INCIDENT 2026-08-22 10:13:26 trigger: php_rss=1632MB ================================================================== load: 0.55 0.78 0.82 15/638 1632461 ncpu:10 mem_avail: 5343MB/11729MB (45.6%) swap_used:3407MB swapout:0/s blocked(D):0 running:18 iowait:0.1% steal:0.0% php: 11 procs / 1632MB heaviest user: madalice (11 procs, 1632MB) apache: 18 procs tcp_estab: 49 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2542 madalice 11 1815 root 244 1073 nobody 17 270 netdata 8 253 cpanellogin 1 154 mailman 20 93 evolution 8 27 dovenull 6 26 mailnull 3 20 wp-toolkit 6 17 zabbix 1 16 alison 1 12 named 1 10 kurri 1 10 nscd 1 7 dovecot 3 7 cpanelconnecttrack 1 3 dbus 1 2 polkitd 1 1 --- php workers by user --- USER PROCS RSS_MB madalice 11 1859 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5211 MB Active(file): 3706 MB Inactive(file): 611 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 454 MB CommitLimit: 9960 MB Committed_AS: 8643 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1297509 root 09:02:10 3120 /usr/bin/imunify-agent-proxy 1630506 root 02:58 61276 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2603580 10.8 Ssl 7-02:22:51 /usr/sbin/mariadbd 1632409 1631772 madalice 219900 99.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1632414 1630635 madalice 218132 98.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1632413 1630354 madalice 215024 93.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1632411 1629416 madalice 212856 98.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1632412 1631785 madalice 206004 95.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1632410 1631964 madalice 203236 88.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 200076 2.5 Ssl 54-00:03:33 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1353013 1343371 root 191232 0.0 S 07:35:04 spamd child 1632419 1631784 madalice 190088 80.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1632418 1632416 madalice 183324 77.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 180752 0.0 Ss 7-02:22:54 /usr/lib/systemd/systemd-journald 1338336 1353308 cpanellogin 158316 0.0 S 07:56:31 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 1343371 1 root 133212 0.0 Ss 07:50:03 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1353014 1343371 root 122260 0.0 S 07:35:04 spamd child 1632429 1632427 madalice 92060 54.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1632430 1632426 madalice 81028 39.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2223 1201 root 61456 0.0 Sl 54-00:03:32 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1630506 1 root 61276 0.9 Ssl 02:58 /opt/imunify360/venv/bin/python3 -m imav.run 1632405 1627613 madalice 52836 115 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1469 1 root 40844 0.1 Ss 54-00:03:32 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1632478 1469 root 38580 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 36536 0.0 Ss 31-07:32:03 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 35180 0.1 Sl 54-00:03:28 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1342210 1 root 26864 0.0 Ss 07:51:03 lfd - sleeping 1463 1 root 26004 0.0 Ss 54-00:03:32 tailwatchd 1625396 1276780 nobody 21644 0.0 S 11:48 /usr/sbin/httpd -k start 1627613 1276780 nobody 21308 0.0 S 08:04 /usr/sbin/httpd -k start 1628313 1276780 nobody 19700 0.0 S 06:39 /usr/sbin/httpd -k start 1629416 1276780 nobody 19696 0.0 S 05:03 /usr/sbin/httpd -k start 1630635 1276780 nobody 19560 0.0 S 02:47 /usr/sbin/httpd -k start 1630354 1276780 nobody 19304 0.0 S 03:21 /usr/sbin/httpd -k start 1631785 1276780 nobody 18600 0.0 S 00:55 /usr/sbin/httpd -k start 1631861 1276780 nobody 18184 0.0 S 00:51 /usr/sbin/httpd -k start 1631784 1276780 nobody 17892 0.0 S 00:56 /usr/sbin/httpd -k start 185104 2431 netdata 17808 2.1 Sl 9-13:39:51 /usr/libexec/netdata/plugins.d/apps.plugin 1 1630143 1276780 nobody 17496 0.0 S 03:32 /usr/sbin/httpd -k start 1631964 1276780 nobody 17144 0.0 S 00:50 /usr/sbin/httpd -k start 1204 1 zabbix 17040 0.2 Ssl 54-00:03:33 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1471 1 root 16956 0.0 Ss 54-00:03:32 cPhulkd - processor 1591218 1471 root 16884 0.0 S 01:11:22 cPhulkd - dbprocessor 1631772 1276780 nobody 16856 0.0 S 00:59 /usr/sbin/httpd -k start 1632427 1276780 nobody 15824 0.0 S 00:01 /usr/sbin/httpd -k start 1632426 1276780 nobody 15244 0.0 S 00:01 /usr/sbin/httpd -k start 1632416 1276780 nobody 15180 0.0 S 00:02 /usr/sbin/httpd -k start 1632408 1471 root 14476 0.0 S 00:02 cPhulkd - processor - http socket 1616626 3828812 alison 13268 0.0 S 27:07 dovecot/imap 1276780 1 root 11244 0.0 Ss 16-18:42:08 /usr/sbin/httpd -k start 1631414 3828812 root 10984 0.0 S 01:31 dovecot/auth -w 3668761 3828812 kurri 10808 0.0 S 1-23:59:12 dovecot/imap 2107664 1 named 10576 0.0 Ssl 3-07:50:47 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 2107879 1 root 9352 0.0 Ss 3-07:50:46 queueprocd - waiting up to 60s to process a task 1632362 2111716 mailnull 8304 0.0 S 00:05 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1059098 3828812 dovenull 8196 0.0 S 8-18:40:38 dovecot/imap-login 918817 27524 root 7844 0.0 Ss 18:59:29 sshd: evolution [priv] 1466 1 root 7692 0.0 Ss 54-00:03:32 dnsadmin - dormant mode 1632258 2111716 mailnull 7532 0.0 S 00:15 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2111078 1 nscd 7512 0.0 Ssl 3-07:50:36 /usr/sbin/nscd 1059102 3828812 dovenull 7508 0.0 S 8-18:40:38 dovecot/imap-login 4028163 27524 root 6444 0.0 Ss 1-18:53:50 sshd: evolution [priv] --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 23076837 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/evolutionerp.com.au-ssl_log 45 evolution/portal.evolutionerp.com.au-ssl_log 12 madalice/madalice.com.au-ssl_log 2 (total vhosts taking traffic: 3) --- top client IPs across all vhosts (last 3 min) --- 30 4.204.200.136 12 203.54.180.238 9 20.151.109.219 1 92.222.104.195 1 54.39.0.225 1 15.235.96.138 1 142.44.228.82 1 142.44.228.204 1 118.127.40.55 1 114.119.159.70 1 114.119.140.234 --- top request paths across all vhosts (last 3 min) --- 12 GET /heartbeat.php 2 GET /store/custom-melbourne-storm-shoes-design2/ 1 POST /wp-cron.php 1 GET /zip.php 1 GET /wp-includes/css/index.php 1 GET /wp-includes/css/ 1 GET /w.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-content/admin.php 1 GET /Uploading.php 1 GET /tiny.php 1 GET /this_is_a_new_hello_world.php 1 GET /sitemap_index.xml 1 GET /simattacker.php 1 GET /shapes.php 1 GET /saka.php 1 GET /robots.txt 1 GET /rc.php 1 GET /qaivbilq.php 1 GET /post-sitemap.xml --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 1 POST /wp-cron.php 1 GET /zip.php 1 GET /wp-includes/css/index.php 1 GET /wp-includes/css/ 1 GET /w.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-content/admin.php 1 GET /Uploading.php 1 GET /tiny.php 1 GET /this_is_a_new_hello_world.php 1 GET /sitemap_index.xml 1 GET /simattacker.php -- last 10 requests -- 4.204.200.136 - - [22/Aug/2026:10:13:04 +1000] "GET /html.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [22/Aug/2026:10:13:05 +1000] "GET /heex.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [22/Aug/2026:10:13:05 +1000] "GET /confag.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [22/Aug/2026:10:13:05 +1000] "GET /baedss.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [22/Aug/2026:10:13:06 +1000] "GET /3xrx.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [22/Aug/2026:10:13:06 +1000] "GET /ema.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [22/Aug/2026:10:13:07 +1000] "GET /atika.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [22/Aug/2026:10:13:07 +1000] "GET /koko.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [22/Aug/2026:10:13:08 +1000] "GET /simattacker.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [22/Aug/2026:10:13:08 +1000] "GET /Uploading.php HTTP/1.1" 401 36 "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 12 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [22/Aug/2026:10:11:20 +1000] "GET /heartbeat.php?sentAt=1787357480&bytes=106,136,233,40&_=1787283563447 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [22/Aug/2026:10:11:30 +1000] "GET /heartbeat.php?sentAt=1787357490&bytes=106,136,233,50&_=1787283563448 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [22/Aug/2026:10:11:40 +1000] "GET /heartbeat.php?sentAt=1787357500&bytes=106,136,233,60&_=1787283563449 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [22/Aug/2026:10:11:50 +1000] "GET /heartbeat.php?sentAt=1787357510&bytes=106,136,233,70&_=1787283563450 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [22/Aug/2026:10:12:00 +1000] "GET /heartbeat.php?sentAt=1787357520&bytes=106,136,233,80&_=1787283563451 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [22/Aug/2026:10:12:10 +1000] "GET /heartbeat.php?sentAt=1787357530&bytes=106,136,233,90&_=1787283563452 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [22/Aug/2026:10:12:20 +1000] "GET /heartbeat.php?sentAt=1787357540&bytes=106,136,233,100&_=1787283563453 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [22/Aug/2026:10:12:30 +1000] "GET /heartbeat.php?sentAt=1787357550&bytes=106,136,233,110&_=1787283563454 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [22/Aug/2026:10:12:40 +1000] "GET /heartbeat.php?sentAt=1787357560&bytes=106,136,233,120&_=1787283563455 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [22/Aug/2026:10:12:50 +1000] "GET /heartbeat.php?sentAt=1787357570&bytes=106,136,233,130&_=1787283563456 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 == madalice/madalice.com.au-ssl_log == -- top paths -- 5 GET /store/custom-melbourne-storm-shoes-design2/ 1 GET /tag/knights/ 1 GET /.aws/credentials 1 GET /.aws/config 1 GET / -- last 10 requests -- 114.119.140.234 - - [22/Aug/2026:10:11:11 +1000] "GET /store/custom-melbourne-storm-shoes-design2/?rating=2&wcpr_page=2&wcpr_verified=1&wcpr_rating=3 HTTP/1.1" 404 30666 "https://madalice.com.au/store/custom-melbourne-st 114.119.159.70 - - [22/Aug/2026:10:11:43 +1000] "GET /store/custom-melbourne-storm-shoes-design2/?amp%3Bwcpr_rating=5&wcpr_page=2&verified=1&wcpr_verified=1 HTTP/1.1" 404 30668 "https://madalice.com.au/store/custom-melbo 2a03:2880:f802:e:: - - [22/Aug/2026:10:12:09 +1000] "GET /tag/knights/ HTTP/1.1" 200 28925 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0. 114.119.137.101 - - [22/Aug/2026:10:12:15 +1000] "GET /store/custom-melbourne-storm-shoes-design2/?amp%3Bwcpr_rating=5&verified=1&wcpr_page=4&rating=2 HTTP/1.1" 404 30671 "https://madalice.com.au/store/custom-melbourne-s 114.119.130.40 - - [22/Aug/2026:10:12:48 +1000] "GET /store/custom-melbourne-storm-shoes-design2/?amp%3Bwcpr_rating=5&verified=1&wcpr_page=4&rating=1 HTTP/1.1" 404 30670 "https://madalice.com.au/store/custom-melbourne-st 136.108.64.202 - - [22/Aug/2026:10:13:21 +1000] "GET / HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 114.119.130.40 - - [22/Aug/2026:10:13:22 +1000] "GET /store/custom-melbourne-storm-shoes-design2/?amp%3Bwcpr_rating=5&verified=1&rating=1&wcpr_rating=5 HTTP/1.1" 404 30666 "https://madalice.com.au/store/custom-melbourne- 136.108.64.202 - - [22/Aug/2026:10:13:24 +1000] "GET /.aws/config HTTP/1.1" 403 13 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 136.108.64.202 - - [22/Aug/2026:10:13:24 +1000] "GET /.aws/credentials HTTP/1.1" 403 13 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" --- last 30 samples (run-up to this incident) --- 2026-08-22 10:11:03 L1=0.78 run=2 blk=0 avail=6562 (55.9%) swpO=0 conn=2 myRSS=2542 php=1 phpRSS=70 ap=17 tcp=27 topuser=evolution 2026-08-22 10:11:05 L1=0.78 run=2 blk=0 avail=6550 (55.8%) swpO=0 conn=2 myRSS=2542 php=1 phpRSS=90 ap=17 tcp=26 topuser=evolution 2026-08-22 10:11:13 L1=0.82 run=1 blk=0 avail=6596 (56.2%) swpO=0 conn=2 myRSS=2542 php=0 phpRSS=0 ap=17 tcp=30 topuser=- 2026-08-22 10:11:15 L1=0.82 run=2 blk=0 avail=6595 (56.2%) swpO=0 conn=2 myRSS=2542 php=0 phpRSS=0 ap=17 tcp=28 topuser=- 2026-08-22 10:11:23 L1=0.85 run=2 blk=0 avail=6574 (56.0%) swpO=0 conn=2 myRSS=2542 php=1 phpRSS=90 ap=14 tcp=22 topuser=aaa 2026-08-22 10:11:25 L1=0.85 run=3 blk=0 avail=6616 (56.4%) swpO=0 conn=2 myRSS=2542 php=1 phpRSS=48 ap=14 tcp=23 topuser=aaa 2026-08-22 10:11:33 L1=0.72 run=1 blk=0 avail=6637 (56.6%) swpO=0 conn=2 myRSS=2542 php=0 phpRSS=0 ap=14 tcp=20 topuser=- 2026-08-22 10:11:35 L1=0.72 run=1 blk=0 avail=6635 (56.6%) swpO=0 conn=2 myRSS=2542 php=0 phpRSS=0 ap=14 tcp=20 topuser=- 2026-08-22 10:11:43 L1=0.76 run=2 blk=0 avail=6591 (56.2%) swpO=0 conn=2 myRSS=2542 php=1 phpRSS=74 ap=14 tcp=21 topuser=madalice 2026-08-22 10:11:45 L1=0.76 run=2 blk=0 avail=6566 (56.0%) swpO=0 conn=2 myRSS=2542 php=1 phpRSS=100 ap=14 tcp=22 topuser=customc 2026-08-22 10:11:53 L1=0.88 run=2 blk=0 avail=6599 (56.3%) swpO=0 conn=1 myRSS=2542 php=0 phpRSS=0 ap=14 tcp=21 topuser=- 2026-08-22 10:11:55 L1=0.88 run=2 blk=0 avail=6549 (55.8%) swpO=0 conn=2 myRSS=2542 php=0 phpRSS=0 ap=14 tcp=22 topuser=- 2026-08-22 10:12:03 L1=0.82 run=2 blk=0 avail=6533 (55.7%) swpO=0 conn=1 myRSS=2542 php=0 phpRSS=0 ap=13 tcp=20 topuser=- 2026-08-22 10:12:05 L1=0.82 run=1 blk=0 avail=6638 (56.6%) swpO=0 conn=2 myRSS=2542 php=0 phpRSS=0 ap=13 tcp=19 topuser=- 2026-08-22 10:12:13 L1=0.69 run=1 blk=0 avail=6634 (56.6%) swpO=0 conn=1 myRSS=2542 php=0 phpRSS=0 ap=13 tcp=22 topuser=- 2026-08-22 10:12:15 L1=0.69 run=2 blk=0 avail=6608 (56.3%) swpO=0 conn=2 myRSS=2542 php=1 phpRSS=56 ap=13 tcp=24 topuser=madalice 2026-08-22 10:12:23 L1=0.59 run=1 blk=0 avail=6639 (56.6%) swpO=0 conn=1 myRSS=2542 php=0 phpRSS=0 ap=13 tcp=22 topuser=- 2026-08-22 10:12:25 L1=0.59 run=1 blk=0 avail=6640 (56.6%) swpO=0 conn=1 myRSS=2542 php=0 phpRSS=0 ap=13 tcp=22 topuser=- 2026-08-22 10:12:33 L1=0.65 run=2 blk=0 avail=6447 (55.0%) swpO=0 conn=1 myRSS=2542 php=1 phpRSS=194 ap=17 tcp=29 topuser=madalice 2026-08-22 10:12:35 L1=0.65 run=2 blk=0 avail=6583 (56.1%) swpO=0 conn=1 myRSS=2542 php=0 phpRSS=0 ap=18 tcp=30 topuser=- 2026-08-22 10:12:43 L1=0.62 run=2 blk=0 avail=6563 (56.0%) swpO=0 conn=1 myRSS=2542 php=1 phpRSS=73 ap=18 tcp=25 topuser=evolution 2026-08-22 10:12:46 L1=0.62 run=1 blk=0 avail=6457 (55.0%) swpO=0 conn=1 myRSS=2542 php=1 phpRSS=179 ap=17 tcp=27 topuser=evolution 2026-08-22 10:12:54 L1=0.68 run=1 blk=0 avail=6607 (56.3%) swpO=0 conn=1 myRSS=2542 php=0 phpRSS=0 ap=17 tcp=24 topuser=- 2026-08-22 10:12:56 L1=0.68 run=1 blk=0 avail=6602 (56.3%) swpO=0 conn=1 myRSS=2542 php=0 phpRSS=0 ap=17 tcp=24 topuser=- 2026-08-22 10:13:04 L1=0.57 run=1 blk=0 avail=6611 (56.4%) swpO=0 conn=1 myRSS=2542 php=0 phpRSS=0 ap=16 tcp=24 topuser=- 2026-08-22 10:13:06 L1=0.57 run=3 blk=0 avail=6608 (56.3%) swpO=0 conn=1 myRSS=2542 php=0 phpRSS=0 ap=16 tcp=20 topuser=- 2026-08-22 10:13:14 L1=0.56 run=1 blk=0 avail=6614 (56.4%) swpO=0 conn=1 myRSS=2542 php=0 phpRSS=0 ap=16 tcp=23 topuser=- 2026-08-22 10:13:16 L1=0.56 run=1 blk=0 avail=6605 (56.3%) swpO=0 conn=1 myRSS=2542 php=0 phpRSS=0 ap=16 tcp=22 topuser=- 2026-08-22 10:13:24 L1=0.55 run=3 blk=0 avail=6436 (54.9%) swpO=0 conn=1 myRSS=2542 php=1 phpRSS=221 ap=15 tcp=23 topuser=madalice 2026-08-22 10:13:26 L1=0.55 run=18 blk=0 avail=5343 (45.6%) swpO=0 conn=12 myRSS=2542 php=11 phpRSS=1632 ap=18 tcp=49 topuser=madalice