INCIDENT 2026-08-15 07:22:17 trigger: php_rss=2547MB mysql_conn=21 ================================================================== load: 2.26 5.27 10.09 32/628 2559828 ncpu:10 mem_avail: 7322MB/11729MB (62.4%) swap_used:1373MB swapout:0/s blocked(D):0 running:24 iowait:0.0% steal:0.0% php: 20 procs / 2547MB heaviest user: madalice (20 procs, 2547MB) apache: 46 procs tcp_estab: 84 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 21 2777 nobody 49 743 mysql 1 531 root 239 405 netdata 8 224 dovenull 6 18 mailnull 3 17 mailman 20 16 wp-toolkit 6 15 cpanellogin 1 13 zabbix 1 12 dovecot 3 7 kurri 1 3 cpanelconnecttrack 1 3 named 1 2 evolution 4 2 polkitd 1 1 nscd 1 1 dbus 1 1 chrony 1 1 --- php workers by user --- USER PROCS RSS_MB madalice 21 2802 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3007 MB Active(file): 1224 MB Inactive(file): 583 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 203 MB CommitLimit: 9960 MB Committed_AS: 10607 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2342983 root 06:11:02 0 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2554273 1 mysql 544464 3.9 Ssl 08:16 /usr/sbin/mariadbd 2559769 2559756 madalice 198288 61.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2559767 2559758 madalice 190620 56.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2559777 2559749 madalice 186636 56.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2559773 2559759 madalice 176648 52.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 170500 2.5 Ssl 46-21:12:20 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2559775 2559757 madalice 167992 49.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2559770 2559755 madalice 164788 47.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2559785 2558149 madalice 159564 44.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2559768 2559762 madalice 152328 43.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2559774 2559748 madalice 150544 41.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2559772 2559761 madalice 147032 40.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2559776 2559763 madalice 139708 39.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2559784 2559780 madalice 137604 37.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2559782 2557815 madalice 137104 37.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2559771 2559760 madalice 134696 36.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2559781 2559690 madalice 115368 29.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2559783 2559359 madalice 104868 24.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2559786 2556059 madalice 103588 35.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2390233 2382613 root 86456 0.0 S 04:46:40 spamd child 2559791 2559789 madalice 84008 47.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2382613 1 root 80432 0.0 Ss 04:59:06 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2559793 2559790 madalice 73764 32.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2559824 2559735 madalice 59940 16.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 159820 1 root 46576 0.0 Ss 25-21:35:28 /usr/lib/systemd/systemd-journald 1353308 1 root 41900 0.0 Ss 24-04:40:50 cpsrvd (SSL) - waiting for connections 2559833 2559820 evolution 40916 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 40648 0.1 Sl 46-21:12:15 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2556059 1276780 nobody 21892 0.0 S 06:06 /usr/sbin/httpd -k start 2223 1201 root 20924 0.0 Sl 46-21:12:19 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 2556342 1276780 nobody 20720 0.0 S 05:58 /usr/sbin/httpd -k start 2559359 1276780 nobody 20192 0.0 S 01:00 /usr/sbin/httpd -k start 2558026 1276780 nobody 19412 0.0 S 03:00 /usr/sbin/httpd -k start 2557815 1276780 nobody 18616 0.0 S 03:31 /usr/sbin/httpd -k start 2557812 1276780 nobody 18132 0.0 S 03:31 /usr/sbin/httpd -k start 2559735 1276780 nobody 17952 0.0 S 00:07 /usr/sbin/httpd -k start 2558149 1276780 nobody 17904 0.0 S 02:48 /usr/sbin/httpd -k start 2556072 1276780 nobody 17396 0.0 S 06:05 /usr/sbin/httpd -k start 2559734 1276780 nobody 17228 0.0 S 00:07 /usr/sbin/httpd -k start 2559690 1276780 nobody 17168 0.1 S 00:10 /usr/sbin/httpd -k start 2559360 1276780 nobody 17148 0.0 S 00:59 /usr/sbin/httpd -k start 2559751 1276780 nobody 17092 0.1 S 00:06 /usr/sbin/httpd -k start 2559738 1276780 nobody 17084 0.2 S 00:07 /usr/sbin/httpd -k start 2559696 1276780 nobody 17076 0.2 S 00:09 /usr/sbin/httpd -k start 2559701 1276780 nobody 17072 0.1 S 00:08 /usr/sbin/httpd -k start 2559739 1276780 nobody 17072 0.1 S 00:07 /usr/sbin/httpd -k start 2559702 1276780 nobody 17020 0.1 S 00:08 /usr/sbin/httpd -k start 2559704 1276780 nobody 17020 0.1 S 00:08 /usr/sbin/httpd -k start 2559703 1276780 nobody 16984 0.1 S 00:08 /usr/sbin/httpd -k start 2559695 1276780 nobody 16976 0.2 S 00:09 /usr/sbin/httpd -k start 2559733 1276780 nobody 16956 0.1 S 00:07 /usr/sbin/httpd -k start 2559737 1276780 nobody 16920 0.1 S 00:07 /usr/sbin/httpd -k start 2559736 1276780 nobody 16916 0.0 S 00:07 /usr/sbin/httpd -k start 2559819 1276780 nobody 16884 0.0 S 00:01 /usr/sbin/httpd -k start 2559740 1276780 nobody 16844 0.2 S 00:07 /usr/sbin/httpd -k start 2559753 1276780 nobody 16820 0.0 S 00:06 /usr/sbin/httpd -k start 2559752 1276780 nobody 16780 0.0 S 00:06 /usr/sbin/httpd -k start 2559754 1276780 nobody 16772 0.0 S 00:06 /usr/sbin/httpd -k start 2559750 1276780 nobody 16380 0.0 S 00:06 /usr/sbin/httpd -k start 185104 2431 netdata 15456 2.0 Sl 2-10:48:38 /usr/libexec/netdata/plugins.d/apps.plugin 1 --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +-----+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +-----+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 884 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 883 | madalice_wp | madalice_wp | Query | 0 | Writing to net | SELECT option_name, option_value FROM AMuqf6qZ_options WHERE autoload IN ( 'yes', 'on', 'auto-on', 'auto' ) | +-----+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 158 otterfencing/otterfencing.com.au-ssl_log 60 evolution/portal.evolutionerp.com.au-ssl_log 18 speedlin/speedlinefencing.com.au-ssl_log 7 alison/alisonarts.com.au-ssl_log 5 evolution/my.evolutionerp.com.au-ssl_log 2 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 133 20.228.229.148 60 20.104.100.201 18 203.54.180.238 7 172.202.39.151 2 72.255.11.185 2 159.26.120.21 1 84.189.42.26 1 80.91.18.175 1 71.115.145.72 1 68.101.66.69 1 59.103.118.63 1 54.236.1.180 1 51.36.227.39 1 46.189.136.28 1 45.94.5.32 --- top request paths across all vhosts (last 3 min) --- 18 GET /heartbeat.php 2 POST / 2 GET /f6.php 1 POST /functions.php 1 GET /zwq.php 1 GET /zample.php 1 GET /yellow.php 1 GET /yawa.php 1 GET /xy.php 1 GET /xxxx.php 1 GET /xxx.php 1 GET /xxw.php 1 GET /xx.php 1 GET /x.php 1 GET /xl2024.php 1 GET /xeqdlun.php 1 GET /x7.php 1 GET /x1da.php 1 GET /x0rg.php 1 GET /wto.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 2 POST / 1 GET /yellow.php 1 GET /xxxx.php 1 GET /xxx.php 1 GET /xxw.php 1 GET /xx.php 1 GET /x.php 1 GET /xeqdlun.php 1 GET /x7.php 1 GET /wto.php 1 GET /wsd.php 1 GET /ws45.php -- last 10 requests -- 186.71.4.3 - - [15/Aug/2026:07:22:10 +1000] "GET /tag/design/ HTTP/1.1" 200 29163 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" 179.127.66.129 - - [15/Aug/2026:07:22:11 +1000] "GET /tag/marten/ HTTP/1.1" 200 29250 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" 105.245.224.20 - - [15/Aug/2026:07:22:10 +1000] "GET /design-your-own-shoes/ HTTP/1.1" 200 34332 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" 170.79.52.218 - - [15/Aug/2026:07:22:11 +1000] "GET /product-category/customised-shoes/sugar-rush/ HTTP/1.1" 200 30108 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/14 45.187.7.201 - - [15/Aug/2026:07:22:11 +1000] "GET /category/collab/ HTTP/1.1" 200 30910 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" 72.255.11.185 - - [15/Aug/2026:07:22:12 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/tag/charms/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, l 45.236.32.225 - - [15/Aug/2026:07:22:12 +1000] "GET /tag/customs/ HTTP/1.1" 200 29302 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" 27.64.153.174 - - [15/Aug/2026:07:22:12 +1000] "GET /product-tag/personalised-sock-pack/ HTTP/1.1" 200 29584 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa 84.189.42.26 - - [15/Aug/2026:07:22:12 +1000] "GET /store/3d-fidget-clicker-adidas-sneaker/ HTTP/1.1" 200 45930 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 197.145.180.236 - - [15/Aug/2026:07:22:12 +1000] "GET /tag/girls/ HTTP/1.1" 200 29127 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 1 GET /zwq.php 1 GET /zample.php 1 GET /yawa.php 1 GET /xy.php 1 GET /xl2024.php 1 GET /x1da.php 1 GET /x0rg.php 1 GET /wp-mter.php 1 GET /wp-michan.php 1 GET /wp-kd4xalrg7m.php 1 GET /wp-admin/maint/max.php 1 GET /tx22.php -- last 10 requests -- 20.104.100.201 - - [15/Aug/2026:07:20:23 +1000] "GET /phpmini.php HTTP/1.1" 401 36 "-" "-" 20.104.100.201 - - [15/Aug/2026:07:20:23 +1000] "GET /awh.php HTTP/1.1" 401 36 "-" "-" 20.104.100.201 - - [15/Aug/2026:07:20:24 +1000] "GET /rovoj.php HTTP/1.1" 401 36 "-" "-" 20.104.100.201 - - [15/Aug/2026:07:20:24 +1000] "GET /phina.php HTTP/1.1" 401 36 "-" "-" 20.104.100.201 - - [15/Aug/2026:07:20:25 +1000] "GET /sweg.php HTTP/1.1" 401 36 "-" "-" 20.104.100.201 - - [15/Aug/2026:07:20:25 +1000] "GET /aee.php HTTP/1.1" 401 36 "-" "-" 20.104.100.201 - - [15/Aug/2026:07:20:26 +1000] "GET /shellerr.php HTTP/1.1" 401 36 "-" "-" 20.104.100.201 - - [15/Aug/2026:07:20:26 +1000] "GET /roter.php HTTP/1.1" 401 36 "-" "-" 20.104.100.201 - - [15/Aug/2026:07:20:26 +1000] "GET /save.php HTTP/1.1" 401 36 "-" "-" 20.104.100.201 - - [15/Aug/2026:07:20:27 +1000] "GET /gelio1.php HTTP/1.1" 401 36 "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 18 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [15/Aug/2026:07:20:43 +1000] "GET /heartbeat.php?sentAt=1786742443&bytes=106,127,134,171&_=1786683795294 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [15/Aug/2026:07:20:45 +1000] "GET /heartbeat.php?sentAt=1786742446&bytes=106,127,134,174&_=1786712385262 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [15/Aug/2026:07:20:53 +1000] "GET /heartbeat.php?sentAt=1786742453&bytes=106,127,134,181&_=1786683795295 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [15/Aug/2026:07:20:55 +1000] "GET /heartbeat.php?sentAt=1786742456&bytes=106,127,134,184&_=1786712385263 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [15/Aug/2026:07:21:03 +1000] "GET /heartbeat.php?sentAt=1786742463&bytes=106,127,134,191&_=1786683795296 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [15/Aug/2026:07:21:05 +1000] "GET /heartbeat.php?sentAt=1786742466&bytes=106,127,134,194&_=1786712385264 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [15/Aug/2026:07:21:13 +1000] "GET /heartbeat.php?sentAt=1786742473&bytes=106,127,134,201&_=1786683795297 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [15/Aug/2026:07:21:15 +1000] "GET /heartbeat.php?sentAt=1786742476&bytes=106,127,134,204&_=1786712385265 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [15/Aug/2026:07:21:23 +1000] "GET /heartbeat.php?sentAt=1786742483&bytes=106,127,134,211&_=1786683795298 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [15/Aug/2026:07:21:25 +1000] "GET /heartbeat.php?sentAt=1786742486&bytes=106,127,134,214&_=1786712385266 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 --- last 30 samples (run-up to this incident) --- 2026-08-15 07:19:49 L1=2.51 run=3 blk=0 avail=9366 (79.9%) swpO=0 conn=2 myRSS=526 php=1 phpRSS=125 ap=19 tcp=18 topuser=speedlin 2026-08-15 07:19:56 L1=2.39 run=2 blk=0 avail=9354 (79.8%) swpO=0 conn=2 myRSS=526 php=2 phpRSS=160 ap=20 tcp=21 topuser=speedlin 2026-08-15 07:19:59 L1=2.20 run=2 blk=0 avail=9414 (80.3%) swpO=0 conn=2 myRSS=526 php=1 phpRSS=66 ap=20 tcp=17 topuser=speedlin 2026-08-15 07:20:06 L1=2.10 run=1 blk=0 avail=9436 (80.5%) swpO=0 conn=2 myRSS=526 php=1 phpRSS=39 ap=20 tcp=22 topuser=evolution 2026-08-15 07:20:09 L1=2.17 run=3 blk=0 avail=9289 (79.2%) swpO=0 conn=2 myRSS=527 php=2 phpRSS=224 ap=20 tcp=19 topuser=alison 2026-08-15 07:20:16 L1=2.00 run=1 blk=0 avail=9449 (80.6%) swpO=0 conn=2 myRSS=527 php=1 phpRSS=39 ap=19 tcp=16 topuser=evolution 2026-08-15 07:20:19 L1=1.92 run=2 blk=0 avail=9458 (80.6%) swpO=0 conn=2 myRSS=527 php=0 phpRSS=0 ap=19 tcp=19 topuser=- 2026-08-15 07:20:26 L1=1.77 run=2 blk=0 avail=9447 (80.5%) swpO=0 conn=2 myRSS=527 php=1 phpRSS=40 ap=19 tcp=18 topuser=evolution 2026-08-15 07:20:29 L1=1.62 run=2 blk=0 avail=9449 (80.6%) swpO=0 conn=2 myRSS=527 php=0 phpRSS=0 ap=19 tcp=15 topuser=- 2026-08-15 07:20:36 L1=1.49 run=1 blk=0 avail=9453 (80.6%) swpO=0 conn=2 myRSS=527 php=1 phpRSS=40 ap=19 tcp=19 topuser=evolution 2026-08-15 07:20:39 L1=1.45 run=1 blk=0 avail=9452 (80.6%) swpO=0 conn=1 myRSS=527 php=0 phpRSS=0 ap=19 tcp=20 topuser=- 2026-08-15 07:20:46 L1=1.42 run=1 blk=0 avail=9433 (80.4%) swpO=0 conn=2 myRSS=527 php=1 phpRSS=39 ap=20 tcp=21 topuser=evolution 2026-08-15 07:20:49 L1=1.38 run=2 blk=0 avail=9343 (79.7%) swpO=0 conn=1 myRSS=527 php=1 phpRSS=131 ap=20 tcp=18 topuser=alison 2026-08-15 07:20:56 L1=1.27 run=1 blk=0 avail=9500 (81.0%) swpO=0 conn=2 myRSS=527 php=1 phpRSS=40 ap=19 tcp=21 topuser=evolution 2026-08-15 07:21:00 L1=1.17 run=3 blk=0 avail=9486 (80.9%) swpO=0 conn=1 myRSS=527 php=0 phpRSS=0 ap=19 tcp=18 topuser=- 2026-08-15 07:21:06 L1=1.16 run=1 blk=0 avail=9471 (80.7%) swpO=0 conn=2 myRSS=530 php=1 phpRSS=40 ap=19 tcp=21 topuser=evolution 2026-08-15 07:21:10 L1=1.22 run=1 blk=0 avail=9491 (80.9%) swpO=0 conn=1 myRSS=530 php=0 phpRSS=0 ap=19 tcp=17 topuser=- 2026-08-15 07:21:16 L1=1.21 run=1 blk=0 avail=9477 (80.8%) swpO=0 conn=2 myRSS=530 php=1 phpRSS=40 ap=19 tcp=21 topuser=evolution 2026-08-15 07:21:20 L1=1.11 run=1 blk=0 avail=9473 (80.8%) swpO=0 conn=1 myRSS=530 php=0 phpRSS=0 ap=22 tcp=20 topuser=- 2026-08-15 07:21:26 L1=1.02 run=1 blk=0 avail=9498 (81.0%) swpO=0 conn=2 myRSS=530 php=1 phpRSS=40 ap=17 tcp=17 topuser=evolution 2026-08-15 07:21:30 L1=0.94 run=2 blk=0 avail=9450 (80.6%) swpO=0 conn=1 myRSS=530 php=1 phpRSS=91 ap=17 tcp=15 topuser=infinium 2026-08-15 07:21:36 L1=0.86 run=1 blk=0 avail=9509 (81.1%) swpO=0 conn=1 myRSS=530 php=0 phpRSS=0 ap=16 tcp=11 topuser=- 2026-08-15 07:21:40 L1=0.79 run=1 blk=0 avail=9523 (81.2%) swpO=0 conn=1 myRSS=530 php=0 phpRSS=0 ap=16 tcp=11 topuser=- 2026-08-15 07:21:46 L1=0.73 run=1 blk=0 avail=9526 (81.2%) swpO=0 conn=1 myRSS=530 php=0 phpRSS=0 ap=15 tcp=13 topuser=- 2026-08-15 07:21:50 L1=0.75 run=2 blk=0 avail=9445 (80.5%) swpO=0 conn=1 myRSS=530 php=0 phpRSS=0 ap=15 tcp=16 topuser=- 2026-08-15 07:21:56 L1=0.69 run=3 blk=0 avail=9519 (81.2%) swpO=0 conn=1 myRSS=530 php=0 phpRSS=0 ap=15 tcp=17 topuser=- 2026-08-15 07:22:00 L1=0.64 run=1 blk=0 avail=9524 (81.2%) swpO=0 conn=1 myRSS=530 php=0 phpRSS=0 ap=15 tcp=16 topuser=- 2026-08-15 07:22:06 L1=0.58 run=1 blk=0 avail=9525 (81.2%) swpO=0 conn=1 myRSS=530 php=0 phpRSS=0 ap=14 tcp=16 topuser=- 2026-08-15 07:22:10 L1=1.50 run=13 blk=0 avail=8441 (72.0%) swpO=0 conn=1 myRSS=530 php=9 phpRSS=1341 ap=21 tcp=31 topuser=madalice 2026-08-15 07:22:17 L1=2.26 run=24 blk=0 avail=7322 (62.4%) swpO=0 conn=21 myRSS=531 php=20 phpRSS=2547 ap=46 tcp=84 topuser=madalice