INCIDENT 2026-08-21 22:33:03 trigger: php_rss=1507MB ================================================================== load: 4.37 1.95 1.61 13/682 1201201 ncpu:10 mem_avail: 5520MB/11729MB (47.1%) swap_used:3588MB swapout:0/s blocked(D):0 running:17 iowait:0.7% steal:0.0% php: 10 procs / 1507MB heaviest user: madalice (10 procs, 1507MB) apache: 68 procs tcp_estab: 46 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2509 madalice 10 1650 nobody 67 1104 root 241 680 netdata 8 247 mailman 20 93 cpanellogin 1 77 evolution 8 28 dovenull 6 25 kurri 2 22 wp-toolkit 6 17 zabbix 1 15 alison 1 11 named 1 10 nscd 1 7 dovecot 3 7 mailnull 1 5 cpanelconnecttrack 1 3 dbus 1 2 polkitd 1 1 --- php workers by user --- USER PROCS RSS_MB madalice 10 1670 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5070 MB Active(file): 2175 MB Inactive(file): 2065 MB Dirty: 3 MB Writeback: 0 MB SReclaimable: 419 MB CommitLimit: 9960 MB Committed_AS: 9052 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 267385 root 21:21:47 2264 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2569864 11.4 Ssl 6-14:42:28 /usr/sbin/mariadbd 1201132 1200801 madalice 247140 72.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1201135 1198609 madalice 214512 66.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1201136 1200765 madalice 203516 65.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1201140 1200832 madalice 202764 61.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 191568 2.5 Ssl 53-12:23:10 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1201139 1200828 madalice 179816 55.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 319521 311538 root 179740 0.0 S 19:55:19 spamd child 1201148 1201035 madalice 179232 83.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1201134 1201045 madalice 177476 56.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1201169 1200836 madalice 97896 60.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1201170 1200965 madalice 90568 58.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 311538 1 root 88624 0.0 Ss 20:10:18 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 853881 311538 root 88212 0.0 S 08:42:14 spamd child 1147543 1353308 cpanellogin 79036 0.0 S 01:00:33 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 2575382 1 root 44052 0.0 Ss 6-14:42:31 /usr/lib/systemd/systemd-journald 2223 1201 root 40920 0.0 Sl 53-12:23:09 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 38324 0.0 Ss 30-19:51:40 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 37388 0.1 Sl 53-12:23:05 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 25508 0.1 Ss 53-12:23:09 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1198139 1276780 nobody 21856 0.0 S 05:21 /usr/sbin/httpd -k start 1198115 1276780 nobody 21768 0.0 S 05:22 /usr/sbin/httpd -k start 1198082 1276780 nobody 21572 0.0 S 05:25 /usr/sbin/httpd -k start 1198609 1276780 nobody 21012 0.2 S 04:13 /usr/sbin/httpd -k start 1198087 1276780 nobody 20940 0.0 S 05:23 /usr/sbin/httpd -k start 1198177 1276780 nobody 20844 0.0 S 05:17 /usr/sbin/httpd -k start 1198179 1276780 nobody 20600 0.0 S 05:17 /usr/sbin/httpd -k start 310731 1 root 20316 0.0 Ss 20:10:50 lfd - sleeping 1193465 1276780 nobody 20292 0.0 S 12:29 /usr/sbin/httpd -k start 1200766 1276780 nobody 20240 0.1 S 00:19 /usr/sbin/httpd -k start 1198089 1276780 nobody 20144 0.0 S 05:23 /usr/sbin/httpd -k start 1200795 1276780 nobody 19012 0.0 S 00:18 /usr/sbin/httpd -k start 1200827 1276780 nobody 18972 0.1 S 00:17 /usr/sbin/httpd -k start 1200841 1276780 nobody 18972 0.1 S 00:17 /usr/sbin/httpd -k start 1200802 1276780 nobody 18960 0.3 S 00:18 /usr/sbin/httpd -k start 1200830 1276780 nobody 18944 0.1 S 00:17 /usr/sbin/httpd -k start 1200829 1276780 nobody 18936 0.2 S 00:17 /usr/sbin/httpd -k start 1200801 1276780 nobody 18876 0.2 S 00:18 /usr/sbin/httpd -k start 1200836 1276780 nobody 18808 0.0 S 00:17 /usr/sbin/httpd -k start 1201036 1276780 nobody 18788 0.1 S 00:09 /usr/sbin/httpd -k start 1199405 1276780 nobody 18416 0.0 S 03:01 /usr/sbin/httpd -k start 1200796 1276780 nobody 18320 0.0 S 00:18 /usr/sbin/httpd -k start 1199404 1276780 nobody 18272 0.0 S 03:01 /usr/sbin/httpd -k start 1200725 1276780 nobody 18176 0.0 S 00:20 /usr/sbin/httpd -k start 1200909 1276780 nobody 18164 0.0 S 00:13 /usr/sbin/httpd -k start 1200938 1276780 nobody 18164 0.0 S 00:12 /usr/sbin/httpd -k start 1201044 1276780 nobody 18116 0.2 S 00:09 /usr/sbin/httpd -k start 1201008 1276780 nobody 18004 0.0 S 00:10 /usr/sbin/httpd -k start 1200834 1276780 nobody 17976 0.1 S 00:17 /usr/sbin/httpd -k start 1200832 1276780 nobody 17964 0.0 S 00:17 /usr/sbin/httpd -k start 1200962 1276780 nobody 17936 0.0 S 00:11 /usr/sbin/httpd -k start 1200963 1276780 nobody 17936 0.0 S 00:11 /usr/sbin/httpd -k start 1201045 1276780 nobody 17904 0.2 S 00:09 /usr/sbin/httpd -k start 1201009 1276780 nobody 17876 0.0 S 00:10 /usr/sbin/httpd -k start 1200828 1276780 nobody 17872 0.0 S 00:17 /usr/sbin/httpd -k start 1200833 1276780 nobody 17868 0.1 S 00:17 /usr/sbin/httpd -k start 1200831 1276780 nobody 17844 0.1 S 00:17 /usr/sbin/httpd -k start 1200964 1276780 nobody 17748 0.0 S 00:11 /usr/sbin/httpd -k start 1200157 1276780 nobody 17740 0.0 S 01:33 /usr/sbin/httpd -k start 1463 1 root 17720 0.0 Ss 53-12:23:09 tailwatchd --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 22974235 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 232 otter2/otterfencing.net.au-ssl_log 98 alison/testing.alisonarts.com.au-ssl_log 44 alison/testing.alisonarts.com.au 43 evolution/portal.evolutionerp.com.au-ssl_log 19 alison/alisonarts.com.au-ssl_log 5 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 180 34.132.192.156 98 74.248.133.44 87 172.191.149.99 45 20.63.64.130 19 203.54.180.238 3 216.244.66.240 2 114.119.137.101 1 66.249.77.34 1 47.128.32.222 1 121.29.51.109 1 121.229.156.24 1 114.119.159.70 1 114.119.143.14 1 114.119.143.104 --- top request paths across all vhosts (last 3 min) --- 19 GET /heartbeat.php 8 GET / 5 GET /store/diamond-bling-laces/ 3 GET /wp-content/options.php 3 GET /wp-admin/ 3 GET /ab.php 2 POST /graphql 2 POST /api/graphql 2 GET /Zoo.php 2 GET /zoko.php 2 GET /xwx1.php 2 GET /xrp.php 2 GET /xr.php 2 GET /xp.php 2 GET /xmlrpc.php 2 GET /xingkong/index.php 2 GET /xex.php 2 GET /xd.php 2 GET /wyzer1.php 2 GET /wtiiy.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 6 GET / 5 GET /store/diamond-bling-laces/ 2 POST /graphql 2 POST /api/graphql 2 GET /wp-json 2 GET /wp-admin/ 2 GET /rclone.conf 2 GET /.gitlab-ci.yml 2 GET /.github/workflows/deploy.yml 2 GET /.git/HEAD 2 GET /.git-credentials 2 GET /.gitconfig -- last 10 requests -- 34.132.192.156 - - [21/Aug/2026:22:33:01 +1000] "GET /config/.env HTTP/1.1" 403 12 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.132.192.156 - - [21/Aug/2026:22:32:58 +1000] "GET /account HTTP/1.1" 404 30635 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.132.192.156 - - [21/Aug/2026:22:32:59 +1000] "GET /settings HTTP/1.1" 404 30631 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.132.192.156 - - [21/Aug/2026:22:32:59 +1000] "GET /wp-login.php HTTP/1.1" 200 4024 "https://mail.madalice.com.au/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobil 34.132.192.156 - - [21/Aug/2026:22:32:58 +1000] "GET /wp-admin/ HTTP/1.1" 302 1 "https://mail.madalice.com.au/admin" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safa 34.132.192.156 - - [21/Aug/2026:22:32:59 +1000] "GET /my HTTP/1.1" 404 30616 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.132.192.156 - - [21/Aug/2026:22:32:59 +1000] "GET /wp-admin/ HTTP/1.1" 302 1 "https://mail.madalice.com.au/dashboard" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile 34.132.192.156 - - [21/Aug/2026:22:32:59 +1000] "GET /workspace HTTP/1.1" 404 30620 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.132.192.156 - - [21/Aug/2026:22:32:59 +1000] "GET /user/login HTTP/1.1" 404 30625 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.132.192.156 - - [21/Aug/2026:22:32:59 +1000] "GET /profile HTTP/1.1" 404 30616 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" == otter2/otterfencing.net.au-ssl_log == -- top paths -- 1 GET /zup.php73 1 GET /x.php 1 GET /xleet.php 1 GET /ww5.php 1 GET /wso.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-includes/Requests/library/index.php 1 GET /wp-includes/fonts/index.php -- last 10 requests -- 74.248.133.44 - - [21/Aug/2026:22:33:00 +1000] "GET /k.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [21/Aug/2026:22:33:00 +1000] "GET /wp-blink.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [21/Aug/2026:22:33:01 +1000] "GET /randkeyword.PhP7 HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [21/Aug/2026:22:33:01 +1000] "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [21/Aug/2026:22:33:01 +1000] "GET /wp-content/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [21/Aug/2026:22:33:02 +1000] "GET /ww5.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [21/Aug/2026:22:33:02 +1000] "GET /2.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [21/Aug/2026:22:33:02 +1000] "GET /wp-admin/classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [21/Aug/2026:22:33:03 +1000] "GET /atomlib.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [21/Aug/2026:22:33:03 +1000] "GET /rip.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == alison/testing.alisonarts.com.au-ssl_log == -- top paths -- 1 GET /Zoo.php 1 GET /zoko.php 1 GET /xwx1.php 1 GET /xrp.php 1 GET /xr.php 1 GET /xp.php 1 GET /xmlrpc.php 1 GET /xingkong/index.php 1 GET /xex.php 1 GET /xd.php 1 GET /wyzer1.php 1 GET /wtiiy.php -- last 10 requests -- 172.191.149.99 - - [21/Aug/2026:22:31:34 +1000] "GET /xrp.php HTTP/1.1" 404 - "-" "-" 172.191.149.99 - - [21/Aug/2026:22:31:34 +1000] "GET /wp-content/radio.php HTTP/1.1" 404 - "-" "-" 172.191.149.99 - - [21/Aug/2026:22:31:34 +1000] "GET /Zoo.php HTTP/1.1" 404 - "-" "-" 172.191.149.99 - - [21/Aug/2026:22:31:35 +1000] "GET /wp-sing.php HTTP/1.1" 404 - "-" "-" 172.191.149.99 - - [21/Aug/2026:22:31:35 +1000] "GET /wp-content/1.php HTTP/1.1" 404 - "-" "-" 172.191.149.99 - - [21/Aug/2026:22:31:36 +1000] "GET /wp-content/plugin.php HTTP/1.1" 404 - "-" "-" 172.191.149.99 - - [21/Aug/2026:22:31:36 +1000] "GET /vct.php HTTP/1.1" 404 - "-" "-" 172.191.149.99 - - [21/Aug/2026:22:31:36 +1000] "GET /wp-content/w.php HTTP/1.1" 404 - "-" "-" 172.191.149.99 - - [21/Aug/2026:22:31:37 +1000] "GET /wper3.php HTTP/1.1" 404 - "-" "-" 172.191.149.99 - - [21/Aug/2026:22:31:37 +1000] "GET /likesample.php HTTP/1.1" 404 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-21 22:30:34 L1=0.72 run=3 blk=0 avail=6843 (58.3%) swpO=0 conn=1 myRSS=2531 php=1 phpRSS=167 ap=15 tcp=18 topuser=madalice 2026-08-21 22:30:42 L1=0.84 run=2 blk=0 avail=6850 (58.4%) swpO=0 conn=4 myRSS=2531 php=1 phpRSS=161 ap=15 tcp=20 topuser=madalice 2026-08-21 22:30:44 L1=0.84 run=2 blk=0 avail=6912 (58.9%) swpO=0 conn=1 myRSS=2531 php=1 phpRSS=98 ap=15 tcp=18 topuser=madalice 2026-08-21 22:30:52 L1=0.87 run=2 blk=0 avail=6882 (58.7%) swpO=0 conn=4 myRSS=2531 php=1 phpRSS=126 ap=15 tcp=21 topuser=madalice 2026-08-21 22:30:54 L1=0.87 run=2 blk=0 avail=6938 (59.2%) swpO=0 conn=2 myRSS=2531 php=1 phpRSS=69 ap=15 tcp=21 topuser=madalice 2026-08-21 22:31:02 L1=0.97 run=3 blk=0 avail=6912 (58.9%) swpO=1 conn=4 myRSS=2531 php=3 phpRSS=162 ap=15 tcp=27 topuser=aaa 2026-08-21 22:31:04 L1=0.97 run=3 blk=0 avail=6719 (57.3%) swpO=1 conn=2 myRSS=2531 php=1 phpRSS=226 ap=15 tcp=23 topuser=madalice 2026-08-21 22:31:12 L1=0.90 run=4 blk=0 avail=6574 (56.0%) swpO=2 conn=4 myRSS=2531 php=3 phpRSS=503 ap=15 tcp=24 topuser=corpkicks 2026-08-21 22:31:14 L1=0.90 run=2 blk=0 avail=6875 (58.6%) swpO=2 conn=2 myRSS=2531 php=1 phpRSS=135 ap=15 tcp=17 topuser=madalice 2026-08-21 22:31:22 L1=0.91 run=3 blk=0 avail=6879 (58.6%) swpO=0 conn=4 myRSS=2531 php=1 phpRSS=132 ap=15 tcp=23 topuser=madalice 2026-08-21 22:31:24 L1=0.91 run=3 blk=0 avail=6940 (59.2%) swpO=0 conn=2 myRSS=2531 php=1 phpRSS=71 ap=15 tcp=21 topuser=madalice 2026-08-21 22:31:32 L1=1.01 run=2 blk=0 avail=6942 (59.2%) swpO=0 conn=4 myRSS=2531 php=1 phpRSS=66 ap=16 tcp=23 topuser=madalice 2026-08-21 22:31:34 L1=1.01 run=2 blk=0 avail=6969 (59.4%) swpO=0 conn=2 myRSS=2531 php=0 phpRSS=0 ap=16 tcp=22 topuser=- 2026-08-21 22:31:42 L1=0.93 run=3 blk=0 avail=6763 (57.7%) swpO=0 conn=4 myRSS=2531 php=2 phpRSS=314 ap=16 tcp=26 topuser=madalice 2026-08-21 22:31:44 L1=0.93 run=4 blk=0 avail=6817 (58.1%) swpO=0 conn=2 myRSS=2531 php=2 phpRSS=260 ap=16 tcp=22 topuser=madalice 2026-08-21 22:31:52 L1=1.02 run=2 blk=0 avail=6920 (59.0%) swpO=0 conn=4 myRSS=2531 php=1 phpRSS=129 ap=16 tcp=24 topuser=madalice 2026-08-21 22:31:54 L1=1.02 run=4 blk=0 avail=6973 (59.5%) swpO=0 conn=2 myRSS=2531 php=2 phpRSS=103 ap=16 tcp=23 topuser=madalice 2026-08-21 22:32:03 L1=1.01 run=1 blk=0 avail=7027 (59.9%) swpO=0 conn=4 myRSS=2531 php=0 phpRSS=0 ap=15 tcp=21 topuser=- 2026-08-21 22:32:05 L1=1.01 run=2 blk=0 avail=6839 (58.3%) swpO=0 conn=2 myRSS=2531 php=1 phpRSS=221 ap=15 tcp=21 topuser=madalice 2026-08-21 22:32:13 L1=1.01 run=2 blk=0 avail=6863 (58.5%) swpO=0 conn=2 myRSS=2531 php=1 phpRSS=196 ap=15 tcp=24 topuser=madalice 2026-08-21 22:32:15 L1=1.01 run=2 blk=0 avail=6926 (59.0%) swpO=0 conn=2 myRSS=2531 php=1 phpRSS=131 ap=15 tcp=20 topuser=madalice 2026-08-21 22:32:23 L1=1.00 run=2 blk=0 avail=6950 (59.3%) swpO=1 conn=2 myRSS=2531 php=1 phpRSS=120 ap=15 tcp=21 topuser=madalice 2026-08-21 22:32:25 L1=1.00 run=2 blk=0 avail=7000 (59.7%) swpO=1 conn=2 myRSS=2531 php=1 phpRSS=66 ap=15 tcp=19 topuser=madalice 2026-08-21 22:32:33 L1=1.00 run=4 blk=0 avail=6998 (59.7%) swpO=2 conn=2 myRSS=2531 php=1 phpRSS=54 ap=15 tcp=24 topuser=madalice 2026-08-21 22:32:35 L1=1.00 run=2 blk=0 avail=6809 (58.1%) swpO=2 conn=2 myRSS=2531 php=1 phpRSS=255 ap=15 tcp=24 topuser=madalice 2026-08-21 22:32:43 L1=1.08 run=4 blk=0 avail=6776 (57.8%) swpO=0 conn=2 myRSS=2531 php=2 phpRSS=318 ap=15 tcp=39 topuser=madalice 2026-08-21 22:32:45 L1=1.08 run=3 blk=0 avail=6643 (56.6%) swpO=0 conn=2 myRSS=2531 php=2 phpRSS=430 ap=18 tcp=39 topuser=madalice 2026-08-21 22:32:53 L1=2.59 run=12 blk=1 avail=5528 (47.1%) swpO=785 conn=2 myRSS=2508 php=7 phpRSS=1497 ap=51 tcp=76 topuser=madalice 2026-08-21 22:32:55 L1=2.59 run=7 blk=0 avail=5697 (48.6%) swpO=785 conn=8 myRSS=2508 php=7 phpRSS=1164 ap=75 tcp=70 topuser=madalice 2026-08-21 22:33:03 L1=4.37 run=17 blk=0 avail=5520 (47.1%) swpO=0 conn=11 myRSS=2509 php=10 phpRSS=1507 ap=68 tcp=46 topuser=madalice