INCIDENT 2026-08-22 06:39:41 trigger: php_rss=1565MB ================================================================== load: 1.43 0.88 1.10 14/646 1502104 ncpu:10 mem_avail: 5620MB/11729MB (47.9%) swap_used:3497MB swapout:2/s blocked(D):0 running:16 iowait:0.0% steal:0.0% php: 13 procs / 1565MB heaviest user: madalice (12 procs, 1529MB) apache: 20 procs tcp_estab: 42 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2476 madalice 12 1707 root 244 964 nobody 19 305 netdata 8 252 cpanellogin 1 106 mailman 20 93 evolution 9 66 infinium 4 48 dovenull 6 26 mailnull 2 25 kurri 2 22 wp-toolkit 6 17 zabbix 1 15 vinesit 1 12 lowrange 1 11 customc 1 11 corpkicks 1 11 named 1 9 nscd 1 7 --- php workers by user --- USER PROCS RSS_MB madalice 12 1718 evolution 1 39 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4733 MB Active(file): 3460 MB Inactive(file): 548 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 444 MB CommitLimit: 9960 MB Committed_AS: 8781 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1297509 root 05:28:25 3120 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2536208 11.0 Ssl 6-22:49:06 /usr/sbin/mariadbd 1220 1 netdata 198744 2.5 Ssl 53-20:29:48 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1353013 1343371 root 178920 0.0 S 04:01:19 spamd child 1502060 1499849 madalice 174268 77.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1502057 1501779 madalice 173308 73.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1502061 1501780 madalice 170268 73.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1502063 1501775 madalice 167860 72.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1502062 1496323 madalice 167788 72.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1502066 1501156 madalice 158804 67.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1502059 1497927 madalice 155284 64.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1502065 1501546 madalice 150272 61.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1343371 1 root 147516 0.0 Ss 04:16:18 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1502058 1501552 madalice 141420 58.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353014 1343371 root 136680 0.0 S 04:01:19 spamd child 1502071 1501776 madalice 130136 105 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1502064 1501950 madalice 123256 48.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 109828 0.0 Ss 6-22:49:09 /usr/lib/systemd/systemd-journald 1338336 1353308 cpanellogin 109544 0.0 S 04:22:46 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 1502070 1496547 madalice 97432 61.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2223 1201 root 62136 0.0 Sl 53-20:29:47 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 40736 0.1 Ss 53-20:29:47 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1502084 1502076 evolution 40676 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 39576 0.0 Ss 31-03:58:18 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 35664 0.1 Sl 53-20:29:43 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1342210 1 root 27360 0.0 Ss 04:17:18 lfd - sleeping 1463 1 root 25976 0.0 Ss 53-20:29:47 tailwatchd 1496323 1276780 nobody 24212 0.0 S 10:04 /usr/sbin/httpd -k start 1501012 1500962 root 23552 0.0 S 01:38 /usr/sbin/exim -q 1500292 1276780 nobody 21984 0.0 S 02:31 /usr/sbin/httpd -k start 1496547 1276780 nobody 21736 0.0 S 09:45 /usr/sbin/httpd -k start 1497927 1276780 nobody 20800 0.0 S 07:30 /usr/sbin/httpd -k start 1501019 1501012 mailnull 20596 0.0 S 01:38 /usr/sbin/exim -q 1501156 1276780 nobody 19340 0.0 S 01:24 /usr/sbin/httpd -k start 1499849 1276780 nobody 18880 0.0 S 03:38 /usr/sbin/httpd -k start 185104 2431 netdata 17808 2.1 Sl 9-10:06:06 /usr/libexec/netdata/plugins.d/apps.plugin 1 1501950 1276780 nobody 17552 0.0 S 00:21 /usr/sbin/httpd -k start 1501546 1276780 nobody 17348 0.0 S 00:45 /usr/sbin/httpd -k start 1501775 1276780 nobody 17220 0.0 S 00:29 /usr/sbin/httpd -k start 1501705 1276780 nobody 17112 0.0 S 00:31 /usr/sbin/httpd -k start 1501552 1276780 nobody 17088 0.0 S 00:44 /usr/sbin/httpd -k start 1501780 1276780 nobody 16932 0.0 S 00:29 /usr/sbin/httpd -k start 1490608 1471 root 16756 0.0 S 18:24 cPhulkd - dbprocessor 1501779 1276780 nobody 16680 0.0 S 00:29 /usr/sbin/httpd -k start 1204 1 zabbix 16356 0.2 Ssl 53-20:29:48 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1501776 1276780 nobody 16096 0.0 S 00:29 /usr/sbin/httpd -k start 1471 1 root 15644 0.0 Ss 53-20:29:47 cPhulkd - processor 1502067 1276780 nobody 15308 0.0 S 00:02 /usr/sbin/httpd -k start 1502078 1276780 nobody 15300 0.0 S 00:01 /usr/sbin/httpd -k start 1502076 1276780 nobody 15120 0.0 S 00:01 /usr/sbin/httpd -k start 1501955 1471 root 13100 0.0 S 00:20 cPhulkd - processor - http socket 1501960 3828812 infinium 12740 0.1 S 00:20 dovecot/imap 1501959 3828812 vinesit 12364 0.1 S 00:20 dovecot/imap 1501957 3828812 lowrange 12272 0.0 S 00:20 dovecot/imap 1481057 3828812 infinium 12256 0.0 S 32:01 dovecot/imap 1501962 3828812 corpkicks 12244 0.0 S 00:20 dovecot/imap 1498791 3828812 infinium 12196 0.0 S 05:34 dovecot/imap 1494970 3828812 infinium 12100 0.0 S 12:35 dovecot/imap 1502056 3828812 kurri 12036 0.0 S 00:05 dovecot/imap 1500962 2111716 root 11748 0.0 S 01:39 /usr/sbin/exim -q 1500706 3828812 customc 11364 0.0 S 01:56 dovecot/quota-status -p postfix --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 23050538 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 150 customc/customcentral.com.au-ssl_log 147 alison/alisonarts.com.au-ssl_log 88 lowrange/lowrange.com.au 44 evolution/portal.evolutionerp.com.au-ssl_log 28 corpkicks/corporatekicks.com.au-ssl_log 7 evolution/my.evolutionerp.com.au-ssl_log 7 evolution/evolutionerp.com.au-ssl_log 5 kamcool/kamcool.com.au 2 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 147 4.204.200.143 141 34.23.124.185 84 4.204.200.136 44 172.191.149.99 28 203.54.180.238 4 40.77.167.154 3 146.70.194.222 3 118.127.40.55 2 66.132.172.108 2 40.77.177.43 2 216.73.216.240 2 114.119.159.70 2 114.119.146.16 2 114.119.137.101 1 95.108.213.225 --- top request paths across all vhosts (last 3 min) --- 28 GET /heartbeat.php 7 GET /store/custom-rainbow-fade-monogram-shoes/ 5 GET /index.php 5 GET / 3 POST /wp-cron.php 3 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 GET /this_is_a_new_hello_world.php 3 GET /.env 3 GET /aaa.php 2 GET /xxx.php 2 GET /xex.php 2 GET /wp-sing.php 2 GET /wp.php 2 GET /wp-content/themes/index.php 2 GET /simple.php 2 GET /robots.txt 2 GET /new.php 2 GET /doc.php 2 GET /admin.php 2 GET /1.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 7 GET /store/custom-rainbow-fade-monogram-shoes/ 4 GET / 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /.zshrc 1 GET /z9x8c7v6b5-debug-trigger-webmail.madalice.com.au 1 GET /wp-json 1 GET /wp-config.php.old 1 GET /wp-config.php.bak 1 GET /web/.env 1 GET /web.config -- last 10 requests -- 34.23.124.185 - - [22/Aug/2026:06:39:18 +1000] "GET /config/runtime.exs HTTP/1.1" 401 12596 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.23.124.185 - - [22/Aug/2026:06:39:19 +1000] "GET /rclone.conf HTTP/1.1" 401 12586 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.23.124.185 - - [22/Aug/2026:06:39:19 +1000] "GET /values.yaml HTTP/1.1" 401 12591 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.23.124.185 - - [22/Aug/2026:06:39:20 +1000] "GET /api/config HTTP/1.1" 401 12596 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.23.124.185 - - [22/Aug/2026:06:39:20 +1000] "GET /api/settings HTTP/1.1" 404 3496 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.23.124.185 - - [22/Aug/2026:06:39:20 +1000] "GET /api/v1/settings HTTP/1.1" 401 12596 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.23.124.185 - - [22/Aug/2026:06:39:20 +1000] "GET /api/v2/config HTTP/1.1" 404 3496 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.23.124.185 - - [22/Aug/2026:06:39:20 +1000] "GET /api/env HTTP/1.1" 404 3496 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.23.124.185 - - [22/Aug/2026:06:39:20 +1000] "GET /api/v1/config HTTP/1.1" 401 12600 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.23.124.185 - - [22/Aug/2026:06:39:21 +1000] "GET /api/v2/settings HTTP/1.1" 404 3496 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" == customc/customcentral.com.au-ssl_log == -- top paths -- 2 GET /xxx.php 2 GET /wp.php 1 GET /zolando.php 1 GET /yanz.php 1 GET /x.php 1 GET /xper1.php 1 GET /xex.php 1 GET /xda.php 1 GET /wp-xx.php 1 GET /wp-the.php 1 GET /wp-slss.php 1 GET /wp-sing.php -- last 10 requests -- 4.204.200.143 - - [22/Aug/2026:06:38:41 +1000] "GET /ty.php HTTP/1.1" 401 36 "-" "-" 4.204.200.143 - - [22/Aug/2026:06:38:41 +1000] "GET /wp-content/plugins/dummyyummy/wp-signup.php HTTP/1.1" 401 36 "-" "-" 4.204.200.143 - - [22/Aug/2026:06:38:42 +1000] "GET /667.php HTTP/1.1" 401 36 "-" "-" 4.204.200.143 - - [22/Aug/2026:06:38:42 +1000] "GET /wp-admin/user/chosen.php HTTP/1.1" 401 36 "-" "-" 4.204.200.143 - - [22/Aug/2026:06:38:43 +1000] "GET /file-manager-advanced.php HTTP/1.1" 401 36 "-" "-" 4.204.200.143 - - [22/Aug/2026:06:38:43 +1000] "GET /fe5.php HTTP/1.1" 401 36 "-" "-" 4.204.200.143 - - [22/Aug/2026:06:38:44 +1000] "GET /ups.php HTTP/1.1" 401 36 "-" "-" 4.204.200.143 - - [22/Aug/2026:06:38:44 +1000] "GET /dropdown.php HTTP/1.1" 401 36 "-" "-" 4.204.200.143 - - [22/Aug/2026:06:38:45 +1000] "GET /wp-includes/block-patterns/index.php HTTP/1.1" 401 36 "-" "-" 4.204.200.143 - - [22/Aug/2026:06:38:45 +1000] "GET /wp-admin/js/index.php HTTP/1.1" 401 36 "-" "-" == alison/alisonarts.com.au-ssl_log == -- top paths -- 2 GET /.env 2 GET /admin.php 2 GET /aaa.php 1 GET /zip.php 1 GET /yj09.php 1 GET /xiugai.php 1 GET /wp-ws68.php 1 GET /wp-load.php 1 GET /wp-includes/Text/ 1 GET /wp-includes/Requests/ 1 GET /wp-includes/l10n/ 1 GET /wp-includes/js/jquery/ -- last 10 requests -- 4.204.200.136 - - [22/Aug/2026:06:37:41 +1000] "GET /wp-content/themes/index.php HTTP/1.1" 404 5749 "-" "-" 4.204.200.136 - - [22/Aug/2026:06:37:41 +1000] "GET /wp-includes/blocks/details/ HTTP/1.1" 404 5749 "-" "-" 4.204.200.136 - - [22/Aug/2026:06:37:41 +1000] "GET /.well-known/about.php HTTP/1.1" 404 5749 "-" "-" 4.204.200.136 - - [22/Aug/2026:06:37:42 +1000] "GET /wp-includes/ID3/about.php HTTP/1.1" 404 5749 "-" "-" 94.154.43.164 - - [22/Aug/2026:06:37:42 +1000] "GET /.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 94.154.43.146 - - [22/Aug/2026:06:37:42 +1000] "GET /.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 4.204.200.136 - - [22/Aug/2026:06:37:42 +1000] "GET /wp-includes/Text/ HTTP/1.1" 404 5749 "-" "-" 4.204.200.136 - - [22/Aug/2026:06:37:43 +1000] "GET /ts.php HTTP/1.1" 404 5749 "-" "-" 4.204.200.136 - - [22/Aug/2026:06:37:43 +1000] "GET /bak.php HTTP/1.1" 404 5749 "-" "-" 148.113.128.155 - - [22/Aug/2026:06:37:42 +1000] "GET /custom-paint-and-airbrush-gallery/page/42/ HTTP/1.1" 200 10641 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" --- last 30 samples (run-up to this incident) --- 2026-08-22 06:37:12 L1=0.41 run=2 blk=0 avail=6409 (54.6%) swpO=1 conn=2 myRSS=2476 php=2 phpRSS=423 ap=18 tcp=34 topuser=corpkicks 2026-08-22 06:37:20 L1=0.38 run=1 blk=0 avail=6763 (57.7%) swpO=1 conn=1 myRSS=2476 php=1 phpRSS=40 ap=18 tcp=26 topuser=evolution 2026-08-22 06:37:22 L1=0.35 run=1 blk=0 avail=6782 (57.8%) swpO=0 conn=1 myRSS=2476 php=0 phpRSS=0 ap=17 tcp=26 topuser=- 2026-08-22 06:37:30 L1=0.40 run=2 blk=0 avail=6753 (57.6%) swpO=0 conn=1 myRSS=2476 php=2 phpRSS=79 ap=17 tcp=32 topuser=evolution 2026-08-22 06:37:32 L1=0.45 run=2 blk=0 avail=6684 (57.0%) swpO=0 conn=1 myRSS=2476 php=1 phpRSS=121 ap=18 tcp=30 topuser=infinium 2026-08-22 06:37:40 L1=0.41 run=4 blk=0 avail=6758 (57.6%) swpO=0 conn=1 myRSS=2476 php=1 phpRSS=40 ap=18 tcp=27 topuser=evolution 2026-08-22 06:37:42 L1=0.46 run=2 blk=0 avail=6740 (57.5%) swpO=0 conn=1 myRSS=2476 php=1 phpRSS=70 ap=18 tcp=29 topuser=alison 2026-08-22 06:37:50 L1=0.46 run=1 blk=0 avail=6702 (57.1%) swpO=0 conn=2 myRSS=2476 php=2 phpRSS=65 ap=19 tcp=30 topuser=evolution 2026-08-22 06:37:52 L1=0.46 run=1 blk=0 avail=6768 (57.7%) swpO=0 conn=1 myRSS=2476 php=0 phpRSS=0 ap=19 tcp=29 topuser=- 2026-08-22 06:38:00 L1=0.39 run=1 blk=0 avail=6755 (57.6%) swpO=0 conn=2 myRSS=2476 php=1 phpRSS=40 ap=19 tcp=26 topuser=evolution 2026-08-22 06:38:02 L1=0.39 run=1 blk=0 avail=6768 (57.7%) swpO=0 conn=1 myRSS=2476 php=0 phpRSS=0 ap=19 tcp=27 topuser=- 2026-08-22 06:38:10 L1=0.48 run=3 blk=0 avail=6520 (55.6%) swpO=0 conn=2 myRSS=2476 php=2 phpRSS=287 ap=19 tcp=28 topuser=madalice 2026-08-22 06:38:12 L1=0.48 run=1 blk=0 avail=6755 (57.6%) swpO=0 conn=1 myRSS=2476 php=0 phpRSS=0 ap=19 tcp=27 topuser=- 2026-08-22 06:38:20 L1=0.56 run=2 blk=0 avail=6654 (56.7%) swpO=0 conn=2 myRSS=2476 php=2 phpRSS=154 ap=19 tcp=29 topuser=madalice 2026-08-22 06:38:22 L1=0.56 run=1 blk=0 avail=6748 (57.5%) swpO=0 conn=1 myRSS=2476 php=0 phpRSS=0 ap=19 tcp=29 topuser=- 2026-08-22 06:38:30 L1=0.56 run=2 blk=0 avail=6675 (56.9%) swpO=0 conn=2 myRSS=2476 php=2 phpRSS=141 ap=18 tcp=25 topuser=madalice 2026-08-22 06:38:32 L1=0.56 run=1 blk=0 avail=6760 (57.6%) swpO=0 conn=1 myRSS=2476 php=0 phpRSS=0 ap=17 tcp=23 topuser=- 2026-08-22 06:38:40 L1=0.47 run=1 blk=0 avail=6757 (57.6%) swpO=0 conn=2 myRSS=2476 php=1 phpRSS=40 ap=17 tcp=24 topuser=evolution 2026-08-22 06:38:42 L1=0.47 run=1 blk=0 avail=6771 (57.7%) swpO=0 conn=1 myRSS=2476 php=0 phpRSS=0 ap=17 tcp=24 topuser=- 2026-08-22 06:38:50 L1=0.48 run=2 blk=0 avail=6617 (56.4%) swpO=0 conn=3 myRSS=2476 php=2 phpRSS=212 ap=17 tcp=26 topuser=corpkicks 2026-08-22 06:38:52 L1=0.48 run=2 blk=0 avail=6676 (56.9%) swpO=0 conn=1 myRSS=2476 php=1 phpRSS=131 ap=17 tcp=25 topuser=madalice 2026-08-22 06:39:00 L1=0.40 run=1 blk=0 avail=6735 (57.4%) swpO=0 conn=3 myRSS=2476 php=1 phpRSS=40 ap=23 tcp=27 topuser=evolution 2026-08-22 06:39:03 L1=0.40 run=1 blk=0 avail=6678 (56.9%) swpO=0 conn=1 myRSS=2476 php=0 phpRSS=0 ap=22 tcp=24 topuser=- 2026-08-22 06:39:11 L1=0.42 run=2 blk=0 avail=6627 (56.5%) swpO=0 conn=3 myRSS=2476 php=1 phpRSS=185 ap=17 tcp=34 topuser=corpkicks 2026-08-22 06:39:13 L1=0.42 run=4 blk=1 avail=6562 (56.0%) swpO=0 conn=1 myRSS=2476 php=1 phpRSS=209 ap=23 tcp=33 topuser=corpkicks 2026-08-22 06:39:21 L1=0.36 run=1 blk=0 avail=6688 (57.0%) swpO=0 conn=3 myRSS=2476 php=1 phpRSS=40 ap=28 tcp=41 topuser=evolution 2026-08-22 06:39:23 L1=0.36 run=2 blk=0 avail=6696 (57.1%) swpO=0 conn=1 myRSS=2476 php=0 phpRSS=0 ap=29 tcp=40 topuser=- 2026-08-22 06:39:31 L1=0.38 run=1 blk=0 avail=6718 (57.3%) swpO=0 conn=3 myRSS=2476 php=1 phpRSS=40 ap=25 tcp=25 topuser=evolution 2026-08-22 06:39:33 L1=0.38 run=1 blk=0 avail=6747 (57.5%) swpO=0 conn=1 myRSS=2476 php=0 phpRSS=0 ap=22 tcp=26 topuser=- 2026-08-22 06:39:41 L1=1.43 run=16 blk=0 avail=5620 (47.9%) swpO=2 conn=14 myRSS=2476 php=13 phpRSS=1565 ap=20 tcp=42 topuser=madalice