INCIDENT 2026-08-28 22:20:33 trigger: swapout=2001/s ================================================================== load: 1.34 1.05 1.08 2/641 606975 ncpu:10 mem_avail: 5731MB/13777MB (41.6%) swap_used:1049MB swapout:2001/s blocked(D):0 running:2 iowait:1.3% steal:0.0% php: 4 procs / 317MB heaviest user: madalice (2 procs, 279MB) apache: 48 procs tcp_estab: 36 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 10 2875 mysql 1 2544 root 252 1008 nobody 47 647 mailman 20 306 madalice 2 279 netdata 7 206 cpanellogin 1 94 infinium 2 83 wp-toolkit 3 75 dovenull 6 59 mailnull 4 49 zabbix 1 26 dovecot 3 24 kurri 2 23 named 1 20 aaa 1 14 lowrange 1 13 candyfabcom 1 13 polkitd 1 10 --- php workers by user --- USER PROCS RSS_MB madalice 2 279 root 1 20 evolution 1 17 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5018 MB Active(file): 2614 MB Inactive(file): 2654 MB Dirty: 521 MB Writeback: 0 MB SReclaimable: 590 MB CommitLimit: 10984 MB Committed_AS: 10281 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 20:01:53 10836 /usr/bin/imunify-agent-proxy 601799 root 00:26 55624 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 606841 606840 evolution 2865132 97.0 RNs 00:14 /usr/local/cpanel/3rdparty/bin/analog +CIMAGEDIR /images/ +CDOMAINSFILE /usr/local/cpanel/3rdparty/share/analog/usdom.tab +CCHARTDIR ./ 506671 1 mysql 2605724 14.3 Ssl 20:01:22 /usr/sbin/mariadbd 508924 1 netdata 183756 2.0 Ssl 20:00:51 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 529389 527476 root 180808 0.0 S 19:56:15 spamd child 592860 510022 madalice 155612 11.9 S 00:33 php-fpm: pool madalice_com_au 606826 510022 madalice 130372 8.8 S 00:15 php-fpm: pool madalice_com_au 4074469 1353308 cpanellogin 96872 0.0 S 03:31:08 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 527476 1 root 90772 0.0 Ss 19:57:54 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2985227 527476 root 86504 0.0 S 08:41:52 spamd child 509266 1 root 64400 0.0 Ss 20:00:48 /usr/lib/systemd/systemd-journald 509236 509098 root 59420 0.0 Sl 20:00:48 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 601799 1 root 55624 5.3 Ssl 00:26 /opt/imunify360/venv/bin/python3 -m imav.run 606925 1353308 infinium 54412 4.0 S 00:03 webmaild - serving 1.41.252.211 938582 1 wp-toolkit 44180 0.0 Ss 18:08:25 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 590050 508116 root 44096 0.4 SN 03:58 cpanellogd - waiting for child to process logs for evolution 606786 590050 evolution 42212 0.3 SN 00:19 cpanellogd - http logs for evolution 1353308 1 root 40444 0.1 Ss 37-19:39:14 cpsrvd (SSL) - waiting for connections 422130 938407 infinium 30928 0.0 S 50:51 php-fpm: pool user_infinium 526869 1 root 29400 0.0 Ss 19:58:17 lfd - sleeping 938585 1 wp-toolkit 29376 0.0 Ss 18:08:25 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1469 1 root 28048 0.1 Ss 60-12:10:43 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 509640 508992 root 26732 0.0 Sl 20:00:46 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 483898 1 zabbix 25580 0.2 Ssl 20:02:05 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 481558 1 root 22572 0.1 Ssl 20:03:15 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1463 1 root 22116 0.0 Ss 60-12:10:43 tailwatchd 510022 1 root 20892 0.0 Ss 20:00:44 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 508634 1 named 20860 0.0 Ssl 20:00:56 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 590018 506832 nobody 19888 0.0 S 04:06 /usr/sbin/httpd -k start 606918 506832 nobody 18764 0.7 S 00:04 /usr/sbin/httpd -k start 591418 506832 nobody 18468 0.0 S 02:30 /usr/sbin/httpd -k start 591392 506832 nobody 18448 0.0 S 02:31 /usr/sbin/httpd -k start 591434 506832 nobody 18376 0.0 S 02:30 /usr/sbin/httpd -k start 591322 506832 nobody 18304 0.0 S 02:33 /usr/sbin/httpd -k start 4180059 4180015 evolution 18124 0.0 Ss 22:20:33 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 591405 506832 nobody 17924 0.0 S 02:31 /usr/sbin/httpd -k start 589994 506832 nobody 17852 0.0 S 04:07 /usr/sbin/httpd -k start 591415 506832 nobody 17840 0.0 S 02:30 /usr/sbin/httpd -k start 591395 506832 nobody 17768 0.0 S 02:31 /usr/sbin/httpd -k start 508856 508814 mailman 17720 0.0 S 20:00:54 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 509671 508992 netdata 17480 2.1 Sl 20:00:46 /usr/libexec/netdata/plugins.d/apps.plugin 1 508867 508814 mailman 17472 0.0 S 20:00:54 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 508861 508814 mailman 17448 0.0 S 20:00:54 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 508865 508814 mailman 17360 0.0 S 20:00:54 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 508862 508814 mailman 17188 0.0 S 20:00:54 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 508854 508814 mailman 17164 0.0 S 20:00:54 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 508855 508814 mailman 17156 0.0 S 20:00:54 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 591428 506832 nobody 17028 0.0 S 02:30 /usr/sbin/httpd -k start 508864 508814 mailman 16928 0.0 S 20:00:54 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 606842 506832 nobody 16836 0.0 S 00:14 /usr/sbin/httpd -k start 606910 506832 nobody 16832 0.0 S 00:05 /usr/sbin/httpd -k start 606917 506832 nobody 16812 0.0 S 00:04 /usr/sbin/httpd -k start 592382 506832 nobody 16748 0.0 S 01:06 /usr/sbin/httpd -k start 508849 508814 mailman 16660 0.0 S 20:00:54 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=ArchRunner:0:1 -s 508857 508814 mailman 16612 0.0 S 20:00:54 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 606920 506832 nobody 16548 0.2 S 00:04 /usr/sbin/httpd -k start 508863 508814 mailman 16452 0.0 S 20:00:54 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 508860 508814 mailman 16288 0.0 S 20:00:54 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 508859 508814 mailman 16200 0.0 S 20:00:54 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 508866 508814 mailman 16196 0.0 S 20:00:54 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 508858 508814 mailman 15988 0.0 S 20:00:54 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s --- processes in D state (uninterruptible IO) --- 1670400 D - [kworker/u256:2+flush-8:0] --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3699008 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min customkidscom/customkids.com.au-ssl_log 167 aaa/aaadownunder.com.au-ssl_log 50 madalice/madalice.com.au-ssl_log 32 evolution/portal.evolutionerp.com.au-ssl_log 20 evolution/evolutionerp.com.au-ssl_log 3 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 167 68.155.159.216 47 196.189.236.151 20 203.54.180.238 14 34.27.235.222 11 2001:8004:6bc0:ab00:d1a3:71c3:290a:12b4 2 118.127.40.55 2 114.119.159.70 2 114.119.143.14 1 54.84.102.81 1 40.77.167.46 1 35.226.35.240 1 209.141.48.118 1 20.48.179.39 1 158.23.184.117 1 114.119.140.234 --- top request paths across all vhosts (last 3 min) --- 20 GET /heartbeat.php 13 GET / 5 GET /store/drippy-air-max-90-custom-shoes/ 2 POST /index.php 2 POST / 2 GET /wp-login.php 2 GET /index.php 1 POST /wp-cron.php 1 POST /test.hello 1 POST /hello.world 1 POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh 1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh 1 GET /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php 1 GET /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php 1 GET /www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php 1 GET /ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php 1 GET /ws.php 1 GET /ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php 1 GET /wp-trackback.php 1 GET /wp-seo.php --- busiest 3 vhosts: top paths + last 10 requests --- == customkidscom/customkids.com.au-ssl_log == -- top paths -- 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-seo.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-load.php 1 GET /wp-includes/widgets/about.php 1 GET /wp-includes/theme-compat/about.php 1 GET /wp-includes/Text/index.php 1 GET /wp-includes/sodium_compat/src/Core32/Curve25519/Ge/index.php 1 GET /wp-includes/SimplePie/index.php -- last 10 requests -- 68.155.159.216 - - [28/Aug/2026:22:19:13 +1000] "GET /wp-admin/images/index.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [28/Aug/2026:22:19:13 +1000] "GET /wp-trackback.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [28/Aug/2026:22:19:14 +1000] "GET /wp-content/plugins/admin.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [28/Aug/2026:22:19:14 +1000] "GET /wp-admin/index.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [28/Aug/2026:22:19:15 +1000] "GET /webadmin.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [28/Aug/2026:22:19:15 +1000] "GET /wp-admin/ HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [28/Aug/2026:22:19:16 +1000] "GET /wp-includes/images/about.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [28/Aug/2026:22:19:16 +1000] "GET /ova.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [28/Aug/2026:22:19:17 +1000] "GET /wp-admin/css/colors/coffee/about.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [28/Aug/2026:22:19:17 +1000] "GET /wp-content/themes/alera/alpha.php HTTP/1.1" 401 36 "-" "-" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 2 POST /index.php 2 GET /index.php 1 POST /wp-cron.php 1 POST /test.hello 1 POST /hello.world 1 POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh 1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh 1 POST / 1 GET /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php 1 GET /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php 1 GET /www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php 1 GET /ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- last 10 requests -- 196.189.236.151 - - [28/Aug/2026:22:19:28 +1000] "GET /backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 - "-" "libredtail-http" 196.189.236.151 - - [28/Aug/2026:22:19:28 +1000] "GET /blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 - "-" "libredtail-http" 196.189.236.151 - - [28/Aug/2026:22:19:28 +1000] "GET /workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 - "-" "libredtail-http" 196.189.236.151 - - [28/Aug/2026:22:19:28 +1000] "GET /panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 - "-" "libredtail-http" 196.189.236.151 - - [28/Aug/2026:22:19:29 +1000] "GET /public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 - "-" "libredtail-http" 196.189.236.151 - - [28/Aug/2026:22:19:29 +1000] "GET /apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 - "-" "libredtail-http" 196.189.236.151 - - [28/Aug/2026:22:19:29 +1000] "GET /app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 - "-" "libredtail-http" 196.189.236.151 - - [28/Aug/2026:22:19:29 +1000] "GET /index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello HTTP/1.1" 200 42585 "-" "libredtail-http" 196.189.236.151 - - [28/Aug/2026:22:19:29 +1000] "GET /public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello HTTP/1.1" 404 - "-" "libredtail-http" 196.189.236.151 - - [28/Aug/2026:22:19:30 +1000] "GET /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/+/tmp/index1.php HTTP/1.1" 200 50700 "-" "libredtail-http" == madalice/madalice.com.au-ssl_log == -- top paths -- 11 GET / 5 GET /store/drippy-air-max-90-custom-shoes/ 1 POST / 1 GET /wp-config.php.swp 1 GET /wp-config.php.bak 1 GET /wp-config.php~ 1 GET /.env.save 1 GET /.env.prod 1 GET /.env.old 1 GET /.env.local 1 GET /.env.example 1 GET /.env.dev -- last 10 requests -- 34.27.235.222 - - [28/Aug/2026:22:20:26 +1000] "GET /.env.dev HTTP/1.1" 403 12 "-" "crusader-worker/1.0" 34.27.235.222 - - [28/Aug/2026:22:20:26 +1000] "GET /.env.old HTTP/1.1" 403 12 "-" "crusader-worker/1.0" 34.27.235.222 - - [28/Aug/2026:22:20:26 +1000] "GET /actuator/env HTTP/1.1" 404 3417 "-" "crusader-worker/1.0" 34.27.235.222 - - [28/Aug/2026:22:20:26 +1000] "GET /crusader-404-probe HTTP/1.1" 404 3417 "-" "crusader-worker/1.0" 34.27.235.222 - - [28/Aug/2026:22:20:26 +1000] "GET /actuator/configprops HTTP/1.1" 404 3417 "-" "crusader-worker/1.0" 34.27.235.222 - - [28/Aug/2026:22:20:26 +1000] "GET /env HTTP/1.1" 404 3417 "-" "crusader-worker/1.0" 34.27.235.222 - - [28/Aug/2026:22:20:27 +1000] "GET /.env.save HTTP/1.1" 403 12 "-" "crusader-worker/1.0" 34.27.235.222 - - [28/Aug/2026:22:20:28 +1000] "GET /.env.local HTTP/1.1" 403 12 "-" "crusader-worker/1.0" 34.27.235.222 - - [28/Aug/2026:22:20:28 +1000] "GET /wp-config.php~ HTTP/1.1" 403 12 "-" "crusader-worker/1.0" 34.27.235.222 - - [28/Aug/2026:22:20:29 +1000] "GET /.env.example HTTP/1.1" 403 12 "-" "crusader-worker/1.0" --- last 30 samples (run-up to this incident) --- 2026-08-28 22:18:06 L1=0.73 run=1 blk=0 avail=8155 (59.2%) swpO=0 conn=1 myRSS=2574 php=5 phpRSS=455 ap=79 tcp=80 topuser=madalice 2026-08-28 22:18:12 L1=0.70 run=1 blk=0 avail=8186 (59.4%) swpO=0 conn=1 myRSS=2574 php=5 phpRSS=455 ap=73 tcp=28 topuser=madalice 2026-08-28 22:18:16 L1=0.70 run=1 blk=0 avail=8208 (59.6%) swpO=0 conn=1 myRSS=2574 php=5 phpRSS=455 ap=69 tcp=33 topuser=madalice 2026-08-28 22:18:22 L1=0.59 run=1 blk=0 avail=8196 (59.5%) swpO=0 conn=1 myRSS=2574 php=5 phpRSS=507 ap=63 tcp=29 topuser=madalice 2026-08-28 22:18:26 L1=0.59 run=1 blk=0 avail=8222 (59.7%) swpO=0 conn=1 myRSS=2574 php=5 phpRSS=507 ap=59 tcp=28 topuser=madalice 2026-08-28 22:18:32 L1=0.50 run=5 blk=0 avail=8218 (59.6%) swpO=0 conn=1 myRSS=2574 php=5 phpRSS=557 ap=53 tcp=27 topuser=madalice 2026-08-28 22:18:36 L1=0.50 run=1 blk=0 avail=8290 (60.2%) swpO=0 conn=1 myRSS=2574 php=5 phpRSS=510 ap=49 tcp=29 topuser=madalice 2026-08-28 22:18:42 L1=0.42 run=2 blk=0 avail=8333 (60.5%) swpO=0 conn=1 myRSS=2574 php=5 phpRSS=510 ap=42 tcp=24 topuser=madalice 2026-08-28 22:18:46 L1=0.42 run=2 blk=0 avail=8492 (61.6%) swpO=0 conn=1 myRSS=2574 php=4 phpRSS=356 ap=39 tcp=30 topuser=madalice 2026-08-28 22:18:53 L1=0.36 run=1 blk=0 avail=8537 (62.0%) swpO=0 conn=1 myRSS=2574 php=4 phpRSS=356 ap=32 tcp=26 topuser=madalice 2026-08-28 22:18:56 L1=0.36 run=2 blk=0 avail=8693 (63.1%) swpO=0 conn=1 myRSS=2574 php=3 phpRSS=201 ap=29 tcp=30 topuser=madalice 2026-08-28 22:19:03 L1=0.38 run=4 blk=0 avail=8484 (61.6%) swpO=0 conn=1 myRSS=2574 php=5 phpRSS=521 ap=22 tcp=30 topuser=corpkicks 2026-08-28 22:19:06 L1=0.38 run=2 blk=0 avail=8770 (63.7%) swpO=0 conn=1 myRSS=2574 php=3 phpRSS=201 ap=19 tcp=29 topuser=madalice 2026-08-28 22:19:13 L1=0.40 run=2 blk=0 avail=8788 (63.8%) swpO=0 conn=1 myRSS=2574 php=3 phpRSS=201 ap=17 tcp=29 topuser=madalice 2026-08-28 22:19:16 L1=0.40 run=1 blk=0 avail=8791 (63.8%) swpO=0 conn=1 myRSS=2574 php=3 phpRSS=201 ap=16 tcp=29 topuser=madalice 2026-08-28 22:19:23 L1=0.34 run=3 blk=0 avail=8766 (63.6%) swpO=0 conn=1 myRSS=2574 php=4 phpRSS=257 ap=16 tcp=27 topuser=madalice 2026-08-28 22:19:26 L1=0.39 run=5 blk=0 avail=8707 (63.2%) swpO=0 conn=1 myRSS=2574 php=4 phpRSS=320 ap=16 tcp=33 topuser=evolution 2026-08-28 22:19:33 L1=0.68 run=3 blk=0 avail=8702 (63.2%) swpO=0 conn=1 myRSS=2574 php=4 phpRSS=318 ap=17 tcp=30 topuser=evolution 2026-08-28 22:19:36 L1=0.79 run=4 blk=0 avail=8699 (63.1%) swpO=0 conn=1 myRSS=2574 php=4 phpRSS=289 ap=17 tcp=33 topuser=evolution 2026-08-28 22:19:43 L1=0.72 run=1 blk=0 avail=8812 (64.0%) swpO=0 conn=1 myRSS=2574 php=3 phpRSS=178 ap=17 tcp=28 topuser=madalice 2026-08-28 22:19:46 L1=0.74 run=2 blk=0 avail=8677 (63.0%) swpO=0 conn=1 myRSS=2574 php=4 phpRSS=351 ap=16 tcp=30 topuser=evolution 2026-08-28 22:19:53 L1=0.68 run=3 blk=0 avail=8822 (64.0%) swpO=0 conn=1 myRSS=2574 php=3 phpRSS=178 ap=16 tcp=27 topuser=madalice 2026-08-28 22:19:57 L1=0.63 run=1 blk=1 avail=8936 (64.9%) swpO=0 conn=1 myRSS=2574 php=2 phpRSS=47 ap=16 tcp=27 topuser=root 2026-08-28 22:20:03 L1=0.98 run=4 blk=0 avail=8758 (63.6%) swpO=0 conn=1 myRSS=2574 php=4 phpRSS=253 ap=16 tcp=26 topuser=madalice 2026-08-28 22:20:07 L1=1.06 run=3 blk=0 avail=8586 (62.3%) swpO=0 conn=1 myRSS=2574 php=4 phpRSS=299 ap=16 tcp=30 topuser=madalice 2026-08-28 22:20:13 L1=1.06 run=5 blk=0 avail=8684 (63.0%) swpO=0 conn=4 myRSS=2574 php=6 phpRSS=380 ap=16 tcp=24 topuser=tubesupplies 2026-08-28 22:20:17 L1=1.05 run=2 blk=0 avail=8542 (62.0%) swpO=0 conn=1 myRSS=2574 php=3 phpRSS=179 ap=16 tcp=27 topuser=madalice 2026-08-28 22:20:23 L1=1.13 run=4 blk=0 avail=7343 (53.3%) swpO=0 conn=4 myRSS=2574 php=4 phpRSS=335 ap=19 tcp=31 topuser=madalice 2026-08-28 22:20:27 L1=1.20 run=3 blk=1 avail=6563 (47.6%) swpO=536 conn=1 myRSS=2567 php=4 phpRSS=331 ap=19 tcp=48 topuser=madalice 2026-08-28 22:20:33 L1=1.34 run=2 blk=0 avail=5731 (41.6%) swpO=2001 conn=1 myRSS=2544 php=4 phpRSS=317 ap=48 tcp=36 topuser=madalice