INCIDENT 2026-08-12 20:11:23 trigger: php_rss=2144MB mysql_conn=15 ================================================================== load: 2.06 1.11 0.86 18/627 172861 ncpu:10 mem_avail: 5283MB/11729MB (45.0%) swap_used:1782MB swapout:107/s blocked(D):0 running:17 iowait:0.1% steal:0.0% php: 14 procs / 2144MB heaviest user: madalice (10 procs, 1953MB) apache: 27 procs tcp_estab: 39 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2397 madalice 10 2060 root 246 815 nobody 26 440 netdata 8 270 evolution 14 173 infinium 1 66 cpanellogin 1 48 dovenull 6 34 mailman 20 30 mailnull 3 23 wp-toolkit 6 19 dovecot 3 13 zabbix 1 11 kurri 1 10 named 1 6 nscd 1 4 dbus 1 3 cpanelconnecttrack 1 3 polkitd 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 10 1838 evolution 3 149 infinium 1 69 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5789 MB Active(file): 4144 MB Inactive(file): 695 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 421 MB CommitLimit: 9960 MB Committed_AS: 8790 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 165983 root 11:22 1292 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3432421 root 19:00:07 3596 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2125801 1 mysql 2455172 15.3 Ssl 1-23:38:17 /usr/sbin/mariadbd 172793 171404 madalice 268200 119 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 172794 172786 madalice 255424 113 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 172791 172418 madalice 237652 110 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 172795 172420 madalice 234860 102 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 216604 2.5 Ssl 44-10:01:24 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 172797 172383 madalice 197444 87.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3478969 3472245 root 188156 0.0 S 17:36:30 spamd child 172796 170900 madalice 179728 86.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 172799 172798 madalice 174592 152 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3979356 3472245 root 145368 0.0 S 07:00:20 spamd child 3472245 1 root 123032 0.0 Ss 17:48:40 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 172804 171865 madalice 93260 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 172807 172801 infinium 80644 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 159820 1 root 74756 0.0 Ss 23-10:24:32 /usr/lib/systemd/systemd-journald 172806 170005 evolution 67964 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 167479 1353308 cpanellogin 49840 0.0 S 08:49 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 2223 1201 root 44772 0.0 Sl 44-10:01:23 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 41928 0.1 Ss 44-10:01:23 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 41652 0.0 Ss 21-17:29:54 cpsrvd (SSL) - waiting for connections 172827 168107 evolution 40876 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 32104 0.1 Sl 44-10:01:19 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3471498 1 root 24508 0.0 Ss 17:49:11 lfd - sleeping 1463 1 root 23344 0.0 Ss 44-10:01:23 tailwatchd 168935 1276780 nobody 22244 0.0 S 06:12 /usr/sbin/httpd -k start 168107 1276780 nobody 21972 0.0 S 07:25 /usr/sbin/httpd -k start 170876 1276780 nobody 21828 0.1 S 02:26 /usr/sbin/httpd -k start 1481367 2431 netdata 21820 2.2 Sl 21-11:26:08 /usr/libexec/netdata/plugins.d/apps.plugin 1 170005 1276780 nobody 21028 0.0 S 04:07 /usr/sbin/httpd -k start 169304 1276780 nobody 20932 0.0 S 05:30 /usr/sbin/httpd -k start 171398 1276780 nobody 20856 0.1 R 01:36 /usr/sbin/httpd -k start 170889 1276780 nobody 20808 0.0 S 02:25 /usr/sbin/httpd -k start 171404 1276780 nobody 20124 0.1 S 01:35 /usr/sbin/httpd -k start 170900 1276780 nobody 19828 0.0 S 02:24 /usr/sbin/httpd -k start 172414 1276780 nobody 19116 0.0 S 00:37 /usr/sbin/httpd -k start 172393 1276780 nobody 18888 0.0 S 00:39 /usr/sbin/httpd -k start 170858 1276780 nobody 18664 0.0 S 02:30 /usr/sbin/httpd -k start 172416 1276780 nobody 18656 0.0 S 00:37 /usr/sbin/httpd -k start 167637 1276780 nobody 18396 0.0 S 08:28 /usr/sbin/httpd -k start 172383 1276780 nobody 17992 0.0 S 00:40 /usr/sbin/httpd -k start 172420 1276780 nobody 17908 0.0 S 00:37 /usr/sbin/httpd -k start 171865 1276780 nobody 17864 0.0 S 01:16 /usr/sbin/httpd -k start 172418 1276780 nobody 17716 0.0 S 00:37 /usr/sbin/httpd -k start 172402 1276780 nobody 16972 0.0 S 00:38 /usr/sbin/httpd -k start 172802 1276780 nobody 15788 0.0 S 00:01 /usr/sbin/httpd -k start 172786 1276780 nobody 15336 0.0 S 00:06 /usr/sbin/httpd -k start 172798 1276780 nobody 15272 0.0 S 00:02 /usr/sbin/httpd -k start 172801 1276780 nobody 15264 0.0 S 00:01 /usr/sbin/httpd -k start 172404 1276780 nobody 14108 0.0 S 00:38 /usr/sbin/httpd -k start 172467 281734 mailnull 13844 0.0 S 00:31 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1204 1 zabbix 12168 0.2 Ssl 44-10:01:24 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 172142 3828812 root 11716 0.0 S 00:56 dovecot/auth -w 837413 1471 root 11208 0.0 S 3-01:02:32 cPhulkd - dbprocessor 2893045 3828812 kurri 10736 0.0 S 1-07:44:10 dovecot/imap 1805633 3828812 dovenull 9568 0.0 S 2-04:38:30 dovecot/imap-login 3935253 27524 root 9104 0.0 Ss 07:50:46 sshd: evolution [priv] 1805629 3828812 dovenull 8640 0.0 S 2-04:38:30 dovecot/imap-login 3651102 1 root 7648 0.0 Ss 4-17:48:37 queueprocd - waiting up to 60s to process a task 1466 1 root 7524 0.0 Ss 44-10:01:23 dnsadmin - dormant mode 172800 281734 mailnull 7520 0.0 S 00:01 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9247286 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 9247186 | madalice_wp | madalice_wp | Query | 0 | starting | SELECT option_value FROM AMuqf6qZ_options WHERE option_name = 'woocommerce_wc_square_access_token_email_settings' LIMIT 1 | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min lowrange/lowrange.com.au-ssl_log 131 evolution/my.evolutionerp.com.au-ssl_log 93 nrg/nrgservices.net.au-ssl_log 88 infinium/infinium.net.au-ssl_log 20 evolution/portal.evolutionerp.com.au-ssl_log 18 madalice/madalice.com.au-ssl_log 1 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 101 20.194.40.105 88 172.161.0.2 49 206.83.118.145 35 147.161.213.78 30 172.213.18.162 18 203.54.180.238 6 175.36.227.212 3 198.38.94.67 2 89.212.147.115 2 62.210.185.4 2 50.6.231.19 2 20.84.23.223 2 118.127.40.55 2 115.146.125.52 2 103.216.117.118 --- top request paths across all vhosts (last 3 min) --- 23 POST /functions.php 18 GET /heartbeat.php 14 GET /app/ajax.php 13 GET /index.php 10 POST /quoteditsave.php 9 GET /wp-login.php 8 POST /itemModify.php 6 POST /wp-login.php 4 GET /wp-json/wp/v2/users/me 3 POST /plugins/csvexporter/plugin.php 3 POST /jobaddsave.php 3 POST /app/ajax/selectFilterSingle.php 3 POST /app/ajax.php 3 GET /this_is_a_new_hello_world.php 3 GET /fffm.php 3 GET /admin.php 2 POST /plugins/fencecosting/plugin.php 2 POST /clienteditsave.php 2 POST / 2 GET /wp.php --- busiest 3 vhosts: top paths + last 10 requests --- == lowrange/lowrange.com.au-ssl_log == -- top paths -- 3 GET /admin.php 2 GET /this_is_a_new_hello_world.php 2 GET /fpwch.php 2 GET /aaa.php 1 GET /zjkrv.php 1 GET /z1.php 1 GET /yj09.php 1 GET /xyn.php 1 GET /xxx.php 1 GET /xx.php 1 GET /x.php 1 GET /xamp.php -- last 10 requests -- 20.194.40.105 - - [12/Aug/2026:20:10:27 +1000] "GET /xamp.php HTTP/1.1" 401 36 "-" "-" 20.194.40.105 - - [12/Aug/2026:20:10:28 +1000] "GET /file25.php HTTP/1.1" 401 36 "-" "-" 20.194.40.105 - - [12/Aug/2026:20:10:28 +1000] "GET /file15.php HTTP/1.1" 401 36 "-" "-" 20.194.40.105 - - [12/Aug/2026:20:10:29 +1000] "GET /f35.php HTTP/1.1" 401 36 "-" "-" 20.194.40.105 - - [12/Aug/2026:20:10:30 +1000] "GET /wp-load.php HTTP/1.1" 401 36 "-" "-" 20.194.40.105 - - [12/Aug/2026:20:10:30 +1000] "GET /wp-includes/assets/ HTTP/1.1" 401 36 "-" "-" 20.194.40.105 - - [12/Aug/2026:20:10:31 +1000] "GET /wp-admin/css/colors/sunrise/ HTTP/1.1" 401 36 "-" "-" 20.194.40.105 - - [12/Aug/2026:20:10:31 +1000] "GET /wp-admin/network/plugins.php HTTP/1.1" 401 36 "-" "-" 20.194.40.105 - - [12/Aug/2026:20:10:32 +1000] "GET /aaa.php HTTP/1.1" 401 36 "-" "-" 20.194.40.105 - - [12/Aug/2026:20:10:33 +1000] "GET /gecko.php HTTP/1.1" 401 36 "-" "-" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 23 POST /functions.php 14 GET /app/ajax.php 13 GET /index.php 10 POST /quoteditsave.php 8 POST /itemModify.php 3 POST /plugins/csvexporter/plugin.php 3 POST /jobaddsave.php 3 POST /app/ajax/selectFilterSingle.php 3 POST /app/ajax.php 2 POST /plugins/fencecosting/plugin.php 2 POST /clienteditsave.php 1 POST /logsave.php -- last 10 requests -- 175.36.227.212 - - [12/Aug/2026:20:11:01 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 974 "https://my.evolutionerp.com.au/index.php?page=opportunityedit&opportunityid=8414" "Mozilla/5.0 (Windows NT 10.0; Win6 147.161.213.78 - - [12/Aug/2026:20:11:04 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=activities&focus=14165" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 206.83.118.145 - - [12/Aug/2026:20:11:07 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36661§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 206.83.118.145 - - [12/Aug/2026:20:11:13 +1000] "GET /index.php?page=invedithist&id=8321&string= HTTP/1.1" 200 15087 "https://my.evolutionerp.com.au/index.php?page=invedit&id=8321&tab=generaltab" "Mozilla/5.0 (Windows NT 206.83.118.145 - - [12/Aug/2026:20:11:14 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invedithist&id=8321&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 206.83.118.145 - - [12/Aug/2026:20:11:14 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvedithist%26id%3D8321%26string%3D&call=getUserSetting&caller=ajaxSubmitLocal&seq=15197732032 HTTP/1.1" 200 108 "https://my.evo 206.83.118.145 - - [12/Aug/2026:20:11:14 +1000] "POST /inveditsave.php?call=filterStockMovement HTTP/1.1" 200 857 "https://my.evolutionerp.com.au/index.php?page=invedithist&id=8321&string=" "Mozilla/5.0 (Windows NT 10.0; 206.83.118.145 - - [12/Aug/2026:20:11:15 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=invedithist&id=8321&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 147.161.213.78 - - [12/Aug/2026:20:11:23 +1000] "POST /activitiessave.php HTTP/1.1" 302 22 "https://my.evolutionerp.com.au/index.php?page=activities&focus=14165" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 147.161.213.78 - - [12/Aug/2026:20:11:23 +1000] "GET /index.php?page=activities&date=2026-08-25&focus=14165 HTTP/1.1" 200 19073 "https://my.evolutionerp.com.au/index.php?page=activities&focus=14165" "Mozilla/5.0 (Windows == nrg/nrgservices.net.au-ssl_log == -- top paths -- 2 GET /fffm.php 1 GET /zaza.php 1 GET /z60.php 1 GET /xxw.php 1 GET /xwx1.php 1 GET /xr.php 1 GET /xml.php 1 GET /ww1.php 1 GET /ws.php 1 GET /ws77.php 1 GET /wp-the.php 1 GET /wp.php -- last 10 requests -- 172.161.0.2 - - [12/Aug/2026:20:10:59 +1000] "GET /elp.php HTTP/1.1" 404 5750 "-" "-" 172.161.0.2 - - [12/Aug/2026:20:10:59 +1000] "GET /admin-footer.php HTTP/1.1" 404 5750 "-" "-" 172.161.0.2 - - [12/Aug/2026:20:11:00 +1000] "GET /inso.php HTTP/1.1" 404 5750 "-" "-" 172.161.0.2 - - [12/Aug/2026:20:11:01 +1000] "GET /sc.php HTTP/1.1" 404 5750 "-" "-" 172.161.0.2 - - [12/Aug/2026:20:11:01 +1000] "GET /css/index.php HTTP/1.1" 404 5750 "-" "-" 172.161.0.2 - - [12/Aug/2026:20:11:02 +1000] "GET /wp-content/plugins/admin.php HTTP/1.1" 404 5750 "-" "-" 172.161.0.2 - - [12/Aug/2026:20:11:03 +1000] "GET /shiny.php HTTP/1.1" 404 5750 "-" "-" 172.161.0.2 - - [12/Aug/2026:20:11:03 +1000] "GET /403.php HTTP/1.1" 404 5750 "-" "-" 172.161.0.2 - - [12/Aug/2026:20:11:04 +1000] "GET /aa1.php HTTP/1.1" 404 5750 "-" "-" 172.161.0.2 - - [12/Aug/2026:20:11:05 +1000] "GET /about/function.php HTTP/1.1" 404 5750 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-12 20:09:02 L1=0.67 run=3 blk=0 avail=6739 (57.5%) swpO=110 conn=1 myRSS=2400 php=1 phpRSS=215 ap=24 tcp=26 topuser=corpkicks 2026-08-12 20:09:02 L1=0.67 run=3 blk=0 avail=6736 (57.4%) swpO=110 conn=2 myRSS=2400 php=1 phpRSS=217 ap=24 tcp=26 topuser=corpkicks 2026-08-12 20:09:12 L1=0.56 run=6 blk=0 avail=6800 (58.0%) swpO=0 conn=2 myRSS=2400 php=3 phpRSS=299 ap=20 tcp=27 topuser=infinium 2026-08-12 20:09:12 L1=0.56 run=4 blk=0 avail=6804 (58.0%) swpO=0 conn=3 myRSS=2400 php=3 phpRSS=292 ap=20 tcp=27 topuser=infinium 2026-08-12 20:09:23 L1=0.55 run=2 blk=0 avail=7044 (60.1%) swpO=0 conn=2 myRSS=2400 php=0 phpRSS=0 ap=18 tcp=22 topuser=- 2026-08-12 20:09:23 L1=0.55 run=2 blk=0 avail=7044 (60.1%) swpO=0 conn=3 myRSS=2400 php=0 phpRSS=0 ap=18 tcp=22 topuser=- 2026-08-12 20:09:33 L1=0.71 run=3 blk=0 avail=6914 (59.0%) swpO=0 conn=3 myRSS=2400 php=2 phpRSS=153 ap=17 tcp=24 topuser=aaa 2026-08-12 20:09:33 L1=0.71 run=3 blk=0 avail=6914 (59.0%) swpO=0 conn=2 myRSS=2400 php=2 phpRSS=153 ap=17 tcp=24 topuser=aaa 2026-08-12 20:09:43 L1=0.68 run=3 blk=0 avail=7045 (60.1%) swpO=0 conn=2 myRSS=2400 php=0 phpRSS=0 ap=17 tcp=21 topuser=- 2026-08-12 20:09:43 L1=0.68 run=3 blk=0 avail=7045 (60.1%) swpO=0 conn=3 myRSS=2400 php=0 phpRSS=0 ap=17 tcp=21 topuser=- 2026-08-12 20:09:53 L1=0.73 run=2 blk=0 avail=6994 (59.6%) swpO=0 conn=3 myRSS=2400 php=0 phpRSS=0 ap=24 tcp=24 topuser=- 2026-08-12 20:09:53 L1=0.73 run=2 blk=0 avail=6994 (59.6%) swpO=0 conn=1 myRSS=2400 php=0 phpRSS=0 ap=24 tcp=24 topuser=- 2026-08-12 20:10:03 L1=0.92 run=2 blk=0 avail=6920 (59.0%) swpO=0 conn=3 myRSS=2400 php=2 phpRSS=134 ap=21 tcp=26 topuser=infinium 2026-08-12 20:10:03 L1=0.92 run=3 blk=0 avail=6918 (59.0%) swpO=0 conn=1 myRSS=2400 php=2 phpRSS=136 ap=21 tcp=28 topuser=infinium 2026-08-12 20:10:13 L1=1.09 run=2 blk=0 avail=6937 (59.1%) swpO=0 conn=1 myRSS=2400 php=0 phpRSS=0 ap=30 tcp=34 topuser=- 2026-08-12 20:10:13 L1=1.09 run=1 blk=0 avail=6938 (59.2%) swpO=0 conn=1 myRSS=2400 php=0 phpRSS=0 ap=30 tcp=34 topuser=- 2026-08-12 20:10:23 L1=1.16 run=3 blk=0 avail=6953 (59.3%) swpO=0 conn=1 myRSS=2400 php=0 phpRSS=0 ap=28 tcp=37 topuser=- 2026-08-12 20:10:23 L1=1.16 run=3 blk=0 avail=6953 (59.3%) swpO=0 conn=1 myRSS=2400 php=0 phpRSS=0 ap=28 tcp=37 topuser=- 2026-08-12 20:10:33 L1=1.21 run=2 blk=0 avail=6813 (58.1%) swpO=0 conn=1 myRSS=2400 php=2 phpRSS=223 ap=23 tcp=30 topuser=tubesupplies 2026-08-12 20:10:33 L1=1.21 run=5 blk=0 avail=6812 (58.1%) swpO=0 conn=1 myRSS=2400 php=2 phpRSS=224 ap=23 tcp=30 topuser=tubesupplies 2026-08-12 20:10:43 L1=1.28 run=1 blk=0 avail=6996 (59.6%) swpO=0 conn=1 myRSS=2400 php=0 phpRSS=0 ap=21 tcp=29 topuser=- 2026-08-12 20:10:43 L1=1.28 run=2 blk=0 avail=6997 (59.7%) swpO=0 conn=1 myRSS=2400 php=0 phpRSS=0 ap=21 tcp=29 topuser=- 2026-08-12 20:10:53 L1=1.08 run=1 blk=0 avail=6936 (59.1%) swpO=0 conn=1 myRSS=2400 php=0 phpRSS=0 ap=31 tcp=36 topuser=- 2026-08-12 20:10:53 L1=1.08 run=3 blk=0 avail=6935 (59.1%) swpO=0 conn=1 myRSS=2400 php=0 phpRSS=0 ap=31 tcp=36 topuser=- 2026-08-12 20:11:03 L1=1.22 run=4 blk=0 avail=6694 (57.1%) swpO=0 conn=1 myRSS=2400 php=2 phpRSS=335 ap=26 tcp=36 topuser=corpkicks 2026-08-12 20:11:03 L1=1.22 run=4 blk=0 avail=6694 (57.1%) swpO=0 conn=1 myRSS=2400 php=2 phpRSS=336 ap=26 tcp=37 topuser=corpkicks 2026-08-12 20:11:13 L1=1.11 run=2 blk=0 avail=6995 (59.6%) swpO=0 conn=1 myRSS=2400 php=0 phpRSS=0 ap=24 tcp=25 topuser=- 2026-08-12 20:11:13 L1=1.11 run=3 blk=0 avail=6994 (59.6%) swpO=0 conn=1 myRSS=2400 php=0 phpRSS=0 ap=24 tcp=26 topuser=- 2026-08-12 20:11:23 L1=2.06 run=17 blk=0 avail=5283 (45.0%) swpO=107 conn=15 myRSS=2397 php=14 phpRSS=2144 ap=27 tcp=39 topuser=madalice 2026-08-12 20:11:23 L1=2.06 run=18 blk=0 avail=5250 (44.8%) swpO=123 conn=14 myRSS=2397 php=14 phpRSS=2210 ap=27 tcp=39 topuser=madalice