INCIDENT 2026-08-25 11:03:33 trigger: php_rss=2468MB ================================================================== load: 6.33 3.95 2.71 24/655 3943891 ncpu:10 mem_avail: 5102MB/11729MB (43.5%) swap_used:1130MB swapout:1281/s blocked(D):0 running:20 iowait:0.4% steal:0.0% php: 14 procs / 2468MB heaviest user: madalice (9 procs, 2099MB) apache: 64 procs tcp_estab: 67 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2024 madalice 8 1848 nobody 63 1048 root 236 819 netdata 8 272 evolution 8 233 infinium 1 125 cpanellogin 1 65 dovenull 6 47 mailman 20 24 vinesit 1 22 wp-toolkit 6 21 dovecot 3 18 zabbix 1 16 candyfabcom 1 14 alison 1 11 kurri 1 8 named 1 6 nscd 1 5 polkitd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 8 1668 evolution 5 221 infinium 1 125 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4755 MB Active(file): 3285 MB Inactive(file): 879 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 378 MB CommitLimit: 9960 MB Committed_AS: 9631 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1913717 root 09:52:16 616 /usr/bin/imunify-agent-proxy 3941860 root 02:13 60800 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2072752 17.9 Ssl 07:32:16 /usr/sbin/mariadbd 3943802 3943801 madalice 265268 40.5 S 00:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3943824 3943819 madalice 259132 56.2 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3943817 3924892 madalice 236592 46.2 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3943815 3926499 madalice 226712 45.4 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 222012 2.5 Ssl 57-00:53:42 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3943812 3943810 madalice 199828 37.6 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2160755 2145741 root 171248 0.0 S 08:38:09 spamd child 3943813 3943811 madalice 160180 48.6 R 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2160756 2145741 root 151260 0.0 S 08:38:09 spamd child 3943845 3927002 infinium 128300 22.0 S 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 2575382 1 root 102028 0.0 Ss 10-03:13:03 /usr/lib/systemd/systemd-journald 2145741 1 root 75420 0.0 Ss 08:40:31 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3943768 3926275 evolution 68188 2.6 S 00:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3943902 3942852 evolution 67132 14.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3339629 1353308 cpanellogin 66748 0.0 S 02:44:14 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 3941860 1 root 60800 1.0 Ssl 02:13 /opt/imunify360/venv/bin/python3 -m imav.run 1353308 1 root 42460 0.0 Ss 34-08:22:12 cpsrvd (SSL) - waiting for connections 2223 1201 root 41608 0.0 Sl 57-00:53:41 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 41248 0.1 Ss 57-00:53:41 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 36556 0.1 Sl 57-00:53:37 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3925844 1276780 nobody 22652 0.2 S 04:59 /usr/sbin/httpd -k start 3851818 3828812 vinesit 22644 0.0 S 27:06 dovecot/imap 3926254 1276780 nobody 22260 0.0 S 04:30 /usr/sbin/httpd -k start 3940913 1276780 nobody 22132 0.0 S 03:19 /usr/sbin/httpd -k start 3940892 1276780 nobody 22092 0.0 S 03:20 /usr/sbin/httpd -k start 3926499 1276780 nobody 22048 0.0 S 04:14 /usr/sbin/httpd -k start 3942433 1276780 nobody 21804 0.0 S 01:35 /usr/sbin/httpd -k start 3924892 1276780 nobody 21496 0.0 S 06:13 /usr/sbin/httpd -k start 3926253 1276780 nobody 21384 0.0 S 04:30 /usr/sbin/httpd -k start 3926275 1276780 nobody 21232 0.0 S 04:29 /usr/sbin/httpd -k start 3925600 1276780 nobody 21116 0.2 S 05:17 /usr/sbin/httpd -k start 3942855 1276780 nobody 21020 0.0 S 01:13 /usr/sbin/httpd -k start 3940949 1276780 nobody 20680 0.0 S 03:14 /usr/sbin/httpd -k start 3942850 1276780 nobody 20616 0.0 S 01:13 /usr/sbin/httpd -k start 3941829 1276780 nobody 20292 0.0 S 02:17 /usr/sbin/httpd -k start 3942178 1276780 nobody 20188 0.0 S 01:59 /usr/sbin/httpd -k start 3943550 1276780 nobody 20128 0.2 S 00:24 /usr/sbin/httpd -k start 3942986 1276780 nobody 20060 0.0 S 01:04 /usr/sbin/httpd -k start 3942837 1276780 nobody 20028 0.0 S 01:14 /usr/sbin/httpd -k start 3943450 1276780 nobody 19652 0.0 S 00:31 /usr/sbin/httpd -k start 3943563 1276780 nobody 19652 0.1 S 00:23 /usr/sbin/httpd -k start 3942997 1276780 nobody 19464 0.0 S 01:03 /usr/sbin/httpd -k start 3942451 1276780 nobody 19280 0.0 S 01:34 /usr/sbin/httpd -k start 3943543 1276780 nobody 19048 0.0 S 00:25 /usr/sbin/httpd -k start 3942161 1276780 nobody 19020 0.1 S 02:00 /usr/sbin/httpd -k start 3942620 1276780 nobody 19000 0.0 S 01:32 /usr/sbin/httpd -k start 3942851 1276780 nobody 18828 0.0 S 01:13 /usr/sbin/httpd -k start 185104 2431 netdata 18812 2.1 Sl 12-14:30:00 /usr/libexec/netdata/plugins.d/apps.plugin 1 3942849 1276780 nobody 18808 0.0 S 01:13 /usr/sbin/httpd -k start 3923263 1276780 nobody 18796 0.0 S 08:13 /usr/sbin/httpd -k start 3943530 1276780 nobody 18744 0.0 S 00:26 /usr/sbin/httpd -k start 3943549 1276780 nobody 18632 0.0 S 00:24 /usr/sbin/httpd -k start 3943811 1276780 nobody 18352 0.0 S 00:06 /usr/sbin/httpd -k start 3943548 1276780 nobody 18224 0.0 S 00:24 /usr/sbin/httpd -k start 3942996 1276780 nobody 18132 0.0 S 01:03 /usr/sbin/httpd -k start 3942827 1276780 nobody 17960 0.0 S 01:15 /usr/sbin/httpd -k start 3927002 1276780 nobody 17332 0.0 S 03:43 /usr/sbin/httpd -k start 3942852 1276780 nobody 17148 0.0 S 01:13 /usr/sbin/httpd -k start 3942854 1276780 nobody 16844 0.1 S 01:13 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 3943897 D - /usr/sbin/httpd -k start 3943903 D - /usr/sbin/httpd -k start --- mariadb processlist (non-sleeping) --- +---------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 1818060 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 1818059 | root | 85-1559715131 | Execute | 0 | Creating sort index | SELECT accounts.id, accounts.accountcode, accounts.accountname, accounts.type, accounts.parent, accounts.children, accounts.balance, accountcats.name as category from accounts,accountcats where accounts.type=accountcats.id and accounts.status='1' and accounts.accountc | +---------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 534 madalice/madalice.com.au-ssl_log 203 infinium/infinium.net.au-ssl_log 128 evolution/portal.evolutionerp.com.au-ssl_log 118 infinium/infinium.net.au 82 cosgrovecreative/cosgrovecreative.com.au-ssl_log 18 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 392 203.54.180.238 204 68.155.159.216 129 103.104.165.99 92 20.151.129.194 77 103.104.164.114 56 20.104.50.220 44 172.182.200.96 18 172.212.194.58 11 182.239.240.254 11 150.228.163.253 10 147.161.213.78 6 180.181.236.49 6 110.174.119.207 5 40.77.167.50 4 118.127.40.55 --- top request paths across all vhosts (last 3 min) --- 237 POST /functions.php 97 GET /app/ajax.php 64 GET /index.php 44 GET /heartbeat.php 35 POST /plugins/csvexporter/plugin.php 30 GET /factory_session_checker.php 15 POST /app/ajax.php 15 GET /factory_session_processed_qty.php 14 GET /factory_session_joiner.php 12 POST /jobeditsave.php 12 POST /clienteditsave.php 12 POST /app/ajax/selectFilterSingle.php 7 POST //functions.php 7 GET /wp-login.php 6 POST /quoteditsave.php 6 POST /itemModify.php 6 POST /inveditsave.php 6 POST /app/ajax/selectFilter.php 6 GET /store/kids-custom-af1-cookie-shoes/ 5 POST /purchaseaddsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 237 POST /functions.php 97 GET /app/ajax.php 51 GET /index.php 35 POST /plugins/csvexporter/plugin.php 15 POST /app/ajax.php 12 POST /jobeditsave.php 12 POST /clienteditsave.php 12 POST /app/ajax/selectFilterSingle.php 7 POST //functions.php 6 POST /quoteditsave.php 6 POST /itemModify.php 6 POST /inveditsave.php -- last 10 requests -- 40.77.167.50 - - [25/Aug/2026:11:03:31 +1000] "GET /index.php?page=activities&keyword=IKA+MATA HTTP/1.1" 200 5265 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bing 203.54.180.238 - - [25/Aug/2026:11:03:31 +1000] "POST /app/templates/ajax.php HTTP/1.1" 200 4112 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K 103.104.165.99 - - [25/Aug/2026:11:03:31 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 103.104.165.99 - - [25/Aug/2026:11:03:31 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=11129" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 103.104.165.99 - - [25/Aug/2026:11:03:32 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=report&file=invReorderInsights" "Mozilla/5.0 (Windows NT 10.0; Win64; x 203.54.180.238 - - [25/Aug/2026:11:03:32 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 203.54.180.238 - - [25/Aug/2026:11:03:32 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=dispatch" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20 103.104.165.99 - - [25/Aug/2026:11:03:31 +1000] "POST /inveditsave.php?save=1 HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=invedit&id=4667&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) App 103.104.165.99 - - [25/Aug/2026:11:03:31 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 11103 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 103.104.165.99 - - [25/Aug/2026:11:03:33 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobregister&call=getUserSetting&caller=ajaxSubmitLocal&seq=11275356114 HTTP/1.1" 200 93 "https://my.evolutionerp.com.au/index.ph == madalice/madalice.com.au-ssl_log == -- top paths -- 6 GET /store/kids-custom-af1-cookie-shoes/ 5 GET /aaa.php 3 GET /wp-includes/Text/ 3 GET /admin.php 3 GET /about.php 3 GET /1.php 2 GET /xxx.php 2 GET /x7.php 2 GET /ws33.php 2 GET /wp-ws68.php 2 GET /wp-login.php 2 GET /wp-load.php -- last 10 requests -- 20.151.129.194 - - [25/Aug/2026:11:03:17 +1000] "GET /3cf97/ HTTP/1.1" 404 30631 "-" "-" 114.119.140.234 - - [25/Aug/2026:11:03:17 +1000] "GET /store/kids-custom-af1-cookie-shoes/?rating=5&wcpr_page=4 HTTP/1.1" 200 45895 "https://madalice.com.au/store/kids-custom-af1-cookie-shoes/?rating=5&wcpr_page=4" "Mozi 20.104.50.220 - - [25/Aug/2026:11:03:19 +1000] "GET /x7.php HTTP/1.1" 301 1 "-" "-" 20.151.129.194 - - [25/Aug/2026:11:03:19 +1000] "GET /12.php HTTP/1.1" 404 30635 "-" "-" 20.104.50.220 - - [25/Aug/2026:11:03:22 +1000] "GET /x7.php HTTP/1.1" 404 30635 "-" "-" 20.151.129.194 - - [25/Aug/2026:11:03:22 +1000] "GET /term.php HTTP/1.1" 404 30638 "-" "-" 20.104.50.220 - - [25/Aug/2026:11:03:24 +1000] "GET /moon.php HTTP/1.1" 301 1 "-" "-" 208.115.206.123 - - [25/Aug/2026:11:03:26 +1000] "GET /mysql.sql HTTP/1.1" 404 30625 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Safari/605.1.15" 208.115.206.123 - - [25/Aug/2026:11:03:26 +1000] "GET /db_backup.sql HTTP/1.1" 404 30625 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.4.1 Safari/605.1.15" 208.115.206.123 - - [25/Aug/2026:11:03:26 +1000] "GET /madalice.com.au.sql HTTP/1.1" 404 30621 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:104.0) Gecko/20100101 Firefox/104.0" == infinium/infinium.net.au-ssl_log == -- top paths -- 5 GET /wp-login.php 3 POST /wp-cron.php 2 GET /wp-admin/maint/ 1 POST /wp-comments-post.php 1 GET /zwso.php 1 GET /wp-seo.php 1 GET /wp-load.php 1 GET /wp-json/wp/v2/posts 1 GET /wp-json/wp/v2/comments 1 GET /wp-includes/SimplePie/index.php 1 GET /wp-includes/SimplePie/admin.php 1 GET /wp-includes/SimplePie/ -- last 10 requests -- 68.155.159.216 - - [25/Aug/2026:11:03:11 +1000] "GET /mah/function.php HTTP/1.1" 404 67725 "-" "-" 68.155.159.216 - - [25/Aug/2026:11:03:13 +1000] "GET /go.php HTTP/1.1" 404 67725 "-" "-" 68.155.159.216 - - [25/Aug/2026:11:03:14 +1000] "GET /cgi-bin/index.php HTTP/1.1" 301 - "-" "-" 68.155.159.216 - - [25/Aug/2026:11:03:15 +1000] "GET /cgi-bin/ HTTP/1.1" 404 67725 "-" "-" 68.155.159.216 - - [25/Aug/2026:11:03:16 +1000] "GET /wp-includes/buy.php HTTP/1.1" 404 67725 "-" "-" 68.155.159.216 - - [25/Aug/2026:11:03:18 +1000] "GET /wp-content/themes/astra/inc/ki1k.php HTTP/1.1" 404 67725 "-" "-" 68.155.159.216 - - [25/Aug/2026:11:03:19 +1000] "GET /erin1.PhP7 HTTP/1.1" 404 67725 "-" "-" 68.155.159.216 - - [25/Aug/2026:11:03:20 +1000] "GET /home/function.php HTTP/1.1" 404 67725 "-" "-" 68.155.159.216 - - [25/Aug/2026:11:03:21 +1000] "GET /wp-login.php HTTP/1.1" 200 6922 "-" "-" 68.155.159.216 - - [25/Aug/2026:11:03:22 +1000] "GET /wp-content/index.php HTTP/1.1" 200 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-25 11:01:12 L1=4.44 run=5 blk=0 avail=6986 (59.6%) swpO=0 conn=5 myRSS=2028 php=4 phpRSS=391 ap=41 tcp=39 topuser=madalice 2026-08-25 11:01:12 L1=4.44 run=7 blk=0 avail=6770 (57.7%) swpO=0 conn=7 myRSS=2028 php=5 phpRSS=638 ap=41 tcp=41 topuser=madalice 2026-08-25 11:01:22 L1=4.44 run=6 blk=0 avail=6685 (57.0%) swpO=0 conn=5 myRSS=2028 php=4 phpRSS=368 ap=45 tcp=41 topuser=madalice 2026-08-25 11:01:22 L1=4.44 run=3 blk=0 avail=6920 (59.0%) swpO=0 conn=7 myRSS=2028 php=2 phpRSS=300 ap=45 tcp=42 topuser=madalice 2026-08-25 11:01:32 L1=4.21 run=6 blk=0 avail=6845 (58.4%) swpO=0 conn=5 myRSS=2028 php=6 phpRSS=554 ap=41 tcp=42 topuser=madalice 2026-08-25 11:01:32 L1=4.21 run=10 blk=0 avail=6850 (58.4%) swpO=0 conn=7 myRSS=2028 php=6 phpRSS=559 ap=41 tcp=44 topuser=madalice 2026-08-25 11:01:42 L1=4.11 run=8 blk=0 avail=6558 (55.9%) swpO=0 conn=5 myRSS=2028 php=6 phpRSS=654 ap=46 tcp=38 topuser=madalice 2026-08-25 11:01:42 L1=4.11 run=5 blk=0 avail=6904 (58.9%) swpO=0 conn=7 myRSS=2028 php=5 phpRSS=429 ap=46 tcp=38 topuser=madalice 2026-08-25 11:01:52 L1=4.38 run=3 blk=0 avail=6806 (58.0%) swpO=0 conn=3 myRSS=2028 php=3 phpRSS=508 ap=42 tcp=34 topuser=madalice 2026-08-25 11:01:53 L1=4.38 run=2 blk=0 avail=7202 (61.4%) swpO=0 conn=7 myRSS=2028 php=1 phpRSS=41 ap=42 tcp=34 topuser=infinium 2026-08-25 11:02:02 L1=4.57 run=6 blk=0 avail=6865 (58.5%) swpO=0 conn=3 myRSS=2028 php=4 phpRSS=435 ap=46 tcp=46 topuser=madalice 2026-08-25 11:02:03 L1=4.57 run=6 blk=0 avail=6780 (57.8%) swpO=0 conn=4 myRSS=2028 php=3 phpRSS=481 ap=46 tcp=44 topuser=madalice 2026-08-25 11:02:12 L1=4.39 run=9 blk=0 avail=6611 (56.4%) swpO=0 conn=3 myRSS=2028 php=7 phpRSS=747 ap=40 tcp=38 topuser=madalice 2026-08-25 11:02:13 L1=4.39 run=5 blk=0 avail=6670 (56.9%) swpO=0 conn=4 myRSS=2028 php=5 phpRSS=719 ap=40 tcp=39 topuser=madalice 2026-08-25 11:02:22 L1=4.63 run=4 blk=0 avail=6924 (59.0%) swpO=0 conn=3 myRSS=2028 php=3 phpRSS=294 ap=54 tcp=53 topuser=madalice 2026-08-25 11:02:23 L1=4.63 run=7 blk=0 avail=6889 (58.7%) swpO=0 conn=4 myRSS=2028 php=4 phpRSS=362 ap=54 tcp=53 topuser=madalice 2026-08-25 11:02:32 L1=4.76 run=9 blk=0 avail=6520 (55.6%) swpO=0 conn=3 myRSS=2028 php=5 phpRSS=636 ap=62 tcp=60 topuser=madalice 2026-08-25 11:02:33 L1=4.76 run=6 blk=0 avail=6721 (57.3%) swpO=0 conn=4 myRSS=2028 php=5 phpRSS=480 ap=62 tcp=58 topuser=madalice 2026-08-25 11:02:42 L1=4.87 run=5 blk=0 avail=6791 (57.9%) swpO=0 conn=3 myRSS=2028 php=4 phpRSS=408 ap=56 tcp=49 topuser=madalice 2026-08-25 11:02:43 L1=4.87 run=8 blk=0 avail=6779 (57.8%) swpO=0 conn=4 myRSS=2028 php=4 phpRSS=428 ap=55 tcp=48 topuser=madalice 2026-08-25 11:02:52 L1=4.80 run=6 blk=0 avail=6439 (54.9%) swpO=0 conn=5 myRSS=2028 php=5 phpRSS=862 ap=50 tcp=39 topuser=madalice 2026-08-25 11:02:53 L1=4.80 run=8 blk=0 avail=6641 (56.6%) swpO=0 conn=4 myRSS=2028 php=5 phpRSS=674 ap=50 tcp=38 topuser=madalice 2026-08-25 11:03:03 L1=4.90 run=6 blk=0 avail=6677 (56.9%) swpO=0 conn=5 myRSS=2028 php=5 phpRSS=657 ap=44 tcp=46 topuser=madalice 2026-08-25 11:03:03 L1=4.90 run=9 blk=0 avail=6588 (56.2%) swpO=0 conn=4 myRSS=2028 php=6 phpRSS=733 ap=45 tcp=41 topuser=madalice 2026-08-25 11:03:13 L1=4.52 run=7 blk=0 avail=6687 (57.0%) swpO=0 conn=5 myRSS=2028 php=4 phpRSS=519 ap=60 tcp=46 topuser=madalice 2026-08-25 11:03:13 L1=4.52 run=9 blk=0 avail=6617 (56.4%) swpO=0 conn=4 myRSS=2028 php=4 phpRSS=556 ap=59 tcp=46 topuser=madalice 2026-08-25 11:03:23 L1=4.37 run=4 blk=0 avail=6919 (59.0%) swpO=0 conn=5 myRSS=2028 php=3 phpRSS=304 ap=52 tcp=46 topuser=madalice 2026-08-25 11:03:23 L1=4.37 run=6 blk=0 avail=6818 (58.1%) swpO=0 conn=4 myRSS=2028 php=3 phpRSS=407 ap=52 tcp=44 topuser=madalice 2026-08-25 11:03:33 L1=6.33 run=20 blk=0 avail=5102 (43.5%) swpO=1281 conn=13 myRSS=2024 php=14 phpRSS=2468 ap=64 tcp=67 topuser=madalice 2026-08-25 11:03:33 L1=6.33 run=16 blk=0 avail=6096 (52.0%) swpO=1281 conn=4 myRSS=2024 php=8 phpRSS=1253 ap=66 tcp=62 topuser=madalice