INCIDENT 2026-08-15 07:16:17 trigger: php_rss=1819MB mysql_conn=17 ================================================================== load: 9.35 13.08 13.91 21/628 2556177 ncpu:10 mem_avail: 8006MB/11729MB (68.3%) swap_used:1497MB swapout:0/s blocked(D):0 running:22 iowait:0.3% steal:0.0% php: 17 procs / 1819MB heaviest user: madalice (15 procs, 1740MB) apache: 56 procs tcp_estab: 70 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 15 1742 nobody 55 795 mysql 1 512 root 236 355 netdata 8 211 cpanellogin 1 53 evolution 5 42 mailman 20 16 dovenull 6 16 wp-toolkit 6 15 candyfabcom 1 12 zabbix 1 10 dovecot 3 7 cpanelconnecttrack 1 3 named 1 2 mailnull 1 2 polkitd 1 1 dbus 1 1 chrony 1 1 rpc 1 0 --- php workers by user --- USER PROCS RSS_MB madalice 15 1767 evolution 1 39 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 2223 MB Active(file): 969 MB Inactive(file): 485 MB Dirty: 2 MB Writeback: 0 MB SReclaimable: 179 MB CommitLimit: 9960 MB Committed_AS: 9817 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2342983 root 06:05:03 0 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2554273 1 mysql 525112 5.4 Ssl 02:17 /usr/sbin/mariadbd 2556112 2553713 madalice 214504 65.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2556110 2554106 madalice 212260 67.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2556113 2551341 madalice 173620 50.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2556123 2556119 madalice 163976 70.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 158184 2.5 Ssl 46-21:06:21 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2556122 2556118 madalice 140696 59.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2556130 2556060 madalice 140012 60.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2556128 2556059 madalice 133508 60.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2556124 2556117 madalice 126952 51.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2556129 2556061 madalice 113392 43.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2556127 2556058 madalice 103152 34.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2556134 2553633 madalice 99128 63.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2556133 2553653 madalice 80160 40.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2382613 1 root 79904 0.0 Ss 04:53:07 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2556143 2555869 madalice 79120 38.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2556144 2553650 madalice 71656 30.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2390233 2382613 root 66256 0.0 S 04:40:41 spamd child 2556172 2556072 madalice 57316 13.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2525318 1353308 cpanellogin 55012 0.1 S 48:06 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 159820 1 root 45540 0.0 Ss 25-21:29:29 /usr/lib/systemd/systemd-journald 2556145 2556141 evolution 40880 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 39888 0.1 Sl 46-21:06:16 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2553912 1276780 nobody 21048 0.2 S 02:46 /usr/sbin/httpd -k start 2223 1201 root 20864 0.0 Sl 46-21:06:20 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 2553889 1276780 nobody 19912 0.0 S 02:47 /usr/sbin/httpd -k start 2553901 1276780 nobody 19860 0.0 S 02:46 /usr/sbin/httpd -k start 2554106 1276780 nobody 19692 0.1 S 02:29 /usr/sbin/httpd -k start 2553985 1276780 nobody 19408 0.1 S 02:43 /usr/sbin/httpd -k start 2555782 1276780 nobody 19012 0.2 S 00:25 /usr/sbin/httpd -k start 2555878 1276780 nobody 18524 0.1 S 00:19 /usr/sbin/httpd -k start 2553905 1276780 nobody 18428 0.0 S 02:46 /usr/sbin/httpd -k start 2553786 1276780 nobody 18060 0.0 S 02:55 /usr/sbin/httpd -k start 2556060 1276780 nobody 18056 0.1 S 00:07 /usr/sbin/httpd -k start 2556058 1276780 nobody 17864 0.0 S 00:07 /usr/sbin/httpd -k start 2556037 1276780 nobody 17736 0.2 S 00:09 /usr/sbin/httpd -k start 2555869 1276780 nobody 17644 0.1 S 00:20 /usr/sbin/httpd -k start 2554112 1276780 nobody 17600 0.0 S 02:23 /usr/sbin/httpd -k start 2556120 1276780 nobody 17428 0.0 S 00:02 /usr/sbin/httpd -k start 2556073 1276780 nobody 17372 0.1 S 00:06 /usr/sbin/httpd -k start 2556048 1276780 nobody 17328 0.1 S 00:08 /usr/sbin/httpd -k start 2556076 1276780 nobody 17028 0.3 S 00:06 /usr/sbin/httpd -k start 2556049 1276780 nobody 17024 0.1 S 00:08 /usr/sbin/httpd -k start 2556074 1276780 nobody 17000 0.0 S 00:06 /usr/sbin/httpd -k start 2556108 1276780 nobody 16948 0.0 S 00:03 /usr/sbin/httpd -k start 2556078 1276780 nobody 16884 0.0 S 00:06 /usr/sbin/httpd -k start 2556061 1276780 nobody 16816 0.0 S 00:07 /usr/sbin/httpd -k start 2556077 1276780 nobody 16780 0.0 S 00:06 /usr/sbin/httpd -k start 2556135 1276780 nobody 16716 0.0 S 00:01 /usr/sbin/httpd -k start 2556059 1276780 nobody 16708 0.1 S 00:07 /usr/sbin/httpd -k start 2556075 1276780 nobody 16380 0.0 S 00:06 /usr/sbin/httpd -k start 2556072 1276780 nobody 16348 0.1 S 00:06 /usr/sbin/httpd -k start 2556079 1276780 nobody 16316 0.0 S 00:06 /usr/sbin/httpd -k start 2553355 1276780 nobody 15888 0.0 S 03:09 /usr/sbin/httpd -k start 2553656 1276780 nobody 15596 0.0 S 03:02 /usr/sbin/httpd -k start 2551341 1276780 nobody 15584 0.0 S 05:59 /usr/sbin/httpd -k start 185104 2431 netdata 15456 2.0 Sl 2-10:42:39 /usr/libexec/netdata/plugins.d/apps.plugin 1 2553633 1276780 nobody 15408 0.0 S 03:04 /usr/sbin/httpd -k start 2551015 1276780 nobody 15224 0.0 S 06:06 /usr/sbin/httpd -k start 2556117 1276780 nobody 14956 0.0 S 00:02 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +-----+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +-----+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 414 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +-----+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 182 vinesit/vinesit.com.au-ssl_log 91 customc/customcentral.com.au-ssl_log 81 alison/alisonarts.com.au-ssl_log 79 evolution/portal.evolutionerp.com.au-ssl_log 18 infinium/infinium.net.au-ssl_log 4 speedlin/speedlinefencing.com.au-ssl_log 4 corpkicks/corporatekicks.com.au-ssl_log 3 cosgrovecreative/cosgrovecreative.com.au-ssl_log 2 evolution/my.evolutionerp.com.au-ssl_log 2 tubesupplies/tubesupplies.com.au-ssl_log 2 (total vhosts taking traffic: 11) --- top client IPs across all vhosts (last 3 min) --- 91 4.232.151.198 89 20.228.229.148 79 20.226.112.14 51 74.248.18.37 45 20.203.183.135 36 20.186.30.159 18 203.54.180.238 7 118.127.40.55 3 72.60.26.19 2 99.229.34.93 2 95.67.96.61 2 45.177.210.8 2 45.13.57.23 2 38.25.146.153 2 207.46.13.130 --- top request paths across all vhosts (last 3 min) --- 36 GET /autodiscover/autodiscover.xml 18 GET /heartbeat.php 17 POST / 14 GET / 5 POST /wp-cron.php 4 GET /k.php 4 GET /file.php 4 GET /bolt.php 4 GET /a.php 4 GET /aa.php 4 GET /404.php 4 GET /222.php 4 GET /1.php 3 GET /xx.php 3 GET /x.php 3 GET /admin.php 3 GET /aaa.php 3 GET /666.php 2 POST /wp-login.php 2 GET /xxxx.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 15 POST / 11 GET / 2 GET /x.php 2 GET /xleet.php 2 GET /ws54.php 2 GET /wp.php 2 GET /wp-mail.php 2 GET /wp-good.php 2 GET /wp-content/themes/pridmag/il.php 2 GET /wp-content/admin.php 2 GET /wp-admin/wp.php 2 GET /wp-admin/ -- last 10 requests -- 47.82.202.165 - - [15/Aug/2026:07:16:17 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/store/custom-air-force-1-with-rhinestones-for-the-groom/" "Mozilla/5.0 (Macintosh; In 187.108.230.138 - - [15/Aug/2026:07:16:15 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/store/personalised-bridal-socks/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Apple 4.232.151.198 - - [15/Aug/2026:07:16:21 +1000] "GET /wp-blink.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 47.82.201.222 - - [15/Aug/2026:07:16:16 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/store/af1-red-rose-crystal-swoosh/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) 138.186.241.86 - - [15/Aug/2026:07:16:17 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/store/nike-airmax-swarovski-bling/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Appl 4.232.151.198 - - [15/Aug/2026:07:16:22 +1000] "GET /randkeyword.PhP7 HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 128.201.50.75 - - [15/Aug/2026:07:16:17 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/product-category/customised-shoes/cartoon/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_ 45.177.210.8 - - [15/Aug/2026:07:16:19 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/store/custom-art-fusion-nike-af1/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWe 103.115.119.13 - - [15/Aug/2026:07:16:17 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/store/hand-dyed-crew-socks-multi-colour-essentials-pack-3-6-pairs/" "Mozilla/5.0 (Macinto 47.82.201.132 - - [15/Aug/2026:07:16:17 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/product-category/accessories/croccharm/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_1 == vinesit/vinesit.com.au-ssl_log == -- top paths -- 1 POST /wp-cron.php 1 POST / 1 GET /xxxx.php 1 GET /xxw.php 1 GET /xx.php 1 GET /x7.php 1 GET /wto.php 1 GET /wsd.php 1 GET /ws45.php 1 GET /ws38.php 1 GET /ws37.php 1 GET /ws36.php -- last 10 requests -- 20.228.229.148 - - [15/Aug/2026:07:16:07 +1000] "GET /card.php HTTP/1.1" 401 36 "-" "-" 20.228.229.148 - - [15/Aug/2026:07:16:07 +1000] "GET /size.php HTTP/1.1" 401 36 "-" "-" 20.228.229.148 - - [15/Aug/2026:07:16:08 +1000] "GET /class629.php HTTP/1.1" 401 36 "-" "-" 20.228.229.148 - - [15/Aug/2026:07:16:08 +1000] "GET /file9.php HTTP/1.1" 401 36 "-" "-" 20.228.229.148 - - [15/Aug/2026:07:16:09 +1000] "GET /moon.php HTTP/1.1" 401 36 "-" "-" 20.228.229.148 - - [15/Aug/2026:07:16:09 +1000] "GET /file18.php HTTP/1.1" 401 36 "-" "-" 20.228.229.148 - - [15/Aug/2026:07:16:10 +1000] "GET /file21.php HTTP/1.1" 401 36 "-" "-" 20.228.229.148 - - [15/Aug/2026:07:16:10 +1000] "GET /xxw.php HTTP/1.1" 401 36 "-" "-" 20.228.229.148 - - [15/Aug/2026:07:16:11 +1000] "GET /racs3.php HTTP/1.1" 401 36 "-" "-" 20.228.229.148 - - [15/Aug/2026:07:16:11 +1000] "GET /wsd.php HTTP/1.1" 401 36 "-" "-" == customc/customcentral.com.au-ssl_log == -- top paths -- 36 GET /autodiscover/autodiscover.xml 2 GET /oxvrws.php 2 GET /1wx.php 1 GET /xx.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /up.php 1 GET /uplozyu.php 1 GET /uploxe.php 1 GET /uploat.php 1 GET /this_is_a_new_hello_world.php 1 GET /system.php 1 GET /sts.php -- last 10 requests -- 20.203.183.135 - - [15/Aug/2026:07:15:35 +1000] "GET /up.php HTTP/1.1" 404 5750 "-" "-" 20.186.30.159 - - [15/Aug/2026:07:15:35 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.203.183.135 - - [15/Aug/2026:07:15:35 +1000] "GET /Hd.php HTTP/1.1" 404 5750 "-" "-" 20.203.183.135 - - [15/Aug/2026:07:15:36 +1000] "GET /nam.php HTTP/1.1" 404 5750 "-" "-" 20.186.30.159 - - [15/Aug/2026:07:15:36 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.203.183.135 - - [15/Aug/2026:07:15:36 +1000] "GET /pt.php HTTP/1.1" 404 5750 "-" "-" 20.186.30.159 - - [15/Aug/2026:07:15:37 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.203.183.135 - - [15/Aug/2026:07:15:37 +1000] "GET /mango.php HTTP/1.1" 404 5750 "-" "-" 20.203.183.135 - - [15/Aug/2026:07:15:38 +1000] "GET /14.php HTTP/1.1" 404 5750 "-" "-" 20.186.30.159 - - [15/Aug/2026:07:15:38 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-15 07:13:45 L1=32.27 run=23 blk=99 avail=259 (2.2%) swpO=60826 conn=- myRSS=499 php=108 phpRSS=8944 ap=129 tcp=61 topuser=madalice 2026-08-15 07:13:57 L1=47.90 run=49 blk=19 avail=352 (3.0%) swpO=31472 conn=- myRSS=0 php=107 phpRSS=9039 ap=136 tcp=50 topuser=madalice 2026-08-15 07:14:07 L1=41.25 run=2 blk=0 avail=9049 (77.2%) swpO=1659 conn=- myRSS=443 php=1 phpRSS=243 ap=123 tcp=21 topuser=madalice 2026-08-15 07:14:07 L1=41.25 run=1 blk=0 avail=9266 (79.0%) swpO=1019 conn=- myRSS=443 php=0 phpRSS=0 ap=122 tcp=23 topuser=- 2026-08-15 07:14:17 L1=35.23 run=3 blk=0 avail=9165 (78.1%) swpO=0 conn=- myRSS=452 php=1 phpRSS=127 ap=113 tcp=25 topuser=madalice 2026-08-15 07:14:17 L1=35.23 run=3 blk=0 avail=9108 (77.7%) swpO=0 conn=- myRSS=452 php=1 phpRSS=185 ap=112 tcp=23 topuser=madalice 2026-08-15 07:14:27 L1=30.21 run=4 blk=0 avail=9091 (77.5%) swpO=0 conn=3 myRSS=460 php=2 phpRSS=188 ap=103 tcp=21 topuser=speedlin 2026-08-15 07:14:27 L1=30.21 run=2 blk=1 avail=9125 (77.8%) swpO=0 conn=- myRSS=460 php=1 phpRSS=111 ap=102 tcp=23 topuser=madalice 2026-08-15 07:14:37 L1=26.10 run=3 blk=0 avail=9086 (77.5%) swpO=0 conn=3 myRSS=461 php=2 phpRSS=246 ap=93 tcp=23 topuser=madalice 2026-08-15 07:14:38 L1=26.10 run=4 blk=0 avail=8970 (76.5%) swpO=0 conn=3 myRSS=462 php=2 phpRSS=370 ap=92 tcp=23 topuser=madalice 2026-08-15 07:14:47 L1=22.46 run=4 blk=1 avail=9049 (77.2%) swpO=0 conn=3 myRSS=464 php=1 phpRSS=244 ap=82 tcp=23 topuser=madalice 2026-08-15 07:14:48 L1=22.46 run=3 blk=0 avail=9242 (78.8%) swpO=0 conn=3 myRSS=464 php=1 phpRSS=45 ap=82 tcp=24 topuser=speedlin 2026-08-15 07:14:57 L1=19.40 run=3 blk=1 avail=8785 (74.9%) swpO=0 conn=3 myRSS=477 php=4 phpRSS=609 ap=72 tcp=29 topuser=madalice 2026-08-15 07:14:58 L1=19.40 run=2 blk=0 avail=8869 (75.6%) swpO=0 conn=3 myRSS=477 php=3 phpRSS=486 ap=72 tcp=31 topuser=madalice 2026-08-15 07:15:07 L1=17.10 run=2 blk=0 avail=9160 (78.1%) swpO=0 conn=3 myRSS=484 php=2 phpRSS=173 ap=62 tcp=30 topuser=madalice 2026-08-15 07:15:08 L1=17.10 run=3 blk=0 avail=9066 (77.3%) swpO=0 conn=3 myRSS=484 php=3 phpRSS=300 ap=62 tcp=28 topuser=madalice 2026-08-15 07:15:17 L1=14.87 run=2 blk=1 avail=8833 (75.3%) swpO=0 conn=3 myRSS=493 php=3 phpRSS=556 ap=52 tcp=27 topuser=madalice 2026-08-15 07:15:18 L1=14.87 run=2 blk=0 avail=9246 (78.8%) swpO=0 conn=3 myRSS=493 php=2 phpRSS=129 ap=52 tcp=29 topuser=evolution 2026-08-15 07:15:27 L1=13.50 run=4 blk=2 avail=9292 (79.2%) swpO=0 conn=4 myRSS=495 php=2 phpRSS=164 ap=43 tcp=38 topuser=madalice 2026-08-15 07:15:28 L1=13.50 run=2 blk=0 avail=9239 (78.8%) swpO=0 conn=3 myRSS=495 php=2 phpRSS=215 ap=42 tcp=34 topuser=madalice 2026-08-15 07:15:37 L1=11.81 run=4 blk=0 avail=9445 (80.5%) swpO=0 conn=4 myRSS=497 php=0 phpRSS=0 ap=32 tcp=29 topuser=- 2026-08-15 07:15:38 L1=11.81 run=4 blk=0 avail=9425 (80.4%) swpO=0 conn=2 myRSS=497 php=1 phpRSS=61 ap=32 tcp=29 topuser=madalice 2026-08-15 07:15:47 L1=10.38 run=3 blk=0 avail=9424 (80.3%) swpO=0 conn=4 myRSS=498 php=1 phpRSS=119 ap=24 tcp=23 topuser=madalice 2026-08-15 07:15:48 L1=10.38 run=3 blk=0 avail=9368 (79.9%) swpO=0 conn=2 myRSS=498 php=1 phpRSS=175 ap=24 tcp=22 topuser=madalice 2026-08-15 07:15:57 L1=9.10 run=4 blk=0 avail=9397 (80.1%) swpO=0 conn=4 myRSS=501 php=2 phpRSS=167 ap=25 tcp=23 topuser=aaa 2026-08-15 07:15:58 L1=9.10 run=2 blk=0 avail=9386 (80.0%) swpO=0 conn=2 myRSS=501 php=2 phpRSS=176 ap=25 tcp=37 topuser=aaa 2026-08-15 07:16:07 L1=8.24 run=5 blk=0 avail=9358 (79.8%) swpO=0 conn=4 myRSS=504 php=3 phpRSS=216 ap=26 tcp=26 topuser=madalice 2026-08-15 07:16:08 L1=8.24 run=8 blk=0 avail=9175 (78.2%) swpO=0 conn=2 myRSS=504 php=4 phpRSS=424 ap=26 tcp=29 topuser=madalice 2026-08-15 07:16:17 L1=9.35 run=22 blk=0 avail=8006 (68.3%) swpO=0 conn=17 myRSS=512 php=17 phpRSS=1819 ap=56 tcp=70 topuser=madalice 2026-08-15 07:16:18 L1=9.35 run=27 blk=0 avail=7772 (66.3%) swpO=0 conn=17 myRSS=512 php=16 phpRSS=1984 ap=56 tcp=69 topuser=madalice