-ssl_log 112 evolution/my.evolutionerp.com.au-ssl_log 96 madalice/madalice.com.au-ssl_log 69 lowrange/lowrange.com.au-ssl_log 33 aaa/aaadownunder.com.au-ssl_log 15 alison/alisonarts.com.au-ssl_log 6 corpkicks/corporatekicks.com.au-ssl_log 3 customc/customcentral.com.au-ssl_log 2 infinium/infinium.net.au-ssl_log 2 tubesupplies/tubesupplies.com.au-ssl_log 2 alison/alisonarts.com.au 1 bigdeals/bigdeals.com.au-ssl_log 1 coscom/coscom.com.au-ssl_log 1 (total vhosts taking traffic: 15) --- top client IPs across all vhosts (last 3 min) --- 154 20.104.50.220 130 203.54.180.238 111 52.139.44.162 52 104.196.115.188 36 14.1.95.251 33 52.139.37.240 20 103.104.164.114 17 103.104.165.99 13 1.158.60.60 7 118.127.40.55 5 207.46.13.7 3 52.167.144.158 2 37.19.197.158 2 209.141.37.195 2 101.182.108.127 --- top request paths across all vhosts (last 3 min) --- 43 POST /functions.php 42 GET /heartbeat.php 26 GET /factory_session_checker.php 20 GET /app/ajax.php 18 GET /index.php 13 GET /factory_session_processed_qty.php 13 GET /factory_session_joiner.php 9 GET /store/delivery-insurance/ 7 POST /portal/register 6 POST /plugins/csvexporter/plugin.php 5 GET /wp-login.php 5 GET / 4 POST /wp-cron.php 4 POST /clienteditsave.php 4 GET /wp.php 4 GET /admin.php 3 POST /factory_functions.php 3 POST /app/ajax/selectFilterSingle.php 3 GET /simple.php 2 POST /wp-login.php --- busiest 3 vhosts: top paths + last 10 requests --- == olympic/olympicfencing.com.au-ssl_log == -- top paths -- 2 GET /xxx.php 2 GET /wp.php 1 GET /zolando.php 1 GET /yanz.php 1 GET /x.php 1 GET /xper1.php 1 GET /xex.php 1 GET /xda.php 1 GET /wp-xx.php 1 GET /wp-the.php 1 GET /wp-slss.php 1 GET /wp-sing.php -- last 10 requests -- 20.104.50.220 - - [28/Aug/2026:06:25:52 +1000] "GET /dropdown.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [28/Aug/2026:06:25:52 +1000] "GET /wp-includes/block-patterns/index.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [28/Aug/2026:06:25:53 +1000] "GET /wp-admin/js/index.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [28/Aug/2026:06:25:53 +1000] "GET /wp-includes/autoload_classmap.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [28/Aug/2026:06:25:54 +1000] "GET /wp-content/plugins/seoplugins/index.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [28/Aug/2026:06:25:54 +1000] "GET /wp-includes/sodium_compat/src/Core32/Curve25519/Ge/about.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [28/Aug/2026:06:25:54 +1000] "GET /file6.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [28/Aug/2026:06:25:55 +1000] "GET /default.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [28/Aug/2026:06:25:56 +1000] "GET /wp-content/plugins/about.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [28/Aug/2026:06:25:56 +1000] "GET /wp-content/plugins/wp-login.php HTTP/1.1" 401 36 "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 42 GET /heartbeat.php 26 GET /factory_session_checker.php 13 GET /factory_session_processed_qty.php 13 GET /factory_session_joiner.php 8 GET /index.php 7 POST /portal/register 3 POST /factory_functions.php -- last 10 requests -- 203.54.180.238 - - [28/Aug/2026:06:26:10 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [28/Aug/2026:06:26:10 +1000] "GET /factory_session_joiner.php?id=34911 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [28/Aug/2026:06:26:11 +1000] "GET /index.php?page=inventory_picking HTTP/1.1" 200 9836 "https://portal.evolutionerp.com.au/index.php?page=inventory_picking_goods&pickid=37915&seq=7534997762205" "Mozill 203.54.180.238 - - [28/Aug/2026:06:26:10 +1000] "GET /heartbeat.php?sentAt=1787862370&bytes=106,144,157,98&_=1787810681534 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [28/Aug/2026:06:26:11 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php?page=inventory_picking" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, 203.54.180.238 - - [28/Aug/2026:06:26:11 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [28/Aug/2026:06:26:12 +1000] "GET /heartbeat.php?sentAt=1787862372&bytes=106,144,157,100&_=1787835392091 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [28/Aug/2026:06:26:14 +1000] "GET /heartbeat.php?sentAt=1787862374&bytes=106,144,157,102&_=1787862184463 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=5 203.54.180.238 - - [28/Aug/2026:06:26:16 +1000] "GET /index.php?page=inventory_picking_goods&pickid=37875&seq=10158580543635 HTTP/1.1" 200 12995 "https://portal.evolutionerp.com.au/index.php?page=inventory_picking" "Mozi 203.54.180.238 - - [28/Aug/2026:06:26:16 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php?page=inventory_picking_goods&pickid=37875&seq=10158580543635" "Mozilla/5.0 (Linux; Andr == kamcool/kamcool.com.au-ssl_log == -- top paths -- 3 GET /admin.php 1 GET /zoo1.php 1 GET /yj09.php 1 GET /xnm-apc.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp.php 1 GET /wp-mails.php 1 GET /w.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-0.php 1 GET /vpn.php -- last 10 requests -- 52.139.44.162 - - [28/Aug/2026:06:25:02 +1000] "GET /a.php HTTP/1.1" 404 5749 "-" "-" 52.139.44.162 - - [28/Aug/2026:06:25:02 +1000] "GET /ass.php HTTP/1.1" 404 5749 "-" "-" 52.139.44.162 - - [28/Aug/2026:06:25:03 +1000] "GET /sb.php HTTP/1.1" 404 5749 "-" "-" 52.139.44.162 - - [28/Aug/2026:06:25:03 +1000] "GET /in.php HTTP/1.1" 404 5749 "-" "-" 52.139.44.162 - - [28/Aug/2026:06:25:03 +1000] "GET /ssg.php HTTP/1.1" 404 5749 "-" "-" 52.139.44.162 - - [28/Aug/2026:06:25:04 +1000] "GET /gigi.php HTTP/1.1" 404 5749 "-" "-" 52.139.44.162 - - [28/Aug/2026:06:25:04 +1000] "GET /credit.php HTTP/1.1" 404 5749 "-" "-" 52.139.44.162 - - [28/Aug/2026:06:25:05 +1000] "GET /xnm-apc.php?p= HTTP/1.1" 404 5749 "-" "-" 52.139.44.162 - - [28/Aug/2026:06:25:05 +1000] "GET /adminimagess.php HTTP/1.1" 404 5749 "-" "-" 45.148.10.166 - - [28/Aug/2026:06:25:11 +1000] "GET / HTTP/1.1" 200 658 "-" "Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.2) Gecko/20121223 Ubuntu/9.25 (jaunty) Firefox/3.8" --- last 30 samples (run-up to this incident) --- 2026-08-28 06:23:59 L1=1.04 run=2 blk=0 avail=9741 (70.7%) swpO=0 conn=2 myRSS=1390 php=3 phpRSS=140 ap=29 tcp=35 topuser=madalice 2026-08-28 06:24:00 L1=1.04 run=1 blk=0 avail=9654 (70.1%) swpO=0 conn=2 myRSS=1390 php=4 phpRSS=251 ap=29 tcp=38 topuser=madalice 2026-08-28 06:24:09 L1=0.96 run=1 blk=0 avail=9707 (70.5%) swpO=0 conn=2 myRSS=1390 php=3 phpRSS=211 ap=24 tcp=34 topuser=madalice 2026-08-28 06:24:10 L1=0.88 run=2 blk=0 avail=9696 (70.4%) swpO=0 conn=2 myRSS=1390 php=4 phpRSS=251 ap=24 tcp=33 topuser=madalice 2026-08-28 06:24:19 L1=0.81 run=1 blk=0 avail=9661 (70.1%) swpO=0 conn=2 myRSS=1390 php=3 phpRSS=211 ap=28 tcp=39 topuser=madalice 2026-08-28 06:24:20 L1=0.74 run=1 blk=0 avail=9647 (70.0%) swpO=0 conn=2 myRSS=1390 php=4 phpRSS=251 ap=28 tcp=37 topuser=madalice 2026-08-28 06:24:29 L1=0.68 run=3 blk=0 avail=9790 (71.1%) swpO=0 conn=2 myRSS=1390 php=3 phpRSS=117 ap=24 tcp=40 topuser=evolution 2026-08-28 06:24:30 L1=0.63 run=1 blk=0 avail=9797 (71.1%) swpO=0 conn=2 myRSS=1390 php=3 phpRSS=119 ap=23 tcp=42 topuser=evolution 2026-08-28 06:24:39 L1=0.82 run=2 blk=0 avail=9647 (70.0%) swpO=0 conn=2 myRSS=1390 php=3 phpRSS=280 ap=23 tcp=38 topuser=madalice 2026-08-28 06:24:41 L1=0.75 run=1 blk=0 avail=9698 (70.4%) swpO=0 conn=2 myRSS=1390 php=4 phpRSS=251 ap=23 tcp=39 topuser=madalice 2026-08-28 06:24:49 L1=0.69 run=1 blk=0 avail=9686 (70.3%) swpO=0 conn=2 myRSS=1390 php=3 phpRSS=212 ap=25 tcp=44 topuser=madalice 2026-08-28 06:24:51 L1=0.64 run=1 blk=0 avail=9679 (70.3%) swpO=0 conn=2 myRSS=1390 php=4 phpRSS=251 ap=25 tcp=43 topuser=madalice 2026-08-28 06:24:59 L1=0.67 run=3 blk=0 avail=9694 (70.4%) swpO=0 conn=1 myRSS=1390 php=3 phpRSS=212 ap=25 tcp=32 topuser=madalice 2026-08-28 06:25:01 L1=0.69 run=1 blk=0 avail=9806 (71.2%) swpO=0 conn=2 myRSS=1390 php=3 phpRSS=119 ap=23 tcp=33 topuser=evolution 2026-08-28 06:25:09 L1=0.88 run=4 blk=0 avail=9768 (70.9%) swpO=0 conn=1 myRSS=1390 php=2 phpRSS=80 ap=30 tcp=40 topuser=evolution 2026-08-28 06:25:11 L1=0.81 run=4 blk=0 avail=9725 (70.6%) swpO=0 conn=3 myRSS=1390 php=4 phpRSS=178 ap=30 tcp=40 topuser=evolution 2026-08-28 06:25:19 L1=0.74 run=8 blk=0 avail=8458 (61.4%) swpO=0 conn=7 myRSS=1390 php=10 phpRSS=1563 ap=28 tcp=57 topuser=madalice 2026-08-28 06:25:21 L1=1.00 run=2 blk=0 avail=8885 (64.5%) swpO=0 conn=3 myRSS=1390 php=10 phpRSS=1090 ap=34 tcp=66 topuser=madalice 2026-08-28 06:25:30 L1=2.87 run=6 blk=0 avail=7763 (56.3%) swpO=324 conn=7 myRSS=1389 php=14 phpRSS=1964 ap=85 tcp=108 topuser=madalice 2026-08-28 06:25:31 L1=2.87 run=13 blk=0 avail=7776 (56.4%) swpO=356 conn=9 myRSS=1389 php=13 phpRSS=1925 ap=86 tcp=108 topuser=madalice 2026-08-28 06:25:40 L1=2.51 run=2 blk=0 avail=7923 (57.5%) swpO=0 conn=4 myRSS=1389 php=13 phpRSS=1811 ap=80 tcp=50 topuser=madalice 2026-08-28 06:25:41 L1=2.51 run=2 blk=0 avail=7989 (58.0%) swpO=0 conn=3 myRSS=1389 php=12 phpRSS=1725 ap=79 tcp=53 topuser=madalice 2026-08-28 06:25:50 L1=2.13 run=2 blk=0 avail=8086 (58.7%) swpO=0 conn=3 myRSS=1389 php=14 phpRSS=1745 ap=70 tcp=40 topuser=madalice 2026-08-28 06:25:51 L1=2.13 run=2 blk=0 avail=8043 (58.4%) swpO=0 conn=2 myRSS=1389 php=13 phpRSS=1763 ap=69 tcp=41 topuser=madalice 2026-08-28 06:26:00 L1=2.18 run=3 blk=0 avail=8346 (60.6%) swpO=0 conn=4 myRSS=1390 php=13 phpRSS=1549 ap=60 tcp=46 topuser=madalice 2026-08-28 06:26:01 L1=2.18 run=1 blk=0 avail=8485 (61.6%) swpO=0 conn=2 myRSS=1390 php=10 phpRSS=1327 ap=59 tcp=39 topuser=madalice 2026-08-28 06:26:10 L1=2.23 run=3 blk=0 avail=8655 (62.8%) swpO=0 conn=4 myRSS=1390 php=10 phpRSS=1251 ap=50 tcp=43 topuser=madalice 2026-08-28 06:26:11 L1=2.23 run=6 blk=0 avail=8769 (63.7%) swpO=0 conn=6 myRSS=1390 php=11 phpRSS=1174 ap=49 tcp=44 topuser=madalice 2026-08-28 06:26:21 L1=2.28 run=6 blk=0 avail=8748 (63.5%) swpO=0 conn=4 myRSS=1391 php=12 phpRSS=1289 ap=40 tcp=47 topuser=madalice 2026-08-28 06:26:21 L1=2.28 run=5 blk=0 avail=8525 (61.9%) swpO=0 conn=5 myRSS=1391 php=12 phpRSS=1521 ap=39 tcp=46 topuser=madalice