INCIDENT 2026-08-17 01:17:54 trigger: php_procs=36 php_rss=5850MB mysql_conn=35 ================================================================== load: 15.76 5.20 2.39 42/707 4096543 ncpu:10 mem_avail: 2046MB/11729MB (17.4%) swap_used:2002MB swapout:872/s blocked(D):0 running:43 iowait:1.0% steal:0.0% php: 36 procs / 5850MB heaviest user: madalice (34 procs, 5616MB) apache: 57 procs tcp_estab: 67 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 34 5379 mysql 1 2276 root 237 844 nobody 56 842 netdata 8 267 evolution 5 173 customc 1 75 cpanellogin 1 60 mailnull 4 59 dovenull 6 26 lowrange 2 25 kurri 2 22 wp-toolkit 6 20 zabbix 1 14 mailman 20 14 infinium 1 12 aaa 1 12 nscd 1 8 dovecot 3 7 named 1 6 --- php workers by user --- USER PROCS RSS_MB madalice 35 5419 evolution 1 172 customc 1 77 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4705 MB Active(file): 1360 MB Inactive(file): 443 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 389 MB CommitLimit: 9960 MB Committed_AS: 13984 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 4090795 root 06:37 7752 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2330872 2.7 Ssl 1-17:27:15 /usr/sbin/mariadbd 4096437 4096249 madalice 268972 38.0 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096433 4096216 madalice 268824 36.1 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096424 4096215 madalice 268480 40.6 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096423 4096253 madalice 266432 39.5 S 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096421 4096196 madalice 264416 38.8 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096426 4094996 madalice 260276 37.8 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096440 4096326 madalice 235456 36.0 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096431 4096250 madalice 230472 29.8 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096438 4095229 madalice 229684 33.7 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096427 4094999 madalice 220096 34.6 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 218192 2.5 Ssl 48-15:07:57 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 4096428 4096252 madalice 217588 32.1 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096442 4094979 madalice 209540 35.3 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096432 4092965 madalice 208100 31.3 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096439 4095363 madalice 198692 27.8 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096425 4096251 madalice 196592 30.1 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096422 4096255 madalice 195356 27.7 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096436 4096214 madalice 180844 31.0 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 171672 0.0 Ss 1-17:27:18 /usr/lib/systemd/systemd-journald 3255082 3247260 root 171348 0.0 S 22:42:04 spamd child 3247260 1 root 136332 0.0 Ss 22:54:34 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4096490 4096447 madalice 126172 52.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096443 4095364 madalice 119632 34.1 R 00:08 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096491 4096448 madalice 114284 48.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096485 4096322 madalice 109640 27.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096493 4095365 madalice 107852 36.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096498 4095367 madalice 100092 37.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096495 4092932 madalice 100000 35.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096486 4096171 madalice 96944 22.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096492 4094994 madalice 95300 26.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096494 4095319 madalice 92160 23.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096500 4095361 madalice 91636 20.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096507 4096327 customc 86452 41.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4096496 4096254 madalice 85360 25.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096488 4094997 madalice 83360 32.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096489 4095612 madalice 83064 22.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096499 4094989 madalice 68432 12.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4062968 1353308 cpanellogin 61904 0.0 S 41:24 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 4096520 4096503 madalice 60872 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4096534 4095228 madalice 60784 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3767579 3247260 root 59460 0.0 S 08:45:16 spamd child 1353308 1 root 41592 0.0 Ss 25-22:36:27 cpsrvd (SSL) - waiting for connections 2223 1201 root 39276 0.0 Sl 48-15:07:56 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 33788 0.1 Sl 48-15:07:52 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 33424 0.1 Ss 48-15:07:56 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4039895 1 root 29052 0.0 Ss 01:17:53 lfd - sleeping 4095367 1276780 nobody 20344 0.1 S 00:58 /usr/sbin/httpd -k start 4095361 1276780 nobody 20240 0.1 S 00:58 /usr/sbin/httpd -k start 4095322 1276780 nobody 20148 0.1 S 00:59 /usr/sbin/httpd -k start 4095364 1276780 nobody 20100 0.1 S 00:58 /usr/sbin/httpd -k start 4095620 1276780 nobody 20100 0.1 S 00:53 /usr/sbin/httpd -k start 4095612 1276780 nobody 19568 0.1 S 00:54 /usr/sbin/httpd -k start 281734 1 mailnull 18868 0.0 Ss 7-22:55:45 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 4096249 1276780 nobody 18628 0.1 S 00:24 /usr/sbin/httpd -k start 4096327 1276780 nobody 18476 0.8 S 00:18 /usr/sbin/httpd -k start 4095365 1276780 nobody 18368 0.0 S 00:58 /usr/sbin/httpd -k start 4095319 1276780 nobody 18332 0.0 S 00:59 /usr/sbin/httpd -k start 4095228 1276780 nobody 17672 0.1 S 01:00 /usr/sbin/httpd -k start 4095229 1276780 nobody 17552 0.1 S 01:00 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 427654 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 156 evolution/legacy.evolutionerp.com.au 139 otterfencing/otterfencing.com.au-ssl_log 88 customkidscom/customkids.com.au-ssl_log 44 evolution/evolutionerp.com.au 44 evolution/evolutionerp.com.au-ssl_log 40 alison/alisonarts.com.au-ssl_log 35 evolution/portal.evolutionerp.com.au-ssl_log 26 aaa/aaadownunder.com.au-ssl_log 3 tubesupplies/tubesupplies.com.au-ssl_log 3 tubesupplies/tubesupplies.com.au 2 customc/customcentral.com.au 1 evolution/my.evolutionerp.com.au-ssl_log 1 (total vhosts taking traffic: 13) --- top client IPs across all vhosts (last 3 min) --- 170 20.104.100.201 148 185.93.89.147 139 20.65.105.233 44 20.24.67.246 30 20.102.65.165 26 203.54.180.238 4 158.101.5.31 4 148.251.41.182 4 118.127.40.55 2 91.92.243.249 2 114.119.143.104 1 40.77.167.75 1 190.153.66.15 1 146.70.194.228 1 114.119.143.14 --- top request paths across all vhosts (last 3 min) --- 26 GET /heartbeat.php 6 GET /wp-content/plugins/hellopress/wp_filemanager.php 6 GET /this_is_a_new_hello_world.php 5 GET /wp-content/admin.php 5 GET /av.php 5 GET /adminner.php 5 GET / 4 POST /wp-cron.php 4 GET /store/boot-charms-heart/ 4 GET /product-category/accessories/ 4 GET /mcs.php 4 GET /kj.php 4 GET /1xmomo.php 3 GET /zero.php 3 GET /x1da.php 3 GET /wp-temp.php 3 GET /wp-css.php 3 GET /wp-content/index.php 3 GET /wp-content/cong.php 3 GET /wp-admin/setup-config.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 5 GET / 4 GET /store/boot-charms-heart/ 4 GET /product-category/accessories/ 3 GET /store/boot-charm-butterfly-heart/ 3 GET /product-category/customised-shoes/womens/ 3 GET /product-category/accessories/croccharm/ 2 GET /store/toys-kids-custom-shoes/ 2 GET /store/tie-dye-socks/ 2 GET /store/sydney-roosters-af1/ 2 GET /store/pearl-butterfly-knot-shoe-set/ 2 GET /store/gold-padlock-sneaker-dubraes/ 2 GET /store/fluffy-laces/ -- last 10 requests -- 185.93.89.147 - - [17/Aug/2026:01:17:46 +1000] "GET /store/boot-charm-butterfly-heart/ HTTP/1.1" 200 43743 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 185.93.89.147 - - [17/Aug/2026:01:17:46 +1000] "GET /store/boot-charms-heart/ HTTP/1.1" 200 43874 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 185.93.89.147 - - [17/Aug/2026:01:17:46 +1000] "GET /store/dont-be-a-goose-custom-nike-air-force-1/ HTTP/1.1" 200 47591 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 185.93.89.147 - - [17/Aug/2026:01:17:46 +1000] "GET /product-tag/dubrae/ HTTP/1.1" 200 29973 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 185.93.89.147 - - [17/Aug/2026:01:17:46 +1000] "GET /store/shoe-charm-initials-with-bling/ HTTP/1.1" 200 44339 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 185.93.89.147 - - [17/Aug/2026:01:17:46 +1000] "GET /store/blue-crystal-swoosh-lace-charms-blue-pair/ HTTP/1.1" 200 44083 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 185.93.89.147 - - [17/Aug/2026:01:17:46 +1000] "GET /product-tag/antique/ HTTP/1.1" 200 29973 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 185.93.89.147 - - [17/Aug/2026:01:17:46 +1000] "GET /store/boot-charm-butterfly-heart/ HTTP/1.1" 200 43709 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 185.93.89.147 - - [17/Aug/2026:01:17:46 +1000] "GET /store/boot-charms-heart/ HTTP/1.1" 200 43922 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 185.93.89.147 - - [17/Aug/2026:01:17:46 +1000] "GET /store/boot-charms-heart/ HTTP/1.1" 200 43917 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" == evolution/legacy.evolutionerp.com.au == -- top paths -- 1 GET /zz.php 1 GET /zxin.php 1 GET /zwq13.php 1 GET /z.php 1 GET /ze.php 1 GET /zc-318.php 1 GET /xxx.php 1 GET /xqq.php 1 GET /xmy.php 1 GET /xleet.php 1 GET /xda.php 1 GET /xa.php -- last 10 requests -- 20.65.105.233 - - [17/Aug/2026:01:16:56 +1000] "GET /clasa99.php HTTP/1.1" 404 - "-" "-" 20.65.105.233 - - [17/Aug/2026:01:16:56 +1000] "GET /666.php HTTP/1.1" 404 - "-" "-" 20.65.105.233 - - [17/Aug/2026:01:16:56 +1000] "GET /thui.php HTTP/1.1" 404 - "-" "-" 20.65.105.233 - - [17/Aug/2026:01:16:56 +1000] "GET /agg.php HTTP/1.1" 404 - "-" "-" 20.65.105.233 - - [17/Aug/2026:01:16:56 +1000] "GET /erty.php HTTP/1.1" 404 - "-" "-" 20.65.105.233 - - [17/Aug/2026:01:16:57 +1000] "GET /mini.php HTTP/1.1" 404 - "-" "-" 20.65.105.233 - - [17/Aug/2026:01:16:57 +1000] "GET /sid3.php HTTP/1.1" 404 - "-" "-" 20.65.105.233 - - [17/Aug/2026:01:16:57 +1000] "GET /moon.php HTTP/1.1" 404 - "-" "-" 20.65.105.233 - - [17/Aug/2026:01:16:57 +1000] "GET /ms.php HTTP/1.1" 404 - "-" "-" 20.65.105.233 - - [17/Aug/2026:01:16:57 +1000] "GET /wsws.php HTTP/1.1" 404 - "-" "-" == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 1 GET /zxz.php 1 GET /zero.php 1 GET /z43agz.php 1 GET /yawa.php 1 GET /x1da.php 1 GET /ws77.php 1 GET /wpxml.php 1 GET /wp-temp.php 1 GET /wp-rrtx.php 1 GET /wp-includes/Text/Diff/Engine/file_cdd9.php 1 GET /wp-css.php 1 GET /wp-content/replace.php -- last 10 requests -- 20.104.100.201 - - [17/Aug/2026:01:16:07 +1000] "GET /7.php HTTP/1.1" 401 36 "-" "-" 20.104.100.201 - - [17/Aug/2026:01:16:08 +1000] "GET /ws77.php HTTP/1.1" 401 36 "-" "-" 20.104.100.201 - - [17/Aug/2026:01:16:08 +1000] "GET /read.php HTTP/1.1" 401 36 "-" "-" 20.104.100.201 - - [17/Aug/2026:01:16:09 +1000] "GET /albin.php HTTP/1.1" 401 36 "-" "-" 20.104.100.201 - - [17/Aug/2026:01:16:09 +1000] "GET /fw/34.php HTTP/1.1" 401 36 "-" "-" 20.104.100.201 - - [17/Aug/2026:01:16:09 +1000] "GET /wp9.php HTTP/1.1" 401 36 "-" "-" 20.104.100.201 - - [17/Aug/2026:01:16:10 +1000] "GET /save.php HTTP/1.1" 401 36 "-" "-" 20.104.100.201 - - [17/Aug/2026:01:16:10 +1000] "GET /wp-rrtx.php HTTP/1.1" 401 36 "-" "-" 20.104.100.201 - - [17/Aug/2026:01:16:11 +1000] "GET /gecko-new.php HTTP/1.1" 401 36 "-" "-" 20.104.100.201 - - [17/Aug/2026:01:16:11 +1000] "GET /df.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-17 01:15:21 L1=0.58 run=4 blk=0 avail=6853 (58.4%) swpO=0 conn=1 myRSS=2369 php=2 phpRSS=112 ap=21 tcp=23 topuser=evolution 2026-08-17 01:15:31 L1=0.49 run=1 blk=0 avail=6946 (59.2%) swpO=0 conn=1 myRSS=2369 php=0 phpRSS=0 ap=17 tcp=24 topuser=- 2026-08-17 01:15:31 L1=0.49 run=2 blk=0 avail=6943 (59.2%) swpO=0 conn=1 myRSS=2369 php=0 phpRSS=0 ap=17 tcp=24 topuser=- 2026-08-17 01:15:41 L1=0.42 run=3 blk=0 avail=6720 (57.3%) swpO=0 conn=1 myRSS=2369 php=3 phpRSS=264 ap=21 tcp=30 topuser=infinium 2026-08-17 01:15:41 L1=0.42 run=4 blk=0 avail=6712 (57.2%) swpO=0 conn=1 myRSS=2369 php=3 phpRSS=272 ap=21 tcp=30 topuser=infinium 2026-08-17 01:15:51 L1=0.43 run=1 blk=0 avail=6896 (58.8%) swpO=0 conn=1 myRSS=2369 php=0 phpRSS=0 ap=21 tcp=29 topuser=- 2026-08-17 01:15:51 L1=0.43 run=3 blk=0 avail=6893 (58.8%) swpO=0 conn=1 myRSS=2369 php=0 phpRSS=0 ap=21 tcp=27 topuser=- 2026-08-17 01:16:01 L1=0.37 run=3 blk=0 avail=6667 (56.8%) swpO=0 conn=1 myRSS=2369 php=1 phpRSS=261 ap=21 tcp=28 topuser=madalice 2026-08-17 01:16:01 L1=0.37 run=4 blk=0 avail=6665 (56.8%) swpO=0 conn=1 myRSS=2369 php=1 phpRSS=146 ap=21 tcp=28 topuser=madalice 2026-08-17 01:16:11 L1=0.54 run=3 blk=0 avail=6767 (57.7%) swpO=0 conn=1 myRSS=2369 php=2 phpRSS=196 ap=20 tcp=27 topuser=alison 2026-08-17 01:16:11 L1=0.54 run=3 blk=0 avail=6750 (57.6%) swpO=0 conn=1 myRSS=2369 php=2 phpRSS=208 ap=20 tcp=29 topuser=alison 2026-08-17 01:16:21 L1=0.76 run=2 blk=0 avail=6842 (58.3%) swpO=0 conn=1 myRSS=2369 php=1 phpRSS=90 ap=20 tcp=25 topuser=evolution 2026-08-17 01:16:21 L1=0.76 run=2 blk=0 avail=6834 (58.3%) swpO=0 conn=1 myRSS=2369 php=1 phpRSS=100 ap=20 tcp=25 topuser=evolution 2026-08-17 01:16:31 L1=0.72 run=2 blk=0 avail=6841 (58.3%) swpO=0 conn=1 myRSS=2369 php=1 phpRSS=90 ap=19 tcp=26 topuser=evolution 2026-08-17 01:16:31 L1=0.72 run=2 blk=0 avail=6832 (58.3%) swpO=0 conn=1 myRSS=2369 php=1 phpRSS=99 ap=19 tcp=26 topuser=evolution 2026-08-17 01:16:41 L1=0.76 run=2 blk=0 avail=6791 (57.9%) swpO=0 conn=1 myRSS=2369 php=1 phpRSS=153 ap=19 tcp=27 topuser=evolution 2026-08-17 01:16:41 L1=0.76 run=2 blk=0 avail=6780 (57.8%) swpO=0 conn=1 myRSS=2369 php=1 phpRSS=160 ap=19 tcp=27 topuser=evolution 2026-08-17 01:16:51 L1=1.92 run=21 blk=0 avail=5364 (45.7%) swpO=401 conn=14 myRSS=2370 php=14 phpRSS=1975 ap=35 tcp=51 topuser=madalice 2026-08-17 01:16:52 L1=1.92 run=20 blk=0 avail=5272 (45.0%) swpO=374 conn=13 myRSS=2369 php=16 phpRSS=1860 ap=34 tcp=74 topuser=madalice 2026-08-17 01:17:02 L1=7.03 run=34 blk=0 avail=2920 (24.9%) swpO=3603 conn=33 myRSS=2308 php=31 phpRSS=4883 ap=54 tcp=57 topuser=madalice 2026-08-17 01:17:08 L1=8.79 run=1 blk=1 avail=6814 (58.1%) swpO=2367 conn=2 myRSS=2306 php=1 phpRSS=87 ap=48 tcp=26 topuser=corpkicks 2026-08-17 01:17:12 L1=8.16 run=3 blk=0 avail=6651 (56.7%) swpO=410 conn=33 myRSS=2306 php=3 phpRSS=326 ap=44 tcp=29 topuser=corpkicks 2026-08-17 01:17:19 L1=7.59 run=24 blk=0 avail=4047 (34.5%) swpO=0 conn=20 myRSS=2306 php=19 phpRSS=3486 ap=41 tcp=46 topuser=madalice 2026-08-17 01:17:23 L1=8.58 run=23 blk=0 avail=6188 (52.8%) swpO=0 conn=33 myRSS=2306 php=14 phpRSS=1198 ap=39 tcp=41 topuser=madalice 2026-08-17 01:17:29 L1=10.69 run=34 blk=0 avail=4578 (39.0%) swpO=0 conn=25 myRSS=2306 php=25 phpRSS=3133 ap=42 tcp=61 topuser=madalice 2026-08-17 01:17:33 L1=10.69 run=33 blk=0 avail=3419 (29.2%) swpO=0 conn=29 myRSS=2306 php=28 phpRSS=4308 ap=50 tcp=55 topuser=madalice 2026-08-17 01:17:39 L1=12.20 run=30 blk=0 avail=2838 (24.2%) swpO=1239 conn=31 myRSS=2295 php=33 phpRSS=4937 ap=53 tcp=60 topuser=madalice 2026-08-17 01:17:43 L1=12.20 run=30 blk=0 avail=5288 (45.1%) swpO=1239 conn=13 myRSS=2295 php=12 phpRSS=1900 ap=49 tcp=44 topuser=madalice 2026-08-17 01:17:50 L1=13.47 run=26 blk=0 avail=3997 (34.1%) swpO=0 conn=24 myRSS=2295 php=24 phpRSS=3560 ap=49 tcp=56 topuser=madalice 2026-08-17 01:17:54 L1=13.47 run=43 blk=0 avail=2046 (17.4%) swpO=872 conn=35 myRSS=2276 php=36 phpRSS=5850 ap=57 tcp=67 topuser=madalice