INCIDENT 2026-08-31 11:04:53 trigger: php_procs=25 ================================================================== load: 2.28 2.71 2.75 3/695 676657 ncpu:10 mem_avail: 7248MB/13777MB (52.6%) swap_used:2000MB swapout:0/s blocked(D):0 running:3 iowait:0.1% steal:0.0% php: 25 procs / 1148MB heaviest user: evolution (23 procs, 992MB) apache: 54 procs tcp_estab: 57 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3441 root 248 1031 evolution 27 1000 nobody 53 938 netdata 7 206 madalice 1 133 mailman 20 76 cpanellogin 1 62 dovenull 6 46 mailnull 2 29 wp-toolkit 3 22 zabbix 1 20 dovecot 3 18 alison 1 14 kurri 1 12 named 1 11 nscd 1 4 polkitd 1 3 dbus 1 2 cpanelconnecttrack 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 23 992 madalice 1 133 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5943 MB Active(file): 5300 MB Inactive(file): 896 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 527 MB CommitLimit: 10984 MB Committed_AS: 10598 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-08:46:14 4692 /usr/bin/imunify-agent-proxy 656623 root 04:52 1268 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3524516 7.9 Ssl 3-08:45:43 /usr/sbin/mariadbd 3036527 3002570 root 208056 0.1 S 08:33:11 spamd child 508924 1 netdata 187580 1.9 Ssl 3-08:45:12 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3002570 1 root 162624 0.0 Ss 08:42:07 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3036528 3002570 root 152860 0.0 S 08:33:11 spamd child 676462 510022 madalice 136376 10.7 S 00:12 php-fpm: pool madalice_com_au 676464 676124 evolution 68640 1.2 S 00:11 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676428 676123 evolution 67764 0.7 S 00:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676152 676132 evolution 67064 0.2 S 00:43 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 574675 1353308 cpanellogin 63624 0.0 S 29:05 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 509640 508992 root 62676 0.0 Sl 3-08:45:07 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509266 1 root 57524 0.0 Ss 3-08:45:09 /usr/lib/systemd/systemd-journald 509236 509098 root 43532 0.0 Sl 3-08:45:09 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 676447 674419 evolution 43152 0.2 S 00:16 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676437 676122 evolution 43136 0.2 S 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676577 676131 evolution 43136 0.8 S 00:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676440 673161 evolution 43076 0.2 S 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676465 676130 evolution 43064 0.2 S 00:11 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676594 675660 evolution 43056 2.0 S 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676568 676458 evolution 43024 0.5 S 00:06 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676435 676330 evolution 43004 0.2 S 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676611 676549 evolution 42984 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676524 673648 evolution 42844 0.3 S 00:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676438 672053 evolution 42820 0.1 S 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676439 654935 evolution 42796 0.1 S 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 42096 0.1 Ss 40-08:23:35 cpsrvd (SSL) - waiting for connections 676226 675657 evolution 41168 0.0 S 00:38 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676160 675634 evolution 41156 0.0 S 00:41 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676221 675152 evolution 41088 0.0 S 00:38 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676240 674457 evolution 41056 0.0 S 00:35 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676228 671565 evolution 40812 0.0 S 00:37 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676682 676523 evolution 40708 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676467 660970 evolution 39572 0.1 S 00:11 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 676532 676530 evolution 39424 0.3 S 00:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3001917 1 root 34184 0.0 Ss 08:42:39 lfd - sleeping 676616 1469 root 29796 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 676612 1469 root 29776 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1463 1 root 25536 0.0 Ss 63-00:55:04 tailwatchd 662371 506832 nobody 23872 0.1 S 04:46 /usr/sbin/httpd -k start 654935 506832 nobody 22664 0.0 S 06:44 /usr/sbin/httpd -k start 510022 1 root 22604 0.0 Ss 3-08:45:05 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1469 1 root 22488 0.1 Ss 63-00:55:04 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 657000 506832 nobody 22144 0.0 S 04:50 /usr/sbin/httpd -k start 672053 506832 nobody 21904 0.0 S 04:00 /usr/sbin/httpd -k start 660970 506832 nobody 21652 0.0 S 04:47 /usr/sbin/httpd -k start 662366 506832 nobody 20608 0.0 S 04:46 /usr/sbin/httpd -k start 675635 506832 nobody 20548 0.0 S 01:18 /usr/sbin/httpd -k start 483898 1 zabbix 20520 0.2 Ssl 3-08:46:26 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 671565 506832 nobody 20188 0.1 S 04:16 /usr/sbin/httpd -k start 673648 506832 nobody 20148 0.1 S 02:51 /usr/sbin/httpd -k start 676104 506832 nobody 20140 0.0 S 00:48 /usr/sbin/httpd -k start 674440 506832 nobody 20032 0.0 S 02:04 /usr/sbin/httpd -k start 673697 506832 nobody 20004 0.0 S 02:48 /usr/sbin/httpd -k start 675152 506832 nobody 19744 0.0 S 01:33 /usr/sbin/httpd -k start 676131 506832 nobody 19728 0.0 S 00:45 /usr/sbin/httpd -k start 674419 506832 nobody 19724 0.0 S 02:05 /usr/sbin/httpd -k start 671635 506832 nobody 19636 0.1 S 04:13 /usr/sbin/httpd -k start 676112 506832 nobody 19488 0.0 S 00:47 /usr/sbin/httpd -k start 676134 506832 nobody 19344 0.0 S 00:45 /usr/sbin/httpd -k start 674455 506832 nobody 19292 0.0 S 02:03 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 7017945 | root | 108-1481181613 | Execute | 42 | Sending data | SELECT jobs.id, jobs.pmId, jobs.clientid, jobs.company, jobs.status, jobs.suburb, jobs.new_flag, jobs.reference, jobs.cat, jobs.dateadded, jobs.price, jobs.nextaction, jobs.repId, contacts.code, contacts.company, contacts.lastname, contacts.firstname, contacts.trading_names, jobs.site, jobs | | 7019879 | root | 108-1481181613 | Execute | 18 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 7019901 | root | 108-1481181613 | Execute | 17 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7019910 | root | 108-1481181613 | Execute | 16 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7019922 | root | 108-1481181613 | Execute | 15 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7020033 | root | 108-1481181613 | Execute | 10 | Waiting for table level lock | select dispatch.*,contacts.company from dispatch,contacts,jobs where dispatch.contactid = contacts.clientid and dispatch.jobid = jobs.id and dispatch.invoiceid = 0 and dispatch.date > date_sub(dispatch.date, interval 30 day) and jobs.status > 0 order by dispatch.statu | | 7020351 | root | 108-1481181613 | Execute | 1 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 7020567 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 7019879 | 108-1481181613 | 18 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 7019901 | 108-1481181613 | 17 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7019910 | 108-1481181613 | 16 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7019922 | 108-1481181613 | 15 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 7020033 | 108-1481181613 | 10 | Waiting for table level lock | select dispatch.*,contacts.company from dispatch,contacts,jobs where dispatch.contactid = contacts.clientid and dispatch.jobid = jobs.id and dispatch.invoiceid = 0 and disp | | 7020351 | 108-1481181613 | 1 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 784 evolution/portal.evolutionerp.com.au-ssl_log 182 otterfencing/otterfencing.com.au-ssl_log 168 evolution/forms.evolutionerp.com.au-ssl_log 134 evolution/forms.evolutionerp.com.au 131 cosgrovecreative/cosgrovecreative.com.au-ssl_log 90 speedlin/speedlinefencing.com.au-ssl_log 71 lowrange/lowrange.com.au-ssl_log 60 aaa/aaadownunder.com.au-ssl_log 30 madalice/madalice.com.au-ssl_log 13 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 432 203.54.180.238 265 20.151.10.161 209 103.104.165.99 168 4.205.62.107 90 20.104.49.130 80 120.150.225.142 69 45.148.10.42 67 103.104.164.114 60 52.139.37.240 59 180.181.236.49 57 182.239.240.254 56 1.144.107.82 10 150.228.243.152 9 147.161.213.71 9 103.253.27.55 --- top request paths across all vhosts (last 3 min) --- 250 POST /functions.php 156 GET /app/ajax.php 68 GET /index.php 67 POST //functions.php 66 GET /factory_session_checker.php 48 GET /heartbeat.php 36 POST /jobeditsave.php 35 POST /plugins/csvexporter/plugin.php 33 GET /factory_session_processed_qty.php 33 GET /factory_session_joiner.php 31 POST /clienteditsave.php 24 POST /app/ajax.php 21 POST /app/ajax/selectFilterSingle.php 19 POST /quoteditsave.php 18 POST /wp/ 13 POST /inveditsave.php 12 POST /wp/index.php 11 POST /purchaseaddsave.php 8 POST /dispatchsave.php 7 POST /wp/wp-json/batch/v1/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 250 POST /functions.php 156 GET /app/ajax.php 67 POST //functions.php 67 GET /index.php 36 POST /jobeditsave.php 35 POST /plugins/csvexporter/plugin.php 31 POST /clienteditsave.php 24 POST /app/ajax.php 21 POST /app/ajax/selectFilterSingle.php 19 POST /quoteditsave.php 13 POST /inveditsave.php 11 POST /purchaseaddsave.php -- last 10 requests -- 103.104.165.99 - - [31/Aug/2026:11:04:52 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dopportunityedit%26opportunityid%3D3191&call=getUserSetting&caller=ajaxSubmitLocal&seq=18915435042 HTTP/1.1" 20 103.104.165.99 - - [31/Aug/2026:11:04:52 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=17689672263 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 103.104.165.99 - - [31/Aug/2026:11:04:52 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dclientedit%26clientid%3D116%26tab%3Dclienteditgeneral&call=getUserSetting&caller=ajaxSubmitLocal&seq=17321182557 HTTP/1.1" 200 1 103.104.164.114 - - [31/Aug/2026:11:04:52 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=18035661179 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/ind 103.104.164.114 - - [31/Aug/2026:11:04:52 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=18909763372 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/inde 103.104.165.99 - - [31/Aug/2026:11:04:52 +1000] "POST /app/ajax.php?call=ts&tsact=tsUpdateTimesheetNominalRates HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=opportunityedit&opportunityid=3191" "Mozilla 103.104.164.114 - - [31/Aug/2026:11:04:52 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dquotedit%26quoteid%3D1808&call=getUserSetting&caller=ajaxSubmitLocal&seq=10793159652 HTTP/1.1" 200 112 "https 103.104.164.114 - - [31/Aug/2026:11:04:52 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotedit%26quoteid%3D1808&call=getUserSetting&caller=ajaxSubmitLocal&seq=10643444297 HTTP/1.1" 200 162 "https://my.evolutionerp 103.104.165.99 - - [31/Aug/2026:11:04:52 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dopportunityedit%26opportunityid%3D3191&call=getUserSetting&caller=ajaxSubmitLocal&seq=10913822387 HTTP/1.1" 200 168 "https://my. 103.104.165.99 - - [31/Aug/2026:11:04:53 +1000] "POST //functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au//index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, lik == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 66 GET /factory_session_checker.php 48 GET /heartbeat.php 33 GET /factory_session_processed_qty.php 33 GET /factory_session_joiner.php 1 POST /factory_functions.php 1 GET /index.php -- last 10 requests -- 203.54.180.238 - - [31/Aug/2026:11:04:35 +1000] "GET /heartbeat.php?sentAt=1788138275&bytes=106,148,211,35&_=1788128160688 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [31/Aug/2026:11:04:35 +1000] "GET /heartbeat.php?sentAt=1788138269&bytes=106,148,211,29&_=1788137334005 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [31/Aug/2026:11:04:38 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [31/Aug/2026:11:04:39 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [31/Aug/2026:11:04:40 +1000] "GET /factory_session_joiner.php?id=34973 HTTP/1.1" 200 79 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [31/Aug/2026:11:04:40 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [31/Aug/2026:11:04:42 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 124 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [31/Aug/2026:11:04:43 +1000] "GET /factory_session_joiner.php?id=34974 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [31/Aug/2026:11:04:43 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [31/Aug/2026:11:04:44 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 2 GET /thui.php 2 GET /ms-edit.php 2 GET /koiy.php 1 GET /zz.php 1 GET /zaza.php 1 GET /xza.php 1 GET /xve22.php 1 GET /xqq.php 1 GET /xp.php 1 GET /xmy.php 1 GET /xin1.php 1 GET /xda.php -- last 10 requests -- 4.205.62.107 - - [31/Aug/2026:11:03:17 +1000] "GET /hochladen.form.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [31/Aug/2026:11:03:17 +1000] "GET /debuggen.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [31/Aug/2026:11:03:18 +1000] "GET /pouhg.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [31/Aug/2026:11:03:18 +1000] "GET /adminfus.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [31/Aug/2026:11:03:19 +1000] "GET /avim.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [31/Aug/2026:11:03:19 +1000] "GET /nw.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [31/Aug/2026:11:03:20 +1000] "GET /product.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [31/Aug/2026:11:03:20 +1000] "GET /fun.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [31/Aug/2026:11:03:20 +1000] "GET /kedi.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [31/Aug/2026:11:03:21 +1000] "GET /oc460l3x.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-31 11:02:32 L1=2.66 run=2 blk=0 avail=7686 (55.8%) swpO=0 conn=2 myRSS=3438 php=3 phpRSS=194 ap=41 tcp=35 topuser=madalice 2026-08-31 11:02:32 L1=2.66 run=2 blk=0 avail=7686 (55.8%) swpO=0 conn=2 myRSS=3438 php=3 phpRSS=194 ap=41 tcp=35 topuser=madalice 2026-08-31 11:02:42 L1=2.33 run=9 blk=0 avail=7560 (54.9%) swpO=0 conn=2 myRSS=3438 php=7 phpRSS=427 ap=41 tcp=48 topuser=evolution 2026-08-31 11:02:42 L1=2.33 run=9 blk=0 avail=7560 (54.9%) swpO=0 conn=3 myRSS=3438 php=7 phpRSS=426 ap=41 tcp=48 topuser=evolution 2026-08-31 11:02:52 L1=2.21 run=5 blk=0 avail=7516 (54.6%) swpO=0 conn=2 myRSS=3438 php=6 phpRSS=416 ap=47 tcp=52 topuser=madalice 2026-08-31 11:02:52 L1=2.21 run=6 blk=0 avail=7506 (54.5%) swpO=0 conn=3 myRSS=3438 php=7 phpRSS=438 ap=47 tcp=51 topuser=madalice 2026-08-31 11:03:02 L1=2.02 run=2 blk=0 avail=7618 (55.3%) swpO=3 conn=2 myRSS=3437 php=4 phpRSS=239 ap=49 tcp=51 topuser=madalice 2026-08-31 11:03:02 L1=2.02 run=3 blk=0 avail=7617 (55.3%) swpO=3 conn=3 myRSS=3437 php=4 phpRSS=241 ap=49 tcp=50 topuser=madalice 2026-08-31 11:03:12 L1=1.94 run=3 blk=0 avail=7612 (55.2%) swpO=0 conn=2 myRSS=3437 php=4 phpRSS=262 ap=48 tcp=50 topuser=madalice 2026-08-31 11:03:12 L1=1.94 run=5 blk=0 avail=7599 (55.2%) swpO=0 conn=3 myRSS=3437 php=4 phpRSS=272 ap=48 tcp=50 topuser=madalice 2026-08-31 11:03:22 L1=2.26 run=3 blk=0 avail=7534 (54.7%) swpO=0 conn=2 myRSS=3438 php=5 phpRSS=330 ap=53 tcp=50 topuser=madalice 2026-08-31 11:03:22 L1=2.26 run=5 blk=0 avail=7529 (54.6%) swpO=0 conn=3 myRSS=3438 php=5 phpRSS=323 ap=53 tcp=50 topuser=madalice 2026-08-31 11:03:32 L1=2.36 run=1 blk=0 avail=7651 (55.5%) swpO=0 conn=2 myRSS=3438 php=3 phpRSS=193 ap=49 tcp=44 topuser=madalice 2026-08-31 11:03:32 L1=2.36 run=2 blk=0 avail=7651 (55.5%) swpO=0 conn=3 myRSS=3438 php=3 phpRSS=193 ap=49 tcp=44 topuser=madalice 2026-08-31 11:03:42 L1=2.39 run=4 blk=0 avail=7689 (55.8%) swpO=0 conn=2 myRSS=3438 php=4 phpRSS=158 ap=53 tcp=43 topuser=evolution 2026-08-31 11:03:42 L1=2.39 run=5 blk=0 avail=7677 (55.7%) swpO=0 conn=2 myRSS=3438 php=4 phpRSS=156 ap=53 tcp=46 topuser=evolution 2026-08-31 11:03:52 L1=2.09 run=3 blk=0 avail=7640 (55.5%) swpO=0 conn=2 myRSS=3439 php=5 phpRSS=273 ap=45 tcp=48 topuser=madalice 2026-08-31 11:03:53 L1=2.09 run=2 blk=0 avail=7651 (55.5%) swpO=0 conn=2 myRSS=3439 php=6 phpRSS=288 ap=45 tcp=48 topuser=madalice 2026-08-31 11:04:03 L1=1.92 run=2 blk=0 avail=7720 (56.0%) swpO=2 conn=2 myRSS=3439 php=3 phpRSS=167 ap=42 tcp=43 topuser=madalice 2026-08-31 11:04:03 L1=1.92 run=2 blk=0 avail=7714 (56.0%) swpO=2 conn=2 myRSS=3439 php=3 phpRSS=167 ap=42 tcp=44 topuser=madalice 2026-08-31 11:04:13 L1=1.63 run=3 blk=0 avail=7715 (56.0%) swpO=0 conn=2 myRSS=3439 php=5 phpRSS=163 ap=54 tcp=46 topuser=evolution 2026-08-31 11:04:13 L1=1.63 run=6 blk=0 avail=7704 (55.9%) swpO=0 conn=2 myRSS=3439 php=5 phpRSS=168 ap=54 tcp=46 topuser=evolution 2026-08-31 11:04:23 L1=1.76 run=7 blk=0 avail=7430 (53.9%) swpO=2 conn=3 myRSS=3441 php=17 phpRSS=863 ap=44 tcp=46 topuser=evolution 2026-08-31 11:04:23 L1=1.76 run=8 blk=0 avail=7392 (53.7%) swpO=2 conn=2 myRSS=3441 php=16 phpRSS=840 ap=44 tcp=45 topuser=evolution 2026-08-31 11:04:33 L1=2.24 run=8 blk=0 avail=7605 (55.2%) swpO=0 conn=3 myRSS=3441 php=10 phpRSS=497 ap=41 tcp=36 topuser=evolution 2026-08-31 11:04:33 L1=2.24 run=9 blk=0 avail=7600 (55.2%) swpO=0 conn=2 myRSS=3441 php=11 phpRSS=532 ap=41 tcp=36 topuser=evolution 2026-08-31 11:04:43 L1=2.34 run=2 blk=0 avail=7451 (54.1%) swpO=0 conn=3 myRSS=3441 php=19 phpRSS=899 ap=39 tcp=47 topuser=evolution 2026-08-31 11:04:43 L1=2.34 run=3 blk=0 avail=7450 (54.1%) swpO=0 conn=7 myRSS=3441 php=19 phpRSS=899 ap=39 tcp=47 topuser=evolution 2026-08-31 11:04:53 L1=2.28 run=3 blk=0 avail=7248 (52.6%) swpO=0 conn=8 myRSS=3441 php=25 phpRSS=1148 ap=54 tcp=57 topuser=evolution 2026-08-31 11:04:53 L1=2.28 run=3 blk=0 avail=7245 (52.6%) swpO=0 conn=8 myRSS=3441 php=25 phpRSS=1148 ap=54 tcp=58 topuser=evolution