INCIDENT 2026-08-28 00:29:53 trigger: php_rss=1596MB ================================================================== load: 1.07 1.00 1.14 6/698 91682 ncpu:10 mem_avail: 7308MB/13777MB (53.0%) swap_used:2584MB swapout:0/s blocked(D):0 running:5 iowait:0.2% steal:0.0% php: 14 procs / 1596MB heaviest user: madalice (7 procs, 1098MB) apache: 42 procs tcp_estab: 42 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2717 madalice 7 1098 root 249 947 nobody 41 712 netdata 8 262 tubesupplies 2 236 evolution 7 207 cpanellogin 1 108 kurri 4 49 mailman 20 47 dovenull 6 45 infinium 3 42 lowrange 2 28 dovecot 3 18 wp-toolkit 6 17 vinesit 1 14 aaa 1 14 mailnull 3 13 zabbix 1 12 nscd 1 6 --- php workers by user --- USER PROCS RSS_MB madalice 7 1099 tubesupplies 2 239 evolution 3 207 root 2 72 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5376 MB Active(file): 2380 MB Inactive(file): 2908 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 440 MB CommitLimit: 10984 MB Committed_AS: 8991 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3565593 root 23:18:36 3420 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2782604 15.6 Ssl 2-20:58:36 /usr/sbin/mariadbd 1220 1 netdata 207160 2.5 Ssl 59-14:20:02 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1910875 3797563 root 172456 0.1 S 11:16:00 spamd child 91387 3787359 madalice 166760 15.3 R 00:20 php-fpm: pool madalice_com_au 91226 3787359 madalice 161004 21.9 S 00:37 php-fpm: pool madalice_com_au 91390 3787359 madalice 160152 17.7 S 00:20 php-fpm: pool madalice_com_au 91420 3787359 madalice 159924 12.4 S 00:20 php-fpm: pool madalice_com_au 91389 3787359 madalice 159736 17.9 S 00:20 php-fpm: pool madalice_com_au 91418 3787359 madalice 159732 12.7 S 00:20 php-fpm: pool madalice_com_au 91391 3787359 madalice 159684 12.3 S 00:20 php-fpm: pool madalice_com_au 3846467 3797563 root 138084 0.0 S 21:54:18 spamd child 91645 91485 tubesupplies 135900 115 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 126468 0.0 Ss 12-16:39:23 /usr/lib/systemd/systemd-journald 91646 91486 tubesupplies 118788 104 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2805458 1353308 cpanellogin 111184 0.0 S 07:10:24 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 91650 88593 evolution 108356 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3797563 1 root 78032 0.0 Ss 22:06:56 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4180059 4180015 evolution 70292 0.0 Ss 29:51 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 2223 1201 root 42148 0.0 Sl 59-14:20:01 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 91652 91494 evolution 41104 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3066250 1 root 39892 0.0 Ss 05:58:27 php-fpm: master process (/opt/cpanel/ea-php82/root/etc/php-fpm.conf) 4922 2431 netdata 35760 0.1 Sl 59-14:19:57 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3787359 1 root 34440 0.0 Ss 02:25:49 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 4180253 1 root 33940 0.0 Ss 29:50 lfd - sleeping 1353308 1 root 27480 0.0 Ss 36-21:48:32 cpsrvd (SSL) - waiting for connections 91651 1469 root 24800 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 88792 3066150 nobody 23976 0.0 S 04:13 /usr/sbin/httpd -k start 88593 3066150 nobody 23888 0.1 S 04:27 /usr/sbin/httpd -k start 88819 3066150 nobody 23804 0.1 S 04:12 /usr/sbin/httpd -k start 89825 3066150 nobody 23592 0.0 S 02:53 /usr/sbin/httpd -k start 72322 3066150 nobody 23084 0.0 S 07:38 /usr/sbin/httpd -k start 74640 3066150 nobody 22380 0.0 S 04:56 /usr/sbin/httpd -k start 88795 3066150 nobody 21980 0.0 S 04:13 /usr/sbin/httpd -k start 89827 3066150 nobody 21796 0.0 S 02:53 /usr/sbin/httpd -k start 89809 3066150 nobody 21620 0.0 S 02:54 /usr/sbin/httpd -k start 89826 3066150 nobody 21200 0.0 S 02:53 /usr/sbin/httpd -k start 88778 3066150 nobody 20764 0.0 S 04:14 /usr/sbin/httpd -k start 90498 3066150 nobody 20252 0.0 S 01:57 /usr/sbin/httpd -k start 91445 3066150 nobody 20220 0.1 S 00:20 /usr/sbin/httpd -k start 185104 2431 netdata 19780 2.1 Sl 15-03:56:20 /usr/libexec/netdata/plugins.d/apps.plugin 1 1469 1 root 19732 0.1 Ss 59-14:20:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 88828 3066150 nobody 19520 0.0 S 04:12 /usr/sbin/httpd -k start 91453 3066150 nobody 19224 0.1 S 00:19 /usr/sbin/httpd -k start 91452 3066150 nobody 19192 0.1 S 00:19 /usr/sbin/httpd -k start 90980 3066150 nobody 19136 0.0 S 01:08 /usr/sbin/httpd -k start 91462 3066150 nobody 18076 0.0 S 00:18 /usr/sbin/httpd -k start 91324 3066150 nobody 18020 0.0 S 00:30 /usr/sbin/httpd -k start 91472 3066150 nobody 17732 0.0 S 00:17 /usr/sbin/httpd -k start 91491 3066150 nobody 17636 0.0 S 00:16 /usr/sbin/httpd -k start 91476 3066150 nobody 17216 0.0 S 00:17 /usr/sbin/httpd -k start 91478 3066150 nobody 17176 0.0 S 00:17 /usr/sbin/httpd -k start 91488 3066150 nobody 17164 0.0 S 00:16 /usr/sbin/httpd -k start 91485 3066150 nobody 17128 0.0 S 00:16 /usr/sbin/httpd -k start 91486 3066150 nobody 17128 0.0 S 00:16 /usr/sbin/httpd -k start 91473 3066150 nobody 17112 0.0 S 00:17 /usr/sbin/httpd -k start 91530 3066150 nobody 17012 0.0 S 00:11 /usr/sbin/httpd -k start 84002 1471 root 16840 0.0 S 04:44 cPhulkd - dbprocessor 91522 3066150 nobody 16696 0.0 S 00:12 /usr/sbin/httpd -k start 91500 3066150 nobody 16688 0.0 S 00:15 /usr/sbin/httpd -k start 91494 3066150 nobody 16676 0.0 S 00:16 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 14132958 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min tubesupplies/tubesupplies.com.au-ssl_log 132 olympic/seb-mobile-auth.olympicfencing.com.au-ssl_log 98 evolution/evolutionerp.com.au-ssl_log 91 evolution/evolutionerp.com.au 71 aaa/aaadownunder.com.au-ssl_log 39 evolution/portal.evolutionerp.com.au-ssl_log 24 olympic/olympicfencing.com.au-ssl_log 24 olympic/olympicfencing.com.au 14 madalice/madalice.com.au-ssl_log 9 corpkicks/corporatekicks.com.au-ssl_log 3 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 160 20.104.50.220 98 158.158.54.35 78 20.48.250.41 49 20.220.227.7 39 20.48.251.3 25 169.58.198.241 24 203.54.180.238 11 146.70.194.254 4 13.229.119.94 3 179.43.145.34 3 118.127.40.55 2 91.92.243.243 1 74.7.230.6 1 74.7.227.177 1 50.6.169.131 --- top request paths across all vhosts (last 3 min) --- 24 GET /heartbeat.php 7 GET / 4 GET /wp-includes/widgets/ 4 GET /wp-includes/fonts/ 3 POST /wp-cron.php 3 GET /wp-p2r3q9c8k4.php 3 GET /wp-includes/css/ 3 GET /wp-blog.php 3 GET /worksec.php 3 GET /store/hand-painted-nike-af1-seaeagles/ 3 GET /num.php 3 GET /init.php 3 GET /fs.php 3 GET /cilus.php 3 GET /7.php 3 GET /3.php 2 POST /wp-login.php 2 GET /zeal.php 2 GET /ynz.PhP7 2 GET /ws61.php --- busiest 3 vhosts: top paths + last 10 requests --- == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 2 POST /wp-login.php 2 GET /sd.php 1 POST /wp-cron.php 1 GET /xxw.php 1 GET /xwx1.php 1 GET /xiugai.php 1 GET /xa.php 1 GET /ws87.php 1 GET /ws85.php 1 GET /ws80.php 1 GET /ws78.php 1 GET /ws58.php -- last 10 requests -- 20.220.227.7 - - [28/Aug/2026:00:29:33 +1000] "GET /ans.php HTTP/1.1" 401 36 "-" "-" 20.220.227.7 - - [28/Aug/2026:00:29:33 +1000] "GET /k2.php HTTP/1.1" 401 36 "-" "-" 20.220.227.7 - - [28/Aug/2026:00:29:34 +1000] "GET /inc.php HTTP/1.1" 401 36 "-" "-" 20.220.227.7 - - [28/Aug/2026:00:29:34 +1000] "GET /file52.php HTTP/1.1" 401 36 "-" "-" 20.220.227.7 - - [28/Aug/2026:00:29:35 +1000] "GET /aa.php HTTP/1.1" 401 36 "-" "-" 20.220.227.7 - - [28/Aug/2026:00:29:35 +1000] "GET /sd.php HTTP/1.1" 401 36 "-" "-" 20.220.227.7 - - [28/Aug/2026:00:29:36 +1000] "GET /ot.php HTTP/1.1" 401 36 "-" "-" 20.220.227.7 - - [28/Aug/2026:00:29:36 +1000] "GET /201.php HTTP/1.1" 401 36 "-" "-" 20.220.227.7 - - [28/Aug/2026:00:29:37 +1000] "GET /op.php HTTP/1.1" 401 36 "-" "-" 20.220.227.7 - - [28/Aug/2026:00:29:37 +1000] "GET /suu.php HTTP/1.1" 401 36 "-" "-" == olympic/seb-mobile-auth.olympicfencing.com.au-ssl_log == -- top paths -- 1 GET /zoom1.php 1 GET /xx.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /ws81.php 1 GET /ws77.php 1 GET /ws37.php 1 GET /wp-trackback.php 1 GET /wp-the.php 1 GET /wp-themes.php 1 GET /wp-signin.php -- last 10 requests -- 158.158.54.35 - - [28/Aug/2026:00:27:24 +1000] "GET /radio.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:00:27:24 +1000] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:00:27:25 +1000] "GET /wp-signin.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:00:27:25 +1000] "GET /Ov-Simple1.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:00:27:25 +1000] "GET /fm.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:00:27:25 +1000] "GET /ftde.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:00:27:26 +1000] "GET /hplfuns.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:00:27:26 +1000] "GET /log.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:00:27:26 +1000] "GET /test.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:00:27:27 +1000] "GET /txets.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /wp-login.php 1 POST /wp-cron.php 1 GET /zeal.php 1 GET /ynz.PhP7 1 GET /ws61.php 1 GET /wp-su.php 1 GET /wp-p2r3q9c8k4.php 1 GET /wplogbak.php 1 GET /wp-includes/Text/network.php 1 GET /wp-includes/Text/Diff/index.php 1 GET /wp-includes/Text/Diff/ 1 GET /wp-includes/random_compat/bala.php -- last 10 requests -- 20.104.50.220 - - [28/Aug/2026:00:29:29 +1000] "GET /wp-content/languages/chosen.php HTTP/1.1" 404 201093 "-" "-" 20.104.50.220 - - [28/Aug/2026:00:29:31 +1000] "GET /.well-known/acme-challenge/bak.php HTTP/1.1" 403 12 "-" "-" 20.104.50.220 - - [28/Aug/2026:00:29:31 +1000] "GET /C1.php HTTP/1.1" 404 205182 "-" "-" 20.104.50.220 - - [28/Aug/2026:00:29:33 +1000] "GET /public/a1vx.php HTTP/1.1" 404 205191 "-" "-" 20.104.50.220 - - [28/Aug/2026:00:29:35 +1000] "GET /files.php HTTP/1.1" 404 205185 "-" "-" 118.127.40.55 - - [28/Aug/2026:00:29:38 +1000] "POST /wp-cron.php?doing_wp_cron=1787840978.6243228912353515625000 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://evolutionerp.com.au" 20.104.50.220 - - [28/Aug/2026:00:29:37 +1000] "GET /wp-admin/wp-admin.php HTTP/1.1" 404 205197 "-" "-" 20.104.50.220 - - [28/Aug/2026:00:29:39 +1000] "GET /ah25.php HTTP/1.1" 404 205184 "-" "-" 20.104.50.220 - - [28/Aug/2026:00:29:41 +1000] "GET /uploads/admin.php HTTP/1.1" 404 205193 "-" "-" 20.104.50.220 - - [28/Aug/2026:00:29:43 +1000] "GET /wp-includes/blocks/buttons/ HTTP/1.1" 200 2326 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-28 00:27:22 L1=1.45 run=4 blk=0 avail=8349 (60.6%) swpO=0 conn=4 myRSS=2717 php=5 phpRSS=459 ap=24 tcp=39 topuser=madalice 2026-08-28 00:27:32 L1=1.31 run=1 blk=0 avail=8479 (61.5%) swpO=0 conn=4 myRSS=2717 php=4 phpRSS=300 ap=23 tcp=38 topuser=madalice 2026-08-28 00:27:32 L1=1.31 run=1 blk=0 avail=8483 (61.6%) swpO=0 conn=4 myRSS=2717 php=5 phpRSS=314 ap=23 tcp=40 topuser=madalice 2026-08-28 00:27:42 L1=1.18 run=1 blk=0 avail=8508 (61.8%) swpO=0 conn=4 myRSS=2717 php=4 phpRSS=301 ap=20 tcp=35 topuser=madalice 2026-08-28 00:27:42 L1=1.18 run=1 blk=0 avail=8507 (61.7%) swpO=0 conn=4 myRSS=2717 php=4 phpRSS=301 ap=20 tcp=34 topuser=madalice 2026-08-28 00:27:52 L1=1.08 run=3 blk=0 avail=8443 (61.3%) swpO=0 conn=4 myRSS=2717 php=5 phpRSS=424 ap=17 tcp=35 topuser=madalice 2026-08-28 00:27:52 L1=1.08 run=4 blk=0 avail=8386 (60.9%) swpO=0 conn=4 myRSS=2717 php=4 phpRSS=382 ap=17 tcp=37 topuser=madalice 2026-08-28 00:28:02 L1=1.15 run=3 blk=0 avail=8446 (61.3%) swpO=0 conn=4 myRSS=2717 php=5 phpRSS=387 ap=18 tcp=31 topuser=madalice 2026-08-28 00:28:02 L1=1.15 run=3 blk=0 avail=8405 (61.0%) swpO=0 conn=4 myRSS=2717 php=6 phpRSS=482 ap=18 tcp=32 topuser=evolution 2026-08-28 00:28:12 L1=1.05 run=1 blk=0 avail=8522 (61.9%) swpO=0 conn=2 myRSS=2717 php=4 phpRSS=302 ap=18 tcp=32 topuser=madalice 2026-08-28 00:28:12 L1=1.05 run=2 blk=0 avail=8454 (61.4%) swpO=0 conn=4 myRSS=2717 php=6 phpRSS=427 ap=18 tcp=33 topuser=evolution 2026-08-28 00:28:22 L1=0.96 run=3 blk=0 avail=8653 (62.8%) swpO=0 conn=2 myRSS=2717 php=4 phpRSS=180 ap=18 tcp=33 topuser=evolution 2026-08-28 00:28:23 L1=0.96 run=2 blk=0 avail=8549 (62.1%) swpO=0 conn=4 myRSS=2717 php=5 phpRSS=311 ap=18 tcp=35 topuser=evolution 2026-08-28 00:28:32 L1=1.05 run=3 blk=0 avail=8353 (60.6%) swpO=0 conn=2 myRSS=2717 php=6 phpRSS=530 ap=18 tcp=32 topuser=infinium 2026-08-28 00:28:33 L1=1.05 run=3 blk=0 avail=8427 (61.2%) swpO=0 conn=4 myRSS=2717 php=6 phpRSS=428 ap=18 tcp=35 topuser=infinium 2026-08-28 00:28:42 L1=1.12 run=2 blk=0 avail=8157 (59.2%) swpO=0 conn=2 myRSS=2717 php=7 phpRSS=736 ap=18 tcp=34 topuser=madalice 2026-08-28 00:28:43 L1=1.12 run=3 blk=0 avail=8207 (59.6%) swpO=0 conn=4 myRSS=2717 php=9 phpRSS=746 ap=18 tcp=34 topuser=madalice 2026-08-28 00:28:52 L1=1.02 run=4 blk=0 avail=8078 (58.6%) swpO=0 conn=2 myRSS=2717 php=9 phpRSS=876 ap=18 tcp=33 topuser=madalice 2026-08-28 00:28:53 L1=1.02 run=2 blk=0 avail=8064 (58.5%) swpO=0 conn=4 myRSS=2717 php=9 phpRSS=883 ap=18 tcp=34 topuser=madalice 2026-08-28 00:29:02 L1=0.86 run=2 blk=0 avail=8138 (59.1%) swpO=0 conn=2 myRSS=2717 php=7 phpRSS=748 ap=18 tcp=33 topuser=madalice 2026-08-28 00:29:03 L1=0.86 run=1 blk=0 avail=8387 (60.9%) swpO=0 conn=4 myRSS=2717 php=6 phpRSS=472 ap=18 tcp=37 topuser=madalice 2026-08-28 00:29:12 L1=0.89 run=2 blk=0 avail=8577 (62.3%) swpO=0 conn=3 myRSS=2717 php=4 phpRSS=248 ap=18 tcp=32 topuser=corpkicks 2026-08-28 00:29:13 L1=0.89 run=2 blk=0 avail=8488 (61.6%) swpO=0 conn=4 myRSS=2717 php=5 phpRSS=364 ap=18 tcp=32 topuser=corpkicks 2026-08-28 00:29:22 L1=0.91 run=3 blk=0 avail=8498 (61.7%) swpO=0 conn=3 myRSS=2717 php=5 phpRSS=344 ap=18 tcp=37 topuser=madalice 2026-08-28 00:29:23 L1=0.91 run=2 blk=0 avail=8448 (61.3%) swpO=0 conn=4 myRSS=2717 php=5 phpRSS=387 ap=18 tcp=37 topuser=madalice 2026-08-28 00:29:33 L1=0.92 run=10 blk=1 avail=8240 (59.8%) swpO=0 conn=3 myRSS=2717 php=9 phpRSS=662 ap=19 tcp=42 topuser=madalice 2026-08-28 00:29:33 L1=0.92 run=11 blk=0 avail=7887 (57.2%) swpO=0 conn=4 myRSS=2717 php=11 phpRSS=1065 ap=19 tcp=45 topuser=madalice 2026-08-28 00:29:43 L1=1.09 run=1 blk=0 avail=7462 (54.2%) swpO=0 conn=3 myRSS=2717 php=11 phpRSS=1276 ap=52 tcp=54 topuser=madalice 2026-08-28 00:29:43 L1=1.09 run=2 blk=0 avail=7461 (54.2%) swpO=0 conn=4 myRSS=2717 php=11 phpRSS=1276 ap=52 tcp=53 topuser=madalice 2026-08-28 00:29:53 L1=1.07 run=5 blk=0 avail=7308 (53.0%) swpO=0 conn=7 myRSS=2717 php=14 phpRSS=1596 ap=42 tcp=42 topuser=madalice