INCIDENT 2026-08-23 11:49:45 trigger: php_rss=1572MB ================================================================== load: 1.50 1.20 1.08 10/631 2537008 ncpu:10 mem_avail: 5164MB/11729MB (44.0%) swap_used:3625MB swapout:0/s blocked(D):0 running:8 iowait:0.0% steal:0.0% php: 8 procs / 1572MB heaviest user: madalice (8 procs, 1572MB) apache: 22 procs tcp_estab: 19 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2659 madalice 8 1613 root 239 977 nobody 21 332 netdata 8 262 mailman 20 93 cpanellogin 1 64 dovenull 6 27 evolution 8 25 mailnull 1 24 wp-toolkit 6 19 zabbix 1 16 infinium 1 16 alison 1 13 named 1 12 aaa 1 11 kurri 1 10 nscd 1 7 dovecot 3 7 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 8 1622 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4821 MB Active(file): 3262 MB Inactive(file): 686 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 451 MB CommitLimit: 9960 MB Committed_AS: 8075 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2136526 root 10:38:29 6592 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2723264 9.7 Ssl 8-03:59:11 /usr/sbin/mariadbd 2536927 2535049 madalice 267124 44.0 S 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2536946 2536936 madalice 229812 101 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2536948 2536940 madalice 224924 94.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2536947 2535014 madalice 218092 100 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2536949 2536941 madalice 208332 93.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2536950 2531156 madalice 206364 92.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2536951 2536302 madalice 206040 90.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 205584 2.5 Ssl 55-01:39:53 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2187119 2179066 root 204244 0.0 S 09:11:48 spamd child 2179066 1 root 168272 0.0 Ss 09:26:43 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2187120 2179066 root 151376 0.0 S 09:11:48 spamd child 2536952 2534455 madalice 143228 117 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 121400 0.0 Ss 8-03:59:14 /usr/lib/systemd/systemd-journald 2449607 1353308 cpanellogin 65572 0.0 S 01:55:37 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 2223 1201 root 48048 0.0 Sl 55-01:39:52 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 40744 0.0 Ss 32-09:08:23 cpsrvd (SSL) - waiting for connections 1469 1 root 40220 0.1 Ss 55-01:39:52 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 34604 0.1 Sl 55-01:39:48 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2178228 1 root 30340 0.0 Ss 09:27:33 lfd - sleeping 1463 1 root 27464 0.0 Ss 55-01:39:52 tailwatchd 2111716 1 mailnull 25516 0.0 Ss 4-09:26:45 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2533176 1276780 nobody 22456 0.0 S 06:25 /usr/sbin/httpd -k start 2531156 1276780 nobody 22164 0.0 S 08:58 /usr/sbin/httpd -k start 2531200 1276780 nobody 21396 0.0 S 08:57 /usr/sbin/httpd -k start 2531206 1276780 nobody 21364 0.0 S 08:57 /usr/sbin/httpd -k start 2533168 1276780 nobody 20360 0.0 S 06:26 /usr/sbin/httpd -k start 2531255 1276780 nobody 19940 0.0 S 08:55 /usr/sbin/httpd -k start 2534455 1276780 nobody 19784 0.0 S 03:43 /usr/sbin/httpd -k start 2534723 1276780 nobody 19696 0.1 S 03:13 /usr/sbin/httpd -k start 2535014 1276780 nobody 19472 0.0 S 02:59 /usr/sbin/httpd -k start 2534650 1276780 nobody 19036 0.0 S 03:22 /usr/sbin/httpd -k start 2535049 1276780 nobody 18832 0.0 S 02:57 /usr/sbin/httpd -k start 185104 2431 netdata 18060 2.1 Sl 10-15:16:11 /usr/libexec/netdata/plugins.d/apps.plugin 1 2536302 1276780 nobody 18012 0.0 S 01:21 /usr/sbin/httpd -k start 1471 1 root 16776 0.0 Ss 55-01:39:52 cPhulkd - processor 2311424 1471 root 16688 0.0 S 05:42:32 cPhulkd - dbprocessor 1204 1 zabbix 16600 0.2 Ssl 55-01:39:53 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2528318 3828812 infinium 16564 0.0 S 13:05 dovecot/imap 2536941 1276780 nobody 15852 0.0 S 00:03 /usr/sbin/httpd -k start 2536936 1276780 nobody 15788 0.0 S 00:04 /usr/sbin/httpd -k start 2536940 1276780 nobody 15780 0.0 S 00:03 /usr/sbin/httpd -k start 2475659 3828812 alison 13616 0.0 S 01:17:05 dovecot/imap 2107664 1 named 13224 0.0 Ssl 4-09:27:07 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 2536942 1276780 nobody 12360 0.0 S 00:02 /usr/sbin/httpd -k start 2536787 3828812 aaa 11420 0.0 S 00:26 dovecot/quota-status -p postfix 2536943 1276780 nobody 11284 0.0 S 00:02 /usr/sbin/httpd -k start 2536944 1276780 nobody 11284 0.0 S 00:02 /usr/sbin/httpd -k start 2536945 1276780 nobody 11284 0.0 S 00:02 /usr/sbin/httpd -k start 1276780 1 root 11204 0.0 Ss 17-20:18:28 /usr/sbin/httpd -k start 2536794 3828812 root 10884 0.0 S 00:26 dovecot/auth -w 3668761 3828812 kurri 10796 0.0 S 3-01:35:32 dovecot/imap 2107879 1 root 9212 0.0 Ss 4-09:27:06 queueprocd - waiting up to 60s to process a task 1059098 3828812 dovenull 8228 0.0 S 9-20:16:58 dovecot/imap-login 2111078 1 nscd 7756 0.0 Ssl 4-09:26:56 /usr/sbin/nscd 1059102 3828812 dovenull 7720 0.0 S 9-20:16:58 dovecot/imap-login 1466 1 root 7472 0.0 Ss 55-01:39:52 dnsadmin - dormant mode 918817 27524 root 7324 0.0 Ss 1-20:35:49 sshd: evolution [priv] 2501853 2431 netdata 6832 0.0 Sl 36:10 /usr/libexec/netdata/plugins.d/debugfs.plugin 1 2136526 1 root 6592 0.0 Ssl 10:38:29 /usr/bin/imunify-agent-proxy --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 23288554 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 23288543 | madalice_wp | madalice_wp | Query | 0 | Sending data | SELECT option_value FROM AMuqf6qZ_options WHERE option_name LIKE 'wc_square_background_sync_job_%' AND ( option_value LIKE '%\"status\":\"queued\"%' OR option_value LIKE '%\"status\":\"processing\"%' ) ORDER BY option_id ASC LIMIT 1 | +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min olympic/olympicfencing.com.au-ssl_log 145 madalice/madalice.com.au-ssl_log 120 evolution/evolutionerp.com.au 72 evolution/evolutionerp.com.au-ssl_log 63 otterfencing/otterfencing.com.au-ssl_log 23 corpkicks/corporatekicks.com.au-ssl_log 4 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 134 158.23.17.4 105 20.220.206.182 91 104.209.144.33 40 20.151.9.151 23 20.220.10.235 16 202.153.211.134 4 118.127.40.55 2 91.215.85.88 2 114.119.146.16 1 66.249.75.229 1 45.175.6.94 1 34.196.51.17 1 2a03:2880:f802:3d:: 1 27.44.122.233 1 114.119.159.70 --- top request paths across all vhosts (last 3 min) --- 18 POST /wp-admin/admin-ajax.php 3 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 GET /berlin.php 2 POST /wp-cron.php 2 GET /yawa.php 2 GET /x1da.php 2 GET /wpupex.php 2 GET /wp-logout.php 2 GET /wp-hoard.php 2 GET /.wp-db.php 2 GET /wp-content/replace.php 2 GET /wp-content/ms-files.php 2 GET /wp-content/df.php 2 GET /wp-config.php6 2 GET /wp-config.development.php 2 GET /wp-admin/privacy.php 2 GET /wp-admin/js/index.php 2 GET /wp9.php 2 GET /wp6.php 2 GET /wg459o.php --- busiest 3 vhosts: top paths + last 10 requests --- == olympic/olympicfencing.com.au-ssl_log == -- top paths -- 2 GET /berlin.php 2 GET /7.php 1 GET /zoo2.php 1 GET /yawa.php 1 GET /xwpg.php 1 GET /xty.php 1 GET /x1da.php 1 GET /wpxml.php 1 GET /wp-wlx.php 1 GET /wpupex.php 1 GET /wp-rrtx.php 1 GET /wp-includes/Text/Diff/Engine/file_ed27.php -- last 10 requests -- 20.220.206.182 - - [23/Aug/2026:11:48:12 +1000] "GET /accesson.php HTTP/1.1" 401 36 "-" "-" 20.220.206.182 - - [23/Aug/2026:11:48:13 +1000] "GET /save.php HTTP/1.1" 401 36 "-" "-" 20.220.206.182 - - [23/Aug/2026:11:48:13 +1000] "GET /wp-includes/Text/Diff/Engine/file_cdd9.php HTTP/1.1" 401 36 "-" "-" 20.220.206.182 - - [23/Aug/2026:11:48:14 +1000] "GET /fw/34.php HTTP/1.1" 401 36 "-" "-" 20.220.206.182 - - [23/Aug/2026:11:48:14 +1000] "GET /wp-admin/maint/max.php HTTP/1.1" 401 36 "-" "-" 20.220.206.182 - - [23/Aug/2026:11:48:15 +1000] "GET /7.php HTTP/1.1" 401 36 "-" "-" 20.220.206.182 - - [23/Aug/2026:11:48:15 +1000] "GET /wp-rrtx.php HTTP/1.1" 401 36 "-" "-" 20.220.206.182 - - [23/Aug/2026:11:48:16 +1000] "GET /kj.php HTTP/1.1" 401 36 "-" "-" 20.220.206.182 - - [23/Aug/2026:11:48:16 +1000] "GET /wp-includes/Text/Diff/Engine/file_ed27.php HTTP/1.1" 401 36 "-" "-" 20.220.206.182 - - [23/Aug/2026:11:48:17 +1000] "GET /log.php HTTP/1.1" 401 36 "-" "-" == madalice/madalice.com.au-ssl_log == -- top paths -- 17 POST /wp-admin/admin-ajax.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /store/custom-collingwood-kids/ 2 GET / 1 GET /xiugai.php 1 GET /ws.php 1 GET /ws58.php 1 GET /ws45.php 1 GET /wp/wp-includes//index.php 1 GET /wpupex.php 1 GET /wp-login.php 1 GET /wp-includes/wp-conflg.php -- last 10 requests -- 114.119.137.101 - - [23/Aug/2026:11:48:47 +1000] "GET /store/custom-melbourne-kids/?rating=5&wcpr_page=4&wcpr_image=1 HTTP/1.1" 404 30650 "https://madalice.com.au/store/custom-melbourne-kids/?rating=5&wcpr_page=4&wcpr_im 202.153.211.134 - - [23/Aug/2026:11:48:58 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 78 "https://madalice.com.au/wp-admin/post.php?post=34665&action=edit" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5 202.153.211.134 - - [23/Aug/2026:11:49:08 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 77 "https://madalice.com.au/wp-admin/post.php?post=34665&action=edit" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5 91.215.85.88 - - [23/Aug/2026:11:49:08 +1000] "GET / HTTP/1.1" 200 36621 "http://madalice.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:147.0) Gecko/20100101 Firefox/147.0" 114.119.143.14 - - [23/Aug/2026:11:49:11 +1000] "GET /store/custom-collingwood-kids/?verified=1&wcpr_rating=1&wcpr_image=1 HTTP/1.1" 404 30656 "https://madalice.com.au/store/custom-collingwood-kids/?verified=1&wcpr_ratin 202.153.211.134 - - [23/Aug/2026:11:49:18 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 77 "https://madalice.com.au/wp-admin/post.php?post=34665&action=edit" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5 202.153.211.134 - - [23/Aug/2026:11:49:28 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 77 "https://madalice.com.au/wp-admin/post.php?post=34665&action=edit" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5 114.119.146.16 - - [23/Aug/2026:11:49:32 +1000] "GET /store/custom-collingwood-kids/?verified=1&rating=4&wcpr_verified=1 HTTP/1.1" 404 30656 "https://madalice.com.au/store/custom-collingwood-kids/?verified=1&rating=4" "M 91.215.85.88 - - [23/Aug/2026:11:49:39 +1000] "GET /wp-includes/connectors.php HTTP/1.1" 500 1 "https://madalice.com.au/wp-includes/connectors.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:147.0) Gecko/20100101 Fire 27.44.122.233 - - [23/Aug/2026:11:49:38 +1000] "GET / HTTP/1.1" 200 36621 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/evolutionerp.com.au == -- top paths -- 1 GET /xxl.php 1 GET /wpm.php 1 GET /wp-logout.php 1 GET /wp-hoard.php 1 GET /.wp-db.php 1 GET /wp-config.php6 1 GET /wp-config.development.php 1 GET /web.php 1 GET /v.php 1 GET /verify.php 1 GET /unix.php 1 GET /ucp.php -- last 10 requests -- 158.23.17.4 - - [23/Aug/2026:11:48:48 +1000] "GET /cal_search.php HTTP/1.1" 301 283 "-" "-" 158.23.17.4 - - [23/Aug/2026:11:48:50 +1000] "GET /.wp-db.php HTTP/1.1" 301 279 "-" "-" 158.23.17.4 - - [23/Aug/2026:11:48:52 +1000] "GET /wpm.php HTTP/1.1" 301 276 "-" "-" 158.23.17.4 - - [23/Aug/2026:11:48:54 +1000] "GET /defines.php HTTP/1.1" 301 280 "-" "-" 158.23.17.4 - - [23/Aug/2026:11:48:56 +1000] "GET /php-config.php HTTP/1.1" 301 283 "-" "-" 158.23.17.4 - - [23/Aug/2026:11:48:58 +1000] "GET /of.php HTTP/1.1" 301 275 "-" "-" 158.23.17.4 - - [23/Aug/2026:11:48:59 +1000] "GET /.phpinfo HTTP/1.1" 301 277 "-" "-" 158.23.17.4 - - [23/Aug/2026:11:49:01 +1000] "GET /indec.php HTTP/1.1" 301 278 "-" "-" 158.23.17.4 - - [23/Aug/2026:11:49:03 +1000] "GET /xxl.php HTTP/1.1" 301 276 "-" "-" 158.23.17.4 - - [23/Aug/2026:11:49:05 +1000] "GET /web.php HTTP/1.1" 301 276 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-23 11:47:24 L1=1.13 run=2 blk=0 avail=6278 (53.5%) swpO=0 conn=1 myRSS=2659 php=1 phpRSS=260 ap=18 tcp=24 topuser=madalice 2026-08-23 11:47:24 L1=1.13 run=1 blk=0 avail=6280 (53.5%) swpO=0 conn=2 myRSS=2659 php=1 phpRSS=260 ap=18 tcp=25 topuser=madalice 2026-08-23 11:47:34 L1=1.11 run=2 blk=0 avail=6482 (55.3%) swpO=0 conn=1 myRSS=2659 php=1 phpRSS=58 ap=18 tcp=28 topuser=evolution 2026-08-23 11:47:34 L1=1.11 run=2 blk=0 avail=6366 (54.3%) swpO=0 conn=2 myRSS=2659 php=1 phpRSS=171 ap=18 tcp=28 topuser=evolution 2026-08-23 11:47:44 L1=1.02 run=2 blk=0 avail=6503 (55.4%) swpO=0 conn=1 myRSS=2659 php=0 phpRSS=0 ap=18 tcp=26 topuser=- 2026-08-23 11:47:44 L1=1.02 run=1 blk=0 avail=6514 (55.5%) swpO=0 conn=2 myRSS=2659 php=0 phpRSS=0 ap=18 tcp=27 topuser=- 2026-08-23 11:47:54 L1=1.01 run=1 blk=0 avail=6502 (55.4%) swpO=0 conn=1 myRSS=2659 php=0 phpRSS=0 ap=18 tcp=31 topuser=- 2026-08-23 11:47:55 L1=1.01 run=2 blk=0 avail=6395 (54.5%) swpO=0 conn=2 myRSS=2659 php=1 phpRSS=145 ap=18 tcp=29 topuser=evolution 2026-08-23 11:48:04 L1=0.93 run=3 blk=0 avail=6272 (53.5%) swpO=0 conn=1 myRSS=2659 php=2 phpRSS=303 ap=17 tcp=28 topuser=madalice 2026-08-23 11:48:05 L1=0.93 run=1 blk=0 avail=6511 (55.5%) swpO=0 conn=1 myRSS=2659 php=0 phpRSS=0 ap=17 tcp=28 topuser=- 2026-08-23 11:48:14 L1=0.94 run=1 blk=0 avail=6523 (55.6%) swpO=2 conn=1 myRSS=2659 php=0 phpRSS=0 ap=17 tcp=25 topuser=- 2026-08-23 11:48:15 L1=0.94 run=3 blk=0 avail=6474 (55.2%) swpO=2 conn=1 myRSS=2659 php=1 phpRSS=77 ap=17 tcp=28 topuser=evolution 2026-08-23 11:48:24 L1=1.03 run=4 blk=0 avail=5996 (51.1%) swpO=1 conn=1 myRSS=2659 php=4 phpRSS=637 ap=19 tcp=28 topuser=corpkicks 2026-08-23 11:48:25 L1=1.03 run=3 blk=0 avail=5843 (49.8%) swpO=1 conn=1 myRSS=2659 php=3 phpRSS=700 ap=19 tcp=26 topuser=corpkicks 2026-08-23 11:48:34 L1=1.03 run=2 blk=0 avail=6185 (52.7%) swpO=0 conn=1 myRSS=2659 php=2 phpRSS=391 ap=19 tcp=24 topuser=madalice 2026-08-23 11:48:35 L1=1.03 run=1 blk=0 avail=6283 (53.6%) swpO=0 conn=1 myRSS=2659 php=1 phpRSS=260 ap=19 tcp=24 topuser=madalice 2026-08-23 11:48:44 L1=0.87 run=1 blk=0 avail=6524 (55.6%) swpO=0 conn=1 myRSS=2659 php=0 phpRSS=0 ap=17 tcp=26 topuser=- 2026-08-23 11:48:45 L1=0.87 run=1 blk=0 avail=6523 (55.6%) swpO=0 conn=1 myRSS=2659 php=0 phpRSS=0 ap=17 tcp=25 topuser=- 2026-08-23 11:48:54 L1=0.89 run=1 blk=0 avail=6526 (55.6%) swpO=0 conn=1 myRSS=2659 php=0 phpRSS=0 ap=15 tcp=29 topuser=- 2026-08-23 11:48:55 L1=0.89 run=3 blk=0 avail=6407 (54.6%) swpO=0 conn=1 myRSS=2659 php=1 phpRSS=147 ap=15 tcp=29 topuser=evolution 2026-08-23 11:49:04 L1=0.91 run=2 blk=0 avail=6363 (54.3%) swpO=0 conn=1 myRSS=2659 php=1 phpRSS=174 ap=15 tcp=27 topuser=evolution 2026-08-23 11:49:05 L1=0.91 run=3 blk=0 avail=6509 (55.5%) swpO=0 conn=1 myRSS=2659 php=0 phpRSS=0 ap=15 tcp=25 topuser=- 2026-08-23 11:49:14 L1=0.93 run=1 blk=0 avail=6522 (55.6%) swpO=0 conn=1 myRSS=2659 php=0 phpRSS=0 ap=15 tcp=24 topuser=- 2026-08-23 11:49:15 L1=0.93 run=3 blk=0 avail=6427 (54.8%) swpO=0 conn=1 myRSS=2659 php=1 phpRSS=126 ap=15 tcp=24 topuser=evolution 2026-08-23 11:49:24 L1=0.86 run=3 blk=0 avail=6464 (55.1%) swpO=0 conn=1 myRSS=2659 php=1 phpRSS=100 ap=15 tcp=22 topuser=evolution 2026-08-23 11:49:25 L1=0.86 run=1 blk=0 avail=6532 (55.7%) swpO=0 conn=1 myRSS=2659 php=0 phpRSS=0 ap=15 tcp=21 topuser=- 2026-08-23 11:49:34 L1=0.73 run=2 blk=0 avail=6324 (53.9%) swpO=1 conn=1 myRSS=2659 php=1 phpRSS=257 ap=15 tcp=21 topuser=madalice 2026-08-23 11:49:35 L1=0.73 run=1 blk=0 avail=6544 (55.8%) swpO=1 conn=1 myRSS=2659 php=0 phpRSS=0 ap=15 tcp=20 topuser=- 2026-08-23 11:49:44 L1=0.94 run=8 blk=0 avail=5599 (47.7%) swpO=0 conn=9 myRSS=2659 php=8 phpRSS=1139 ap=22 tcp=19 topuser=madalice 2026-08-23 11:49:45 L1=0.94 run=8 blk=0 avail=5164 (44.0%) swpO=0 conn=9 myRSS=2659 php=8 phpRSS=1572 ap=22 tcp=19 topuser=madalice