INCIDENT 2026-08-21 16:34:53 trigger: php_rss=1509MB ================================================================== load: 8.34 4.68 2.56 12/640 968924 ncpu:10 mem_avail: 5125MB/11729MB (43.7%) swap_used:2914MB swapout:0/s blocked(D):0 running:11 iowait:0.2% steal:0.0% php: 9 procs / 1509MB heaviest user: madalice (9 procs, 1509MB) apache: 28 procs tcp_estab: 35 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2970 madalice 8 1283 root 241 876 nobody 27 472 netdata 8 244 cpanellogin 1 104 mailman 20 95 evolution 8 30 dovenull 6 25 wp-toolkit 6 20 zabbix 1 14 named 1 14 aaa 1 13 kamcool 1 11 kurri 1 10 nscd 1 7 dovecot 3 7 mailnull 1 5 cpanelconnecttrack 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 8 1074 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4584 MB Active(file): 3651 MB Inactive(file): 696 MB Dirty: 2 MB Writeback: 0 MB SReclaimable: 568 MB CommitLimit: 9960 MB Committed_AS: 7941 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 267385 root 15:23:37 5408 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 3041472 11.8 Ssl 6-08:44:18 /usr/sbin/mariadbd 1220 1 netdata 193620 2.5 Ssl 53-06:25:00 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 968879 968599 madalice 191264 72.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 968874 968588 madalice 190448 83.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 968877 965039 madalice 180608 66.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 968880 965046 madalice 179208 66.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 968881 966708 madalice 170164 101 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 319521 311538 root 160664 0.0 S 13:57:09 spamd child 853881 311538 root 153336 0.0 S 02:44:04 spamd child 968886 963511 madalice 131360 68.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 117724 0.0 Ss 6-08:44:21 /usr/lib/systemd/systemd-journald 950837 1353308 cpanellogin 107424 0.1 S 28:30 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 311538 1 root 96588 0.0 Ss 14:12:08 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 968893 963904 madalice 74668 66.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2223 1201 root 42928 0.0 Sl 53-06:24:59 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42292 0.0 Ss 30-13:53:30 cpsrvd (SSL) - waiting for connections 968953 966558 madalice 40784 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 968929 1469 root 37716 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1469 1 root 37668 0.1 Ss 53-06:24:59 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 31452 0.1 Sl 53-06:24:55 /usr/libexec/netdata/plugins.d/go.d.plugin 1 963511 1276780 nobody 22108 0.1 S 08:33 /usr/sbin/httpd -k start 963901 1276780 nobody 21924 0.0 S 07:58 /usr/sbin/httpd -k start 1463 1 root 21752 0.0 Ss 53-06:24:59 tailwatchd 310731 1 root 21704 0.0 Ss 14:12:40 lfd - sleeping 963904 1276780 nobody 21380 0.1 S 07:58 /usr/sbin/httpd -k start 965046 1276780 nobody 21224 0.2 S 05:51 /usr/sbin/httpd -k start 965105 1276780 nobody 21072 0.2 S 05:43 /usr/sbin/httpd -k start 965431 1276780 nobody 21016 0.2 S 05:04 /usr/sbin/httpd -k start 965039 1276780 nobody 20976 0.2 S 05:52 /usr/sbin/httpd -k start 965928 1276780 nobody 20928 0.0 S 04:31 /usr/sbin/httpd -k start 966708 1276780 nobody 20096 0.3 S 03:21 /usr/sbin/httpd -k start 965052 1276780 nobody 19664 0.0 S 05:51 /usr/sbin/httpd -k start 967169 1276780 nobody 19496 0.3 S 02:42 /usr/sbin/httpd -k start 966558 1276780 nobody 19440 0.3 S 03:33 /usr/sbin/httpd -k start 965938 1276780 nobody 19172 0.0 S 04:30 /usr/sbin/httpd -k start 968101 1276780 nobody 18656 0.0 S 01:16 /usr/sbin/httpd -k start 968588 1276780 nobody 18560 0.0 S 00:23 /usr/sbin/httpd -k start 968123 1276780 nobody 18100 0.0 S 01:12 /usr/sbin/httpd -k start 185104 2431 netdata 17852 2.1 Sl 8-20:01:18 /usr/libexec/netdata/plugins.d/apps.plugin 1 967778 1276780 nobody 17720 0.0 S 01:47 /usr/sbin/httpd -k start 967787 1276780 nobody 17564 0.0 S 01:46 /usr/sbin/httpd -k start 968599 1276780 nobody 17432 0.0 S 00:22 /usr/sbin/httpd -k start 967819 1276780 nobody 17384 0.2 S 01:43 /usr/sbin/httpd -k start 968149 1276780 nobody 17380 0.0 S 01:11 /usr/sbin/httpd -k start 968093 1276780 nobody 17148 0.0 S 01:17 /usr/sbin/httpd -k start 967786 1276780 nobody 17128 0.0 S 01:46 /usr/sbin/httpd -k start 967813 1276780 nobody 16904 0.0 S 01:44 /usr/sbin/httpd -k start 968600 1276780 nobody 16688 0.0 S 00:22 /usr/sbin/httpd -k start 1204 1 zabbix 15116 0.2 Ssl 53-06:25:00 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2107664 1 named 14472 0.0 Ssl 2-14:12:14 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 946022 3828812 aaa 13832 0.0 S 36:32 dovecot/imap 1471 1 root 13048 0.0 Ss 53-06:24:59 cPhulkd - processor 405204 1471 root 12960 0.0 S 11:23:43 cPhulkd - dbprocessor 1276780 1 root 12192 0.0 Ss 16-01:03:35 /usr/sbin/httpd -k start 968837 1471 root 12184 0.0 S 00:07 cPhulkd - processor - http socket 963402 3828812 kamcool 11720 0.0 S 08:48 dovecot/pop3 3668761 3828812 kurri 10828 0.0 S 1-06:20:39 dovecot/imap 2107879 1 root 9808 0.0 Ss 2-14:12:13 queueprocd - waiting up to 60s to process a task 918817 27524 root 9132 0.0 Ss 01:20:56 sshd: evolution [priv] 1059098 3828812 dovenull 8020 0.0 S 8-01:02:05 dovecot/imap-login --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 22882622 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 450 evolution/my.evolutionerp.com.au-ssl_log 99 bigdeals/bigdeals.com.au-ssl_log 39 evolution/portal.evolutionerp.com.au-ssl_log 30 corpkicks/corporatekicks.com.au-ssl_log 8 evolution/evolutionerp.com.au 5 evolution/evolutionerp.com.au-ssl_log 2 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 475 20.251.48.93 120 203.54.180.238 39 20.118.172.148 7 82.102.18.190 3 46.232.235.6 3 103.104.165.99 2 118.127.40.55 2 114.119.146.16 2 103.241.67.243 1 85.208.98.23 1 52.167.144.212 1 52.139.47.57 1 40.77.167.241 1 40.77.167.150 1 34.196.51.17 --- top request paths across all vhosts (last 3 min) --- 30 GET /heartbeat.php 29 POST /functions.php 21 GET /app/ajax.php 13 POST /quoteditsave.php 9 GET /zip.php 9 GET /yedliner.php 9 GET /version.php 9 GET /Uploading.php 9 GET /upgrade.php 9 GET /uni.php 9 GET /styles.php 9 GET /source.php 9 GET /simattacker.php 9 GET /RxR.php 9 GET /rc.php 9 GET /pegi.php 9 GET /oldd.php 9 GET /ng.php 9 GET /mri.php 9 GET /mc.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 9 GET /zip.php 9 GET /yedliner.php 9 GET /version.php 9 GET /Uploading.php 9 GET /upgrade.php 9 GET /uni.php 9 GET /styles.php 9 GET /source.php 9 GET /simattacker.php 9 GET /RxR.php 9 GET /rc.php 9 GET /pegi.php -- last 10 requests -- 20.251.48.93 - - [21/Aug/2026:16:34:48 +1000] "GET /000.php HTTP/1.1" 404 30622 "-" "-" 20.251.48.93 - - [21/Aug/2026:16:34:48 +1000] "GET /11.php?p= HTTP/1.1" 301 1 "-" "-" 20.251.48.93 - - [21/Aug/2026:16:34:48 +1000] "GET /wp-ws68.php HTTP/1.1" 404 30627 "-" "-" 20.251.48.93 - - [21/Aug/2026:16:34:49 +1000] "GET /000.php HTTP/1.1" 404 30623 "-" "-" 20.251.48.93 - - [21/Aug/2026:16:34:48 +1000] "GET /coffee.php HTTP/1.1" 404 30623 "-" "-" 20.251.48.93 - - [21/Aug/2026:16:34:49 +1000] "GET /coffee.php HTTP/1.1" 404 30623 "-" "-" 20.251.48.93 - - [21/Aug/2026:16:34:53 +1000] "GET /classwithtostring.php?p= HTTP/1.1" 403 13 "-" "-" 20.251.48.93 - - [21/Aug/2026:16:34:53 +1000] "GET /classwithtostring.php?p= HTTP/1.1" 403 13 "-" "-" 20.251.48.93 - - [21/Aug/2026:16:34:50 +1000] "GET /b9007d/ HTTP/1.1" 404 30625 "-" "-" 20.251.48.93 - - [21/Aug/2026:16:34:50 +1000] "GET /9b97ec/ HTTP/1.1" 404 30626 "-" "-" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 29 POST /functions.php 21 GET /app/ajax.php 13 POST /quoteditsave.php 9 GET /index.php 5 POST /plugins/csvexporter/plugin.php 5 POST /app/ajax/selectFilter.php 4 POST /itemModify.php 4 POST /app/ajax/selectFilterSingle.php 4 POST /app/ajax.php 4 GET /plugins/fensa/fensa-ajax.php 1 POST /print.php -- last 10 requests -- 203.54.180.238 - - [21/Aug/2026:16:33:38 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 22740 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78656§ionid=0" "Mozilla/5.0 (Windows NT 10.0; 203.54.180.238 - - [21/Aug/2026:16:33:40 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=activities&date=28-08-2026&company=cta" "Mozilla/5.0 (Windows NT 10.0; 203.54.180.238 - - [21/Aug/2026:16:33:44 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 285 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29270&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 103.104.165.99 - - [21/Aug/2026:16:33:44 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 281 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11921&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; 40.77.167.150 - - [21/Aug/2026:16:33:50 +1000] "GET /index.php?page=globalsearch&string=%E6%89%89%E4%B9%8B%E4%B9%A6%E6%BA%90%E7%A0%81%E6%88%96%E7%B1%BB%E4%BC%BC%E9%A1%B9%E7%9B%AE%E6%BA%90%E7%A0%81 HTTP/1.1" 200 5323 "-" 203.54.180.238 - - [21/Aug/2026:16:33:55 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78656§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 103.104.165.99 - - [21/Aug/2026:16:33:59 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 282 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11921&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [21/Aug/2026:16:34:07 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=dispatchedit&dispatchid=33862" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 203.54.180.238 - - [21/Aug/2026:16:34:16 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78656§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 203.54.180.238 - - [21/Aug/2026:16:34:20 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78645§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 2 GET /cong.php 1 GET /z60.php 1 GET /xv.php 1 GET /x56.php 1 GET /x50.php 1 GET /wsd.php 1 GET /wp-includes/images/wp-login.php 1 GET /w.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-admin/maint/about.php 1 GET /wp-admin/css/colors/blue/index.php 1 GET /tx1.php -- last 10 requests -- 20.118.172.148 - - [21/Aug/2026:16:34:41 +1000] "GET /click.php HTTP/1.1" 401 36 "-" "-" 20.118.172.148 - - [21/Aug/2026:16:34:41 +1000] "GET /install.php HTTP/1.1" 401 36 "-" "-" 20.118.172.148 - - [21/Aug/2026:16:34:41 +1000] "GET /lv.php HTTP/1.1" 401 36 "-" "-" 20.118.172.148 - - [21/Aug/2026:16:34:42 +1000] "GET /simple.php HTTP/1.1" 401 36 "-" "-" 20.118.172.148 - - [21/Aug/2026:16:34:42 +1000] "GET /css.php HTTP/1.1" 401 36 "-" "-" 20.118.172.148 - - [21/Aug/2026:16:34:42 +1000] "GET /cong.php HTTP/1.1" 401 36 "-" "-" 20.118.172.148 - - [21/Aug/2026:16:34:43 +1000] "GET /wp-includes/images/wp-login.php HTTP/1.1" 401 36 "-" "-" 20.118.172.148 - - [21/Aug/2026:16:34:43 +1000] "GET /cong.php HTTP/1.1" 401 36 "-" "-" 20.118.172.148 - - [21/Aug/2026:16:34:43 +1000] "GET /w.php HTTP/1.1" 401 36 "-" "-" 20.118.172.148 - - [21/Aug/2026:16:34:44 +1000] "GET /404.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-21 16:32:32 L1=5.25 run=9 blk=0 avail=5216 (44.5%) swpO=0 conn=7 myRSS=2970 php=8 phpRSS=1289 ap=32 tcp=53 topuser=madalice 2026-08-21 16:32:33 L1=5.25 run=12 blk=0 avail=5329 (45.4%) swpO=0 conn=6 myRSS=2970 php=9 phpRSS=1289 ap=32 tcp=48 topuser=madalice 2026-08-21 16:32:42 L1=5.53 run=7 blk=0 avail=5710 (48.7%) swpO=0 conn=7 myRSS=2970 php=7 phpRSS=835 ap=29 tcp=39 topuser=madalice 2026-08-21 16:32:43 L1=5.53 run=27 blk=0 avail=5512 (47.0%) swpO=0 conn=6 myRSS=2970 php=8 phpRSS=1091 ap=29 tcp=38 topuser=madalice 2026-08-21 16:32:52 L1=5.90 run=9 blk=0 avail=5279 (45.0%) swpO=0 conn=7 myRSS=2970 php=8 phpRSS=1335 ap=28 tcp=39 topuser=madalice 2026-08-21 16:32:53 L1=5.90 run=9 blk=0 avail=5530 (47.2%) swpO=0 conn=6 myRSS=2970 php=7 phpRSS=849 ap=28 tcp=34 topuser=madalice 2026-08-21 16:33:02 L1=6.37 run=9 blk=0 avail=5385 (45.9%) swpO=0 conn=9 myRSS=2970 php=8 phpRSS=1235 ap=27 tcp=32 topuser=madalice 2026-08-21 16:33:03 L1=6.37 run=9 blk=0 avail=5666 (48.3%) swpO=0 conn=6 myRSS=2970 php=7 phpRSS=923 ap=27 tcp=34 topuser=madalice 2026-08-21 16:33:12 L1=7.02 run=10 blk=0 avail=5269 (44.9%) swpO=1 conn=9 myRSS=2971 php=9 phpRSS=1083 ap=32 tcp=43 topuser=madalice 2026-08-21 16:33:13 L1=7.02 run=15 blk=0 avail=5248 (44.7%) swpO=1 conn=6 myRSS=2971 php=10 phpRSS=1237 ap=32 tcp=43 topuser=madalice 2026-08-21 16:33:22 L1=6.93 run=7 blk=0 avail=5705 (48.6%) swpO=0 conn=9 myRSS=2971 php=6 phpRSS=832 ap=27 tcp=30 topuser=madalice 2026-08-21 16:33:23 L1=6.93 run=9 blk=0 avail=5380 (45.9%) swpO=0 conn=8 myRSS=2971 php=8 phpRSS=1140 ap=27 tcp=30 topuser=madalice 2026-08-21 16:33:32 L1=6.95 run=19 blk=0 avail=5548 (47.3%) swpO=0 conn=9 myRSS=2971 php=9 phpRSS=1095 ap=26 tcp=32 topuser=madalice 2026-08-21 16:33:34 L1=6.95 run=9 blk=0 avail=5519 (47.1%) swpO=0 conn=8 myRSS=2971 php=7 phpRSS=1059 ap=26 tcp=29 topuser=madalice 2026-08-21 16:33:42 L1=7.11 run=12 blk=0 avail=5390 (46.0%) swpO=0 conn=9 myRSS=2971 php=9 phpRSS=1223 ap=32 tcp=33 topuser=madalice 2026-08-21 16:33:44 L1=7.11 run=12 blk=0 avail=5228 (44.6%) swpO=0 conn=8 myRSS=2971 php=9 phpRSS=1395 ap=34 tcp=35 topuser=madalice 2026-08-21 16:33:52 L1=7.17 run=11 blk=0 avail=5685 (48.5%) swpO=0 conn=9 myRSS=2971 php=6 phpRSS=832 ap=32 tcp=30 topuser=madalice 2026-08-21 16:33:54 L1=7.17 run=8 blk=0 avail=5608 (47.8%) swpO=0 conn=8 myRSS=2971 php=7 phpRSS=951 ap=31 tcp=30 topuser=madalice 2026-08-21 16:34:03 L1=7.22 run=10 blk=0 avail=5385 (45.9%) swpO=0 conn=10 myRSS=2971 php=9 phpRSS=1288 ap=26 tcp=29 topuser=madalice 2026-08-21 16:34:04 L1=7.22 run=10 blk=0 avail=5367 (45.8%) swpO=0 conn=8 myRSS=2971 php=8 phpRSS=1253 ap=26 tcp=30 topuser=madalice 2026-08-21 16:34:13 L1=7.34 run=11 blk=0 avail=5672 (48.4%) swpO=0 conn=10 myRSS=2971 php=8 phpRSS=923 ap=26 tcp=31 topuser=madalice 2026-08-21 16:34:14 L1=7.34 run=7 blk=0 avail=5558 (47.4%) swpO=0 conn=8 myRSS=2971 php=6 phpRSS=998 ap=26 tcp=29 topuser=madalice 2026-08-21 16:34:23 L1=7.06 run=12 blk=0 avail=5326 (45.4%) swpO=0 conn=10 myRSS=2971 php=8 phpRSS=1254 ap=25 tcp=31 topuser=madalice 2026-08-21 16:34:24 L1=7.06 run=12 blk=0 avail=5491 (46.8%) swpO=0 conn=7 myRSS=2971 php=8 phpRSS=1036 ap=25 tcp=30 topuser=madalice 2026-08-21 16:34:33 L1=7.29 run=11 blk=0 avail=5187 (44.2%) swpO=0 conn=10 myRSS=2971 php=8 phpRSS=1430 ap=28 tcp=35 topuser=madalice 2026-08-21 16:34:34 L1=7.29 run=7 blk=0 avail=5792 (49.4%) swpO=0 conn=7 myRSS=2971 php=6 phpRSS=746 ap=28 tcp=30 topuser=madalice 2026-08-21 16:34:43 L1=7.46 run=13 blk=0 avail=5150 (43.9%) swpO=27 conn=10 myRSS=2970 php=8 phpRSS=1449 ap=28 tcp=30 topuser=madalice 2026-08-21 16:34:44 L1=7.46 run=7 blk=0 avail=5727 (48.8%) swpO=27 conn=7 myRSS=2970 php=6 phpRSS=734 ap=28 tcp=30 topuser=madalice 2026-08-21 16:34:53 L1=8.34 run=11 blk=0 avail=5125 (43.7%) swpO=0 conn=9 myRSS=2970 php=9 phpRSS=1509 ap=28 tcp=35 topuser=madalice 2026-08-21 16:34:54 L1=8.34 run=20 blk=0 avail=4987 (42.5%) swpO=0 conn=9 myRSS=2970 php=10 phpRSS=1657 ap=28 tcp=34 topuser=madalice