INCIDENT 2026-08-26 18:39:42 trigger: php_rss=1721MB mysql_conn=15 ================================================================== load: 4.52 2.71 1.72 14/616 2228935 ncpu:10 mem_avail: 5502MB/11729MB (46.9%) swap_used:1479MB swapout:0/s blocked(D):0 running:16 iowait:0.1% steal:0.0% php: 13 procs / 1721MB heaviest user: madalice (12 procs, 1574MB) apache: 40 procs tcp_estab: 48 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2410 madalice 12 1711 root 237 789 nobody 39 707 netdata 8 256 mailman 20 202 alison 1 147 cpanellogin 1 62 dovenull 6 46 wp-toolkit 6 43 dovecot 3 19 evolution 6 16 zabbix 1 11 aaa 1 11 kurri 1 7 named 1 6 nscd 1 4 dbus 1 3 cpanelconnecttrack 1 3 polkitd 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 12 1565 alison 1 147 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5002 MB Active(file): 3702 MB Inactive(file): 650 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 428 MB CommitLimit: 9960 MB Committed_AS: 8949 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2703186 root 17:28:25 4808 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2468424 16.3 Ssl 1-15:08:25 /usr/sbin/mariadbd 2228857 2226372 madalice 272980 113 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 201984 2.5 Ssl 58-08:29:51 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1065018 2938778 root 191936 0.1 S 05:27:37 spamd child 2228866 2228764 madalice 188704 162 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2228864 2228676 madalice 187244 162 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2228865 2227568 madalice 186956 163 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2228863 2228307 alison 151856 59.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2228869 2227541 madalice 147276 119 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2956399 2938778 root 145444 0.0 S 16:09:43 spamd child 2228870 2228326 madalice 116780 88.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2228877 2228765 madalice 100908 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2228875 2228871 madalice 96240 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2938778 1 root 94792 0.0 Ss 16:16:13 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2228873 2227563 madalice 80112 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2228874 2228872 madalice 74272 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 63992 0.0 Ss 11-10:49:12 /usr/lib/systemd/systemd-journald 2175075 1353308 cpanellogin 63680 0.0 S 18:19 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 1353308 1 root 42008 0.0 Ss 35-15:58:21 cpsrvd (SSL) - waiting for connections 2223 1201 root 41708 0.0 Sl 58-08:29:50 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 33244 0.1 Sl 58-08:29:46 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2228974 2220104 madalice 30844 0.0 S 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2228432 1198 wp-toolkit 26860 0.0 S 00:35 sw-engine-fpm: pool wordpress-toolkit 1469 1 root 25728 0.1 Ss 58-08:29:50 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2220104 1276780 nobody 22328 0.1 S 04:34 /usr/sbin/httpd -k start 1463 1 root 21684 0.0 Ss 58-08:29:50 tailwatchd 2227554 1276780 nobody 21560 0.1 S 01:17 /usr/sbin/httpd -k start 2226777 1276780 nobody 21232 0.1 S 02:37 /usr/sbin/httpd -k start 2227545 1276780 nobody 21012 0.1 S 01:18 /usr/sbin/httpd -k start 2226372 1276780 nobody 20816 0.1 S 03:12 /usr/sbin/httpd -k start 2228324 1276780 nobody 20620 0.1 S 00:42 /usr/sbin/httpd -k start 2227568 1276780 nobody 20592 0.1 S 01:16 /usr/sbin/httpd -k start 2228307 1276780 nobody 20392 0.1 S 00:43 /usr/sbin/httpd -k start 2227541 1276780 nobody 20356 0.1 S 01:19 /usr/sbin/httpd -k start 2227281 1276780 nobody 20324 0.1 S 01:45 /usr/sbin/httpd -k start 2227564 1276780 nobody 20312 0.1 S 01:16 /usr/sbin/httpd -k start 2938201 1 root 20224 0.0 Ss 16:16:47 lfd - sleeping 2227556 1276780 nobody 20144 0.1 S 01:17 /usr/sbin/httpd -k start 2227563 1276780 nobody 20084 0.1 S 01:16 /usr/sbin/httpd -k start 2227570 1276780 nobody 20040 0.1 S 01:16 /usr/sbin/httpd -k start 2227584 1276780 nobody 20040 0.1 S 01:15 /usr/sbin/httpd -k start 2227582 1276780 nobody 19996 0.1 S 01:15 /usr/sbin/httpd -k start 2228300 1276780 nobody 19984 0.1 S 00:44 /usr/sbin/httpd -k start 185104 2431 netdata 19940 2.1 Sl 13-22:06:09 /usr/libexec/netdata/plugins.d/apps.plugin 1 2227585 1276780 nobody 19936 0.1 S 01:15 /usr/sbin/httpd -k start 2228301 1276780 nobody 19920 0.1 S 00:44 /usr/sbin/httpd -k start 2228305 1276780 nobody 19892 0.1 S 00:43 /usr/sbin/httpd -k start 2228304 1276780 nobody 19884 0.1 S 00:43 /usr/sbin/httpd -k start 2228774 1276780 nobody 19812 0.2 S 00:15 /usr/sbin/httpd -k start 2228767 1276780 nobody 19700 0.1 S 00:16 /usr/sbin/httpd -k start 2228776 1276780 nobody 19652 0.2 S 00:15 /usr/sbin/httpd -k start 2228775 1276780 nobody 19588 0.1 S 00:15 /usr/sbin/httpd -k start 2228326 1276780 nobody 19444 0.0 S 00:42 /usr/sbin/httpd -k start 2228759 1276780 nobody 18700 0.1 S 00:17 /usr/sbin/httpd -k start 2228764 1276780 nobody 18644 0.1 S 00:16 /usr/sbin/httpd -k start 2228676 1276780 nobody 18604 0.0 S 00:28 /usr/sbin/httpd -k start 2228777 1276780 nobody 18600 0.0 S 00:15 /usr/sbin/httpd -k start 2228773 1276780 nobody 18568 0.1 S 00:15 /usr/sbin/httpd -k start 2228772 1276780 nobody 18260 0.1 S 00:15 /usr/sbin/httpd -k start 2228765 1276780 nobody 16664 0.0 S 00:16 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 8813138 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 198 evolution/evolutionerp.com.au-ssl_log 75 vinesit/vinesit.com.au-ssl_log 36 aaa/aaadownunder.com.au-ssl_log 34 evolution/my.evolutionerp.com.au-ssl_log 32 evolution/portal.evolutionerp.com.au-ssl_log 24 corpkicks/corporatekicks.com.au-ssl_log 4 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 132 64.31.55.44 75 158.23.162.109 58 20.104.104.62 35 52.139.37.240 34 20.151.129.194 24 203.54.180.238 22 101.119.90.203 7 180.181.236.49 2 118.127.40.55 2 114.119.140.234 1 86.107.103.67 1 52.167.144.217 1 43.173.173.8 1 40.77.167.126 1 34.196.51.17 --- top request paths across all vhosts (last 3 min) --- 24 GET /heartbeat.php 21 POST /wp-login.php 20 POST /xmlrpc.php 20 GET /wp-login.php 15 POST /functions.php 15 GET /xmlrpc.php 6 POST /purchaseaddsave.php 6 GET /index.php 2 POST /wp-cron.php 2 GET /wp-load.php 2 GET /wp-includes/ID3/about.php 2 GET /.well-known/about.php 2 GET /updates.php 2 GET /store/design-your-own-kicks-copy/ 2 GET /store/delivery-insurance/ 2 GET /simple.php 2 GET /madalice.com.au.tar 2 GET /madalice.com.au.bz2 2 GET /madalice.com.au.7z 2 GET /db.tar --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 2 GET /store/design-your-own-kicks-copy/ 2 GET /store/delivery-insurance/ 2 GET /madalice.com.au.tar 2 GET /madalice.com.au.bz2 2 GET /madalice.com.au.7z 2 GET /db.tar 2 GET /db.bz2 2 GET /db.7z 1 POST /wp-login.php 1 GET /www.tar 1 GET /wwwroot.tar 1 GET /wwwroot.bz2 -- last 10 requests -- 20.104.104.62 - - [26/Aug/2026:18:39:29 +1000] "GET /wp-content/plugins/Cache/Cache.php HTTP/1.1" 404 36643 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/53 20.104.104.62 - - [26/Aug/2026:18:39:32 +1000] "GET /wp-admin/js/widgets/about.php7 HTTP/1.1" 404 36648 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 64.31.55.44 - - [26/Aug/2026:18:39:33 +1000] "GET /tmp.bz2 HTTP/1.1" 404 36645 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:107.0) Gecko/20100101 Firefox/107.0" 20.104.104.62 - - [26/Aug/2026:18:39:35 +1000] "GET /wp-p.php7 HTTP/1.1" 404 36640 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 64.31.55.44 - - [26/Aug/2026:18:39:35 +1000] "GET /db.bz2 HTTP/1.1" 404 36643 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/602.4.8 (KHTML, like Gecko) Version/10.0.3 Safari/602.4.8" 64.31.55.44 - - [26/Aug/2026:18:39:36 +1000] "GET /data.bz2 HTTP/1.1" 404 36644 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.9 Mobile/15E148 Safari/604.1" 64.31.55.44 - - [26/Aug/2026:18:39:36 +1000] "GET /upload.bz2 HTTP/1.1" 404 36642 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.3" 64.31.55.44 - - [26/Aug/2026:18:39:36 +1000] "GET /ftp.bz2 HTTP/1.1" 404 36645 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" 64.31.55.44 - - [26/Aug/2026:18:39:36 +1000] "GET /output.bz2 HTTP/1.1" 404 36645 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0" 64.31.55.44 - - [26/Aug/2026:18:39:37 +1000] "GET /src.bz2 HTTP/1.1" 404 36645 "-" "Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15" == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 20 POST /xmlrpc.php 20 POST /wp-login.php 20 GET /wp-login.php 15 GET /xmlrpc.php -- last 10 requests -- 158.23.162.109 - - [26/Aug/2026:18:37:59 +1000] "POST /wp-login.php HTTP/1.1" 200 11767 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.162.109 - - [26/Aug/2026:18:37:59 +1000] "POST /xmlrpc.php HTTP/1.1" 301 - "https://www.evolutionerp.com.au" "Mozilla/5.0 (Linux; Android 11; Nokia G50) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.61 158.23.162.109 - - [26/Aug/2026:18:38:01 +1000] "GET /xmlrpc.php HTTP/1.1" 404 123836 "https://www.evolutionerp.com.au" "Mozilla/5.0 (Linux; Android 11; Nokia G50) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312 158.23.162.109 - - [26/Aug/2026:18:38:02 +1000] "GET /wp-login.php HTTP/1.1" 200 11767 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" 158.23.162.109 - - [26/Aug/2026:18:38:03 +1000] "POST /wp-login.php HTTP/1.1" 200 11767 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" 158.23.162.109 - - [26/Aug/2026:18:38:04 +1000] "POST /xmlrpc.php HTTP/1.1" 301 - "https://www.evolutionerp.com.au" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0" 158.23.162.109 - - [26/Aug/2026:18:38:05 +1000] "GET /xmlrpc.php HTTP/1.1" 404 123838 "https://www.evolutionerp.com.au" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0" 158.23.162.109 - - [26/Aug/2026:18:38:06 +1000] "GET /wp-login.php HTTP/1.1" 200 11767 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" 158.23.162.109 - - [26/Aug/2026:18:38:08 +1000] "POST /wp-login.php HTTP/1.1" 200 11767 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" 158.23.162.109 - - [26/Aug/2026:18:38:09 +1000] "POST /xmlrpc.php HTTP/1.1" 301 - "https://www.evolutionerp.com.au" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430 == vinesit/vinesit.com.au-ssl_log == -- top paths -- 1 GET /xmrlpc.php 1 GET /wp-trackback.php 1 GET /wp-signup.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-load.php 1 GET /wp-cron.php 1 GET /wp-conflg.php 1 GET /wp-comments-post.php 1 GET /wp-blog-header.php 1 GET /wp-activate.php 1 GET /wp-2019.php -- last 10 requests -- 52.139.37.240 - - [26/Aug/2026:18:37:52 +1000] "GET /wp-conflg.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [26/Aug/2026:18:37:53 +1000] "GET /bypass.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [26/Aug/2026:18:37:53 +1000] "GET /404.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [26/Aug/2026:18:37:53 +1000] "GET /updates.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [26/Aug/2026:18:37:53 +1000] "GET /radio.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [26/Aug/2026:18:37:54 +1000] "GET /xmrlpc.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [26/Aug/2026:18:37:54 +1000] "GET /ae.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [26/Aug/2026:18:37:54 +1000] "GET /moon.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [26/Aug/2026:18:37:54 +1000] "GET /blog.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [26/Aug/2026:18:37:54 +1000] "GET /ini.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-26 18:37:19 L1=2.27 run=4 blk=0 avail=6791 (57.9%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=231 ap=23 tcp=24 topuser=evolution 2026-08-26 18:37:19 L1=2.27 run=3 blk=0 avail=6779 (57.8%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=242 ap=23 tcp=24 topuser=evolution 2026-08-26 18:37:29 L1=2.38 run=3 blk=0 avail=6668 (56.9%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=360 ap=23 tcp=19 topuser=madalice 2026-08-26 18:37:29 L1=2.38 run=3 blk=0 avail=6662 (56.8%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=377 ap=23 tcp=18 topuser=madalice 2026-08-26 18:37:39 L1=2.16 run=3 blk=0 avail=6786 (57.9%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=258 ap=20 tcp=21 topuser=madalice 2026-08-26 18:37:39 L1=2.16 run=2 blk=0 avail=6769 (57.7%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=270 ap=20 tcp=21 topuser=madalice 2026-08-26 18:37:49 L1=1.83 run=3 blk=0 avail=6814 (58.1%) swpO=0 conn=2 myRSS=2427 php=1 phpRSS=153 ap=20 tcp=22 topuser=madalice 2026-08-26 18:37:49 L1=1.83 run=2 blk=0 avail=6807 (58.0%) swpO=0 conn=2 myRSS=2427 php=1 phpRSS=160 ap=20 tcp=22 topuser=madalice 2026-08-26 18:37:59 L1=1.93 run=4 blk=0 avail=6868 (58.6%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=103 ap=24 tcp=24 topuser=madalice 2026-08-26 18:38:00 L1=1.93 run=3 blk=0 avail=6836 (58.3%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=131 ap=24 tcp=24 topuser=madalice 2026-08-26 18:38:10 L1=1.87 run=4 blk=0 avail=6560 (55.9%) swpO=0 conn=3 myRSS=2427 php=3 phpRSS=449 ap=22 tcp=27 topuser=corpkicks 2026-08-26 18:38:10 L1=1.87 run=5 blk=0 avail=6541 (55.8%) swpO=0 conn=2 myRSS=2427 php=3 phpRSS=471 ap=22 tcp=27 topuser=corpkicks 2026-08-26 18:38:20 L1=1.81 run=2 blk=0 avail=6821 (58.2%) swpO=0 conn=3 myRSS=2427 php=1 phpRSS=149 ap=19 tcp=24 topuser=madalice 2026-08-26 18:38:20 L1=1.81 run=2 blk=0 avail=6815 (58.1%) swpO=0 conn=2 myRSS=2427 php=2 phpRSS=164 ap=19 tcp=24 topuser=madalice 2026-08-26 18:38:30 L1=2.40 run=8 blk=0 avail=5977 (51.0%) swpO=737 conn=3 myRSS=2410 php=5 phpRSS=966 ap=48 tcp=48 topuser=madalice 2026-08-26 18:38:30 L1=2.40 run=6 blk=0 avail=5928 (50.5%) swpO=737 conn=2 myRSS=2410 php=5 phpRSS=1025 ap=48 tcp=48 topuser=madalice 2026-08-26 18:38:40 L1=2.33 run=21 blk=0 avail=4987 (42.5%) swpO=0 conn=15 myRSS=2410 php=13 phpRSS=2292 ap=38 tcp=35 topuser=madalice 2026-08-26 18:38:40 L1=2.33 run=16 blk=0 avail=5047 (43.0%) swpO=0 conn=15 myRSS=2410 php=13 phpRSS=2241 ap=38 tcp=35 topuser=madalice 2026-08-26 18:38:51 L1=2.91 run=3 blk=0 avail=6799 (58.0%) swpO=0 conn=15 myRSS=2410 php=1 phpRSS=121 ap=31 tcp=20 topuser=madalice 2026-08-26 18:38:51 L1=2.91 run=3 blk=0 avail=6799 (58.0%) swpO=0 conn=15 myRSS=2410 php=1 phpRSS=121 ap=31 tcp=20 topuser=madalice 2026-08-26 18:39:01 L1=3.91 run=11 blk=1 avail=5600 (47.7%) swpO=0 conn=15 myRSS=2410 php=6 phpRSS=1394 ap=43 tcp=35 topuser=madalice 2026-08-26 18:39:01 L1=3.91 run=11 blk=0 avail=5603 (47.8%) swpO=0 conn=15 myRSS=2410 php=6 phpRSS=1404 ap=43 tcp=35 topuser=madalice 2026-08-26 18:39:12 L1=4.26 run=12 blk=0 avail=6075 (51.8%) swpO=0 conn=15 myRSS=2410 php=8 phpRSS=981 ap=33 tcp=40 topuser=madalice 2026-08-26 18:39:12 L1=4.26 run=14 blk=0 avail=6097 (52.0%) swpO=0 conn=8 myRSS=2410 php=8 phpRSS=952 ap=33 tcp=40 topuser=madalice 2026-08-26 18:39:22 L1=4.21 run=6 blk=0 avail=6538 (55.7%) swpO=0 conn=8 myRSS=2410 php=4 phpRSS=475 ap=31 tcp=26 topuser=madalice 2026-08-26 18:39:22 L1=4.21 run=5 blk=0 avail=6546 (55.8%) swpO=0 conn=5 myRSS=2410 php=4 phpRSS=469 ap=31 tcp=26 topuser=madalice 2026-08-26 18:39:32 L1=4.32 run=1 blk=0 avail=6791 (57.9%) swpO=0 conn=8 myRSS=2410 php=0 phpRSS=0 ap=45 tcp=36 topuser=- 2026-08-26 18:39:32 L1=4.32 run=3 blk=0 avail=6790 (57.9%) swpO=0 conn=5 myRSS=2410 php=0 phpRSS=0 ap=45 tcp=36 topuser=- 2026-08-26 18:39:42 L1=4.52 run=16 blk=0 avail=5502 (46.9%) swpO=0 conn=15 myRSS=2410 php=13 phpRSS=1721 ap=40 tcp=48 topuser=madalice 2026-08-26 18:39:42 L1=4.52 run=18 blk=0 avail=5465 (46.6%) swpO=0 conn=13 myRSS=2410 php=13 phpRSS=1799 ap=40 tcp=49 topuser=madalice