INCIDENT 2026-08-31 12:00:53 trigger: php_rss=1562MB ================================================================== load: 2.75 2.61 2.32 11/707 911290 ncpu:10 mem_avail: 6642MB/13777MB (48.2%) swap_used:2057MB swapout:0/s blocked(D):0 running:14 iowait:0.5% steal:0.0% php: 20 procs / 1562MB heaviest user: madalice (5 procs, 777MB) apache: 58 procs tcp_estab: 78 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3449 nobody 57 1028 root 253 959 madalice 5 738 evolution 17 530 netdata 7 205 infinium 5 177 mailman 20 75 mailnull 4 62 cpanellogin 1 62 dovenull 6 46 wp-toolkit 3 21 lowrange 1 21 zabbix 1 20 dovecot 3 18 alison 1 14 kurri 1 12 named 1 11 nscd 1 4 polkitd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 5 745 evolution 12 522 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5632 MB Active(file): 4721 MB Inactive(file): 1126 MB Dirty: 4 MB Writeback: 0 MB SReclaimable: 504 MB CommitLimit: 10984 MB Committed_AS: 9816 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-09:42:14 4272 /usr/bin/imunify-agent-proxy 896009 root 00:52 1268 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3532208 8.4 Ssl 3-09:41:43 /usr/sbin/mariadbd 3036527 3002570 root 203364 0.1 S 09:29:11 spamd child 911209 510022 madalice 202736 94.0 S 00:01 php-fpm: pool madalice_com_au 508924 1 netdata 186200 1.9 Ssl 3-09:41:12 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 911210 510022 madalice 175296 98.0 R 00:01 php-fpm: pool madalice_com_au 910660 510022 madalice 163400 16.4 S 00:22 php-fpm: pool madalice_com_au 3002570 1 root 146708 0.0 Ss 09:38:07 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 911218 510022 madalice 138744 0.0 R 00:00 php-fpm: pool madalice_com_au 3036528 3002570 root 136928 0.0 S 09:29:11 spamd child 911225 510022 madalice 114200 0.0 R 00:00 php-fpm: pool madalice_com_au 896061 895998 evolution 93988 6.9 Rs 00:52 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 911157 895359 evolution 68900 6.6 S 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 911229 910572 evolution 68320 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509640 508992 root 63724 0.0 Sl 3-09:41:07 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 873062 1353308 cpanellogin 63672 0.1 S 09:35 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 509266 1 root 61256 0.0 Ss 3-09:41:09 /usr/lib/systemd/systemd-journald 895969 1353308 infinium 56168 0.2 S 00:53 webmaild - serving 1.41.252.211 896091 1353308 infinium 56032 0.2 S 00:52 webmaild - serving 1.41.252.211 509236 509098 root 49028 0.0 Sl 3-09:41:09 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 911311 910600 evolution 43528 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 41984 0.1 Ss 40-09:19:35 cpsrvd (SSL) - waiting for connections 911217 892226 evolution 40636 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 911222 910571 evolution 40596 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 911221 892221 evolution 40516 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 911172 892208 evolution 39892 1.0 S 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 911171 911154 evolution 39692 0.6 S 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 911200 911176 evolution 39112 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 911162 894414 evolution 38996 1.0 S 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3001917 1 root 33992 0.0 Ss 09:38:39 lfd - sleeping 895973 938407 infinium 29728 0.3 S 00:53 php-fpm: pool user_infinium 1463 1 root 24932 0.0 Ss 63-01:51:04 tailwatchd 876108 506832 nobody 23840 0.0 S 06:44 /usr/sbin/httpd -k start 876139 506832 nobody 22588 0.0 S 06:43 /usr/sbin/httpd -k start 510022 1 root 22564 0.0 Ss 3-09:41:05 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 910700 508511 lowrange 22432 0.3 S 00:20 dovecot/imap 895270 506832 nobody 22032 0.3 S 01:31 /usr/sbin/httpd -k start 1469 1 root 21992 0.1 Ss 63-01:51:04 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 892221 506832 nobody 21992 0.0 S 04:45 /usr/sbin/httpd -k start 892208 506832 nobody 21804 0.2 S 04:45 /usr/sbin/httpd -k start 892216 506832 nobody 21784 0.0 S 04:45 /usr/sbin/httpd -k start 876158 506832 nobody 21668 0.0 S 06:42 /usr/sbin/httpd -k start 892178 506832 nobody 21660 0.0 S 04:46 /usr/sbin/httpd -k start 894955 506832 nobody 21548 0.1 S 01:53 /usr/sbin/httpd -k start 892180 506832 nobody 21512 0.0 S 04:46 /usr/sbin/httpd -k start 894456 506832 nobody 21492 0.0 S 02:26 /usr/sbin/httpd -k start 875049 506832 nobody 21476 0.0 S 07:35 /usr/sbin/httpd -k start 876156 506832 nobody 21340 0.0 S 06:42 /usr/sbin/httpd -k start 893747 506832 nobody 21132 0.0 S 03:14 /usr/sbin/httpd -k start 483898 1 zabbix 21128 0.2 Ssl 3-09:42:26 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 892215 506832 nobody 20960 0.1 S 04:45 /usr/sbin/httpd -k start 896341 938407 infinium 20816 0.1 S 00:51 php-fpm: pool user_infinium 895340 506832 nobody 20772 0.0 S 01:30 /usr/sbin/httpd -k start 892226 506832 nobody 20696 0.1 S 04:45 /usr/sbin/httpd -k start 894467 506832 nobody 20588 0.0 S 02:25 /usr/sbin/httpd -k start 895700 506832 nobody 20336 0.1 S 01:09 /usr/sbin/httpd -k start 895740 506832 nobody 20284 0.0 S 01:06 /usr/sbin/httpd -k start 894414 506832 nobody 20268 0.2 S 02:30 /usr/sbin/httpd -k start 910336 508720 mailnull 20156 0.0 S 00:34 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 910604 506832 nobody 19952 0.0 S 00:24 /usr/sbin/httpd -k start 895741 506832 nobody 19592 0.0 S 01:06 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 7571457 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 7571376 | root | 304-1779936994 | Execute | 0 | Sending data | SELECT purchases.id,purchases.createdate,purchases.date,purchases.status,purchaseitems.id as puritemid, purchaseitems.qty,purchaseitems.reqitemid,purchaseitems.status as status2 FROM purchaseitems,purchases WHERE purchaseitems.purchaseid=purchases.id AND purchaseitems.reqitemid='135' | +---------+------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 737 evolution/my.evolutionerp.com.au-ssl_log 702 evolution/portal.evolutionerp.com.au-ssl_log 450 candyfabcom/candyfab.com.au-ssl_log 93 evolution/evolutionerp.com.au-ssl_log 91 candyfabcom/candyfab.com.au 90 madalice/madalice.com.au-ssl_log 85 evolution/evolutionerp.com.au 59 olytis/tis.com.au-ssl_log 46 nrg/nrgservices.net.au-ssl_log 29 alison/alisonarts.com.au-ssl_log 27 aaa/aaadownunder.com.au-ssl_log 1 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 737 40.115.94.245 673 203.54.180.238 183 20.104.49.130 178 103.104.164.114 132 103.104.165.99 131 158.23.147.79 79 158.23.184.117 77 52.139.37.240 46 20.104.18.15 39 150.228.243.152 37 182.239.240.254 29 45.148.10.40 14 93.123.109.166 14 195.178.110.104 9 182.9.34.248 --- top request paths across all vhosts (last 3 min) --- 287 POST /functions.php 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFB2001KG 127 GET /app/ajax.php 108 GET /heartbeat.php 107 GET /factory_session_checker.php 77 GET /index.php 55 GET /factory_session_processed_qty.php 54 GET /factory_session_joiner.php 26 POST /plugins/csvexporter/plugin.php 20 POST /billaddsave.php 20 POST /app/ajax.php 19 POST //functions.php 19 POST /app/ajax/selectFilterSingle.php 17 GET /api/getItem/LWPG2001KG 16 POST /quoteditsave.php 14 POST /clienteditsave.php 13 GET //app/ajax.php 12 POST /factory_functions.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFB2001KG 17 GET /api/getItem/LWPG2001KG 9 GET /api/getItem/NA 4 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 2 GET /api/getItem/SHSG757540-8 -- last 10 requests -- 40.115.94.245 - - [31/Aug/2026:12:00:52 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [31/Aug/2026:12:00:52 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [31/Aug/2026:12:00:52 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [31/Aug/2026:12:00:52 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [31/Aug/2026:12:00:52 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [31/Aug/2026:12:00:52 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [31/Aug/2026:12:00:52 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [31/Aug/2026:12:00:52 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [31/Aug/2026:12:00:52 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [31/Aug/2026:12:00:52 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 287 POST /functions.php 127 GET /app/ajax.php 60 GET /index.php 26 POST /plugins/csvexporter/plugin.php 20 POST /billaddsave.php 20 POST /app/ajax.php 19 POST //functions.php 19 POST /app/ajax/selectFilterSingle.php 16 POST /quoteditsave.php 14 POST /clienteditsave.php 13 GET //app/ajax.php 9 POST /jobeditsave.php -- last 10 requests -- 103.104.164.114 - - [31/Aug/2026:12:00:48 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 15821 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4187&tab=maintab" "Mozilla/5.0 (Windows NT 1 103.104.165.99 - - [31/Aug/2026:12:00:48 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=mfreqedit&id=11240" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 203.54.180.238 - - [31/Aug/2026:12:00:49 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78933§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 203.54.180.238 - - [31/Aug/2026:12:00:49 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=13922" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 203.54.180.238 - - [31/Aug/2026:12:00:50 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 285 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29330&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 182.239.240.254 - - [31/Aug/2026:12:00:50 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 150.228.243.152 - - [31/Aug/2026:12:00:51 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=inventory&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 150.228.243.152 - - [31/Aug/2026:12:00:51 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=3650" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe 103.104.164.114 - - [31/Aug/2026:12:00:51 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4187&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; 103.104.165.99 - - [31/Aug/2026:12:00:52 +1000] "POST /mfreqsave.php?reqsave=2 HTTP/1.1" 302 21 "https://my.evolutionerp.com.au/index.php?page=mfreqedit&id=11240" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 108 GET /heartbeat.php 107 GET /factory_session_checker.php 55 GET /factory_session_processed_qty.php 54 GET /factory_session_joiner.php 15 GET /index.php 12 POST /factory_functions.php 8 POST /portal/register 6 GET /uploadsave.php 2 POST /uploadsave.php 2 POST /inventory.php 1 POST /login.php 1 POST /ajax/selectFilter.php -- last 10 requests -- 203.54.180.238 - - [31/Aug/2026:12:00:47 +1000] "GET /heartbeat.php?sentAt=1788141648&bytes=106,148,224,80&_=1788141207943 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=8" 103.104.165.99 - - [31/Aug/2026:12:00:45 +1000] "POST /factory_functions.php?factory_session_create HTTP/1.1" 302 20 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=9" "Mozilla/5.0 (Linux; A 203.54.180.238 - - [31/Aug/2026:12:00:49 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 103.104.165.99 - - [31/Aug/2026:12:00:49 +1000] "GET /index.php?page=factory_workbench HTTP/1.1" 200 12319 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=9" "Mozilla/5.0 (Linux; Android 10; 103.104.165.99 - - [31/Aug/2026:12:00:49 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, 203.54.180.238 - - [31/Aug/2026:12:00:50 +1000] "GET /factory_session_joiner.php?id=34963 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [31/Aug/2026:12:00:50 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 123 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [31/Aug/2026:12:00:50 +1000] "GET /heartbeat.php?sentAt=1788141650&bytes=106,148,224,82&_=1788140245247 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [31/Aug/2026:12:00:52 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [31/Aug/2026:12:00:52 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 124 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb --- last 30 samples (run-up to this incident) --- 2026-08-31 11:58:33 L1=3.26 run=2 blk=0 avail=7375 (53.5%) swpO=0 conn=5 myRSS=3448 php=6 phpRSS=488 ap=61 tcp=51 topuser=madalice 2026-08-31 11:58:33 L1=3.26 run=3 blk=0 avail=7366 (53.5%) swpO=0 conn=2 myRSS=3448 php=7 phpRSS=536 ap=60 tcp=50 topuser=madalice 2026-08-31 11:58:43 L1=3.06 run=3 blk=0 avail=7350 (53.3%) swpO=0 conn=5 myRSS=3448 php=6 phpRSS=582 ap=52 tcp=49 topuser=madalice 2026-08-31 11:58:43 L1=3.06 run=3 blk=0 avail=7339 (53.3%) swpO=0 conn=4 myRSS=3448 php=6 phpRSS=587 ap=52 tcp=49 topuser=madalice 2026-08-31 11:58:53 L1=3.13 run=3 blk=0 avail=7328 (53.2%) swpO=0 conn=5 myRSS=3449 php=7 phpRSS=640 ap=49 tcp=51 topuser=madalice 2026-08-31 11:58:53 L1=3.13 run=5 blk=0 avail=7309 (53.1%) swpO=0 conn=4 myRSS=3449 php=6 phpRSS=627 ap=49 tcp=51 topuser=madalice 2026-08-31 11:59:03 L1=3.10 run=3 blk=0 avail=7447 (54.1%) swpO=0 conn=2 myRSS=3449 php=6 phpRSS=460 ap=54 tcp=61 topuser=madalice 2026-08-31 11:59:03 L1=3.10 run=2 blk=0 avail=7446 (54.0%) swpO=0 conn=4 myRSS=3449 php=5 phpRSS=390 ap=54 tcp=61 topuser=madalice 2026-08-31 11:59:13 L1=2.86 run=2 blk=0 avail=7438 (54.0%) swpO=0 conn=2 myRSS=3449 php=6 phpRSS=455 ap=54 tcp=54 topuser=madalice 2026-08-31 11:59:13 L1=2.86 run=5 blk=0 avail=7423 (53.9%) swpO=0 conn=4 myRSS=3449 php=6 phpRSS=487 ap=54 tcp=55 topuser=madalice 2026-08-31 11:59:23 L1=2.64 run=5 blk=0 avail=7331 (53.2%) swpO=0 conn=2 myRSS=3449 php=6 phpRSS=522 ap=56 tcp=65 topuser=madalice 2026-08-31 11:59:23 L1=2.64 run=4 blk=0 avail=7355 (53.4%) swpO=0 conn=4 myRSS=3449 php=8 phpRSS=578 ap=56 tcp=66 topuser=madalice 2026-08-31 11:59:33 L1=2.77 run=3 blk=0 avail=7375 (53.5%) swpO=0 conn=2 myRSS=3449 php=7 phpRSS=449 ap=66 tcp=68 topuser=madalice 2026-08-31 11:59:33 L1=2.77 run=2 blk=0 avail=7355 (53.4%) swpO=0 conn=4 myRSS=3449 php=7 phpRSS=469 ap=66 tcp=69 topuser=madalice 2026-08-31 11:59:43 L1=2.72 run=6 blk=1 avail=7180 (52.1%) swpO=0 conn=2 myRSS=3449 php=10 phpRSS=753 ap=61 tcp=67 topuser=evolution 2026-08-31 11:59:43 L1=2.72 run=6 blk=0 avail=7168 (52.0%) swpO=0 conn=8 myRSS=3449 php=10 phpRSS=764 ap=61 tcp=68 topuser=evolution 2026-08-31 11:59:53 L1=2.75 run=8 blk=0 avail=7125 (51.7%) swpO=0 conn=2 myRSS=3449 php=8 phpRSS=539 ap=67 tcp=65 topuser=madalice 2026-08-31 11:59:53 L1=2.75 run=3 blk=0 avail=7295 (52.9%) swpO=0 conn=8 myRSS=3449 php=8 phpRSS=540 ap=67 tcp=65 topuser=madalice 2026-08-31 12:00:03 L1=2.56 run=6 blk=0 avail=7207 (52.3%) swpO=0 conn=8 myRSS=3449 php=11 phpRSS=701 ap=58 tcp=58 topuser=evolution 2026-08-31 12:00:03 L1=2.56 run=5 blk=0 avail=7212 (52.3%) swpO=0 conn=8 myRSS=3449 php=11 phpRSS=684 ap=58 tcp=60 topuser=evolution 2026-08-31 12:00:13 L1=3.00 run=12 blk=0 avail=7210 (52.3%) swpO=0 conn=8 myRSS=3449 php=11 phpRSS=792 ap=49 tcp=53 topuser=madalice 2026-08-31 12:00:13 L1=3.00 run=5 blk=0 avail=7203 (52.3%) swpO=0 conn=8 myRSS=3449 php=11 phpRSS=780 ap=49 tcp=52 topuser=madalice 2026-08-31 12:00:23 L1=3.09 run=8 blk=0 avail=7363 (53.4%) swpO=0 conn=8 myRSS=3449 php=10 phpRSS=653 ap=41 tcp=60 topuser=madalice 2026-08-31 12:00:23 L1=3.09 run=5 blk=0 avail=7368 (53.5%) swpO=0 conn=8 myRSS=3449 php=9 phpRSS=618 ap=41 tcp=60 topuser=madalice 2026-08-31 12:00:33 L1=2.69 run=2 blk=0 avail=7465 (54.2%) swpO=0 conn=8 myRSS=3449 php=7 phpRSS=377 ap=55 tcp=57 topuser=evolution 2026-08-31 12:00:33 L1=2.69 run=4 blk=0 avail=7474 (54.3%) swpO=0 conn=8 myRSS=3449 php=8 phpRSS=394 ap=55 tcp=56 topuser=evolution 2026-08-31 12:00:43 L1=2.89 run=5 blk=0 avail=7364 (53.5%) swpO=0 conn=8 myRSS=3449 php=10 phpRSS=566 ap=53 tcp=57 topuser=evolution 2026-08-31 12:00:43 L1=2.89 run=6 blk=0 avail=7358 (53.4%) swpO=0 conn=9 myRSS=3449 php=10 phpRSS=589 ap=53 tcp=57 topuser=evolution 2026-08-31 12:00:53 L1=2.75 run=14 blk=0 avail=6642 (48.2%) swpO=0 conn=14 myRSS=3449 php=20 phpRSS=1562 ap=58 tcp=78 topuser=madalice 2026-08-31 12:00:53 L1=2.75 run=15 blk=0 avail=6577 (47.7%) swpO=0 conn=13 myRSS=3449 php=18 phpRSS=1515 ap=58 tcp=79 topuser=madalice