INCIDENT 2026-08-19 21:05:26 trigger: php_rss=1697MB ================================================================== load: 1.22 0.64 0.79 10/624 3005217 ncpu:10 mem_avail: 4858MB/11729MB (41.4%) swap_used:2331MB swapout:63/s blocked(D):0 running:16 iowait:0.1% steal:0.0% php: 11 procs / 1697MB heaviest user: madalice (11 procs, 1697MB) apache: 21 procs tcp_estab: 33 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2838 madalice 8 1195 root 243 905 nobody 20 323 netdata 8 255 mailman 20 178 kurri 4 46 dovenull 6 26 evolution 6 23 cpanellogin 1 18 wp-toolkit 6 17 named 1 15 zabbix 1 14 mailnull 1 8 dovecot 3 6 nscd 1 5 cpanelconnecttrack 1 3 dbus 1 2 polkitd 1 1 rpc 1 0 --- php workers by user --- USER PROCS RSS_MB madalice 8 1204 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5004 MB Active(file): 3459 MB Inactive(file): 1015 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 395 MB CommitLimit: 9960 MB Committed_AS: 7991 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2064673 root 19:54:10 1940 /usr/bin/imunify-agent-proxy 3002744 root 05:25 2952 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2906280 11.1 Ssl 4-13:14:49 /usr/sbin/mariadbd 3005138 3002561 madalice 266388 73.6 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3005141 3001358 madalice 238088 69.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 209028 0.0 Ss 4-13:14:52 /usr/lib/systemd/systemd-journald 1220 1 netdata 204012 2.5 Ssl 51-10:55:31 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3005147 3005145 madalice 197716 85.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3005146 3005144 madalice 186140 81.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2122939 2112450 root 180520 0.0 S 18:26:57 spamd child 2661802 2112450 root 146984 0.0 S 07:51:10 spamd child 3005184 3005181 madalice 104536 67.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3005186 3005179 madalice 98268 68.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3005185 3005180 madalice 92768 58.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3005183 3005178 madalice 91548 52.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2112450 1 root 61788 0.0 Ss 18:41:53 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2223 1201 root 56720 0.0 Sl 51-10:55:30 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41716 0.0 Ss 28-18:24:01 cpsrvd (SSL) - waiting for connections 1469 1 root 36072 0.1 Ss 51-10:55:30 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 34672 0.1 Sl 51-10:55:26 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3000494 1276780 nobody 22208 0.0 S 09:28 /usr/sbin/httpd -k start 3002561 1276780 nobody 21264 0.0 S 05:55 /usr/sbin/httpd -k start 3001453 1276780 nobody 20704 0.0 S 08:03 /usr/sbin/httpd -k start 3001444 1276780 nobody 20512 0.0 S 08:03 /usr/sbin/httpd -k start 3001358 1276780 nobody 19416 0.0 S 08:08 /usr/sbin/httpd -k start 3001463 1276780 nobody 19156 0.0 S 08:02 /usr/sbin/httpd -k start 2999724 1353308 cpanellogin 18696 0.0 S 11:08 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 3003063 1276780 nobody 18380 0.0 S 04:57 /usr/sbin/httpd -k start 3004184 1276780 nobody 18244 0.0 S 02:17 /usr/sbin/httpd -k start 1463 1 root 18212 0.0 Ss 51-10:55:30 tailwatchd 3005137 1276780 nobody 18112 0.3 S 00:03 /usr/sbin/httpd -k start 3004126 1276780 nobody 17748 0.0 S 02:23 /usr/sbin/httpd -k start 3004328 1276780 nobody 17648 0.0 S 01:52 /usr/sbin/httpd -k start 3003981 1276780 nobody 17444 0.0 S 02:50 /usr/sbin/httpd -k start 185104 2431 netdata 16428 2.1 Sl 7-00:31:49 /usr/libexec/netdata/plugins.d/apps.plugin 1 2111676 1 root 16332 0.0 Ss 18:42:23 lfd - sleeping 3005144 1276780 nobody 15920 0.0 S 00:02 /usr/sbin/httpd -k start 3005145 1276780 nobody 15864 0.5 S 00:02 /usr/sbin/httpd -k start 3005178 1276780 nobody 15864 0.0 S 00:01 /usr/sbin/httpd -k start 3005181 1276780 nobody 15864 0.0 S 00:01 /usr/sbin/httpd -k start 3005180 1276780 nobody 15836 0.0 S 00:01 /usr/sbin/httpd -k start 3005179 1276780 nobody 15832 0.0 S 00:01 /usr/sbin/httpd -k start 2107664 1 named 15632 0.0 Ssl 18:42:45 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1204 1 zabbix 14644 0.2 Ssl 51-10:55:31 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2998444 3828812 kurri 11960 0.0 S 13:24 dovecot/imap 1471 1 root 11928 0.0 Ss 51-10:55:30 cPhulkd - processor 2986584 3828812 kurri 11884 0.0 S 33:15 dovecot/imap 3002554 3828812 kurri 11856 0.0 S 05:56 dovecot/imap 3002557 3828812 kurri 11684 0.0 S 05:56 dovecot/imap 2225566 1471 root 11396 0.0 S 15:35:50 cPhulkd - dbprocessor 2111825 2111790 mailman 11240 0.0 S 18:42:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 1276780 1 root 11208 0.0 Ss 14-05:34:06 /usr/sbin/httpd -k start 2111817 2111790 mailman 10948 0.0 S 18:42:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 3004883 3828812 root 10932 0.0 S 00:28 dovecot/auth -w 2111816 2111790 mailman 10648 0.0 S 18:42:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s 2111818 2111790 mailman 10584 0.0 S 18:42:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 2111823 2111790 mailman 10436 0.0 S 18:42:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 2107879 1 root 10352 0.0 Ss 18:42:44 queueprocd - waiting up to 60s to process a task 2111822 2111790 mailman 10284 0.0 S 18:42:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 2111819 2111790 mailman 10188 0.0 S 18:42:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 2111815 2111790 mailman 10004 0.0 S 18:42:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 2111820 2111790 mailman 9844 0.0 S 18:42:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 14445250 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min kurri/kurrimotorinn.com.au 132 infinium/infinium.net.au-ssl_log 41 evolution/portal.evolutionerp.com.au-ssl_log 18 evolution/my.evolutionerp.com.au-ssl_log 5 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 131 20.104.100.201 39 74.249.206.207 18 203.54.180.238 4 207.46.13.7 2 118.127.40.55 1 52.167.144.160 1 194.113.194.84 --- top request paths across all vhosts (last 3 min) --- 18 GET /heartbeat.php 5 GET /index.php 3 GET /admin.php 2 POST /wp-cron.php 2 GET /yup.php 2 GET /xiugai.php 2 GET /wp-ws68.php 2 GET /wp-temp.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /this_is_a_new_hello_world.php 2 GET /nope.php 2 GET /new.php 2 GET /domvf.php 2 GET /classwithtostring.php 2 GET /ccc.php 2 GET /adminner.php 2 GET /aaa.php 1 GET /zxz.php 1 GET /zero.php 1 GET /z43agz.php --- busiest 3 vhosts: top paths + last 10 requests --- == kurri/kurrimotorinn.com.au == -- top paths -- 2 GET /yup.php 2 GET /wp-temp.php 1 GET /zxz.php 1 GET /zero.php 1 GET /z43agz.php 1 GET /yawa.php 1 GET /xyn.php 1 GET /xwpg.php 1 GET /x1da.php 1 GET /ws77.php 1 GET /wpxml.php 1 GET /wp-the.php -- last 10 requests -- 20.104.100.201 - - [19/Aug/2026:21:03:53 +1000] "GET /xwpg.php HTTP/1.1" 404 - "-" "-" 20.104.100.201 - - [19/Aug/2026:21:03:54 +1000] "GET /dex.php HTTP/1.1" 404 - "-" "-" 20.104.100.201 - - [19/Aug/2026:21:03:54 +1000] "GET /xyn.php HTTP/1.1" 404 - "-" "-" 20.104.100.201 - - [19/Aug/2026:21:03:54 +1000] "GET //wp-admin/js/index.php HTTP/1.1" 404 - "-" "-" 20.104.100.201 - - [19/Aug/2026:21:03:54 +1000] "GET /wp-good.php HTTP/1.1" 404 - "-" "-" 20.104.100.201 - - [19/Aug/2026:21:03:54 +1000] "GET /wmore1.php HTTP/1.1" 404 - "-" "-" 20.104.100.201 - - [19/Aug/2026:21:03:55 +1000] "GET //special.php HTTP/1.1" 404 - "-" "-" 20.104.100.201 - - [19/Aug/2026:21:03:55 +1000] "GET /wp-content/themes/index.php HTTP/1.1" 404 - "-" "-" 20.104.100.201 - - [19/Aug/2026:21:03:55 +1000] "GET /thoms.php HTTP/1.1" 404 - "-" "-" 20.104.100.201 - - [19/Aug/2026:21:03:55 +1000] "GET /wp-includes/Text/Diff/Engine/about.php HTTP/1.1" 404 - "-" "-" == infinium/infinium.net.au-ssl_log == -- top paths -- 3 GET /admin.php 2 POST /wp-cron.php 2 GET /xiugai.php 2 GET /wp-ws68.php 2 GET /nope.php 2 GET /new.php 2 GET /ccc.php 2 GET /aaa.php 1 GET /yj09.php 1 GET /wp-manager.php 1 GET /wp-load.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php -- last 10 requests -- 74.249.206.207 - - [19/Aug/2026:21:03:36 +1000] "GET /ccc.php?p= HTTP/1.1" 301 - "-" "-" 74.249.206.207 - - [19/Aug/2026:21:03:37 +1000] "GET /ccc.php HTTP/1.1" 404 67076 "-" "-" 74.249.206.207 - - [19/Aug/2026:21:03:38 +1000] "GET /admin.php?p= HTTP/1.1" 301 - "-" "-" 74.249.206.207 - - [19/Aug/2026:21:03:39 +1000] "GET /admin.php HTTP/1.1" 404 67076 "-" "-" 74.249.206.207 - - [19/Aug/2026:21:03:40 +1000] "GET /reviall.php HTTP/1.1" 404 67076 "-" "-" 74.249.206.207 - - [19/Aug/2026:21:03:42 +1000] "GET /nope.php?d= HTTP/1.1" 404 67076 "-" "-" 74.249.206.207 - - [19/Aug/2026:21:03:43 +1000] "GET /nope.php HTTP/1.1" 404 67076 "-" "-" 74.249.206.207 - - [19/Aug/2026:21:03:44 +1000] "GET /new.php HTTP/1.1" 403 13 "-" "-" 74.249.206.207 - - [19/Aug/2026:21:03:45 +1000] "GET /new.php HTTP/1.1" 403 13 "-" "-" 74.249.206.207 - - [19/Aug/2026:21:03:45 +1000] "GET /hp2.php HTTP/1.1" 404 67076 "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 18 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [19/Aug/2026:21:03:42 +1000] "GET /heartbeat.php?sentAt=1787137423&bytes=106,133,141,143&_=1787115830609 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:21:03:48 +1000] "GET /heartbeat.php?sentAt=1787137428&bytes=106,133,141,148&_=1787124375729 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:21:03:52 +1000] "GET /heartbeat.php?sentAt=1787137433&bytes=106,133,141,153&_=1787115830610 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:21:03:58 +1000] "GET /heartbeat.php?sentAt=1787137438&bytes=106,133,141,158&_=1787124375730 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:21:04:02 +1000] "GET /heartbeat.php?sentAt=1787137443&bytes=106,133,141,163&_=1787115830611 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:21:04:08 +1000] "GET /heartbeat.php?sentAt=1787137448&bytes=106,133,141,168&_=1787124375731 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:21:04:12 +1000] "GET /heartbeat.php?sentAt=1787137453&bytes=106,133,141,173&_=1787115830612 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:21:04:18 +1000] "GET /heartbeat.php?sentAt=1787137458&bytes=106,133,141,178&_=1787124375732 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:21:04:22 +1000] "GET /heartbeat.php?sentAt=1787137463&bytes=106,133,141,183&_=1787115830613 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:21:04:28 +1000] "GET /heartbeat.php?sentAt=1787137468&bytes=106,133,141,188&_=1787124375733 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 --- last 30 samples (run-up to this incident) --- 2026-08-19 21:03:04 L1=0.07 run=5 blk=0 avail=6461 (55.1%) swpO=0 conn=1 myRSS=2840 php=1 phpRSS=70 ap=16 tcp=19 topuser=infinium 2026-08-19 21:03:05 L1=0.07 run=2 blk=0 avail=6440 (54.9%) swpO=0 conn=1 myRSS=2840 php=1 phpRSS=93 ap=16 tcp=19 topuser=corpkicks 2026-08-19 21:03:14 L1=0.21 run=2 blk=0 avail=6431 (54.8%) swpO=0 conn=1 myRSS=2840 php=1 phpRSS=97 ap=17 tcp=17 topuser=infinium 2026-08-19 21:03:15 L1=0.21 run=1 blk=0 avail=6498 (55.4%) swpO=0 conn=1 myRSS=2840 php=0 phpRSS=0 ap=17 tcp=17 topuser=- 2026-08-19 21:03:24 L1=0.25 run=2 blk=0 avail=6501 (55.4%) swpO=0 conn=1 myRSS=2840 php=0 phpRSS=0 ap=17 tcp=18 topuser=- 2026-08-19 21:03:25 L1=0.25 run=2 blk=0 avail=6442 (54.9%) swpO=0 conn=1 myRSS=2840 php=1 phpRSS=88 ap=17 tcp=18 topuser=infinium 2026-08-19 21:03:34 L1=0.29 run=2 blk=0 avail=6497 (55.4%) swpO=0 conn=1 myRSS=2840 php=1 phpRSS=35 ap=18 tcp=19 topuser=infinium 2026-08-19 21:03:35 L1=0.29 run=1 blk=0 avail=6500 (55.4%) swpO=0 conn=1 myRSS=2840 php=0 phpRSS=0 ap=18 tcp=21 topuser=- 2026-08-19 21:03:44 L1=0.24 run=2 blk=0 avail=6309 (53.8%) swpO=2 conn=1 myRSS=2840 php=1 phpRSS=230 ap=19 tcp=25 topuser=corpkicks 2026-08-19 21:03:45 L1=0.24 run=3 blk=0 avail=6437 (54.9%) swpO=2 conn=2 myRSS=2840 php=1 phpRSS=87 ap=20 tcp=26 topuser=infinium 2026-08-19 21:03:54 L1=0.35 run=2 blk=0 avail=6300 (53.7%) swpO=0 conn=1 myRSS=2840 php=2 phpRSS=251 ap=19 tcp=24 topuser=evolution 2026-08-19 21:03:55 L1=0.32 run=1 blk=0 avail=6492 (55.4%) swpO=0 conn=2 myRSS=2840 php=0 phpRSS=0 ap=19 tcp=21 topuser=- 2026-08-19 21:04:04 L1=0.30 run=1 blk=0 avail=6510 (55.5%) swpO=0 conn=1 myRSS=2840 php=0 phpRSS=0 ap=16 tcp=16 topuser=- 2026-08-19 21:04:05 L1=0.27 run=1 blk=0 avail=6509 (55.5%) swpO=0 conn=2 myRSS=2840 php=0 phpRSS=0 ap=16 tcp=16 topuser=- 2026-08-19 21:04:14 L1=0.25 run=1 blk=0 avail=6532 (55.7%) swpO=0 conn=1 myRSS=2840 php=0 phpRSS=0 ap=14 tcp=14 topuser=- 2026-08-19 21:04:15 L1=0.31 run=2 blk=0 avail=6495 (55.4%) swpO=0 conn=2 myRSS=2840 php=1 phpRSS=67 ap=14 tcp=15 topuser=alison 2026-08-19 21:04:24 L1=0.29 run=1 blk=0 avail=6526 (55.6%) swpO=0 conn=1 myRSS=2840 php=0 phpRSS=0 ap=14 tcp=19 topuser=- 2026-08-19 21:04:25 L1=0.26 run=1 blk=0 avail=6524 (55.6%) swpO=0 conn=2 myRSS=2840 php=0 phpRSS=0 ap=14 tcp=19 topuser=- 2026-08-19 21:04:34 L1=0.24 run=1 blk=0 avail=6527 (55.7%) swpO=0 conn=1 myRSS=2840 php=0 phpRSS=0 ap=14 tcp=18 topuser=- 2026-08-19 21:04:35 L1=0.22 run=1 blk=0 avail=6527 (55.6%) swpO=0 conn=2 myRSS=2840 php=0 phpRSS=0 ap=14 tcp=18 topuser=- 2026-08-19 21:04:44 L1=0.20 run=1 blk=0 avail=6530 (55.7%) swpO=0 conn=1 myRSS=2840 php=0 phpRSS=0 ap=14 tcp=18 topuser=- 2026-08-19 21:04:45 L1=0.19 run=1 blk=0 avail=6529 (55.7%) swpO=0 conn=1 myRSS=2840 php=0 phpRSS=0 ap=14 tcp=18 topuser=- 2026-08-19 21:04:54 L1=0.17 run=1 blk=0 avail=6529 (55.7%) swpO=0 conn=1 myRSS=2840 php=0 phpRSS=0 ap=14 tcp=16 topuser=- 2026-08-19 21:04:55 L1=0.16 run=1 blk=0 avail=6528 (55.7%) swpO=0 conn=1 myRSS=2840 php=0 phpRSS=0 ap=14 tcp=16 topuser=- 2026-08-19 21:05:04 L1=0.14 run=2 blk=0 avail=6326 (53.9%) swpO=0 conn=1 myRSS=2840 php=1 phpRSS=227 ap=14 tcp=20 topuser=corpkicks 2026-08-19 21:05:05 L1=0.13 run=1 blk=0 avail=6522 (55.6%) swpO=0 conn=1 myRSS=2840 php=0 phpRSS=0 ap=14 tcp=20 topuser=- 2026-08-19 21:05:15 L1=0.12 run=1 blk=0 avail=6521 (55.6%) swpO=0 conn=1 myRSS=2840 php=0 phpRSS=0 ap=14 tcp=19 topuser=- 2026-08-19 21:05:16 L1=0.11 run=1 blk=0 avail=6521 (55.6%) swpO=0 conn=1 myRSS=2840 php=0 phpRSS=0 ap=14 tcp=18 topuser=- 2026-08-19 21:05:25 L1=0.10 run=11 blk=0 avail=5553 (47.3%) swpO=0 conn=9 myRSS=2840 php=8 phpRSS=1203 ap=17 tcp=31 topuser=madalice 2026-08-19 21:05:26 L1=1.22 run=16 blk=0 avail=4858 (41.4%) swpO=63 conn=9 myRSS=2838 php=11 phpRSS=1697 ap=21 tcp=33 topuser=madalice