INCIDENT 2026-08-31 11:11:58 trigger: mysql_conn=19 ================================================================== load: 5.12 3.19 2.89 8/759 711890 ncpu:10 mem_avail: 6746MB/13777MB (49.0%) swap_used:2084MB swapout:0/s blocked(D):0 running:3 iowait:0.3% steal:0.0% php: 8 procs / 650MB heaviest user: madalice (2 procs, 314MB) apache: 133 procs tcp_estab: 59 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3400 nobody 132 2392 root 250 974 madalice 2 314 netdata 7 204 speedlin 1 96 aaa 1 89 mailman 20 75 evolution 6 61 cpanellogin 1 61 dovenull 6 46 mailnull 2 29 kurri 2 25 wp-toolkit 3 21 zabbix 1 19 dovecot 3 18 alison 1 15 named 1 11 nscd 1 4 polkitd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 2 314 speedlin 1 96 root 1 22 evolution 1 12 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3879 MB Active(file): 2746 MB Inactive(file): 1286 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 507 MB CommitLimit: 10984 MB Committed_AS: 9359 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-08:53:19 4400 /usr/bin/imunify-agent-proxy 656623 root 11:57 1268 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3482312 8.1 Ssl 3-08:52:48 /usr/sbin/mariadbd 3036527 3002570 root 201348 0.1 S 08:40:16 spamd child 508924 1 netdata 185024 1.9 Ssl 3-08:52:17 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 711395 510022 madalice 161160 39.2 S 00:25 php-fpm: pool madalice_com_au 711284 510022 madalice 161036 42.6 S 00:31 php-fpm: pool madalice_com_au 3002570 1 root 147112 0.0 Ss 08:49:12 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3036528 3002570 root 137328 0.0 S 08:40:16 spamd child 711856 700175 speedlin 107384 70.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509640 508992 root 62932 0.0 Sl 3-08:52:12 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 711235 1353308 cpanellogin 62784 1.9 S 00:40 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 509266 1 root 57912 0.0 Ss 3-08:52:14 /usr/lib/systemd/systemd-journald 509236 509098 root 42168 0.0 Sl 3-08:52:14 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41548 0.1 Ss 40-08:30:40 cpsrvd (SSL) - waiting for connections 711923 676131 evolution 40504 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3001917 1 root 33956 0.0 Ss 08:49:44 lfd - sleeping 711860 1469 root 29076 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1463 1 root 24872 0.0 Ss 63-01:02:09 tailwatchd 662371 506832 nobody 23900 0.0 S 11:51 /usr/sbin/httpd -k start 654935 506832 nobody 22768 0.0 S 13:49 /usr/sbin/httpd -k start 510022 1 root 22560 0.0 Ss 3-08:52:10 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 672053 506832 nobody 22312 0.0 S 11:05 /usr/sbin/httpd -k start 657000 506832 nobody 22200 0.0 S 11:55 /usr/sbin/httpd -k start 710515 506832 nobody 22020 0.1 S 01:04 /usr/sbin/httpd -k start 1469 1 root 21956 0.1 Ss 63-01:02:09 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 710507 506832 nobody 21836 0.0 S 01:07 /usr/sbin/httpd -k start 660970 506832 nobody 21684 0.0 S 11:52 /usr/sbin/httpd -k start 695462 506832 nobody 21656 0.0 S 02:51 /usr/sbin/httpd -k start 691543 506832 nobody 21456 0.0 S 06:11 /usr/sbin/httpd -k start 673648 506832 nobody 21228 0.0 S 09:56 /usr/sbin/httpd -k start 674419 506832 nobody 21184 0.0 S 09:10 /usr/sbin/httpd -k start 673697 506832 nobody 21084 0.0 S 09:53 /usr/sbin/httpd -k start 692495 506832 nobody 21084 0.0 S 05:25 /usr/sbin/httpd -k start 711144 506832 nobody 21016 0.0 S 00:49 /usr/sbin/httpd -k start 694536 506832 nobody 21012 0.0 S 03:39 /usr/sbin/httpd -k start 694886 506832 nobody 21000 0.0 S 03:20 /usr/sbin/httpd -k start 691536 506832 nobody 20920 0.0 S 06:11 /usr/sbin/httpd -k start 676112 506832 nobody 20856 0.0 S 07:52 /usr/sbin/httpd -k start 711141 506832 nobody 20824 0.0 S 00:50 /usr/sbin/httpd -k start 694548 506832 nobody 20820 0.1 S 03:38 /usr/sbin/httpd -k start 695700 506832 nobody 20788 0.0 S 02:25 /usr/sbin/httpd -k start 695430 506832 nobody 20744 0.0 S 02:52 /usr/sbin/httpd -k start 675635 506832 nobody 20660 0.0 S 08:23 /usr/sbin/httpd -k start 695461 506832 nobody 20640 0.0 S 02:51 /usr/sbin/httpd -k start 710182 506832 nobody 20540 0.0 S 01:37 /usr/sbin/httpd -k start 676539 506832 nobody 20472 0.0 S 07:13 /usr/sbin/httpd -k start 711151 506832 nobody 20444 0.1 S 00:48 /usr/sbin/httpd -k start 676104 506832 nobody 20436 0.0 S 07:53 /usr/sbin/httpd -k start 693095 506832 nobody 20300 0.0 S 05:04 /usr/sbin/httpd -k start 676554 506832 nobody 20284 0.0 S 07:12 /usr/sbin/httpd -k start 676555 506832 nobody 20144 0.0 S 07:12 /usr/sbin/httpd -k start 693640 506832 nobody 20132 0.0 S 04:29 /usr/sbin/httpd -k start 691002 506832 nobody 20088 0.0 S 06:43 /usr/sbin/httpd -k start 691524 506832 nobody 20076 0.0 S 06:12 /usr/sbin/httpd -k start 676111 506832 nobody 19976 0.0 S 07:52 /usr/sbin/httpd -k start 675152 506832 nobody 19972 0.0 S 08:38 /usr/sbin/httpd -k start 676548 506832 nobody 19964 0.0 S 07:12 /usr/sbin/httpd -k start 483898 1 zabbix 19944 0.2 Ssl 3-08:53:31 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 691544 506832 nobody 19888 0.0 S 06:11 /usr/sbin/httpd -k start 695692 506832 nobody 19884 0.0 S 02:27 /usr/sbin/httpd -k start 710524 506832 nobody 19832 0.0 S 01:03 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 7065147 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 622 cosgrovecreative/cosgrovecreative.com.au-ssl_log 77 speedlin/speedlinefencing.com.au-ssl_log 54 lowrange/lowrange.com.au-ssl_log 38 evolution/portal.evolutionerp.com.au-ssl_log 31 customc/customcentral.com.au-ssl_log 19 madalice/madalice.com.au-ssl_log 19 speedlin/speedlinefencing.com.au 11 aaa/aaadownunder.com.au-ssl_log 7 corpkicks/corporatekicks.com.au-ssl_log 4 evolution/evolutionerp.com.au-ssl_log 3 bigdeals/bigdeals.com.au-ssl_log 1 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 263 203.54.180.238 126 103.104.165.99 115 52.139.37.240 85 103.104.164.114 72 101.166.96.210 51 150.228.243.152 39 93.123.109.164 34 182.239.240.254 18 4.204.224.164 17 158.158.54.35 9 147.161.213.71 7 118.127.40.55 6 45.148.10.40 5 147.161.215.103 4 180.181.236.49 --- top request paths across all vhosts (last 3 min) --- 238 POST /functions.php 101 GET /app/ajax.php 55 GET /index.php 30 GET /heartbeat.php 27 POST /plugins/csvexporter/plugin.php 27 POST //functions.php 19 GET / 18 POST /app/ajax.php 17 POST /jobeditsave.php 16 POST /quoteditsave.php 15 POST /app/ajax/selectFilterSingle.php 15 GET //app/ajax.php 13 POST /app/ajax/selectFilter.php 12 POST / 10 POST /clienteditsave.php 8 POST /plugins/fencecosting/plugin.php 6 POST //clienteditsave.php 5 POST /purchaseaddsave.php 5 POST /logsave.php 4 POST /wp-cron.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 238 POST /functions.php 101 GET /app/ajax.php 47 GET /index.php 27 POST /plugins/csvexporter/plugin.php 27 POST //functions.php 18 POST /app/ajax.php 17 POST /jobeditsave.php 16 POST /quoteditsave.php 15 POST /app/ajax/selectFilterSingle.php 15 GET //app/ajax.php 13 POST /app/ajax/selectFilter.php 10 POST /clienteditsave.php -- last 10 requests -- 103.104.165.99 - - [31/Aug/2026:11:11:56 +1000] "GET //app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=10346443645 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au//in 103.104.165.99 - - [31/Aug/2026:11:11:56 +1000] "GET //app/ajax.php?cn=&furi=true&uri=page%3Djobedit%26id%3D12061&call=getUserSetting&caller=ajaxSubmitLocal&seq=16874549195 HTTP/1.1" 200 161 "https://my.evolutionerp.com. 103.104.165.99 - - [31/Aug/2026:11:11:56 +1000] "GET //app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Djobedit%26id%3D12061&call=getUserSetting&caller=ajaxSubmitLocal&seq=17219966416 HTTP/1.1" 200 112 "https://my 203.54.180.238 - - [31/Aug/2026:11:11:57 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dmfreqedit%26id%3D20766&call=getUserSetting&caller=ajaxSubmitLocal&seq=18341587134 HTTP/1.1" 200 100 "https://my.evolutionerp.com 103.104.165.99 - - [31/Aug/2026:11:11:56 +1000] "POST /purchaseaddsave.php?call=fetch HTTP/1.1" 200 3819 "https://my.evolutionerp.com.au/index.php?page=purchasereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 203.54.180.238 - - [31/Aug/2026:11:11:57 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78139" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K 180.181.236.49 - - [31/Aug/2026:11:11:57 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=purchasereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 103.104.165.99 - - [31/Aug/2026:11:11:58 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=purchasereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 103.104.165.99 - - [31/Aug/2026:11:11:58 +1000] "POST //functions.php?call=heartbeat HTTP/1.1" 200 3565 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=12061" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe 203.54.180.238 - - [31/Aug/2026:11:11:58 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 1 GET /zwso.php 1 GET /zoom1.php 1 GET /y.php 1 GET /yanz.php 1 GET /xleet.php 1 GET /wp-sigunq.php 1 GET /wp-includes/rest-api/ 1 GET /wp-includes/PHPMailer/ 1 GET /wp-includes/images/media/ 1 GET /wp-includes/images/crystal/ 1 GET /wp-includes/customize/index.php 1 GET /wp-content/themes/alera/alpha.php -- last 10 requests -- 52.139.37.240 - - [31/Aug/2026:11:09:18 +1000] "GET /conf_upload.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:19 +1000] "GET /content.php888 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:19 +1000] "GET /gecko-new.php.1 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:19 +1000] "GET /OthioNDwMEK.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:19 +1000] "GET /sim.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:20 +1000] "GET /y.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:20 +1000] "GET /xleet.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:20 +1000] "GET /admin.php1 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:20 +1000] "GET /M1.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:11:09:20 +1000] "GET /ds.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 10 GET / 5 POST / 5 GET /index.php 3 GET /wp-json/gravitysmtp/v1/tests/mock-data 2 GET /wp-json/batch/v1 2 GET /ba.php 1 POST /wp-cron.php 1 POST /signup 1 POST /login 1 POST /api/auth/signin 1 GET /yj09.php 1 GET /wp-json/contact-form-7/v1/contact-forms/678/feedback/schema -- last 10 requests -- 4.204.224.164 - - [31/Aug/2026:11:11:31 +1000] "GET /robots.php HTTP/1.1" 404 45250 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:11:33 +1000] "GET /sky.php HTTP/1.1" 404 45250 "-" "-" 93.123.109.164 - - [31/Aug/2026:11:11:36 +1000] "POST /api/auth/signin HTTP/1.1" 404 45250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0" 4.204.224.164 - - [31/Aug/2026:11:11:36 +1000] "GET /sixxis.php HTTP/1.1" 404 45250 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:11:39 +1000] "GET /yj09.php HTTP/1.1" 404 45250 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:11:41 +1000] "GET /k.php HTTP/1.1" 404 45250 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:11:43 +1000] "GET /w.php HTTP/1.1" 404 45250 "-" "-" 135.232.20.130 - - [31/Aug/2026:11:11:45 +1000] "GET /wp-json/contact-form-7/v1/contact-forms/678/feedback/schema HTTP/1.1" 200 221 "https://speedlinefencing.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 4.204.224.164 - - [31/Aug/2026:11:11:45 +1000] "GET /FWAZ.php HTTP/1.1" 404 45250 "-" "-" 4.204.224.164 - - [31/Aug/2026:11:11:47 +1000] "GET /blurbs.php HTTP/1.1" 404 45250 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-31 11:09:36 L1=2.16 run=5 blk=0 avail=5235 (38.0%) swpO=0 conn=22 myRSS=3407 php=125 phpRSS=5225 ap=149 tcp=112 topuser=evolution 2026-08-31 11:09:36 L1=2.16 run=8 blk=0 avail=5184 (37.6%) swpO=0 conn=22 myRSS=3407 php=125 phpRSS=5223 ap=153 tcp=117 topuser=evolution 2026-08-31 11:09:46 L1=2.06 run=4 blk=1 avail=5038 (36.6%) swpO=287 conn=21 myRSS=3399 php=120 phpRSS=5292 ap=152 tcp=100 topuser=evolution 2026-08-31 11:09:46 L1=2.06 run=4 blk=0 avail=5111 (37.1%) swpO=287 conn=20 myRSS=3399 php=121 phpRSS=5244 ap=151 tcp=100 topuser=evolution 2026-08-31 11:09:56 L1=1.90 run=2 blk=0 avail=5157 (37.4%) swpO=0 conn=20 myRSS=3399 php=121 phpRSS=5239 ap=144 tcp=104 topuser=evolution 2026-08-31 11:09:56 L1=1.90 run=4 blk=0 avail=5156 (37.4%) swpO=0 conn=20 myRSS=3399 php=121 phpRSS=5239 ap=144 tcp=104 topuser=evolution 2026-08-31 11:10:06 L1=2.16 run=5 blk=1 avail=4955 (36.0%) swpO=0 conn=21 myRSS=3398 php=125 phpRSS=5460 ap=147 tcp=107 topuser=evolution 2026-08-31 11:10:06 L1=2.16 run=6 blk=1 avail=4948 (35.9%) swpO=0 conn=21 myRSS=3398 php=125 phpRSS=5462 ap=147 tcp=107 topuser=evolution 2026-08-31 11:10:16 L1=2.36 run=5 blk=0 avail=5058 (36.7%) swpO=0 conn=24 myRSS=3398 php=127 phpRSS=5532 ap=143 tcp=100 topuser=evolution 2026-08-31 11:10:16 L1=2.36 run=7 blk=0 avail=5051 (36.7%) swpO=0 conn=24 myRSS=3398 php=127 phpRSS=5539 ap=143 tcp=100 topuser=evolution 2026-08-31 11:10:26 L1=2.38 run=3 blk=0 avail=5262 (38.2%) swpO=0 conn=21 myRSS=3398 php=125 phpRSS=5231 ap=150 tcp=99 topuser=evolution 2026-08-31 11:10:26 L1=2.38 run=6 blk=0 avail=5252 (38.1%) swpO=0 conn=22 myRSS=3398 php=126 phpRSS=5276 ap=150 tcp=99 topuser=evolution 2026-08-31 11:10:36 L1=2.25 run=4 blk=0 avail=5186 (37.6%) swpO=0 conn=20 myRSS=3398 php=128 phpRSS=5383 ap=144 tcp=102 topuser=evolution 2026-08-31 11:10:37 L1=2.25 run=5 blk=0 avail=5186 (37.6%) swpO=0 conn=19 myRSS=3398 php=127 phpRSS=5376 ap=144 tcp=102 topuser=evolution 2026-08-31 11:10:47 L1=2.20 run=3 blk=0 avail=5111 (37.1%) swpO=0 conn=20 myRSS=3399 php=130 phpRSS=5579 ap=148 tcp=101 topuser=evolution 2026-08-31 11:10:47 L1=2.20 run=3 blk=0 avail=5114 (37.1%) swpO=0 conn=19 myRSS=3399 php=130 phpRSS=5584 ap=148 tcp=101 topuser=evolution 2026-08-31 11:10:57 L1=2.09 run=3 blk=0 avail=5184 (37.6%) swpO=0 conn=20 myRSS=3399 php=129 phpRSS=5457 ap=153 tcp=102 topuser=evolution 2026-08-31 11:10:57 L1=2.09 run=5 blk=0 avail=5174 (37.6%) swpO=0 conn=20 myRSS=3399 php=129 phpRSS=5465 ap=153 tcp=102 topuser=evolution 2026-08-31 11:11:07 L1=2.08 run=2 blk=0 avail=5187 (37.7%) swpO=0 conn=19 myRSS=3399 php=132 phpRSS=5569 ap=148 tcp=100 topuser=evolution 2026-08-31 11:11:07 L1=2.08 run=2 blk=0 avail=5186 (37.6%) swpO=0 conn=19 myRSS=3399 php=132 phpRSS=5569 ap=148 tcp=101 topuser=evolution 2026-08-31 11:11:17 L1=1.99 run=3 blk=0 avail=5029 (36.5%) swpO=0 conn=20 myRSS=3399 php=135 phpRSS=5770 ap=153 tcp=100 topuser=evolution 2026-08-31 11:11:18 L1=1.99 run=4 blk=0 avail=5103 (37.0%) swpO=0 conn=20 myRSS=3399 php=135 phpRSS=5698 ap=153 tcp=100 topuser=evolution 2026-08-31 11:11:27 L1=2.08 run=4 blk=0 avail=5136 (37.3%) swpO=0 conn=21 myRSS=3399 php=135 phpRSS=5618 ap=153 tcp=110 topuser=evolution 2026-08-31 11:11:28 L1=2.08 run=5 blk=1 avail=4878 (35.4%) swpO=0 conn=22 myRSS=3399 php=136 phpRSS=5920 ap=153 tcp=112 topuser=evolution 2026-08-31 11:11:37 L1=4.79 run=14 blk=0 avail=5696 (41.3%) swpO=0 conn=16 myRSS=3399 php=68 phpRSS=3221 ap=153 tcp=130 topuser=evolution 2026-08-31 11:11:38 L1=4.79 run=10 blk=0 avail=5546 (40.3%) swpO=0 conn=19 myRSS=3399 php=65 phpRSS=3304 ap=153 tcp=132 topuser=evolution 2026-08-31 11:11:47 L1=5.25 run=4 blk=0 avail=6820 (49.5%) swpO=0 conn=6 myRSS=3400 php=10 phpRSS=611 ap=143 tcp=63 topuser=madalice 2026-08-31 11:11:48 L1=5.25 run=9 blk=0 avail=6664 (48.4%) swpO=0 conn=19 myRSS=3400 php=16 phpRSS=958 ap=143 tcp=65 topuser=evolution 2026-08-31 11:11:57 L1=5.12 run=4 blk=0 avail=6868 (49.8%) swpO=0 conn=6 myRSS=3400 php=6 phpRSS=438 ap=133 tcp=56 topuser=madalice 2026-08-31 11:11:58 L1=5.12 run=3 blk=0 avail=6746 (49.0%) swpO=0 conn=19 myRSS=3400 php=8 phpRSS=650 ap=133 tcp=59 topuser=madalice