INCIDENT 2026-09-03 11:28:30 trigger: php_rss=1938MB ================================================================== load: 2.82 2.07 1.72 25/783 3516010 ncpu:10 mem_avail: 6400MB/13777MB (46.5%) swap_used:1409MB swapout:478/s blocked(D):0 running:15 iowait:0.2% steal:0.0% php: 14 procs / 1938MB heaviest user: madalice (10 procs, 1774MB) apache: 120 procs tcp_estab: 165 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2836 madalice 10 1981 nobody 119 1589 root 243 938 netdata 8 257 wp-toolkit 3 103 evolution 12 99 cpanellogin 1 51 dovenull 6 27 mailman 20 26 polkitd 1 18 mailnull 3 13 zabbix 1 12 kurri 1 11 corpkicks 1 11 candyfabcom 1 10 named 1 6 dovecot 3 6 nscd 1 4 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 2005 evolution 2 65 root 1 33 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5570 MB Active(file): 4034 MB Inactive(file): 1731 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 556 MB CommitLimit: 10984 MB Committed_AS: 10545 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 2-09:06:03 4980 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 2901944 13.8 Ssl 21:14:18 /usr/sbin/mariadbd 3515862 1542510 madalice 253224 44.5 R 00:06 php-fpm: pool madalice_com_au 3515865 1542510 madalice 252652 52.8 R 00:05 php-fpm: pool madalice_com_au 3515849 1542510 madalice 248888 63.5 R 00:06 php-fpm: pool madalice_com_au 3515848 1542510 madalice 248656 66.3 R 00:06 php-fpm: pool madalice_com_au 3515928 1542510 madalice 241708 67.5 R 00:02 php-fpm: pool madalice_com_au 3515850 1542510 madalice 222792 60.1 R 00:06 php-fpm: pool madalice_com_au 3514697 1542510 madalice 206304 12.2 R 00:58 php-fpm: pool madalice_com_au 1596047 1543747 root 198568 0.1 S 08:50:43 spamd child 3515852 1542510 madalice 186288 59.5 R 00:06 php-fpm: pool madalice_com_au 3515856 1542510 madalice 185148 54.6 R 00:06 php-fpm: pool madalice_com_au 1542443 1 netdata 179000 2.5 Ssl 09:06:08 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3515854 1542510 madalice 172816 57.6 R 00:06 php-fpm: pool madalice_com_au 1596048 1543747 root 168688 0.0 S 08:50:43 spamd child 1543747 1 root 119624 0.0 Ss 09:05:38 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3515933 3513373 evolution 67416 15.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1542487 1 wp-toolkit 55908 0.0 Ss 09:06:08 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1542981 1542551 netdata 52812 0.1 Sl 09:06:04 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3192902 1353308 cpanellogin 52744 0.0 S 01:24:54 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 509236 509098 root 51120 0.0 Sl 6-09:08:49 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41748 0.1 Ss 43-08:47:15 cpsrvd (SSL) - waiting for connections 1542531 1 wp-toolkit 40544 0.0 Ss 09:06:07 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 509266 1 root 38000 0.0 Ss 6-09:08:49 /usr/lib/systemd/systemd-journald 1542141 1 root 36360 0.0 Ss 09:06:11 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 1469 1 root 35352 0.1 Ss 66-01:18:44 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542510 1 root 33996 0.0 Ss 09:06:07 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1542072 1 root 32192 0.0 Ss 09:06:12 lfd - sleeping 1542188 1 root 26396 0.1 Ssl 09:06:10 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1463 1 root 24808 0.0 Ss 66-01:18:44 tailwatchd 3496718 506832 nobody 22268 0.1 S 04:22 /usr/sbin/httpd -k start 3496180 506832 nobody 21712 0.0 S 05:01 /usr/sbin/httpd -k start 3492434 506832 nobody 21152 0.0 S 08:15 /usr/sbin/httpd -k start 3495350 506832 nobody 20900 0.0 S 05:38 /usr/sbin/httpd -k start 3497296 506832 nobody 20756 0.0 S 03:49 /usr/sbin/httpd -k start 3497313 506832 nobody 20484 0.0 S 03:48 /usr/sbin/httpd -k start 3512129 506832 nobody 20404 0.0 S 03:01 /usr/sbin/httpd -k start 3513375 506832 nobody 20356 0.0 S 01:55 /usr/sbin/httpd -k start 3496111 506832 nobody 20252 0.0 S 05:02 /usr/sbin/httpd -k start 3512128 506832 nobody 20164 0.0 S 03:01 /usr/sbin/httpd -k start 3512131 506832 nobody 19940 0.1 S 03:01 /usr/sbin/httpd -k start 3513347 506832 nobody 19684 0.1 S 01:56 /usr/sbin/httpd -k start 3513373 506832 nobody 19516 0.0 S 01:55 /usr/sbin/httpd -k start 3513035 506832 nobody 19448 0.0 S 02:09 /usr/sbin/httpd -k start 3497440 506832 nobody 19360 0.0 S 03:38 /usr/sbin/httpd -k start 3514966 506832 nobody 19172 0.0 S 00:44 /usr/sbin/httpd -k start 3514700 506832 nobody 19164 0.1 S 00:58 /usr/sbin/httpd -k start 3513374 506832 nobody 19160 0.0 R 01:55 /usr/sbin/httpd -k start 3512928 506832 nobody 18912 0.0 S 02:13 /usr/sbin/httpd -k start 3513344 506832 nobody 18852 0.3 S 01:56 /usr/sbin/httpd -k start 3515650 506832 nobody 18716 0.1 S 00:17 /usr/sbin/httpd -k start 1542555 1 polkitd 18552 0.0 Ssl 09:06:07 /usr/lib/polkit-1/polkitd --no-debug 3514688 506832 nobody 18296 0.1 S 00:59 /usr/sbin/httpd -k start 3513095 506832 nobody 18280 0.1 S 02:06 /usr/sbin/httpd -k start 3515030 506832 nobody 18248 0.0 S 00:42 /usr/sbin/httpd -k start 3513128 506832 nobody 18200 0.0 S 02:05 /usr/sbin/httpd -k start 3514967 506832 nobody 17940 0.0 S 00:44 /usr/sbin/httpd -k start 3513132 506832 nobody 17908 0.0 S 02:05 /usr/sbin/httpd -k start 3515682 506832 nobody 17840 0.1 S 00:15 /usr/sbin/httpd -k start 3512034 506832 nobody 17820 0.0 S 03:03 /usr/sbin/httpd -k start 3515703 506832 nobody 17656 0.1 S 00:14 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4151107 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 804 evolution/portal.evolutionerp.com.au-ssl_log 229 kamcool/kamcool.com.au-ssl_log 206 evolution/app.evolutionerp.com.au-ssl_log 165 vinesit/vinesit.com.au-ssl_log 135 alison/alisonarts.com.au-ssl_log 110 otterfencing/otterfencing.com.au-ssl_log 92 madalice/madalice.com.au-ssl_log 17 aaa/aaadownunder.com.au-ssl_log 13 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 507 203.54.180.238 165 40.115.94.245 159 182.239.240.254 141 101.166.96.210 125 45.148.10.238 113 103.104.165.99 108 20.48.179.39 92 20.104.49.130 81 91.148.244.131 38 91.148.245.81 34 180.181.236.49 30 150.228.151.47 29 81.171.74.60 29 81.171.72.93 29 81.171.72.135 --- top request paths across all vhosts (last 3 min) --- 205 POST /functions.php 186 GET /app/ajax.php 106 GET /api/getItem/LWFBW2001KG 88 GET /factory_session_checker.php 71 GET /index.php 59 GET /api/getItem/LWHG2001KG 45 POST /app/ajax/selectFilter.php 44 GET /heartbeat.php 44 GET /factory_session_processed_qty.php 43 GET /factory_session_joiner.php 37 POST /plugins/csvexporter/plugin.php 30 POST /app/ajax.php 28 POST /clienteditsave.php 27 POST /app/ajax/selectFilterSingle.php 22 POST /quoteditsave.php 20 POST /jobeditsave.php 20 POST /itemModify.php 18 POST / 13 POST /plugins/fencecosting/plugin.php 12 GET //app/ajax.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 205 POST /functions.php 186 GET /app/ajax.php 63 GET /index.php 45 POST /app/ajax/selectFilter.php 37 POST /plugins/csvexporter/plugin.php 30 POST /app/ajax.php 28 POST /clienteditsave.php 27 POST /app/ajax/selectFilterSingle.php 22 POST /quoteditsave.php 20 POST /jobeditsave.php 20 POST /itemModify.php 13 POST /plugins/fencecosting/plugin.php -- last 10 requests -- 180.181.236.49 - - [03/Sep/2026:11:28:27 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dpurchaseadd%26purchaseid%3D1151&call=getUserSetting&caller=ajaxSubmitLocal&seq=15097561538 HTTP/1.1" 200 116 " 180.181.236.49 - - [03/Sep/2026:11:28:27 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=&cursel=&curseltext=&fromMS=1&&nolimit=LIMIT%2050&include=&supplierid=1071&contactid=1071&tid=%25%25&returnobj=itemFi 180.181.236.49 - - [03/Sep/2026:11:28:27 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dpurchaseadd%26purchaseid%3D1151&call=getUserSetting&caller=ajaxSubmitLocal&seq=11883943459 HTTP/1.1" 200 164 "https://my.evoluti 182.239.240.254 - - [03/Sep/2026:11:28:27 +1000] "GET /index.php?page=activities&focus=4252 HTTP/1.1" 200 27875 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=4252" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) A 182.239.240.254 - - [03/Sep/2026:11:28:28 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dactivities%26focus%3D4252&call=getUserSetting&caller=ajaxSubmitLocal&seq=12975569603 HTTP/1.1" 200 103 "https://my.evolutionerp 101.166.96.210 - - [03/Sep/2026:11:28:27 +1000] "GET /index.php?page=invedithist&id=7393&string= HTTP/1.1" 200 15935 "https://my.evolutionerp.com.au/index.php?page=invedit&id=7393&tab=generaltab" "Mozilla/5.0 (Windows NT 101.166.96.210 - - [03/Sep/2026:11:28:28 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invedithist&id=7393&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 101.166.96.210 - - [03/Sep/2026:11:28:28 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvedithist%26id%3D7393%26string%3D&call=getUserSetting&caller=ajaxSubmitLocal&seq=14906814165 HTTP/1.1" 200 109 "https://my.evo 180.181.236.49 - - [03/Sep/2026:11:28:28 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=1151" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 101.166.96.210 - - [03/Sep/2026:11:28:28 +1000] "POST /inveditsave.php?call=filterStockMovement HTTP/1.1" 200 2016 "https://my.evolutionerp.com.au/index.php?page=invedithist&id=7393&string=" "Mozilla/5.0 (Windows NT 10.0 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 88 GET /factory_session_checker.php 44 GET /heartbeat.php 44 GET /factory_session_processed_qty.php 43 GET /factory_session_joiner.php 8 GET /index.php 2 POST /portal/register -- last 10 requests -- 203.54.180.238 - - [03/Sep/2026:11:28:21 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 124 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [03/Sep/2026:11:28:23 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [03/Sep/2026:11:28:23 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [03/Sep/2026:11:28:23 +1000] "GET /factory_session_joiner.php?id=35094 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [03/Sep/2026:11:28:22 +1000] "GET /heartbeat.php?sentAt=1788398902&bytes=106,152,205,54&_=1788398069511 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [03/Sep/2026:11:28:24 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [03/Sep/2026:11:28:23 +1000] "GET /heartbeat.php?sentAt=1788398903&bytes=106,152,205,55&_=1788349195456 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [03/Sep/2026:11:28:25 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [03/Sep/2026:11:28:28 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 124 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [03/Sep/2026:11:28:28 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == kamcool/kamcool.com.au-ssl_log == -- top paths -- 7 POST / 7 HEAD / 7 GET /wp-config.php 7 GET /wp-admin/setup-config.php 7 GET /_vti_pvt/service.pwd 7 GET /storage/logs/laravel.log 7 GET /.ssh/id_rsa 7 GET /phpinfo.php 7 GET /.npmrc 7 GET /.git/HEAD 7 GET /.env 7 GET /dump.sql -- last 10 requests -- 91.148.244.131 - - [03/Sep/2026:11:27:57 +1000] "GET /backup.sql HTTP/1.1" 400 52 "-" "Go-http-client/1.1" 91.148.244.131 - - [03/Sep/2026:11:27:57 +1000] "GET /config.php HTTP/1.1" 400 52 "-" "Go-http-client/1.1" 91.148.244.131 - - [03/Sep/2026:11:27:57 +1000] "GET /backup.zip HTTP/1.1" 400 52 "-" "Go-http-client/1.1" 91.148.244.131 - - [03/Sep/2026:11:27:57 +1000] "GET /dump.sql HTTP/1.1" 400 52 "-" "Go-http-client/1.1" 91.148.244.131 - - [03/Sep/2026:11:27:58 +1000] "GET /database.sql HTTP/1.1" 400 52 "-" "Go-http-client/1.1" 91.148.244.131 - - [03/Sep/2026:11:28:00 +1000] "GET /.env HTTP/1.1" 403 12 "-" "Go-http-client/1.1" 91.148.244.131 - - [03/Sep/2026:11:28:00 +1000] "GET /api/.env HTTP/1.1" 403 12 "-" "Go-http-client/1.1" 91.148.244.131 - - [03/Sep/2026:11:28:00 +1000] "GET /.npmrc HTTP/1.1" 403 13 "-" "Go-http-client/1.1" 91.148.244.131 - - [03/Sep/2026:11:28:00 +1000] "GET /phpinfo.php HTTP/1.1" 403 12 "-" "Go-http-client/1.1" 91.148.244.131 - - [03/Sep/2026:11:28:00 +1000] "GET /.bash_history HTTP/1.1" 403 13 "-" "Go-http-client/1.1" --- last 30 samples (run-up to this incident) --- 2026-09-03 11:26:10 L1=2.06 run=2 blk=0 avail=8235 (59.8%) swpO=0 conn=2 myRSS=2862 php=4 phpRSS=203 ap=46 tcp=50 topuser=madalice 2026-09-03 11:26:10 L1=2.06 run=7 blk=0 avail=8163 (59.3%) swpO=0 conn=1 myRSS=2862 php=3 phpRSS=232 ap=46 tcp=50 topuser=madalice 2026-09-03 11:26:20 L1=1.82 run=2 blk=0 avail=8232 (59.7%) swpO=0 conn=1 myRSS=2862 php=4 phpRSS=207 ap=45 tcp=53 topuser=madalice 2026-09-03 11:26:20 L1=1.82 run=2 blk=0 avail=8231 (59.7%) swpO=0 conn=1 myRSS=2862 php=4 phpRSS=208 ap=45 tcp=54 topuser=madalice 2026-09-03 11:26:30 L1=1.85 run=2 blk=0 avail=7973 (57.9%) swpO=0 conn=1 myRSS=2862 php=4 phpRSS=253 ap=74 tcp=60 topuser=madalice 2026-09-03 11:26:30 L1=1.85 run=3 blk=0 avail=7982 (57.9%) swpO=0 conn=2 myRSS=2862 php=4 phpRSS=253 ap=73 tcp=58 topuser=madalice 2026-09-03 11:26:40 L1=1.81 run=4 blk=0 avail=7778 (56.5%) swpO=0 conn=1 myRSS=2862 php=5 phpRSS=406 ap=84 tcp=80 topuser=tubesupplies 2026-09-03 11:26:40 L1=1.81 run=4 blk=0 avail=7766 (56.4%) swpO=0 conn=2 myRSS=2862 php=5 phpRSS=430 ap=83 tcp=81 topuser=tubesupplies 2026-09-03 11:26:50 L1=1.99 run=9 blk=0 avail=7769 (56.4%) swpO=0 conn=1 myRSS=2862 php=9 phpRSS=578 ap=80 tcp=84 topuser=vinesit 2026-09-03 11:26:50 L1=1.99 run=6 blk=0 avail=7734 (56.1%) swpO=0 conn=2 myRSS=2862 php=9 phpRSS=598 ap=81 tcp=87 topuser=vinesit 2026-09-03 11:27:00 L1=2.05 run=7 blk=0 avail=7750 (56.3%) swpO=0 conn=1 myRSS=2862 php=7 phpRSS=567 ap=74 tcp=59 topuser=infinium 2026-09-03 11:27:00 L1=2.05 run=3 blk=0 avail=7708 (55.9%) swpO=0 conn=2 myRSS=2862 php=9 phpRSS=673 ap=73 tcp=60 topuser=infinium 2026-09-03 11:27:10 L1=2.75 run=3 blk=0 avail=7703 (55.9%) swpO=0 conn=1 myRSS=2862 php=6 phpRSS=647 ap=65 tcp=66 topuser=corpkicks 2026-09-03 11:27:10 L1=2.75 run=5 blk=0 avail=7661 (55.6%) swpO=0 conn=2 myRSS=2862 php=6 phpRSS=700 ap=65 tcp=66 topuser=corpkicks 2026-09-03 11:27:20 L1=2.70 run=1 blk=0 avail=8196 (59.5%) swpO=1 conn=1 myRSS=2862 php=2 phpRSS=33 ap=67 tcp=62 topuser=root 2026-09-03 11:27:20 L1=2.70 run=2 blk=0 avail=8201 (59.5%) swpO=1 conn=2 myRSS=2862 php=3 phpRSS=53 ap=67 tcp=64 topuser=root 2026-09-03 11:27:30 L1=2.51 run=2 blk=0 avail=8216 (59.6%) swpO=0 conn=1 myRSS=2862 php=4 phpRSS=145 ap=58 tcp=62 topuser=evolution 2026-09-03 11:27:30 L1=2.51 run=1 blk=0 avail=8264 (60.0%) swpO=0 conn=3 myRSS=2862 php=3 phpRSS=56 ap=57 tcp=62 topuser=root 2026-09-03 11:27:40 L1=2.57 run=5 blk=0 avail=8070 (58.6%) swpO=0 conn=1 myRSS=2862 php=4 phpRSS=284 ap=56 tcp=45 topuser=madalice 2026-09-03 11:27:40 L1=2.57 run=3 blk=0 avail=8045 (58.4%) swpO=0 conn=3 myRSS=2862 php=4 phpRSS=319 ap=55 tcp=46 topuser=alison 2026-09-03 11:27:50 L1=2.40 run=5 blk=0 avail=7924 (57.5%) swpO=0 conn=1 myRSS=2862 php=4 phpRSS=206 ap=67 tcp=65 topuser=madalice 2026-09-03 11:27:50 L1=2.40 run=3 blk=0 avail=7942 (57.6%) swpO=0 conn=3 myRSS=2862 php=4 phpRSS=176 ap=67 tcp=56 topuser=madalice 2026-09-03 11:28:00 L1=2.26 run=3 blk=0 avail=7962 (57.8%) swpO=0 conn=1 myRSS=2862 php=4 phpRSS=331 ap=57 tcp=48 topuser=madalice 2026-09-03 11:28:01 L1=2.26 run=3 blk=1 avail=7892 (57.3%) swpO=0 conn=3 myRSS=2862 php=6 phpRSS=460 ap=57 tcp=46 topuser=evolution 2026-09-03 11:28:10 L1=2.14 run=1 blk=0 avail=8149 (59.2%) swpO=0 conn=1 myRSS=2862 php=3 phpRSS=187 ap=47 tcp=43 topuser=madalice 2026-09-03 11:28:11 L1=2.14 run=3 blk=0 avail=8086 (58.7%) swpO=0 conn=3 myRSS=2862 php=5 phpRSS=321 ap=47 tcp=44 topuser=madalice 2026-09-03 11:28:20 L1=2.12 run=5 blk=0 avail=7971 (57.9%) swpO=0 conn=3 myRSS=2862 php=5 phpRSS=332 ap=60 tcp=57 topuser=madalice 2026-09-03 11:28:21 L1=2.12 run=6 blk=0 avail=8008 (58.1%) swpO=0 conn=3 myRSS=2862 php=5 phpRSS=290 ap=60 tcp=58 topuser=madalice 2026-09-03 11:28:30 L1=2.82 run=15 blk=0 avail=6400 (46.5%) swpO=478 conn=14 myRSS=2844 php=14 phpRSS=1938 ap=120 tcp=165 topuser=madalice 2026-09-03 11:28:31 L1=2.82 run=21 blk=0 avail=6190 (44.9%) swpO=837 conn=13 myRSS=2833 php=13 phpRSS=2108 ap=120 tcp=165 topuser=madalice