INCIDENT 2026-08-19 22:08:53 trigger: php_rss=1750MB ================================================================== load: 1.45 1.19 1.00 12/665 3043611 ncpu:10 mem_avail: 4919MB/11729MB (41.9%) swap_used:2299MB swapout:269/s blocked(D):0 running:19 iowait:0.1% steal:0.0% php: 10 procs / 1750MB heaviest user: madalice (10 procs, 1750MB) apache: 31 procs tcp_estab: 51 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2834 madalice 8 1324 root 242 727 nobody 46 625 netdata 8 260 mailman 20 174 kurri 5 57 coscom 3 49 dovenull 6 26 evolution 6 23 wp-toolkit 6 17 named 1 15 zabbix 1 13 aaa 1 13 lowrange 1 11 alison 1 11 mailnull 1 7 nscd 1 6 dovecot 3 6 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 8 1335 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5302 MB Active(file): 3230 MB Inactive(file): 1453 MB Dirty: 172 MB Writeback: 0 MB SReclaimable: 409 MB CommitLimit: 9960 MB Committed_AS: 8374 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2064673 root 20:57:38 1940 /usr/bin/imunify-agent-proxy 3038954 root 08:52 1284 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2902604 11.0 Ssl 4-14:18:17 /usr/sbin/mariadbd 3043463 3042685 madalice 269952 73.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3043499 3043495 madalice 227488 101 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3043498 3043494 madalice 225916 102 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3043503 3043497 madalice 210624 93.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 207852 2.5 Ssl 51-11:58:59 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3043504 3043496 madalice 202932 94.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2122939 2112450 root 180244 0.0 S 19:30:25 spamd child 2661802 2112450 root 127644 0.0 S 08:54:38 spamd child 3043552 3043535 madalice 101340 65.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3043554 3043539 madalice 100920 63.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3043553 3043542 madalice 97080 59.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2112450 1 root 61668 0.0 Ss 19:45:21 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2223 1201 root 55748 0.0 Sl 51-11:58:58 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3042323 2111368 root 44264 0.7 SN 01:38 cpanellogd - waiting for child to process logs for coscom 3043488 3042323 coscom 42624 1.3 SN 00:03 cpanellogd - http logs for coscom 3043634 3043589 evolution 41044 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2575382 1 root 38408 0.0 Ss 4-14:18:20 /usr/lib/systemd/systemd-journald 1469 1 root 35424 0.1 Ss 51-11:58:58 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 35236 0.1 Sl 51-11:58:54 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3039822 1276780 nobody 22420 0.0 S 06:55 /usr/sbin/httpd -k start 3037148 1276780 nobody 21276 0.0 S 12:09 /usr/sbin/httpd -k start 3040158 1276780 nobody 20720 0.0 S 06:11 /usr/sbin/httpd -k start 3038316 1276780 nobody 20328 0.0 S 10:12 /usr/sbin/httpd -k start 3040164 1276780 nobody 19636 0.0 S 06:09 /usr/sbin/httpd -k start 3040159 1276780 nobody 19568 0.0 S 06:10 /usr/sbin/httpd -k start 3042436 1276780 nobody 19528 0.0 S 01:31 /usr/sbin/httpd -k start 3041031 1276780 nobody 19344 0.0 S 04:26 /usr/sbin/httpd -k start 3041187 1276780 nobody 19108 0.1 S 04:11 /usr/sbin/httpd -k start 3041439 1276780 nobody 18436 0.0 S 03:51 /usr/sbin/httpd -k start 1463 1 root 18332 0.0 Ss 51-11:58:58 tailwatchd 3043460 1276780 nobody 18104 0.3 S 00:03 /usr/sbin/httpd -k start 3043459 1276780 nobody 18036 0.3 S 00:03 /usr/sbin/httpd -k start 3042437 1276780 nobody 17804 0.0 S 01:30 /usr/sbin/httpd -k start 3042681 1276780 nobody 17500 0.0 S 01:00 /usr/sbin/httpd -k start 3042685 1276780 nobody 17068 0.0 S 00:59 /usr/sbin/httpd -k start 185104 2431 netdata 16668 2.1 Sl 7-01:35:17 /usr/libexec/netdata/plugins.d/apps.plugin 1 2111676 1 root 16292 0.0 Ss 19:45:51 lfd - sleeping 3043458 1276780 nobody 16260 0.0 S 00:04 /usr/sbin/httpd -k start 3043536 1276780 nobody 16216 0.0 S 00:01 /usr/sbin/httpd -k start 3043537 1276780 nobody 16216 0.0 S 00:01 /usr/sbin/httpd -k start 3043495 1276780 nobody 15960 0.0 S 00:02 /usr/sbin/httpd -k start 3043538 1276780 nobody 15948 0.0 S 00:01 /usr/sbin/httpd -k start 3043494 1276780 nobody 15916 0.0 S 00:02 /usr/sbin/httpd -k start 3043542 1276780 nobody 15916 0.0 S 00:01 /usr/sbin/httpd -k start 3043535 1276780 nobody 15904 0.0 S 00:01 /usr/sbin/httpd -k start 3043497 1276780 nobody 15884 0.0 S 00:02 /usr/sbin/httpd -k start 3043539 1276780 nobody 15860 0.0 S 00:01 /usr/sbin/httpd -k start 3043541 1276780 nobody 15852 0.0 S 00:01 /usr/sbin/httpd -k start 3043496 1276780 nobody 15836 0.0 S 00:02 /usr/sbin/httpd -k start 3043540 1276780 nobody 15788 0.0 S 00:01 /usr/sbin/httpd -k start 3043589 1276780 nobody 15728 0.0 S 00:00 /usr/sbin/httpd -k start 2107664 1 named 15564 0.0 Ssl 19:46:13 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1204 1 zabbix 14280 0.2 Ssl 51-11:58:59 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3036636 3828812 aaa 13384 0.0 S 13:25 dovecot/imap 3039524 3828812 lowrange 12224 0.0 S 07:47 dovecot/imap 3040310 3828812 alison 12208 0.0 S 05:50 dovecot/imap 3038886 3828812 kurri 11988 0.0 S 08:58 dovecot/imap 3031000 3828812 kurri 11984 0.0 S 21:51 dovecot/imap 3021382 3828812 kurri 11888 0.0 S 36:48 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 14490594 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 14490583 | madalice_wp | madalice_wp | Query | 0 | Sending data | SELECT option_value FROM AMuqf6qZ_options WHERE option_name LIKE 'wc_square_background_sync_job_%' AND ( option_value LIKE '%\"status\":\"queued\"%' OR option_value LIKE '%\"status\":\"processing\"%' ) ORDER BY option_id ASC LIMIT 1 | +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/evolutionerp.com.au 44 evolution/evolutionerp.com.au-ssl_log 36 evolution/portal.evolutionerp.com.au-ssl_log 12 madalice/madalice.com.au-ssl_log 2 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 72 20.228.229.148 12 203.54.180.238 2 216.24.219.223 1 45.132.227.73 1 216.24.219.228 1 202.153.211.134 1 172.98.32.122 1 136.144.42.87 1 136.144.42.82 1 118.127.40.55 1 104.234.19.112 --- top request paths across all vhosts (last 3 min) --- 12 GET /heartbeat.php 8 POST /wp-login.php 3 GET /xxx.php 2 POST /wp-admin/admin-ajax.php 2 GET /yanz.php 2 GET /xex.php 2 GET /xda.php 2 GET /wp-xx.php 2 GET /wp-slss.php 2 GET /wplogbak.php 2 GET /wp-conflg.php 2 GET /wp-block.php 2 GET /wander.php 2 GET /vxrl.php 2 GET /ups.php 2 GET /t.php 2 GET /sitemap.php 2 GET /sg.php 2 GET /p-blog.php 2 GET /noe.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/evolutionerp.com.au == -- top paths -- 1 GET /yanz.php 1 GET /xxx.php 1 GET //xxx.php 1 GET /xex.php 1 GET /xda.php 1 GET /wp-xx.php 1 GET /wp-slss.php 1 GET /wp.php 1 GET /wplogbak.php 1 GET /wp-links.php 1 GET /wp-includes/css/wp-conflg.php 1 GET /wp-content/uploads/2024/index.php -- last 10 requests -- 20.228.229.148 - - [19/Aug/2026:22:08:16 +1000] "GET /makeasmtp.php HTTP/1.1" 301 282 "-" "-" 20.228.229.148 - - [19/Aug/2026:22:08:18 +1000] "GET /config.php HTTP/1.1" 301 279 "-" "-" 20.228.229.148 - - [19/Aug/2026:22:08:19 +1000] "GET /shell20211028.php HTTP/1.1" 301 286 "-" "-" 20.228.229.148 - - [19/Aug/2026:22:08:21 +1000] "GET /wp-links.php HTTP/1.1" 301 281 "-" "-" 20.228.229.148 - - [19/Aug/2026:22:08:23 +1000] "GET /admin/function.php HTTP/1.1" 301 287 "-" "-" 20.228.229.148 - - [19/Aug/2026:22:08:25 +1000] "GET /wp-admin/images/wp-login.php HTTP/1.1" 301 297 "-" "-" 20.228.229.148 - - [19/Aug/2026:22:08:27 +1000] "GET /wp-content/themes/twenty/twenty.php HTTP/1.1" 301 304 "-" "-" 20.228.229.148 - - [19/Aug/2026:22:08:29 +1000] "GET /wp-content/plugins/seoplugins/mar.php HTTP/1.1" 301 306 "-" "-" 20.228.229.148 - - [19/Aug/2026:22:08:31 +1000] "GET /wp-content/uploads/2024/index.php HTTP/1.1" 301 302 "-" "-" 20.228.229.148 - - [19/Aug/2026:22:08:31 +1000] "GET /wp-content/config.php HTTP/1.1" 301 290 "-" "-" == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 8 POST /wp-login.php 2 GET /xxx.php 1 GET /yanz.php 1 GET /xex.php 1 GET /xda.php 1 GET /wp-xx.php 1 GET /wp-slss.php 1 GET /wplogbak.php 1 GET /wp-conflg.php 1 GET /wp-block.php 1 GET /wander.php 1 GET /w3lls.php -- last 10 requests -- 216.24.219.223 - - [19/Aug/2026:22:07:50 +1000] "POST /wp-login.php HTTP/1.1" 401 3456 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; rv:143.0) Gecko/20100101 Firefox/143.0" 104.234.19.112 - - [19/Aug/2026:22:07:50 +1000] "POST /wp-login.php HTTP/1.1" 401 3456 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; rv:143.0) Gecko/20100101 Firefox/143.0" 20.228.229.148 - - [19/Aug/2026:22:07:51 +1000] "GET /xxx.php HTTP/1.1" 404 123227 "-" "-" 20.228.229.148 - - [19/Aug/2026:22:07:53 +1000] "GET /noe.php HTTP/1.1" 404 123227 "-" "-" 20.228.229.148 - - [19/Aug/2026:22:07:55 +1000] "GET /xxx.php HTTP/1.1" 404 123227 "-" "-" 20.228.229.148 - - [19/Aug/2026:22:07:57 +1000] "GET /fe5.php HTTP/1.1" 404 123227 "-" "-" 20.228.229.148 - - [19/Aug/2026:22:07:59 +1000] "GET /xex.php HTTP/1.1" 404 123227 "-" "-" 20.228.229.148 - - [19/Aug/2026:22:08:00 +1000] "GET /vxrl.php HTTP/1.1" 404 123228 "-" "-" 20.228.229.148 - - [19/Aug/2026:22:08:02 +1000] "GET /wp-xx.php HTTP/1.1" 404 123229 "-" "-" 20.228.229.148 - - [19/Aug/2026:22:08:04 +1000] "GET /db.php HTTP/1.1" 404 123226 "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 12 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [19/Aug/2026:22:07:28 +1000] "GET /heartbeat.php?sentAt=1787141248&bytes=106,133,156,128&_=1787124376111 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:22:07:32 +1000] "GET /heartbeat.php?sentAt=1787141253&bytes=106,133,156,133&_=1787115830992 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:22:07:38 +1000] "GET /heartbeat.php?sentAt=1787141258&bytes=106,133,156,138&_=1787124376112 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:22:07:42 +1000] "GET /heartbeat.php?sentAt=1787141263&bytes=106,133,156,143&_=1787115830993 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:22:07:48 +1000] "GET /heartbeat.php?sentAt=1787141268&bytes=106,133,156,148&_=1787124376113 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:22:07:52 +1000] "GET /heartbeat.php?sentAt=1787141273&bytes=106,133,156,153&_=1787115830994 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:22:07:58 +1000] "GET /heartbeat.php?sentAt=1787141278&bytes=106,133,156,158&_=1787124376114 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:22:08:02 +1000] "GET /heartbeat.php?sentAt=1787141283&bytes=106,133,156,163&_=1787115830995 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:22:08:08 +1000] "GET /heartbeat.php?sentAt=1787141288&bytes=106,133,156,168&_=1787124376115 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:22:08:12 +1000] "GET /heartbeat.php?sentAt=1787141293&bytes=106,133,156,173&_=1787115830996 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 --- last 30 samples (run-up to this incident) --- 2026-08-19 22:06:32 L1=1.29 run=2 blk=0 avail=6276 (53.5%) swpO=0 conn=2 myRSS=2844 php=1 phpRSS=144 ap=20 tcp=26 topuser=evolution 2026-08-19 22:06:33 L1=1.29 run=2 blk=0 avail=6390 (54.5%) swpO=0 conn=1 myRSS=2844 php=1 phpRSS=39 ap=19 tcp=25 topuser=evolution 2026-08-19 22:06:42 L1=1.17 run=3 blk=0 avail=6338 (54.0%) swpO=0 conn=2 myRSS=2844 php=1 phpRSS=93 ap=17 tcp=25 topuser=corpkicks 2026-08-19 22:06:43 L1=1.17 run=3 blk=0 avail=6094 (52.0%) swpO=0 conn=1 myRSS=2844 php=4 phpRSS=425 ap=17 tcp=28 topuser=corpkicks 2026-08-19 22:06:52 L1=1.07 run=1 blk=0 avail=6397 (54.5%) swpO=0 conn=2 myRSS=2844 php=0 phpRSS=0 ap=17 tcp=24 topuser=- 2026-08-19 22:06:53 L1=1.07 run=2 blk=0 avail=6334 (54.0%) swpO=0 conn=1 myRSS=2844 php=2 phpRSS=122 ap=17 tcp=25 topuser=evolution 2026-08-19 22:07:02 L1=0.91 run=2 blk=0 avail=6369 (54.3%) swpO=0 conn=2 myRSS=2844 php=1 phpRSS=60 ap=17 tcp=24 topuser=evolution 2026-08-19 22:07:03 L1=0.91 run=1 blk=0 avail=6388 (54.5%) swpO=0 conn=2 myRSS=2844 php=1 phpRSS=39 ap=17 tcp=26 topuser=evolution 2026-08-19 22:07:12 L1=0.85 run=2 blk=0 avail=6293 (53.7%) swpO=0 conn=2 myRSS=2844 php=1 phpRSS=140 ap=17 tcp=25 topuser=evolution 2026-08-19 22:07:13 L1=0.85 run=1 blk=0 avail=6385 (54.4%) swpO=0 conn=2 myRSS=2844 php=1 phpRSS=39 ap=17 tcp=31 topuser=evolution 2026-08-19 22:07:22 L1=0.87 run=1 blk=0 avail=6432 (54.8%) swpO=0 conn=2 myRSS=2844 php=0 phpRSS=0 ap=18 tcp=33 topuser=- 2026-08-19 22:07:23 L1=0.87 run=5 blk=0 avail=5933 (50.6%) swpO=0 conn=2 myRSS=2844 php=7 phpRSS=703 ap=18 tcp=32 topuser=evolution 2026-08-19 22:07:32 L1=1.12 run=1 blk=0 avail=6406 (54.6%) swpO=0 conn=2 myRSS=2844 php=0 phpRSS=0 ap=23 tcp=25 topuser=- 2026-08-19 22:07:33 L1=1.12 run=2 blk=0 avail=6263 (53.4%) swpO=0 conn=2 myRSS=2844 php=2 phpRSS=205 ap=22 tcp=25 topuser=evolution 2026-08-19 22:07:42 L1=1.02 run=5 blk=0 avail=6198 (52.8%) swpO=0 conn=3 myRSS=2844 php=2 phpRSS=301 ap=17 tcp=27 topuser=madalice 2026-08-19 22:07:43 L1=1.02 run=2 blk=0 avail=6194 (52.8%) swpO=0 conn=2 myRSS=2844 php=2 phpRSS=299 ap=17 tcp=29 topuser=madalice 2026-08-19 22:07:52 L1=1.01 run=3 blk=0 avail=6187 (52.7%) swpO=0 conn=3 myRSS=2844 php=2 phpRSS=293 ap=17 tcp=30 topuser=evolution 2026-08-19 22:07:53 L1=1.01 run=6 blk=0 avail=5985 (51.0%) swpO=0 conn=2 myRSS=2844 php=3 phpRSS=283 ap=17 tcp=32 topuser=infinium 2026-08-19 22:08:02 L1=1.25 run=2 blk=1 avail=5731 (48.9%) swpO=67 conn=3 myRSS=2843 php=0 phpRSS=0 ap=18 tcp=25 topuser=- 2026-08-19 22:08:03 L1=1.25 run=4 blk=0 avail=5594 (47.7%) swpO=124 conn=3 myRSS=2842 php=2 phpRSS=182 ap=17 tcp=26 topuser=evolution 2026-08-19 22:08:12 L1=1.13 run=2 blk=0 avail=6387 (54.5%) swpO=248 conn=3 myRSS=2838 php=1 phpRSS=100 ap=17 tcp=24 topuser=evolution 2026-08-19 22:08:13 L1=1.13 run=1 blk=0 avail=6444 (54.9%) swpO=191 conn=3 myRSS=2838 php=1 phpRSS=39 ap=17 tcp=27 topuser=evolution 2026-08-19 22:08:22 L1=1.03 run=2 blk=0 avail=6336 (54.0%) swpO=0 conn=3 myRSS=2838 php=1 phpRSS=147 ap=17 tcp=25 topuser=evolution 2026-08-19 22:08:23 L1=1.03 run=1 blk=0 avail=6439 (54.9%) swpO=0 conn=3 myRSS=2838 php=1 phpRSS=39 ap=17 tcp=28 topuser=evolution 2026-08-19 22:08:32 L1=1.02 run=3 blk=0 avail=6312 (53.8%) swpO=0 conn=3 myRSS=2838 php=1 phpRSS=156 ap=17 tcp=23 topuser=evolution 2026-08-19 22:08:33 L1=1.02 run=3 blk=0 avail=6357 (54.2%) swpO=0 conn=3 myRSS=2838 php=2 phpRSS=150 ap=16 tcp=25 topuser=alison 2026-08-19 22:08:42 L1=1.25 run=1 blk=0 avail=6461 (55.1%) swpO=0 conn=1 myRSS=2838 php=0 phpRSS=0 ap=16 tcp=25 topuser=- 2026-08-19 22:08:43 L1=1.25 run=2 blk=0 avail=6359 (54.2%) swpO=0 conn=3 myRSS=2838 php=2 phpRSS=157 ap=16 tcp=27 topuser=evolution 2026-08-19 22:08:52 L1=1.45 run=10 blk=0 avail=5466 (46.6%) swpO=0 conn=1 myRSS=2838 php=8 phpRSS=1180 ap=23 tcp=45 topuser=madalice 2026-08-19 22:08:53 L1=1.45 run=19 blk=0 avail=4919 (41.9%) swpO=269 conn=9 myRSS=2834 php=10 phpRSS=1750 ap=31 tcp=51 topuser=madalice