INCIDENT 2026-09-03 12:00:55 trigger: php_rss=1568MB ================================================================== load: 3.85 2.54 2.33 2/723 3649027 ncpu:10 mem_avail: 7032MB/13777MB (51.0%) swap_used:1483MB swapout:0/s blocked(D):0 running:4 iowait:0.2% steal:0.0% php: 13 procs / 1568MB heaviest user: madalice (9 procs, 1376MB) apache: 50 procs tcp_estab: 67 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2806 madalice 9 1376 root 252 934 nobody 49 844 netdata 8 242 evolution 12 168 alison 4 89 wp-toolkit 3 83 cpanellogin 1 59 mailman 20 26 dovenull 6 26 kurri 2 23 mailnull 2 17 polkitd 1 14 zabbix 1 10 aaa 1 10 named 1 6 dovecot 3 6 nscd 1 4 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 9 1376 evolution 3 155 root 1 30 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5866 MB Active(file): 3109 MB Inactive(file): 2924 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 516 MB CommitLimit: 10984 MB Committed_AS: 9026 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3634029 root 00:54 1240 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 2-09:38:27 4772 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 2873520 14.6 Ssl 21:46:42 /usr/sbin/mariadbd 1596047 1543747 root 199404 0.1 S 09:23:07 spamd child 1542443 1 netdata 175980 2.5 Ssl 09:38:32 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1596048 1543747 root 168296 0.0 S 09:23:07 spamd child 3633694 1542510 madalice 164020 8.7 S 01:12 php-fpm: pool madalice_com_au 3633128 1542510 madalice 162828 14.1 S 01:42 php-fpm: pool madalice_com_au 3633849 1542510 madalice 158604 7.9 S 01:02 php-fpm: pool madalice_com_au 3633873 1542510 madalice 157088 8.1 S 01:01 php-fpm: pool madalice_com_au 3648661 1542510 madalice 156852 12.1 S 00:20 php-fpm: pool madalice_com_au 3648678 1542510 madalice 155872 12.5 S 00:20 php-fpm: pool madalice_com_au 3648659 1542510 madalice 151864 12.6 S 00:20 php-fpm: pool madalice_com_au 3648690 1542510 madalice 151508 11.9 S 00:20 php-fpm: pool madalice_com_au 3648660 1542510 madalice 151316 12.2 S 00:20 php-fpm: pool madalice_com_au 1543747 1 root 119328 0.0 Ss 09:38:02 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3634087 3634026 evolution 91732 2.7 Ss 00:53 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3648997 3633167 evolution 67240 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3192902 1353308 cpanellogin 61124 0.0 S 01:57:18 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 3649036 3648730 evolution 55144 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509266 1 root 47012 0.0 Ss 6-09:41:13 /usr/lib/systemd/systemd-journald 1542487 1 wp-toolkit 45956 0.0 Ss 09:38:32 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 509236 509098 root 45284 0.0 Rl 6-09:41:13 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1542981 1542551 netdata 42252 0.1 Sl 09:38:28 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 41272 0.1 Ss 66-01:51:08 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3632629 508511 alison 40560 23.2 S 02:13 dovecot/imap 3649062 3648692 evolution 39464 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3649046 3648731 evolution 39312 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 37504 0.1 Ss 43-09:19:39 cpsrvd (SSL) - waiting for connections 3649063 3630655 evolution 34848 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1542531 1 wp-toolkit 31972 0.0 Ss 09:38:31 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1542072 1 root 31760 0.0 Ss 09:38:36 lfd - sleeping 1542510 1 root 30988 0.0 Ss 09:38:31 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1542141 1 root 28028 0.0 Ss 09:38:35 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 1542188 1 root 24776 0.1 Ssl 09:38:34 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1463 1 root 24208 0.0 Ss 66-01:51:08 tailwatchd 3631660 508511 alison 22600 2.1 S 03:10 dovecot/imap 3630731 506832 nobody 21600 0.0 S 03:48 /usr/sbin/httpd -k start 3629400 506832 nobody 21424 0.1 S 04:50 /usr/sbin/httpd -k start 3630691 506832 nobody 21412 0.0 S 03:49 /usr/sbin/httpd -k start 3630257 506832 nobody 21212 0.0 S 04:05 /usr/sbin/httpd -k start 3633057 506832 nobody 21200 0.0 S 01:45 /usr/sbin/httpd -k start 3630658 506832 nobody 21012 0.0 S 03:50 /usr/sbin/httpd -k start 3630571 506832 nobody 21008 0.0 S 03:53 /usr/sbin/httpd -k start 3630655 506832 nobody 20804 0.1 S 03:50 /usr/sbin/httpd -k start 3630287 506832 nobody 20732 0.0 S 04:04 /usr/sbin/httpd -k start 3630300 506832 nobody 20608 0.0 S 04:04 /usr/sbin/httpd -k start 3632184 506832 nobody 20112 0.0 S 02:34 /usr/sbin/httpd -k start 3630289 506832 nobody 20096 0.0 S 04:04 /usr/sbin/httpd -k start 3633487 506832 nobody 20044 0.0 S 01:21 /usr/sbin/httpd -k start 3630717 506832 nobody 19960 0.0 S 03:48 /usr/sbin/httpd -k start 3630291 506832 nobody 19852 0.1 S 04:04 /usr/sbin/httpd -k start 3633844 506832 nobody 19852 0.0 S 01:03 /usr/sbin/httpd -k start 3630689 506832 nobody 19752 0.0 S 03:49 /usr/sbin/httpd -k start 3633860 506832 nobody 19280 0.1 S 01:02 /usr/sbin/httpd -k start 3633932 506832 nobody 19204 0.0 S 01:00 /usr/sbin/httpd -k start 3630727 506832 nobody 19176 0.0 S 03:48 /usr/sbin/httpd -k start 3633933 506832 nobody 19060 0.0 S 01:00 /usr/sbin/httpd -k start 3648708 506832 nobody 18888 0.2 S 00:17 /usr/sbin/httpd -k start 3633136 506832 nobody 18588 0.0 S 01:41 /usr/sbin/httpd -k start 3633384 506832 nobody 18584 0.0 S 01:27 /usr/sbin/httpd -k start 3633931 506832 nobody 18496 0.1 S 01:00 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4527729 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 4527727 | root | 108-1481181613 | Execute | 0 | Sending data | SELECT activityid, title, startdate, status, DATE_FORMAT(projectActivities.startdate,'%d-%m-%Y') as actdate, (SELECT sum(qty) from projectAssign where activityid = projectActivities.activityid) as callups FROM projectActivities where projectid = '29632' AND status='1' order by startd | +---------+------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 1072 evolution/portal.evolutionerp.com.au-ssl_log 208 evolution/app.evolutionerp.com.au-ssl_log 146 madalice/madalice.com.au-ssl_log 71 aaa/aaadownunder.com.au-ssl_log 19 customc/customcentral.com.au-ssl_log 14 corpkicks/corporatekicks.com.au-ssl_log 9 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 521 203.54.180.238 146 40.115.94.245 144 203.40.84.196 137 103.104.165.99 108 180.181.236.49 106 150.228.151.47 92 182.239.240.254 82 103.104.164.114 54 1.145.70.156 33 196.251.121.151 28 101.166.96.210 23 2001:8004:14b3:854f:95d1:bdfe:1050:32b5 19 120.150.225.142 14 146.190.251.165 8 118.127.40.55 --- top request paths across all vhosts (last 3 min) --- 282 GET /app/ajax.php 272 POST /functions.php 97 GET /index.php 74 GET /heartbeat.php 60 GET /api/getItem/LWPB2001KG 53 POST /plugins/csvexporter/plugin.php 52 POST /app/ajax.php 52 GET /factory_session_checker.php 46 POST /app/ajax/selectFilterSingle.php 34 POST /clienteditsave.php 32 POST /plugins/fencecosting/plugin.php 28 POST /quoteditsave.php 28 POST /app/ajax/selectFilter.php 27 GET /factory_session_processed_qty.php 27 GET /factory_session_joiner.php 24 POST /wp-login.php 24 GET //app/ajax.php 16 POST /logsave.php 14 POST /dispatchsave.php 13 POST /wp-admin/admin-ajax.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 282 GET /app/ajax.php 272 POST /functions.php 81 GET /index.php 53 POST /plugins/csvexporter/plugin.php 52 POST /app/ajax.php 46 POST /app/ajax/selectFilterSingle.php 34 POST /clienteditsave.php 32 POST /plugins/fencecosting/plugin.php 28 POST /quoteditsave.php 28 POST /app/ajax/selectFilter.php 24 GET //app/ajax.php 16 POST /logsave.php -- last 10 requests -- 103.104.164.114 - - [03/Sep/2026:12:00:54 +1000] "GET //app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Djobedit%26id%3D61%26tab%3Djobeditinv&call=getUserSetting&caller=ajaxSubmitLocal&seq=13394363969 HTTP/1.1" 20 103.104.164.114 - - [03/Sep/2026:12:00:54 +1000] "GET //app/ajax.php?cn=&furi=true&uri=page%3Djobedit%26id%3D61%26tab%3Djobeditinv&call=getUserSetting&caller=ajaxSubmitLocal&seq=10933952081 HTTP/1.1" 200 166 "https://my. 203.54.180.238 - - [03/Sep/2026:12:00:53 +1000] "GET /index.php?page=mfreqedit&id=20982 HTTP/1.1" 200 24255 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29632&tab=jobeditmf" "Mozilla/5.0 (Windows NT 10.0; Wi 203.54.180.238 - - [03/Sep/2026:12:00:53 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 203.54.180.238 - - [03/Sep/2026:12:00:54 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=mfreqedit&id=20982" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe 203.54.180.238 - - [03/Sep/2026:12:00:54 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dmfreqedit%26id%3D20982&call=getUserSetting&caller=ajaxSubmitLocal&seq=16442548567 HTTP/1.1" 200 100 "https://my.evolutionerp.com 203.54.180.238 - - [03/Sep/2026:12:00:55 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=27532&tab=invoicingtab" "Mozilla/5.0 (Windows NT 10.0; Win64 103.104.164.114 - - [03/Sep/2026:12:00:54 +1000] "POST //app/ajax/selectFilterSingle.php HTTP/1.1" 200 16275 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=61&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Wi 103.104.164.114 - - [03/Sep/2026:12:00:55 +1000] "POST //functions.php?call=heartbeat HTTP/1.1" 200 2661 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=61&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 182.239.240.254 - - [03/Sep/2026:12:00:55 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=5764&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 74 GET /heartbeat.php 52 GET /factory_session_checker.php 27 GET /factory_session_processed_qty.php 27 GET /factory_session_joiner.php 16 GET /index.php 7 POST /portal/register 4 POST /factory_functions.php 1 GET /uploadsave.php -- last 10 requests -- 203.54.180.238 - - [03/Sep/2026:12:00:43 +1000] "GET /index.php?page=inventory_picking_goods&pickid=38048 HTTP/1.1" 200 10934 "https://portal.evolutionerp.com.au/index.php?page=inventory_picking_goods&pickid=38048" "Mozi 203.54.180.238 - - [03/Sep/2026:12:00:43 +1000] "GET /heartbeat.php?sentAt=1788400843&bytes=106,152,212,203&_=1788349195650 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [03/Sep/2026:12:00:43 +1000] "GET /heartbeat.php?sentAt=1788400843&bytes=106,152,212,203&_=1788400273521 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=1 203.54.180.238 - - [03/Sep/2026:12:00:44 +1000] "GET /factory_session_joiner.php?id=35088 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [03/Sep/2026:12:00:44 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 124 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [03/Sep/2026:12:00:46 +1000] "POST /factory_functions.php HTTP/1.1" 302 20 "https://portal.evolutionerp.com.au/index.php?page=inventory_picking_goods&pickid=38055&seq=9688949189595" "Mozilla/5.0 (Linux 203.54.180.238 - - [03/Sep/2026:12:00:46 +1000] "GET /index.php?page=inventory_picking_goods&pickid=38055 HTTP/1.1" 200 10835 "https://portal.evolutionerp.com.au/index.php?page=inventory_picking_goods&pickid=38055&seq=96 203.54.180.238 - - [03/Sep/2026:12:00:46 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php?page=inventory_picking_goods&pickid=38055" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [03/Sep/2026:12:00:48 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [03/Sep/2026:12:00:47 +1000] "GET /heartbeat.php?sentAt=1788400847&bytes=106,152,212,207&_=1788400777586 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=8 == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 60 GET /api/getItem/LWPB2001KG 13 GET /api/getItem/LWFB2001KG 3 GET /api/getItem/SHSG656520 2 GET /api/getItem/SHSG656516 2 GET /api/getItem/SHSG3030258 1 GET /api/getItem/SHSH2525308 1 GET /api/getItem/SHSG8989508 1 GET /api/getItem/SHSG8989358 1 GET /api/getItem/SHSG8989258 1 GET /api/getItem/SHSG8989208 1 GET /api/getItem/SHSG7575508 1 GET /api/getItem/SHSG757540-8 -- last 10 requests -- 40.115.94.245 - - [03/Sep/2026:12:00:48 +1000] "GET /api/getItem/SHSG4040168 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:12:00:48 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:12:00:48 +1000] "GET /api/getItem/SHSG4040208 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:12:00:48 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:12:00:48 +1000] "GET /api/getItem/SHSG4040258 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:12:00:49 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:12:00:49 +1000] "GET /api/getItem/SHSG4040308 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:12:00:49 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:12:00:49 +1000] "GET /api/getItem/SHSG4040408 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:12:00:49 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-03 11:58:30 L1=1.74 run=1 blk=0 avail=8121 (58.9%) swpO=0 conn=4 myRSS=2829 php=3 phpRSS=165 ap=55 tcp=56 topuser=madalice 2026-09-03 11:58:35 L1=1.60 run=4 blk=0 avail=8152 (59.2%) swpO=0 conn=1 myRSS=2829 php=5 phpRSS=224 ap=51 tcp=54 topuser=madalice 2026-09-03 11:58:40 L1=1.47 run=2 blk=0 avail=8201 (59.5%) swpO=0 conn=1 myRSS=2829 php=3 phpRSS=165 ap=45 tcp=44 topuser=madalice 2026-09-03 11:58:45 L1=1.59 run=5 blk=0 avail=8198 (59.5%) swpO=0 conn=1 myRSS=2829 php=6 phpRSS=244 ap=42 tcp=48 topuser=madalice 2026-09-03 11:58:50 L1=1.63 run=3 blk=0 avail=8200 (59.5%) swpO=0 conn=1 myRSS=2829 php=3 phpRSS=155 ap=42 tcp=57 topuser=infinium 2026-09-03 11:58:55 L1=1.66 run=2 blk=1 avail=8164 (59.3%) swpO=0 conn=1 myRSS=2829 php=3 phpRSS=165 ap=47 tcp=54 topuser=madalice 2026-09-03 11:59:00 L1=1.60 run=4 blk=0 avail=8139 (59.1%) swpO=0 conn=1 myRSS=2829 php=5 phpRSS=254 ap=45 tcp=57 topuser=madalice 2026-09-03 11:59:05 L1=1.64 run=2 blk=0 avail=8175 (59.3%) swpO=0 conn=1 myRSS=2829 php=3 phpRSS=170 ap=45 tcp=58 topuser=madalice 2026-09-03 11:59:10 L1=1.58 run=11 blk=1 avail=7915 (57.4%) swpO=0 conn=1 myRSS=2829 php=11 phpRSS=668 ap=47 tcp=58 topuser=evolution 2026-09-03 11:59:15 L1=1.78 run=2 blk=1 avail=7862 (57.1%) swpO=0 conn=1 myRSS=2829 php=5 phpRSS=498 ap=50 tcp=70 topuser=madalice 2026-09-03 11:59:21 L1=1.80 run=5 blk=1 avail=7845 (56.9%) swpO=5 conn=1 myRSS=2829 php=11 phpRSS=623 ap=59 tcp=68 topuser=evolution 2026-09-03 11:59:25 L1=1.89 run=5 blk=1 avail=7918 (57.5%) swpO=10 conn=1 myRSS=2829 php=6 phpRSS=452 ap=55 tcp=60 topuser=madalice 2026-09-03 11:59:31 L1=2.06 run=3 blk=0 avail=7912 (57.4%) swpO=143 conn=1 myRSS=2826 php=5 phpRSS=412 ap=56 tcp=62 topuser=madalice 2026-09-03 11:59:35 L1=2.30 run=9 blk=1 avail=7781 (56.5%) swpO=161 conn=7 myRSS=2825 php=14 phpRSS=815 ap=55 tcp=64 topuser=evolution 2026-09-03 11:59:41 L1=2.43 run=3 blk=0 avail=7927 (57.5%) swpO=141 conn=3 myRSS=2823 php=9 phpRSS=506 ap=56 tcp=68 topuser=evolution 2026-09-03 11:59:45 L1=2.56 run=1 blk=0 avail=7984 (58.0%) swpO=188 conn=7 myRSS=2822 php=5 phpRSS=354 ap=54 tcp=62 topuser=madalice 2026-09-03 11:59:51 L1=2.51 run=9 blk=0 avail=8040 (58.4%) swpO=70 conn=3 myRSS=2822 php=8 phpRSS=441 ap=48 tcp=53 topuser=madalice 2026-09-03 11:59:55 L1=2.63 run=5 blk=0 avail=7607 (55.2%) swpO=7 conn=7 myRSS=2822 php=10 phpRSS=876 ap=54 tcp=72 topuser=madalice 2026-09-03 12:00:01 L1=2.90 run=5 blk=0 avail=7737 (56.2%) swpO=7 conn=3 myRSS=2822 php=11 phpRSS=754 ap=58 tcp=51 topuser=madalice 2026-09-03 12:00:05 L1=3.31 run=9 blk=0 avail=7658 (55.6%) swpO=52 conn=7 myRSS=2821 php=12 phpRSS=837 ap=56 tcp=70 topuser=madalice 2026-09-03 12:00:11 L1=3.37 run=5 blk=0 avail=7801 (56.6%) swpO=52 conn=3 myRSS=2821 php=10 phpRSS=640 ap=57 tcp=57 topuser=madalice 2026-09-03 12:00:15 L1=3.34 run=1 blk=0 avail=7779 (56.5%) swpO=0 conn=7 myRSS=2821 php=9 phpRSS=651 ap=53 tcp=65 topuser=madalice 2026-09-03 12:00:21 L1=3.23 run=2 blk=0 avail=7739 (56.2%) swpO=0 conn=3 myRSS=2821 php=10 phpRSS=718 ap=53 tcp=58 topuser=madalice 2026-09-03 12:00:25 L1=3.13 run=3 blk=0 avail=7656 (55.6%) swpO=11 conn=7 myRSS=2821 php=12 phpRSS=896 ap=49 tcp=57 topuser=madalice 2026-09-03 12:00:31 L1=2.96 run=4 blk=0 avail=7727 (56.1%) swpO=11 conn=3 myRSS=2821 php=9 phpRSS=731 ap=46 tcp=54 topuser=madalice 2026-09-03 12:00:35 L1=2.96 run=8 blk=0 avail=7541 (54.7%) swpO=235 conn=9 myRSS=2816 php=11 phpRSS=1000 ap=44 tcp=63 topuser=madalice 2026-09-03 12:00:41 L1=2.97 run=1 blk=0 avail=7104 (51.6%) swpO=775 conn=2 myRSS=2806 php=12 phpRSS=1376 ap=59 tcp=65 topuser=madalice 2026-09-03 12:00:45 L1=2.81 run=1 blk=0 avail=7134 (51.8%) swpO=539 conn=9 myRSS=2806 php=12 phpRSS=1377 ap=56 tcp=51 topuser=madalice 2026-09-03 12:00:51 L1=3.22 run=3 blk=0 avail=7183 (52.1%) swpO=0 conn=2 myRSS=2806 php=12 phpRSS=1382 ap=50 tcp=48 topuser=madalice 2026-09-03 12:00:55 L1=3.85 run=4 blk=0 avail=7032 (51.0%) swpO=0 conn=2 myRSS=2806 php=13 phpRSS=1568 ap=50 tcp=67 topuser=madalice