INCIDENT 2026-08-22 08:09:17 trigger: php_rss=2148MB ================================================================== load: 4.11 1.46 0.97 14/691 1557173 ncpu:10 mem_avail: 4611MB/11729MB (39.3%) swap_used:3475MB swapout:0/s blocked(D):0 running:11 iowait:0.1% steal:0.0% php: 11 procs / 2148MB heaviest user: madalice (11 procs, 2148MB) apache: 72 procs tcp_estab: 50 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2459 madalice 9 1583 nobody 71 1098 root 245 984 netdata 8 254 cpanellogin 1 120 mailman 20 93 evolution 8 27 dovenull 6 26 kurri 2 22 mailnull 3 18 wp-toolkit 6 17 zabbix 1 14 lowrange 1 12 named 1 11 candyfabcom 1 11 nscd 1 7 dovecot 3 7 cpanelconnecttrack 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 9 1604 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4693 MB Active(file): 3390 MB Inactive(file): 602 MB Dirty: 3 MB Writeback: 0 MB SReclaimable: 445 MB CommitLimit: 9960 MB Committed_AS: 9238 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1297509 root 06:58:01 3120 /usr/bin/imunify-agent-proxy 1550718 root 09:16 1268 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2518032 10.9 Ssl 7-00:18:42 /usr/sbin/mariadbd 1557093 1556970 madalice 265600 43.0 S 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1557124 1556902 madalice 228024 67.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1557122 1556899 madalice 225060 68.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1557115 1556980 madalice 218312 66.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1557123 1556901 madalice 218088 64.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 200772 2.5 Ssl 53-21:59:24 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1353013 1343371 root 185884 0.0 S 05:30:55 spamd child 1557125 1556900 madalice 179616 52.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1557129 1556984 madalice 175428 75.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 140604 0.0 Ss 7-00:18:45 /usr/lib/systemd/systemd-journald 1343371 1 root 138544 0.0 Ss 05:45:54 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1557134 1556914 madalice 133612 53.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353014 1343371 root 127640 0.0 S 05:30:55 spamd child 1338336 1353308 cpanellogin 123648 0.0 S 05:52:22 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 2223 1201 root 61548 0.0 Sl 53-21:59:23 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1557168 1556919 madalice 58284 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1469 1 root 40896 0.1 Ss 53-21:59:23 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1557141 1469 root 38484 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 37844 0.0 Ss 31-05:27:54 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 35236 0.1 Sl 53-21:59:19 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1342210 1 root 27068 0.0 Ss 05:46:54 lfd - sleeping 1463 1 root 25816 0.0 Ss 53-21:59:23 tailwatchd 1554301 1276780 nobody 21884 0.0 S 04:27 /usr/sbin/httpd -k start 1555594 1276780 nobody 21536 0.0 S 01:58 /usr/sbin/httpd -k start 1555586 1276780 nobody 20992 0.0 S 01:59 /usr/sbin/httpd -k start 1555592 1276780 nobody 20552 0.0 S 01:58 /usr/sbin/httpd -k start 1556435 1276780 nobody 20044 0.1 S 00:43 /usr/sbin/httpd -k start 1555122 1276780 nobody 19888 0.1 S 02:54 /usr/sbin/httpd -k start 1555371 1276780 nobody 19412 0.0 S 02:28 /usr/sbin/httpd -k start 1556406 1276780 nobody 19396 0.1 S 00:44 /usr/sbin/httpd -k start 1556360 1276780 nobody 19360 0.1 S 00:46 /usr/sbin/httpd -k start 1556963 1276780 nobody 18384 0.0 S 00:12 /usr/sbin/httpd -k start 1556439 1276780 nobody 18120 0.0 S 00:43 /usr/sbin/httpd -k start 1555117 1276780 nobody 18116 0.0 S 02:54 /usr/sbin/httpd -k start 185104 2431 netdata 17808 2.1 Sl 9-11:35:42 /usr/libexec/netdata/plugins.d/apps.plugin 1 1556849 1276780 nobody 17788 0.1 S 00:17 /usr/sbin/httpd -k start 1556955 1276780 nobody 17740 0.1 S 00:12 /usr/sbin/httpd -k start 1556974 1276780 nobody 17676 0.0 S 00:12 /usr/sbin/httpd -k start 1556973 1276780 nobody 17512 0.0 S 00:12 /usr/sbin/httpd -k start 1556962 1276780 nobody 17424 0.0 S 00:12 /usr/sbin/httpd -k start 1556964 1276780 nobody 17296 0.0 S 00:12 /usr/sbin/httpd -k start 1547049 1471 root 16784 0.0 S 15:32 cPhulkd - dbprocessor 1556407 1276780 nobody 16492 0.0 S 00:44 /usr/sbin/httpd -k start 1556433 1276780 nobody 16484 0.0 S 00:43 /usr/sbin/httpd -k start 1556966 1276780 nobody 16412 0.0 S 00:12 /usr/sbin/httpd -k start 1556899 1276780 nobody 16232 0.0 S 00:15 /usr/sbin/httpd -k start 1556976 1276780 nobody 16204 0.0 S 00:12 /usr/sbin/httpd -k start 1556900 1276780 nobody 16200 0.0 S 00:15 /usr/sbin/httpd -k start 1556913 1276780 nobody 16132 0.0 S 00:14 /usr/sbin/httpd -k start 1556857 1276780 nobody 16084 0.0 S 00:16 /usr/sbin/httpd -k start 1556928 1276780 nobody 16084 0.0 S 00:13 /usr/sbin/httpd -k start 1556965 1276780 nobody 16024 0.0 S 00:12 /usr/sbin/httpd -k start 1556902 1276780 nobody 16008 0.0 S 00:15 /usr/sbin/httpd -k start 1556901 1276780 nobody 16004 0.0 S 00:15 /usr/sbin/httpd -k start 1556919 1276780 nobody 15996 0.0 S 00:14 /usr/sbin/httpd -k start 1556438 1276780 nobody 15948 0.0 S 00:43 /usr/sbin/httpd -k start 1556856 1276780 nobody 15948 0.0 S 00:16 /usr/sbin/httpd -k start 1556914 1276780 nobody 15932 0.0 S 00:14 /usr/sbin/httpd -k start 1556978 1276780 nobody 15932 0.0 S 00:12 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 23067433 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 160 customc/customcentral.com.au-ssl_log 89 olympic/olympicfencing.com.au-ssl_log 61 evolution/portal.evolutionerp.com.au-ssl_log 16 evolution/my.evolutionerp.com.au-ssl_log 3 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 150 34.74.34.49 89 4.204.200.136 61 20.151.129.194 16 203.54.180.238 2 114.119.140.234 2 114.119.137.101 1 52.167.144.173 1 43.173.182.243 1 43.173.173.129 1 43.172.194.134 1 40.77.167.45 1 2a03:2880:f802:3c:: 1 157.55.39.9 1 114.119.131.88 1 114.119.130.40 --- top request paths across all vhosts (last 3 min) --- 16 GET /heartbeat.php 7 GET /store/custom-nike-af1-sunflower-kids/ 6 GET / 4 GET /aaa.php 3 GET /index.php 3 GET /admin.php 3 GET /about.php 2 POST /graphql 2 POST /api/graphql 2 GET /zip.php 2 GET /yj09.php 2 GET /xiugai.php 2 GET /wp-ws68.php 2 GET /wp-load.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /Uploading.php 2 GET /this_is_a_new_hello_world.php 2 GET /styles.php 2 GET /source.php 2 GET /simple.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 7 GET /store/custom-nike-af1-sunflower-kids/ 6 GET / 2 POST /graphql 2 POST /api/graphql 2 GET /rclone.conf 2 GET /.env.old 2 GET /.env.bak 2 GET /config/.env 2 GET /backend/.env 2 GET /api/.env 2 GET /admin/.env 1 POST /v1/graphql -- last 10 requests -- 34.74.34.49 - - [22/Aug/2026:08:09:11 +1000] "GET /config/.env HTTP/1.1" 403 12 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.74.34.49 - - [22/Aug/2026:08:09:08 +1000] "POST /api/graphql HTTP/1.1" 404 30622 "https://mail.madalice.com.au" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari 34.74.34.49 - - [22/Aug/2026:08:09:07 +1000] "GET /portal HTTP/1.1" 404 30618 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.74.34.49 - - [22/Aug/2026:08:09:09 +1000] "GET /profile HTTP/1.1" 404 30616 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.74.34.49 - - [22/Aug/2026:08:09:09 +1000] "GET /account HTTP/1.1" 404 30635 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.74.34.49 - - [22/Aug/2026:08:09:09 +1000] "GET /my HTTP/1.1" 404 30616 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.74.34.49 - - [22/Aug/2026:08:09:09 +1000] "GET /wp-admin/ HTTP/1.1" 302 1 "https://mail.madalice.com.au/dashboard" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Saf 34.74.34.49 - - [22/Aug/2026:08:09:10 +1000] "GET /wp-login.php HTTP/1.1" 200 4024 "https://mail.madalice.com.au/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile S 34.74.34.49 - - [22/Aug/2026:08:09:09 +1000] "GET /settings HTTP/1.1" 404 30630 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.74.34.49 - - [22/Aug/2026:08:09:10 +1000] "GET /user/login HTTP/1.1" 404 30625 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" == customc/customcentral.com.au-ssl_log == -- top paths -- 2 GET /admin.php 2 GET /about.php 2 GET /aaa.php 1 GET /zip.php 1 GET /yj09.php 1 GET /xiugai.php 1 GET /wp-ws68.php 1 GET /wp-load.php 1 GET /wp-includes/Text/ 1 GET /wp-includes/Requests/ 1 GET /wp-includes/l10n/ 1 GET /wp-includes/js/jquery/ -- last 10 requests -- 4.204.200.136 - - [22/Aug/2026:08:09:11 +1000] "GET /.well-known/about.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [22/Aug/2026:08:09:11 +1000] "GET /wp-includes/ID3/about.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [22/Aug/2026:08:09:12 +1000] "GET /wp-includes/Text/ HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [22/Aug/2026:08:09:12 +1000] "GET /ts.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [22/Aug/2026:08:09:13 +1000] "GET /bak.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [22/Aug/2026:08:09:13 +1000] "GET /olik.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [22/Aug/2026:08:09:14 +1000] "GET /about.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [22/Aug/2026:08:09:14 +1000] "GET /19.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [22/Aug/2026:08:09:15 +1000] "GET /3cf97/index.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [22/Aug/2026:08:09:15 +1000] "GET /2x.php HTTP/1.1" 401 36 "-" "-" == olympic/olympicfencing.com.au-ssl_log == -- top paths -- 2 GET /aaa.php 1 GET /zip.php 1 GET /yj09.php 1 GET /xiugai.php 1 GET /wp-ws68.php 1 GET /wp-load.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /Uploading.php 1 GET /this_is_a_new_hello_world.php 1 GET /styles.php 1 GET /source.php 1 GET /simple.php -- last 10 requests -- 20.151.129.194 - - [22/Aug/2026:08:08:19 +1000] "GET /fpwch.php HTTP/1.1" 404 5750 "-" "-" 20.151.129.194 - - [22/Aug/2026:08:08:19 +1000] "GET /adminner.php HTTP/1.1" 404 5750 "-" "-" 20.151.129.194 - - [22/Aug/2026:08:08:19 +1000] "GET /abcd.php HTTP/1.1" 404 5750 "-" "-" 20.151.129.194 - - [22/Aug/2026:08:08:20 +1000] "GET /simple.php HTTP/1.1" 404 5750 "-" "-" 20.151.129.194 - - [22/Aug/2026:08:08:20 +1000] "GET /xiugai.php?p= HTTP/1.1" 404 5750 "-" "-" 20.151.129.194 - - [22/Aug/2026:08:08:21 +1000] "GET /wp-load.php HTTP/1.1" 404 5750 "-" "-" 20.151.129.194 - - [22/Aug/2026:08:08:21 +1000] "GET /155.php HTTP/1.1" 404 5750 "-" "-" 20.151.129.194 - - [22/Aug/2026:08:08:21 +1000] "GET /aaa.php?p= HTTP/1.1" 404 5750 "-" "-" 20.151.129.194 - - [22/Aug/2026:08:08:22 +1000] "GET /FWAZ.php HTTP/1.1" 404 5750 "-" "-" 20.151.129.194 - - [22/Aug/2026:08:08:22 +1000] "GET /ccc.php?p= HTTP/1.1" 404 5750 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-22 08:06:56 L1=0.92 run=1 blk=0 avail=6751 (57.6%) swpO=0 conn=1 myRSS=2475 php=0 phpRSS=0 ap=17 tcp=22 topuser=- 2026-08-22 08:06:56 L1=0.84 run=1 blk=0 avail=6751 (57.6%) swpO=0 conn=1 myRSS=2475 php=0 phpRSS=0 ap=17 tcp=21 topuser=- 2026-08-22 08:07:06 L1=0.78 run=1 blk=0 avail=6774 (57.8%) swpO=0 conn=1 myRSS=2475 php=0 phpRSS=0 ap=14 tcp=18 topuser=- 2026-08-22 08:07:06 L1=0.71 run=1 blk=0 avail=6774 (57.8%) swpO=0 conn=1 myRSS=2475 php=0 phpRSS=0 ap=14 tcp=18 topuser=- 2026-08-22 08:07:16 L1=0.82 run=1 blk=0 avail=6779 (57.8%) swpO=1 conn=1 myRSS=2475 php=0 phpRSS=0 ap=15 tcp=28 topuser=- 2026-08-22 08:07:16 L1=0.75 run=1 blk=0 avail=6777 (57.8%) swpO=1 conn=1 myRSS=2475 php=0 phpRSS=0 ap=15 tcp=28 topuser=- 2026-08-22 08:07:26 L1=0.69 run=1 blk=0 avail=6732 (57.4%) swpO=1 conn=1 myRSS=2475 php=0 phpRSS=0 ap=23 tcp=20 topuser=- 2026-08-22 08:07:27 L1=0.63 run=1 blk=0 avail=6732 (57.4%) swpO=1 conn=1 myRSS=2475 php=1 phpRSS=9 ap=23 tcp=20 topuser=evolution 2026-08-22 08:07:36 L1=0.66 run=1 blk=0 avail=6770 (57.7%) swpO=0 conn=1 myRSS=2475 php=0 phpRSS=0 ap=16 tcp=23 topuser=- 2026-08-22 08:07:37 L1=0.61 run=1 blk=0 avail=6769 (57.7%) swpO=0 conn=1 myRSS=2475 php=0 phpRSS=0 ap=16 tcp=23 topuser=- 2026-08-22 08:07:46 L1=0.56 run=1 blk=0 avail=6769 (57.7%) swpO=0 conn=1 myRSS=2475 php=0 phpRSS=0 ap=16 tcp=21 topuser=- 2026-08-22 08:07:47 L1=0.52 run=1 blk=0 avail=6768 (57.7%) swpO=0 conn=1 myRSS=2475 php=0 phpRSS=0 ap=16 tcp=21 topuser=- 2026-08-22 08:07:56 L1=0.47 run=2 blk=0 avail=6589 (56.2%) swpO=0 conn=1 myRSS=2475 php=1 phpRSS=213 ap=16 tcp=25 topuser=madalice 2026-08-22 08:07:57 L1=0.52 run=2 blk=0 avail=6534 (55.7%) swpO=0 conn=1 myRSS=2475 php=1 phpRSS=264 ap=16 tcp=25 topuser=madalice 2026-08-22 08:08:06 L1=0.44 run=1 blk=0 avail=6766 (57.7%) swpO=0 conn=1 myRSS=2475 php=0 phpRSS=0 ap=16 tcp=23 topuser=- 2026-08-22 08:08:07 L1=0.44 run=1 blk=0 avail=6767 (57.7%) swpO=0 conn=1 myRSS=2475 php=0 phpRSS=0 ap=16 tcp=22 topuser=- 2026-08-22 08:08:16 L1=0.52 run=2 blk=0 avail=6721 (57.3%) swpO=0 conn=2 myRSS=2475 php=1 phpRSS=74 ap=16 tcp=21 topuser=madalice 2026-08-22 08:08:17 L1=0.52 run=2 blk=0 avail=6690 (57.0%) swpO=0 conn=1 myRSS=2475 php=1 phpRSS=106 ap=16 tcp=21 topuser=madalice 2026-08-22 08:08:26 L1=0.52 run=2 blk=0 avail=6763 (57.7%) swpO=0 conn=2 myRSS=2475 php=0 phpRSS=0 ap=16 tcp=22 topuser=- 2026-08-22 08:08:27 L1=0.52 run=2 blk=0 avail=6741 (57.5%) swpO=0 conn=1 myRSS=2475 php=1 phpRSS=56 ap=16 tcp=24 topuser=madalice 2026-08-22 08:08:36 L1=0.51 run=1 blk=0 avail=6658 (56.8%) swpO=1 conn=2 myRSS=2475 php=0 phpRSS=0 ap=31 tcp=37 topuser=- 2026-08-22 08:08:37 L1=0.51 run=1 blk=0 avail=6652 (56.7%) swpO=1 conn=1 myRSS=2475 php=0 phpRSS=0 ap=31 tcp=41 topuser=- 2026-08-22 08:08:46 L1=0.51 run=2 blk=0 avail=6550 (55.8%) swpO=0 conn=2 myRSS=2475 php=1 phpRSS=150 ap=29 tcp=32 topuser=evolution 2026-08-22 08:08:47 L1=0.51 run=3 blk=0 avail=6664 (56.8%) swpO=0 conn=1 myRSS=2475 php=0 phpRSS=0 ap=29 tcp=31 topuser=- 2026-08-22 08:08:56 L1=0.51 run=1 blk=0 avail=6556 (55.9%) swpO=2 conn=2 myRSS=2475 php=1 phpRSS=212 ap=21 tcp=23 topuser=madalice 2026-08-22 08:08:57 L1=0.51 run=1 blk=0 avail=6555 (55.9%) swpO=2 conn=1 myRSS=2475 php=1 phpRSS=213 ap=20 tcp=23 topuser=madalice 2026-08-22 08:09:07 L1=2.51 run=10 blk=0 avail=5655 (48.2%) swpO=705 conn=2 myRSS=2458 php=9 phpRSS=970 ap=82 tcp=65 topuser=madalice 2026-08-22 08:09:07 L1=2.51 run=15 blk=0 avail=5339 (45.5%) swpO=775 conn=1 myRSS=2458 php=11 phpRSS=1382 ap=81 tcp=66 topuser=madalice 2026-08-22 08:09:17 L1=4.11 run=11 blk=0 avail=4611 (39.3%) swpO=0 conn=10 myRSS=2459 php=11 phpRSS=2148 ap=72 tcp=50 topuser=madalice 2026-08-22 08:09:17 L1=4.11 run=13 blk=0 avail=4867 (41.5%) swpO=0 conn=9 myRSS=2459 php=10 phpRSS=1858 ap=71 tcp=51 topuser=madalice