INCIDENT 2026-08-22 08:29:13 trigger: php_rss=1563MB ================================================================== load: 2.16 1.02 0.93 19/682 1570570 ncpu:10 mem_avail: 5211MB/11729MB (44.4%) swap_used:3475MB swapout:0/s blocked(D):0 running:19 iowait:0.0% steal:0.0% php: 12 procs / 1563MB heaviest user: madalice (10 procs, 1477MB) apache: 55 procs tcp_estab: 73 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2458 madalice 11 1450 root 249 1006 nobody 54 875 netdata 8 252 cpanellogin 1 122 mailman 20 93 evolution 9 66 aaa 1 57 dovenull 6 26 wp-toolkit 6 17 zabbix 1 14 named 1 11 infinium 1 11 kurri 1 10 kamcool 1 10 nscd 1 7 dovecot 3 7 mailnull 1 4 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 11 1497 aaa 1 60 evolution 1 39 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4722 MB Active(file): 3564 MB Inactive(file): 534 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 444 MB CommitLimit: 9960 MB Committed_AS: 9611 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1297509 root 07:17:58 3120 /usr/bin/imunify-agent-proxy 1568202 root 03:19 59376 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2517716 10.9 Ssl 7-00:38:39 /usr/sbin/mariadbd 1570479 1570463 madalice 220260 50.2 S 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1570493 1568583 madalice 218928 64.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 198784 2.5 Ssl 53-22:19:21 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1353013 1343371 root 186880 0.0 S 05:50:52 spamd child 1570500 1568440 madalice 176764 77.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1570503 1570338 madalice 173948 75.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1570504 1570310 madalice 164592 72.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1570506 1570484 madalice 158516 66.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 145548 0.0 Ss 7-00:38:42 /usr/lib/systemd/systemd-journald 1343371 1 root 138544 0.0 Ss 06:05:51 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1570518 1570337 madalice 130884 50.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353014 1343371 root 127640 0.0 S 05:50:52 spamd child 1338336 1353308 cpanellogin 126036 0.0 S 06:12:19 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 1570519 1570371 madalice 94368 27.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1570532 1570482 aaa 84732 51.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1570564 1570522 madalice 69576 24.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2223 1201 root 61636 0.0 Sl 53-22:19:20 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1570565 1570369 madalice 60528 18.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1568202 1 root 59376 0.7 Ssl 03:19 /opt/imunify360/venv/bin/python3 -m imav.run 1570584 1570368 madalice 54160 10.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1469 1 root 40896 0.1 Ss 53-22:19:20 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1570536 1570483 evolution 40712 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 37836 0.0 Ss 31-05:47:51 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 35232 0.1 Sl 53-22:19:16 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1570606 1353308 root 34664 0.0 S 00:00 webmaild - serving 127.0.0.1 1570613 1353308 root 33588 0.0 S 00:00 webmaild - serving 127.0.0.1 1342210 1 root 27072 0.0 Ss 06:06:51 lfd - sleeping 1463 1 root 25724 0.0 Ss 53-22:19:20 tailwatchd 1569369 1276780 nobody 21448 0.0 S 01:54 /usr/sbin/httpd -k start 1566357 1276780 nobody 21216 0.0 S 05:20 /usr/sbin/httpd -k start 1566524 1276780 nobody 21160 0.1 S 04:59 /usr/sbin/httpd -k start 1568534 1276780 nobody 20732 0.0 S 03:07 /usr/sbin/httpd -k start 1569602 1276780 nobody 20384 0.0 S 01:33 /usr/sbin/httpd -k start 1569799 1276780 nobody 20216 0.0 S 01:14 /usr/sbin/httpd -k start 1568583 1276780 nobody 19924 0.0 S 03:04 /usr/sbin/httpd -k start 1569595 1276780 nobody 19348 0.0 S 01:34 /usr/sbin/httpd -k start 1568440 1276780 nobody 18952 0.0 S 03:09 /usr/sbin/httpd -k start 1569611 1276780 nobody 18252 0.0 S 01:32 /usr/sbin/httpd -k start 1570402 1276780 nobody 18044 0.2 S 00:07 /usr/sbin/httpd -k start 1570371 1276780 nobody 18000 0.2 S 00:09 /usr/sbin/httpd -k start 1570370 1276780 nobody 17988 0.2 S 00:09 /usr/sbin/httpd -k start 1570384 1276780 nobody 17840 0.2 S 00:08 /usr/sbin/httpd -k start 185104 2431 netdata 17808 2.1 Rl 9-11:55:39 /usr/libexec/netdata/plugins.d/apps.plugin 1 1570381 1276780 nobody 17804 0.1 S 00:08 /usr/sbin/httpd -k start 1570383 1276780 nobody 17796 0.1 S 00:08 /usr/sbin/httpd -k start 1570379 1276780 nobody 17784 0.1 S 00:08 /usr/sbin/httpd -k start 1570386 1276780 nobody 17784 0.2 S 00:08 /usr/sbin/httpd -k start 1570399 1276780 nobody 17768 0.2 S 00:07 /usr/sbin/httpd -k start 1570403 1276780 nobody 17768 0.1 S 00:07 /usr/sbin/httpd -k start 1570380 1276780 nobody 17740 0.2 S 00:08 /usr/sbin/httpd -k start 1570441 1276780 nobody 17740 0.2 S 00:05 /usr/sbin/httpd -k start 1568579 1276780 nobody 17736 0.0 S 03:04 /usr/sbin/httpd -k start 1570397 1276780 nobody 17676 0.2 S 00:07 /usr/sbin/httpd -k start 1570385 1276780 nobody 17648 0.1 S 00:08 /usr/sbin/httpd -k start 1569614 1276780 nobody 17388 0.0 S 01:32 /usr/sbin/httpd -k start 1570368 1276780 nobody 16936 0.1 S 00:09 /usr/sbin/httpd -k start 1565142 1471 root 16784 0.0 S 07:40 cPhulkd - dbprocessor 1570369 1276780 nobody 16664 0.1 S 00:09 /usr/sbin/httpd -k start 1570338 1276780 nobody 16636 0.1 S 00:10 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 23068764 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 108 evolution/evolutionerp.com.au-ssl_log 97 otterfencing/otterfencing.com.au-ssl_log 92 evolution/portal.evolutionerp.com.au-ssl_log 23 alison/alisonarts.com.au-ssl_log 9 vinesit/vinesit.com.au-ssl_log 6 speedlin/speedlinefencing.com.au-ssl_log 3 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 98 34.24.13.68 92 74.248.133.44 90 20.151.129.194 23 203.54.180.238 6 62.60.130.247 3 169.58.198.242 2 24.207.64.124 2 216.73.216.213 2 118.127.40.55 2 114.119.159.70 2 114.119.137.101 1 68.67.112.235 1 45.132.227.62 1 44.196.172.251 1 40.77.167.121 --- top request paths across all vhosts (last 3 min) --- 23 GET /heartbeat.php 12 GET / 6 GET /store/custom-nike-af1-sunflower-kids/ 5 POST / 4 POST /wp-login.php 3 GET /robots.txt 3 GET /rclone.conf 3 GET /.git/HEAD 3 GET /.git-credentials 3 GET /.git/config 2 POST /wp-cron.php 2 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 2 GET /wp-json 2 GET /wp-admin/css/colors/modern/ 2 GET /signin 2 GET /new.php 2 GET /doc.php 2 GET /.aws/credentials 2 GET /.aws/config 2 GET /auth/login --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 6 GET /store/custom-nike-af1-sunflower-kids/ 4 GET / 3 GET /rclone.conf 3 GET /.git/HEAD 3 GET /.git-credentials 3 GET /.git/config 2 POST /graphql 2 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 2 GET /wp-json 2 GET /signin 2 GET /login 2 GET /console -- last 10 requests -- 34.24.13.68 - - [22/Aug/2026:08:29:12 +1000] "GET /console HTTP/1.1" 404 30629 "https://www.madalice.com.au/console" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safa 34.24.13.68 - - [22/Aug/2026:08:29:15 +1000] "GET /web/.env HTTP/1.1" 403 12 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.24.13.68 - - [22/Aug/2026:08:29:15 +1000] "GET /config/application.properties HTTP/1.1" 404 3496 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.24.13.68 - - [22/Aug/2026:08:29:15 +1000] "GET /application.yml HTTP/1.1" 404 3496 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.24.13.68 - - [22/Aug/2026:08:29:15 +1000] "GET /application.properties HTTP/1.1" 404 3496 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.24.13.68 - - [22/Aug/2026:08:29:15 +1000] "GET /bootstrap.yml HTTP/1.1" 401 12602 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.24.13.68 - - [22/Aug/2026:08:29:15 +1000] "GET /bootstrap.properties HTTP/1.1" 401 12591 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.24.13.68 - - [22/Aug/2026:08:29:12 +1000] "GET /my HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.24.13.68 - - [22/Aug/2026:08:29:15 +1000] "GET /config/secrets.yml HTTP/1.1" 401 12596 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.24.13.68 - - [22/Aug/2026:08:29:15 +1000] "GET /gradle.properties HTTP/1.1" 401 12591 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 4 POST /wp-login.php 1 POST /wp-cron.php 1 GET /zoom1.php 1 GET /xx.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /ws81.php 1 GET /ws77.php 1 GET /ws37.php 1 GET /wp-trackback.php 1 GET /wp-the.php -- last 10 requests -- 74.248.133.44 - - [22/Aug/2026:08:29:03 +1000] "GET /ws81.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [22/Aug/2026:08:29:03 +1000] "GET /3.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [22/Aug/2026:08:29:04 +1000] "GET /a1.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [22/Aug/2026:08:29:04 +1000] "GET /ca5.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [22/Aug/2026:08:29:04 +1000] "GET /install.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [22/Aug/2026:08:29:05 +1000] "GET /radio.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [22/Aug/2026:08:29:05 +1000] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [22/Aug/2026:08:29:05 +1000] "GET /wp-signin.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [22/Aug/2026:08:29:06 +1000] "GET /Ov-Simple1.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [22/Aug/2026:08:29:06 +1000] "GET /fm.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 2 GET /admin.php 2 GET /about.php 2 GET /aaa.php 1 POST /wp-cron.php 1 GET /zip.php 1 GET /yj09.php 1 GET /xiugai.php 1 GET /wp-ws68.php 1 GET /wp-load.php 1 GET /wp-includes/Text/ 1 GET /wp-includes/Requests/ 1 GET /wp-includes/l10n/ -- last 10 requests -- 20.151.129.194 - - [22/Aug/2026:08:27:50 +1000] "GET /wp-includes/ID3/about.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [22/Aug/2026:08:27:50 +1000] "GET /wp-includes/Text/ HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [22/Aug/2026:08:27:51 +1000] "GET /ts.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [22/Aug/2026:08:27:51 +1000] "GET /bak.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [22/Aug/2026:08:27:51 +1000] "GET /olik.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [22/Aug/2026:08:27:52 +1000] "GET /about.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [22/Aug/2026:08:27:52 +1000] "GET /19.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [22/Aug/2026:08:27:53 +1000] "GET /3cf97/index.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [22/Aug/2026:08:27:53 +1000] "GET /2x.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [22/Aug/2026:08:27:54 +1000] "GET /12.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-22 08:26:52 L1=0.51 run=1 blk=0 avail=6746 (57.5%) swpO=0 conn=1 myRSS=2458 php=0 phpRSS=0 ap=17 tcp=24 topuser=- 2026-08-22 08:26:54 L1=0.51 run=1 blk=0 avail=6736 (57.4%) swpO=0 conn=4 myRSS=2458 php=1 phpRSS=40 ap=17 tcp=24 topuser=evolution 2026-08-22 08:27:03 L1=0.58 run=3 blk=0 avail=6701 (57.1%) swpO=0 conn=1 myRSS=2458 php=1 phpRSS=76 ap=17 tcp=25 topuser=infinium 2026-08-22 08:27:04 L1=0.58 run=1 blk=0 avail=6734 (57.4%) swpO=0 conn=4 myRSS=2458 php=1 phpRSS=40 ap=17 tcp=25 topuser=evolution 2026-08-22 08:27:13 L1=0.49 run=1 blk=0 avail=6753 (57.6%) swpO=0 conn=1 myRSS=2458 php=0 phpRSS=0 ap=17 tcp=22 topuser=- 2026-08-22 08:27:14 L1=0.49 run=1 blk=0 avail=6736 (57.4%) swpO=0 conn=4 myRSS=2458 php=1 phpRSS=40 ap=16 tcp=24 topuser=evolution 2026-08-22 08:27:23 L1=0.42 run=1 blk=0 avail=6742 (57.5%) swpO=0 conn=1 myRSS=2458 php=0 phpRSS=0 ap=17 tcp=27 topuser=- 2026-08-22 08:27:24 L1=0.42 run=2 blk=0 avail=6733 (57.4%) swpO=1 conn=2 myRSS=2458 php=1 phpRSS=40 ap=17 tcp=28 topuser=evolution 2026-08-22 08:27:33 L1=0.35 run=2 blk=0 avail=6676 (56.9%) swpO=1 conn=1 myRSS=2458 php=1 phpRSS=96 ap=17 tcp=23 topuser=alison 2026-08-22 08:27:34 L1=0.35 run=1 blk=0 avail=6739 (57.5%) swpO=0 conn=2 myRSS=2458 php=0 phpRSS=0 ap=17 tcp=25 topuser=- 2026-08-22 08:27:43 L1=0.62 run=1 blk=0 avail=6699 (57.1%) swpO=0 conn=1 myRSS=2458 php=0 phpRSS=0 ap=24 tcp=31 topuser=- 2026-08-22 08:27:44 L1=0.62 run=2 blk=0 avail=6594 (56.2%) swpO=0 conn=2 myRSS=2458 php=1 phpRSS=130 ap=24 tcp=32 topuser=alison 2026-08-22 08:27:53 L1=0.60 run=1 blk=0 avail=6710 (57.2%) swpO=0 conn=1 myRSS=2458 php=0 phpRSS=0 ap=21 tcp=27 topuser=- 2026-08-22 08:27:54 L1=0.60 run=1 blk=0 avail=6715 (57.3%) swpO=0 conn=2 myRSS=2458 php=0 phpRSS=0 ap=21 tcp=28 topuser=- 2026-08-22 08:28:03 L1=0.67 run=2 blk=0 avail=6501 (55.4%) swpO=0 conn=1 myRSS=2458 php=1 phpRSS=244 ap=22 tcp=28 topuser=madalice 2026-08-22 08:28:04 L1=0.67 run=1 blk=0 avail=6711 (57.2%) swpO=0 conn=2 myRSS=2458 php=0 phpRSS=0 ap=22 tcp=29 topuser=- 2026-08-22 08:28:13 L1=0.65 run=2 blk=0 avail=6692 (57.1%) swpO=0 conn=1 myRSS=2458 php=0 phpRSS=0 ap=23 tcp=27 topuser=- 2026-08-22 08:28:14 L1=0.65 run=1 blk=0 avail=6690 (57.0%) swpO=0 conn=2 myRSS=2458 php=0 phpRSS=0 ap=23 tcp=27 topuser=- 2026-08-22 08:28:23 L1=0.55 run=3 blk=0 avail=6663 (56.8%) swpO=0 conn=1 myRSS=2458 php=1 phpRSS=97 ap=18 tcp=21 topuser=madalice 2026-08-22 08:28:24 L1=0.55 run=3 blk=0 avail=6399 (54.6%) swpO=0 conn=4 myRSS=2458 php=3 phpRSS=430 ap=18 tcp=26 topuser=madalice 2026-08-22 08:28:33 L1=0.46 run=1 blk=0 avail=6740 (57.5%) swpO=0 conn=1 myRSS=2458 php=0 phpRSS=0 ap=17 tcp=21 topuser=- 2026-08-22 08:28:35 L1=0.46 run=2 blk=0 avail=6738 (57.4%) swpO=0 conn=4 myRSS=2458 php=0 phpRSS=0 ap=17 tcp=21 topuser=- 2026-08-22 08:28:43 L1=0.39 run=1 blk=0 avail=6738 (57.4%) swpO=1 conn=1 myRSS=2458 php=0 phpRSS=0 ap=17 tcp=21 topuser=- 2026-08-22 08:28:45 L1=0.39 run=2 blk=0 avail=6657 (56.8%) swpO=1 conn=4 myRSS=2458 php=1 phpRSS=106 ap=17 tcp=22 topuser=madalice 2026-08-22 08:28:53 L1=0.33 run=2 blk=0 avail=6724 (57.3%) swpO=1 conn=2 myRSS=2458 php=1 phpRSS=52 ap=16 tcp=21 topuser=speedlin 2026-08-22 08:28:55 L1=0.33 run=2 blk=0 avail=6613 (56.4%) swpO=1 conn=4 myRSS=2458 php=1 phpRSS=164 ap=16 tcp=23 topuser=madalice 2026-08-22 08:29:03 L1=0.28 run=14 blk=0 avail=5660 (48.3%) swpO=1 conn=2 myRSS=2458 php=10 phpRSS=1394 ap=17 tcp=34 topuser=madalice 2026-08-22 08:29:05 L1=0.28 run=4 blk=0 avail=6373 (54.3%) swpO=1 conn=4 myRSS=2458 php=3 phpRSS=427 ap=19 tcp=41 topuser=madalice 2026-08-22 08:29:13 L1=2.16 run=19 blk=0 avail=5211 (44.4%) swpO=0 conn=12 myRSS=2458 php=12 phpRSS=1563 ap=55 tcp=73 topuser=madalice 2026-08-22 08:29:15 L1=2.16 run=17 blk=0 avail=5125 (43.7%) swpO=0 conn=12 myRSS=2458 php=13 phpRSS=1528 ap=57 tcp=67 topuser=madalice