INCIDENT 2026-08-23 00:12:32 trigger: php_rss=1632MB ================================================================== load: 1.97 1.92 1.47 11/644 2098864 ncpu:10 mem_avail: 5390MB/11729MB (46.0%) swap_used:3768MB swapout:0/s blocked(D):0 running:19 iowait:0.2% steal:0.0% php: 11 procs / 1632MB heaviest user: madalice (10 procs, 1508MB) apache: 25 procs tcp_estab: 56 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2383 madalice 7 1199 root 242 727 nobody 24 352 netdata 8 249 corpkicks 1 144 mailman 20 92 cpanellogin 1 63 kurri 4 47 lowrange 3 37 dovenull 6 26 evolution 8 25 infinium 2 23 mailnull 3 20 wp-toolkit 6 17 zabbix 1 15 named 1 11 nscd 1 7 dovecot 3 6 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 7 1208 corpkicks 1 146 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4385 MB Active(file): 1423 MB Inactive(file): 2372 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 506 MB CommitLimit: 9960 MB Committed_AS: 8069 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1297509 root 23:01:16 4604 /usr/bin/imunify-agent-proxy 2091924 root 12:32 3276 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2440780 10.2 Ssl 7-16:21:57 /usr/sbin/mariadbd 2098735 2097302 madalice 314104 82.5 R 00:13 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2098819 2097286 madalice 217840 96.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2098820 2081793 madalice 207648 95.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 196232 2.5 Ssl 54-14:02:39 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2098824 2098772 madalice 186428 82.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353014 1343371 root 163968 0.0 S 21:34:10 spamd child 2098828 2097280 corpkicks 161304 67.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2098823 2098821 madalice 140368 58.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2098827 2098826 madalice 103204 67.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2098830 2098320 madalice 100296 63.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 78760 0.0 Ss 7-16:22:00 /usr/lib/systemd/systemd-journald 1343371 1 root 70532 0.0 Ss 21:49:09 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2063691 1353308 cpanellogin 65428 0.0 S 01:03:41 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 1846716 1343371 root 53344 0.0 S 07:30:51 spamd child 2223 1201 root 45688 0.0 Sl 54-14:02:38 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 41760 0.1 Ss 54-14:02:38 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 41320 0.0 Ss 31-21:31:09 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 34400 0.1 Sl 54-14:02:34 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2092128 1 root 31588 0.0 Ss 12:31 lfd - sleeping 1466 1 root 25660 0.0 Ss 54-14:02:38 dnsadmin - server mode 1463 1 root 23484 0.0 Ss 54-14:02:38 tailwatchd 2097280 1276780 nobody 19408 0.1 S 02:37 /usr/sbin/httpd -k start 2081793 1276780 nobody 18928 0.0 S 32:56 /usr/sbin/httpd -k start 2097302 1276780 nobody 18532 0.0 S 02:34 /usr/sbin/httpd -k start 2097286 1276780 nobody 17844 0.0 S 02:36 /usr/sbin/httpd -k start 2098773 1276780 nobody 17840 0.2 S 00:08 /usr/sbin/httpd -k start 185104 2431 netdata 17704 2.1 Sl 10-03:38:57 /usr/libexec/netdata/plugins.d/apps.plugin 1 2098505 1276780 nobody 17700 0.0 S 00:46 /usr/sbin/httpd -k start 2098347 1276780 nobody 17240 0.0 S 00:50 /usr/sbin/httpd -k start 2097279 1276780 nobody 17108 0.0 S 02:37 /usr/sbin/httpd -k start 2098320 1276780 nobody 16808 0.0 S 00:51 /usr/sbin/httpd -k start 2098504 1276780 nobody 16552 0.0 S 00:46 /usr/sbin/httpd -k start 2098772 1276780 nobody 16132 0.1 S 00:08 /usr/sbin/httpd -k start 1204 1 zabbix 15824 0.2 Ssl 54-14:02:39 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2098770 1276780 nobody 15776 0.0 S 00:09 /usr/sbin/httpd -k start 2098821 1276780 nobody 15776 0.0 S 00:02 /usr/sbin/httpd -k start 2098826 1276780 nobody 15776 0.0 S 00:01 /usr/sbin/httpd -k start 2098348 1276780 nobody 15684 0.0 S 00:50 /usr/sbin/httpd -k start 2098834 1276780 nobody 15248 0.0 S 00:00 /usr/sbin/httpd -k start 2098832 1276780 nobody 15212 0.0 S 00:00 /usr/sbin/httpd -k start 2098833 1276780 nobody 15184 0.0 S 00:00 /usr/sbin/httpd -k start 2098835 1276780 nobody 15184 0.0 S 00:00 /usr/sbin/httpd -k start 2098825 1276780 nobody 15148 0.0 S 00:01 /usr/sbin/httpd -k start 2094522 1276780 nobody 14608 0.0 S 07:42 /usr/sbin/httpd -k start 2090314 1276780 nobody 13848 0.0 S 15:00 /usr/sbin/httpd -k start 1591218 1471 root 13200 0.0 S 15:10:28 cPhulkd - dbprocessor 2094194 3828812 lowrange 13072 0.0 S 08:26 dovecot/pop3 2014757 3828812 lowrange 12968 0.0 S 02:28:49 dovecot/imap 2098512 3828812 kurri 12860 0.0 S 00:44 dovecot/imap 1471 1 root 12852 0.0 Ss 54-14:02:38 cPhulkd - processor 2029117 3828812 lowrange 12624 0.0 S 02:03:02 dovecot/imap 2098513 3828812 kurri 12524 0.0 S 00:43 dovecot/imap 2098510 3828812 kurri 12496 0.0 S 00:44 dovecot/imap 2094803 3828812 infinium 12312 0.0 S 07:21 dovecot/imap 2098829 1471 root 12284 0.0 S 00:01 cPhulkd - processor - http socket 2088317 3828812 infinium 11864 0.0 S 18:47 dovecot/imap 2107664 1 named 11768 0.0 Ssl 3-21:49:53 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1276780 1 root 11220 0.0 Ss 17-08:41:14 /usr/sbin/httpd -k start 2097795 3828812 root 11136 0.0 S 01:54 dovecot/auth -w --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 23214244 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min tubesupplies/tubesupplies.com.au-ssl_log 100 kamcool/kamcool.com.au-ssl_log 80 madalice/madalice.com.au-ssl_log 19 (total vhosts taking traffic: 3) --- top client IPs across all vhosts (last 3 min) --- 100 20.151.128.234 80 20.119.58.187 7 118.127.40.55 3 2001:8003:2288:ad00:1ce2:9783:2e83:9337 3 114.119.140.234 2 141.148.174.48 1 87.250.224.210 1 114.119.146.16 1 114.119.143.104 1 114.119.137.101 --- top request paths across all vhosts (last 3 min) --- 6 GET /wp-admin/admin-ajax.php 4 GET /store/hand-painted-nike-af1-canberra-raiders/ 3 GET / 2 GET /w.php 2 GET /wp-content/plugins/index.php 2 GET /themes.php 2 GET /simple.php 2 GET /lock360.php 2 GET /index/function.php 2 GET /file.php 2 GET /css.php 2 GET /cong.php 2 GET /class.php 2 GET /as.php 2 GET /404.php 2 GET /403.php 2 GET /0x.php 1 POST /wp-admin/admin-ajax.php 1 POST / 1 GET /z60.php --- busiest 3 vhosts: top paths + last 10 requests --- == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 2 GET /css.php 2 GET /cong.php 2 GET /404.php 1 GET /z60.php 1 GET /xv.php 1 GET /x.php 1 GET /x56.php 1 GET /x50.php 1 GET /ww1.php 1 GET /wsd.php 1 GET /wp-trackback.php 1 GET /wp-includes/style-engine/about.php -- last 10 requests -- 20.151.128.234 - - [23/Aug/2026:00:10:53 +1000] "GET /ioxi-o1.php HTTP/1.1" 401 36 "-" "-" 20.151.128.234 - - [23/Aug/2026:00:10:54 +1000] "GET /juuuu.php HTTP/1.1" 401 36 "-" "-" 20.151.128.234 - - [23/Aug/2026:00:10:55 +1000] "GET /ha.php HTTP/1.1" 401 36 "-" "-" 20.151.128.234 - - [23/Aug/2026:00:10:56 +1000] "GET /gg.php HTTP/1.1" 401 36 "-" "-" 20.151.128.234 - - [23/Aug/2026:00:10:56 +1000] "GET /we2.php HTTP/1.1" 401 36 "-" "-" 20.151.128.234 - - [23/Aug/2026:00:10:57 +1000] "GET /04.php HTTP/1.1" 401 36 "-" "-" 20.151.128.234 - - [23/Aug/2026:00:10:57 +1000] "GET /333.php HTTP/1.1" 401 36 "-" "-" 20.151.128.234 - - [23/Aug/2026:00:10:58 +1000] "GET /520.php HTTP/1.1" 401 36 "-" "-" 20.151.128.234 - - [23/Aug/2026:00:10:58 +1000] "GET /ar.php HTTP/1.1" 401 36 "-" "-" 20.151.128.234 - - [23/Aug/2026:00:10:59 +1000] "GET /x.php HTTP/1.1" 401 36 "-" "-" == kamcool/kamcool.com.au-ssl_log == -- top paths -- 1 GET /xda.php 1 GET /wp-themes.php 1 GET /wp-links-opml.php 1 GET /wp-includes/PHPMailer 1 GET /wp-includes/ID3/index.php 1 GET /wp-includes/css 1 GET /wp-includes/blocks/search/index.php 1 GET /w.php 1 GET /wp-content/wp-conflg.php 1 GET /wp-content/plugins/index.php 1 GET /wp-content/packed.php 1 GET /wp-blog-header.php -- last 10 requests -- 20.119.58.187 - - [23/Aug/2026:00:11:24 +1000] "GET /modules/ HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [23/Aug/2026:00:11:24 +1000] "GET /lock360.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [23/Aug/2026:00:11:25 +1000] "GET /m5c9h7sz5 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [23/Aug/2026:00:11:25 +1000] "GET /majalahpro-core/lib/index.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [23/Aug/2026:00:11:25 +1000] "GET /pwnd/as.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [23/Aug/2026:00:11:25 +1000] "GET /rk2.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [23/Aug/2026:00:11:25 +1000] "GET /storage/rip.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [23/Aug/2026:00:11:26 +1000] "GET /tool.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [23/Aug/2026:00:11:26 +1000] "GET /twentytwenty/functions.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.119.58.187 - - [23/Aug/2026:00:11:26 +1000] "GET /wp-admin.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 6 GET /wp-admin/admin-ajax.php 4 GET /store/hand-painted-nike-af1-canberra-raiders/ 2 GET / 1 POST /wp-admin/admin-ajax.php 1 POST / 1 GET /tag/leaf/ 1 GET /tag/leaf 1 GET /store/hand-painted-nike-af1-drake/ 1 GET /store/hand-painted-nike-af1-dodskull/ 1 GET /robots.txt -- last 10 requests -- 114.119.140.234 - - [23/Aug/2026:00:11:17 +1000] "GET /store/hand-painted-nike-af1-canberra-raiders/?verified=1&rating=3&image=1 HTTP/1.1" 404 30656 "https://madalice.com.au/store/hand-painted-nike-af1-canberra-raiders/? 118.127.40.55 - - [23/Aug/2026:00:11:08 +1000] "GET /wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=1&scanMode=standard&cronKey=5251191523b2e2eb2715c5626531e1b1&signature=4bcba834ee0187ecbd18327dcd2f6b26bd5db4d57 2001:8003:2288:ad00:1ce2:9783:2e83:9337 - - [23/Aug/2026:00:11:39 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) A 2001:8003:2288:ad00:1ce2:9783:2e83:9337 - - [23/Aug/2026:00:11:39 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleW 114.119.143.104 - - [23/Aug/2026:00:11:39 +1000] "GET /store/hand-painted-nike-af1-canberra-raiders/?image=1&wcpr_page=4&wcpr_rating=5&wcpr_verified=1 HTTP/1.1" 404 30666 "https://madalice.com.au/store/hand-painted-nike- 87.250.224.210 - - [23/Aug/2026:00:11:43 +1000] "GET /robots.txt HTTP/1.1" 304 - "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)" 118.127.40.55 - - [23/Aug/2026:00:11:26 +1000] "GET /wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=1&scanMode=standard&cronKey=f082923f8cfd804985570a91272ed1b9&signature=467cc21658b58ea54ed0e2c518486356df30d7de4 118.127.40.55 - - [23/Aug/2026:00:11:44 +1000] "GET /wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=1&scanMode=standard&cronKey=7c0f27d850bba234309d4beab49c4374&signature=b2ee8a2061d6271067aa79d08317293cd45b8601b 114.119.146.16 - - [23/Aug/2026:00:12:03 +1000] "GET /store/hand-painted-nike-af1-canberra-raiders/?image=1&verified=1&rating=3 HTTP/1.1" 404 30652 "https://madalice.com.au/store/hand-painted-nike-af1-canberra-raiders/?a 2001:8003:2288:ad00:1ce2:9783:2e83:9337 - - [23/Aug/2026:00:12:04 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/product-category/customised-shoes/womens/" "Mozilla/5.0 (iP --- last 30 samples (run-up to this incident) --- 2026-08-23 00:10:04 L1=2.84 run=4 blk=0 avail=6773 (57.7%) swpO=7 conn=2 myRSS=2341 php=1 phpRSS=305 ap=19 tcp=30 topuser=madalice 2026-08-23 00:10:11 L1=2.77 run=3 blk=0 avail=6832 (58.3%) swpO=0 conn=2 myRSS=2341 php=1 phpRSS=305 ap=16 tcp=22 topuser=madalice 2026-08-23 00:10:14 L1=2.63 run=2 blk=0 avail=7062 (60.2%) swpO=0 conn=2 myRSS=2344 php=1 phpRSS=118 ap=16 tcp=23 topuser=madalice 2026-08-23 00:10:21 L1=2.50 run=2 blk=0 avail=6868 (58.6%) swpO=0 conn=2 myRSS=2344 php=1 phpRSS=305 ap=16 tcp=23 topuser=madalice 2026-08-23 00:10:24 L1=2.38 run=2 blk=0 avail=6871 (58.6%) swpO=0 conn=2 myRSS=2344 php=1 phpRSS=307 ap=16 tcp=22 topuser=madalice 2026-08-23 00:10:31 L1=2.67 run=2 blk=1 avail=6774 (57.8%) swpO=0 conn=3 myRSS=2373 php=1 phpRSS=307 ap=16 tcp=23 topuser=madalice 2026-08-23 00:10:34 L1=2.85 run=3 blk=0 avail=6713 (57.2%) swpO=0 conn=2 myRSS=2373 php=3 phpRSS=489 ap=16 tcp=28 topuser=madalice 2026-08-23 00:10:41 L1=2.79 run=2 blk=0 avail=6822 (58.2%) swpO=0 conn=3 myRSS=2373 php=1 phpRSS=308 ap=16 tcp=26 topuser=madalice 2026-08-23 00:10:44 L1=2.64 run=3 blk=0 avail=6689 (57.0%) swpO=0 conn=2 myRSS=2373 php=2 phpRSS=474 ap=16 tcp=27 topuser=madalice 2026-08-23 00:10:51 L1=2.51 run=5 blk=0 avail=6916 (59.0%) swpO=0 conn=3 myRSS=2374 php=2 phpRSS=248 ap=16 tcp=27 topuser=madalice 2026-08-23 00:10:54 L1=2.47 run=2 blk=0 avail=6823 (58.2%) swpO=0 conn=2 myRSS=2374 php=1 phpRSS=307 ap=16 tcp=28 topuser=madalice 2026-08-23 00:11:01 L1=2.35 run=2 blk=0 avail=6826 (58.2%) swpO=0 conn=3 myRSS=2374 php=1 phpRSS=308 ap=16 tcp=28 topuser=madalice 2026-08-23 00:11:04 L1=2.24 run=3 blk=0 avail=6594 (56.2%) swpO=0 conn=2 myRSS=2374 php=3 phpRSS=601 ap=16 tcp=28 topuser=madalice 2026-08-23 00:11:12 L1=2.22 run=2 blk=0 avail=6597 (56.2%) swpO=0 conn=3 myRSS=2374 php=2 phpRSS=567 ap=16 tcp=29 topuser=madalice 2026-08-23 00:11:14 L1=2.13 run=2 blk=0 avail=6587 (56.2%) swpO=0 conn=2 myRSS=2374 php=2 phpRSS=567 ap=16 tcp=30 topuser=madalice 2026-08-23 00:11:22 L1=2.12 run=3 blk=0 avail=6828 (58.2%) swpO=0 conn=3 myRSS=2374 php=1 phpRSS=308 ap=16 tcp=28 topuser=madalice 2026-08-23 00:11:24 L1=2.03 run=2 blk=0 avail=6829 (58.2%) swpO=0 conn=2 myRSS=2374 php=1 phpRSS=307 ap=16 tcp=24 topuser=madalice 2026-08-23 00:11:32 L1=1.94 run=3 blk=0 avail=6836 (58.3%) swpO=0 conn=2 myRSS=2377 php=1 phpRSS=305 ap=15 tcp=24 topuser=madalice 2026-08-23 00:11:35 L1=1.87 run=2 blk=0 avail=6839 (58.3%) swpO=0 conn=2 myRSS=2377 php=1 phpRSS=306 ap=15 tcp=23 topuser=madalice 2026-08-23 00:11:42 L1=1.80 run=4 blk=0 avail=6630 (56.5%) swpO=0 conn=2 myRSS=2378 php=3 phpRSS=513 ap=15 tcp=28 topuser=madalice 2026-08-23 00:11:45 L1=1.81 run=2 blk=0 avail=6757 (57.6%) swpO=0 conn=2 myRSS=2381 php=2 phpRSS=401 ap=17 tcp=33 topuser=madalice 2026-08-23 00:11:52 L1=1.75 run=1 blk=0 avail=6819 (58.1%) swpO=0 conn=2 myRSS=2381 php=1 phpRSS=306 ap=18 tcp=27 topuser=madalice 2026-08-23 00:11:55 L1=1.77 run=2 blk=0 avail=6811 (58.1%) swpO=0 conn=2 myRSS=2381 php=1 phpRSS=309 ap=17 tcp=28 topuser=madalice 2026-08-23 00:12:02 L1=1.71 run=2 blk=1 avail=6720 (57.3%) swpO=0 conn=2 myRSS=2381 php=2 phpRSS=446 ap=15 tcp=28 topuser=madalice 2026-08-23 00:12:05 L1=1.73 run=6 blk=0 avail=6586 (56.2%) swpO=0 conn=2 myRSS=2383 php=4 phpRSS=651 ap=15 tcp=28 topuser=madalice 2026-08-23 00:12:12 L1=1.75 run=3 blk=0 avail=6785 (57.8%) swpO=0 conn=2 myRSS=2383 php=2 phpRSS=385 ap=15 tcp=25 topuser=madalice 2026-08-23 00:12:15 L1=1.77 run=4 blk=0 avail=6795 (57.9%) swpO=0 conn=2 myRSS=2383 php=2 phpRSS=374 ap=15 tcp=25 topuser=madalice 2026-08-23 00:12:22 L1=1.87 run=3 blk=0 avail=6789 (57.9%) swpO=0 conn=2 myRSS=2383 php=2 phpRSS=386 ap=15 tcp=30 topuser=madalice 2026-08-23 00:12:25 L1=1.96 run=2 blk=0 avail=6590 (56.2%) swpO=0 conn=2 myRSS=2383 php=2 phpRSS=565 ap=18 tcp=31 topuser=madalice 2026-08-23 00:12:32 L1=1.97 run=19 blk=0 avail=5390 (46.0%) swpO=0 conn=9 myRSS=2383 php=11 phpRSS=1632 ap=25 tcp=56 topuser=madalice