INCIDENT 2026-08-25 03:12:46 trigger: php_rss=1813MB mysql_conn=16 ================================================================== load: 1.96 0.87 0.85 21/665 2310388 ncpu:10 mem_avail: 5099MB/11729MB (43.5%) swap_used:3763MB swapout:1176/s blocked(D):0 running:18 iowait:0.7% steal:0.0% php: 15 procs / 1813MB heaviest user: madalice (15 procs, 1813MB) apache: 30 procs tcp_estab: 89 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2866 madalice 15 1884 root 237 1046 nobody 45 619 netdata 8 266 mailman 20 93 dovenull 6 66 cpanellogin 1 63 lowrange 2 29 dovecot 3 29 kurri 2 27 mailnull 3 25 wp-toolkit 6 19 zabbix 1 15 aaa 1 15 infinium 1 14 candyfabcom 1 14 named 1 12 evolution 4 12 nscd 1 7 --- php workers by user --- USER PROCS RSS_MB madalice 15 1702 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4568 MB Active(file): 2930 MB Inactive(file): 1005 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 492 MB CommitLimit: 9960 MB Committed_AS: 9263 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1913717 root 02:01:29 5668 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2935084 9.8 Ssl 9-19:22:13 /usr/sbin/mariadbd 1220 1 netdata 214120 2.5 Ssl 56-17:02:55 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2310211 2310207 madalice 212796 65.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2310245 2310227 madalice 201476 87.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2310244 2310226 madalice 190560 82.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2160755 2145741 root 184764 0.0 S 47:22 spamd child 2145741 1 root 176112 0.1 Ss 49:44 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2310242 2310224 madalice 170012 75.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2160756 2145741 root 168408 0.0 S 47:22 spamd child 2310241 2310225 madalice 149640 60.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 141276 0.0 Ss 9-19:22:16 /usr/lib/systemd/systemd-journald 2310273 2295083 madalice 129852 101 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2310320 2310303 madalice 104212 73.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2310314 2310299 madalice 100116 61.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2310317 2310300 madalice 91756 50.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2310319 2310301 madalice 79604 39.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2310316 2310297 madalice 76204 34.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2310315 2310298 madalice 75556 32.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2310318 2310302 madalice 74704 33.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2310313 2310295 madalice 74320 32.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2244527 1353308 cpanellogin 65072 0.0 S 21:06 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 2223 1201 root 44268 0.0 Sl 56-17:02:54 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41840 0.0 Ss 34-00:31:25 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 33736 0.1 Sl 56-17:02:50 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 33408 0.1 Ss 56-17:02:54 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2144580 1 root 32264 0.0 Ss 50:33 lfd - sleeping 2310219 1463 root 27972 2.5 S 00:02 tailwatchd - chkservd - httpd check 2293801 1276780 nobody 23556 0.0 S 05:13 /usr/sbin/httpd -k start 1463 1 root 23440 0.0 Ss 56-17:02:54 tailwatchd 2295108 1276780 nobody 22672 0.0 S 03:05 /usr/sbin/httpd -k start 2261315 1276780 nobody 22616 0.0 S 13:45 /usr/sbin/httpd -k start 2276002 1276780 nobody 22556 0.0 S 12:01 /usr/sbin/httpd -k start 2295082 1276780 nobody 22120 0.0 S 03:07 /usr/sbin/httpd -k start 2281161 1276780 nobody 21500 0.0 S 07:42 /usr/sbin/httpd -k start 2295107 1276780 nobody 21360 0.0 S 03:05 /usr/sbin/httpd -k start 2309158 1276780 nobody 20372 0.1 S 01:47 /usr/sbin/httpd -k start 2292837 1276780 nobody 20168 0.0 S 06:19 /usr/sbin/httpd -k start 2309340 1276780 nobody 20160 0.1 S 01:29 /usr/sbin/httpd -k start 2295092 1276780 nobody 20000 0.1 S 03:06 /usr/sbin/httpd -k start 2295083 1276780 nobody 19448 0.0 S 03:07 /usr/sbin/httpd -k start 2310206 1276780 nobody 19176 0.3 S 00:03 /usr/sbin/httpd -k start 2310199 1276780 nobody 19080 0.5 S 00:04 /usr/sbin/httpd -k start 185104 2431 netdata 18268 2.1 Sl 12-06:39:13 /usr/libexec/netdata/plugins.d/apps.plugin 1 1780161 3828812 root 17140 0.0 S 02:39:55 dovecot/config 2310302 1276780 nobody 16832 0.0 S 00:01 /usr/sbin/httpd -k start 2310207 1276780 nobody 16808 0.0 S 00:03 /usr/sbin/httpd -k start 2310227 1276780 nobody 16792 0.0 S 00:02 /usr/sbin/httpd -k start 2310301 1276780 nobody 16792 0.0 S 00:01 /usr/sbin/httpd -k start 2310300 1276780 nobody 16780 0.0 S 00:01 /usr/sbin/httpd -k start 2310225 1276780 nobody 16772 0.0 S 00:02 /usr/sbin/httpd -k start 2310295 1276780 nobody 16772 0.0 S 00:01 /usr/sbin/httpd -k start 2310299 1276780 nobody 16772 0.0 S 00:01 /usr/sbin/httpd -k start 2310303 1276780 nobody 16720 0.0 S 00:01 /usr/sbin/httpd -k start 2310226 1276780 nobody 16716 0.0 S 00:02 /usr/sbin/httpd -k start 2310224 1276780 nobody 16708 0.0 S 00:02 /usr/sbin/httpd -k start 2261100 1471 root 16704 0.0 S 14:09 cPhulkd - dbprocessor 2310297 1276780 nobody 16580 0.0 S 00:01 /usr/sbin/httpd -k start 2310298 1276780 nobody 16544 0.0 S 00:01 /usr/sbin/httpd -k start 1204 1 zabbix 16024 0.2 Ssl 56-17:02:55 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1780602 3828812 aaa 15840 0.0 S 02:39:30 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 28126934 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min aaa/aaadownunder.com.au-ssl_log 166 coscom/coscom.com.au-ssl_log 76 madalice/madalice.com.au-ssl_log 56 evolution/my.evolutionerp.com.au-ssl_log 24 evolution/portal.evolutionerp.com.au-ssl_log 5 alison/alisonarts.com.au-ssl_log 1 evolution/legacy.evolutionerp.com.au-ssl_log 1 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 100 52.139.37.240 76 20.104.87.97 65 20.48.160.90 47 40.83.93.50 21 35.185.33.135 9 54.209.60.63 5 203.54.180.238 4 54.175.74.27 3 54.86.66.252 3 40.77.167.76 3 114.119.143.104 2 40.77.167.7 2 184.72.115.35 1 91.92.243.239 1 8.229.118.12 --- top request paths across all vhosts (last 3 min) --- 76 GET /autodiscover/autodiscover.xml 23 GET /index.php 11 GET / 6 GET /getcmd 5 GET /heartbeat.php 4 GET /admin.php 4 GET /about.php 4 GET /aaa9 3 GET /wp-content/uploads/ 3 GET /wp-content/themes/index.php 3 GET /wp-content/admin.php 3 GET /store/diamond-bling-laces/ 3 GET /abcd.php 3 GET /aab9 3 GET /aaa.php 2 GET /wp-login.php 2 GET /wp-good.php 2 GET /wp-content/uploads/index.php 2 GET /wp-content/themes/admin.php 2 GET /wp-admin/css/colors/ectoplasm/ --- busiest 3 vhosts: top paths + last 10 requests --- == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 3 GET /admin.php 3 GET /about.php 3 GET /aaa.php 2 GET /wp-content/uploads/ 2 GET /wp-content/themes/index.php 2 GET /wp-content/admin.php 2 GET /term.php 2 GET /simple.php 2 GET /abcd.php 2 GET /222.php 2 GET /1.php 2 GET /155.php -- last 10 requests -- 20.48.160.90 - - [25/Aug/2026:03:12:01 +1000] "GET /wp-includes/Text/ HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [25/Aug/2026:03:12:01 +1000] "GET /ts.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [25/Aug/2026:03:12:02 +1000] "GET /bak.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [25/Aug/2026:03:12:02 +1000] "GET /olik.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [25/Aug/2026:03:12:02 +1000] "GET /about.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [25/Aug/2026:03:12:03 +1000] "GET /19.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [25/Aug/2026:03:12:03 +1000] "GET /3cf97/index.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [25/Aug/2026:03:12:04 +1000] "GET /12.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [25/Aug/2026:03:12:04 +1000] "GET /term.php HTTP/1.1" 404 5750 "-" "-" 118.127.40.55 - - [25/Aug/2026:03:12:24 +1000] "POST /wp-cron.php?doing_wp_cron=1787591544.7821910381317138671875 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://aaadownunder.com.au" == coscom/coscom.com.au-ssl_log == -- top paths -- 76 GET /autodiscover/autodiscover.xml -- last 10 requests -- 20.104.87.97 - - [25/Aug/2026:03:12:05 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.87.97 - - [25/Aug/2026:03:12:06 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.87.97 - - [25/Aug/2026:03:12:07 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.87.97 - - [25/Aug/2026:03:12:08 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.87.97 - - [25/Aug/2026:03:12:09 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.87.97 - - [25/Aug/2026:03:12:10 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.87.97 - - [25/Aug/2026:03:12:11 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.87.97 - - [25/Aug/2026:03:12:12 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.87.97 - - [25/Aug/2026:03:12:13 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.87.97 - - [25/Aug/2026:03:12:14 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" == madalice/madalice.com.au-ssl_log == -- top paths -- 10 GET / 6 GET /getcmd 4 GET /aaa9 3 GET /store/diamond-bling-laces/ 3 GET /aab9 2 GET /store/design-your-own-sliders/ 1 GET /xmlrpc.php 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-login.php 1 GET /wp-includes/Requests/src/Response/about.php 1 GET /wp-includes/PHPMailer/ -- last 10 requests -- 35.185.33.135 - - [25/Aug/2026:03:12:46 +1000] "GET / HTTP/1.1" 200 36620 "http://104.26.3.184:2082" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 35.185.33.135 - - [25/Aug/2026:03:12:46 +1000] "GET /getcmd HTTP/1.1" 404 30636 "http://104.26.3.184:8080/getcmd" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safa 35.185.33.135 - - [25/Aug/2026:03:12:46 +1000] "GET / HTTP/1.1" 200 36620 "http://104.26.3.184:8880" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 35.185.33.135 - - [25/Aug/2026:03:12:46 +1000] "GET /getcmd HTTP/1.1" 404 30633 "http://104.26.2.184:8080/getcmd" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safa 40.83.93.50 - - [25/Aug/2026:03:12:49 +1000] "GET /wp-content/uploads/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 40.83.93.50 - - [25/Aug/2026:03:12:49 +1000] "GET /wp-content/themes/admin.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 40.83.93.50 - - [25/Aug/2026:03:12:49 +1000] "GET /wp-content/themes/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 40.83.93.50 - - [25/Aug/2026:03:12:50 +1000] "GET /wp-content/plugins/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 40.83.93.50 - - [25/Aug/2026:03:12:50 +1000] "GET /wp-includes/PHPMailer/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 35.185.33.135 - - [25/Aug/2026:03:12:45 +1000] "GET /getcmd HTTP/1.1" 404 30636 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-25 03:10:26 L1=0.50 run=1 blk=0 avail=6577 (56.1%) swpO=0 conn=1 myRSS=2897 php=0 phpRSS=0 ap=15 tcp=21 topuser=- 2026-08-25 03:10:26 L1=0.50 run=2 blk=0 avail=6577 (56.1%) swpO=0 conn=1 myRSS=2897 php=0 phpRSS=0 ap=15 tcp=21 topuser=- 2026-08-25 03:10:36 L1=0.42 run=1 blk=0 avail=6599 (56.3%) swpO=2 conn=1 myRSS=2897 php=0 phpRSS=0 ap=15 tcp=22 topuser=- 2026-08-25 03:10:36 L1=0.42 run=2 blk=0 avail=6597 (56.2%) swpO=2 conn=1 myRSS=2897 php=0 phpRSS=0 ap=15 tcp=22 topuser=- 2026-08-25 03:10:46 L1=0.36 run=1 blk=0 avail=6581 (56.1%) swpO=0 conn=1 myRSS=2897 php=0 phpRSS=0 ap=14 tcp=23 topuser=- 2026-08-25 03:10:46 L1=0.36 run=4 blk=0 avail=6580 (56.1%) swpO=0 conn=1 myRSS=2897 php=0 phpRSS=0 ap=14 tcp=23 topuser=- 2026-08-25 03:10:56 L1=0.45 run=2 blk=0 avail=6545 (55.8%) swpO=0 conn=1 myRSS=2897 php=1 phpRSS=76 ap=14 tcp=24 topuser=olympic 2026-08-25 03:10:56 L1=0.45 run=5 blk=0 avail=6544 (55.8%) swpO=0 conn=1 myRSS=2897 php=1 phpRSS=77 ap=14 tcp=24 topuser=olympic 2026-08-25 03:11:06 L1=0.38 run=3 blk=0 avail=6579 (56.1%) swpO=0 conn=1 myRSS=2897 php=0 phpRSS=0 ap=15 tcp=22 topuser=- 2026-08-25 03:11:06 L1=0.38 run=3 blk=0 avail=6579 (56.1%) swpO=0 conn=1 myRSS=2897 php=0 phpRSS=0 ap=15 tcp=22 topuser=- 2026-08-25 03:11:16 L1=0.40 run=3 blk=0 avail=6365 (54.3%) swpO=0 conn=1 myRSS=2897 php=1 phpRSS=252 ap=15 tcp=24 topuser=madalice 2026-08-25 03:11:16 L1=0.40 run=3 blk=0 avail=6361 (54.2%) swpO=0 conn=1 myRSS=2897 php=1 phpRSS=254 ap=15 tcp=24 topuser=madalice 2026-08-25 03:11:26 L1=0.34 run=1 blk=0 avail=6572 (56.0%) swpO=0 conn=1 myRSS=2897 php=0 phpRSS=0 ap=16 tcp=25 topuser=- 2026-08-25 03:11:26 L1=0.34 run=2 blk=0 avail=6572 (56.0%) swpO=0 conn=1 myRSS=2897 php=0 phpRSS=0 ap=16 tcp=25 topuser=- 2026-08-25 03:11:36 L1=0.29 run=2 blk=0 avail=6572 (56.0%) swpO=0 conn=1 myRSS=2897 php=0 phpRSS=0 ap=16 tcp=21 topuser=- 2026-08-25 03:11:36 L1=0.29 run=2 blk=0 avail=6572 (56.0%) swpO=0 conn=1 myRSS=2897 php=0 phpRSS=0 ap=16 tcp=21 topuser=- 2026-08-25 03:11:46 L1=0.32 run=2 blk=0 avail=6583 (56.1%) swpO=1 conn=1 myRSS=2897 php=0 phpRSS=0 ap=16 tcp=25 topuser=- 2026-08-25 03:11:46 L1=0.32 run=3 blk=0 avail=6583 (56.1%) swpO=1 conn=1 myRSS=2897 php=0 phpRSS=0 ap=16 tcp=25 topuser=- 2026-08-25 03:11:56 L1=0.27 run=1 blk=0 avail=6584 (56.1%) swpO=0 conn=1 myRSS=2897 php=0 phpRSS=0 ap=16 tcp=26 topuser=- 2026-08-25 03:11:56 L1=0.27 run=2 blk=0 avail=6583 (56.1%) swpO=0 conn=1 myRSS=2897 php=0 phpRSS=0 ap=16 tcp=23 topuser=- 2026-08-25 03:12:06 L1=0.23 run=2 blk=0 avail=6580 (56.1%) swpO=0 conn=1 myRSS=2897 php=0 phpRSS=0 ap=16 tcp=23 topuser=- 2026-08-25 03:12:06 L1=0.23 run=1 blk=0 avail=6581 (56.1%) swpO=0 conn=1 myRSS=2897 php=0 phpRSS=0 ap=16 tcp=23 topuser=- 2026-08-25 03:12:16 L1=0.43 run=2 blk=0 avail=6576 (56.1%) swpO=0 conn=1 myRSS=2897 php=0 phpRSS=0 ap=16 tcp=22 topuser=- 2026-08-25 03:12:16 L1=0.43 run=2 blk=0 avail=6576 (56.1%) swpO=0 conn=1 myRSS=2897 php=0 phpRSS=0 ap=16 tcp=22 topuser=- 2026-08-25 03:12:26 L1=0.44 run=2 blk=0 avail=6523 (55.6%) swpO=0 conn=1 myRSS=2897 php=1 phpRSS=88 ap=15 tcp=21 topuser=aaa 2026-08-25 03:12:26 L1=0.44 run=4 blk=0 avail=6521 (55.6%) swpO=0 conn=1 myRSS=2897 php=1 phpRSS=88 ap=15 tcp=21 topuser=aaa 2026-08-25 03:12:36 L1=0.61 run=1 blk=0 avail=6574 (56.1%) swpO=0 conn=1 myRSS=2897 php=0 phpRSS=0 ap=15 tcp=24 topuser=- 2026-08-25 03:12:36 L1=0.61 run=2 blk=0 avail=6575 (56.1%) swpO=0 conn=1 myRSS=2897 php=0 phpRSS=0 ap=15 tcp=25 topuser=- 2026-08-25 03:12:46 L1=1.96 run=18 blk=0 avail=5099 (43.5%) swpO=1176 conn=16 myRSS=2866 php=15 phpRSS=1813 ap=30 tcp=89 topuser=madalice 2026-08-25 03:12:46 L1=1.96 run=19 blk=0 avail=5097 (43.5%) swpO=1176 conn=15 myRSS=2866 php=15 phpRSS=1843 ap=46 tcp=88 topuser=madalice