INCIDENT 2026-08-28 00:57:41 trigger: php_rss=1932MB ================================================================== load: 1.63 1.42 1.38 11/726 193029 ncpu:10 mem_avail: 6667MB/13777MB (48.4%) swap_used:2558MB swapout:0/s blocked(D):0 running:11 iowait:0.0% steal:0.0% php: 14 procs / 1932MB heaviest user: madalice (10 procs, 1689MB) apache: 71 procs tcp_estab: 67 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2789 madalice 10 1715 nobody 70 1230 root 248 881 netdata 8 267 infinium 4 153 cpanellogin 1 112 evolution 5 71 mailman 20 47 dovenull 6 45 kurri 3 35 mailnull 5 29 wp-toolkit 6 19 dovecot 3 18 aaa 1 15 lowrange 1 14 candyfabcom 1 14 zabbix 1 13 nscd 1 6 named 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1727 infinium 1 115 root 2 72 evolution 1 68 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5589 MB Active(file): 2686 MB Inactive(file): 2969 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 445 MB CommitLimit: 10984 MB Committed_AS: 9744 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3565593 root 23:46:25 3420 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2856440 15.5 Ssl 2-21:26:25 /usr/sbin/mariadbd 192970 3787359 madalice 244392 91.2 R 00:04 php-fpm: pool madalice_com_au 192417 3787359 madalice 234616 22.5 R 00:45 php-fpm: pool madalice_com_au 1220 1 netdata 212112 2.5 Ssl 59-14:47:51 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 192692 3787359 madalice 188940 25.3 R 00:28 php-fpm: pool madalice_com_au 192688 3787359 madalice 167640 27.1 R 00:28 php-fpm: pool madalice_com_au 192972 3787359 madalice 164836 80.5 R 00:04 php-fpm: pool madalice_com_au 192134 3787359 madalice 164376 18.5 R 00:56 php-fpm: pool madalice_com_au 192698 3787359 madalice 160148 23.5 S 00:27 php-fpm: pool madalice_com_au 192696 3787359 madalice 160036 22.2 S 00:27 php-fpm: pool madalice_com_au 192693 3787359 madalice 160016 25.4 S 00:28 php-fpm: pool madalice_com_au 192974 3787359 madalice 159596 63.5 S 00:04 php-fpm: pool madalice_com_au 3846467 3797563 root 138028 0.0 S 22:22:07 spamd child 2575382 1 root 136676 0.0 Ss 12-17:07:12 /usr/lib/systemd/systemd-journald 192998 190585 infinium 123572 50.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 141899 3797563 root 117392 0.0 S 14:45 spamd child 2805458 1353308 cpanellogin 114816 0.0 S 07:38:13 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 3797563 1 root 78772 0.0 Ss 22:34:45 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4180059 4180015 evolution 70292 0.0 Ss 57:40 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 2223 1201 root 42148 0.0 Sl 59-14:47:50 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3066250 1 root 39892 0.0 Ss 06:26:16 php-fpm: master process (/opt/cpanel/ea-php82/root/etc/php-fpm.conf) 4922 2431 netdata 35760 0.1 Sl 59-14:47:46 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3787359 1 root 34500 0.0 Ss 02:53:38 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 4180253 1 root 33976 0.0 Ss 57:39 lfd - sleeping 1353308 1 root 27488 0.0 Ss 36-22:16:21 cpsrvd (SSL) - waiting for connections 174709 3066150 nobody 22116 0.1 S 05:16 /usr/sbin/httpd -k start 192398 3066150 nobody 21552 0.0 S 00:45 /usr/sbin/httpd -k start 190562 3066150 nobody 21444 0.0 S 02:27 /usr/sbin/httpd -k start 173349 3066150 nobody 21072 0.0 S 07:27 /usr/sbin/httpd -k start 190565 3066150 nobody 21048 0.0 S 02:27 /usr/sbin/httpd -k start 192355 3066150 nobody 20924 0.1 S 00:46 /usr/sbin/httpd -k start 192397 3066150 nobody 20828 0.0 S 00:45 /usr/sbin/httpd -k start 192345 3066150 nobody 20672 0.0 S 00:46 /usr/sbin/httpd -k start 192396 3066150 nobody 20496 0.0 S 00:45 /usr/sbin/httpd -k start 192354 3066150 nobody 20444 0.0 S 00:46 /usr/sbin/httpd -k start 192286 3066150 nobody 20244 0.0 S 00:48 /usr/sbin/httpd -k start 174671 3066150 nobody 20036 0.0 S 05:18 /usr/sbin/httpd -k start 190546 3066150 nobody 19932 0.0 S 02:28 /usr/sbin/httpd -k start 185104 2431 netdata 19776 2.1 Sl 15-04:24:09 /usr/libexec/netdata/plugins.d/apps.plugin 1 1469 1 root 19740 0.1 Ss 59-14:47:50 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 192339 3066150 nobody 19592 0.0 S 00:46 /usr/sbin/httpd -k start 192309 3066150 nobody 19560 0.0 S 00:47 /usr/sbin/httpd -k start 192378 3066150 nobody 19488 0.0 S 00:45 /usr/sbin/httpd -k start 192292 3066150 nobody 19452 0.0 S 00:48 /usr/sbin/httpd -k start 192391 3066150 nobody 19408 0.0 S 00:45 /usr/sbin/httpd -k start 192310 3066150 nobody 19400 0.0 S 00:47 /usr/sbin/httpd -k start 192311 3066150 nobody 19380 0.0 S 00:47 /usr/sbin/httpd -k start 192358 3066150 nobody 19368 0.0 S 00:46 /usr/sbin/httpd -k start 192330 3066150 nobody 19280 0.0 S 00:46 /usr/sbin/httpd -k start 192342 3066150 nobody 19268 0.0 S 00:46 /usr/sbin/httpd -k start 192289 3066150 nobody 19236 0.0 S 00:48 /usr/sbin/httpd -k start 192338 3066150 nobody 19208 0.0 S 00:46 /usr/sbin/httpd -k start 192346 3066150 nobody 19200 0.0 S 00:46 /usr/sbin/httpd -k start 192375 3066150 nobody 19156 0.0 S 00:45 /usr/sbin/httpd -k start 192329 3066150 nobody 19152 0.0 S 00:46 /usr/sbin/httpd -k start 190594 3066150 nobody 19004 0.0 S 02:26 /usr/sbin/httpd -k start 192359 3066150 nobody 19004 0.0 S 00:46 /usr/sbin/httpd -k start 192380 3066150 nobody 18992 0.0 S 00:45 /usr/sbin/httpd -k start 190563 3066150 nobody 18852 0.1 S 02:27 /usr/sbin/httpd -k start 190589 3066150 nobody 18796 0.1 S 02:26 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 14135913 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 305 kamcool/kamcool.com.au-ssl_log 273 infinium/infinium.net.au-ssl_log 198 alison/alisonarts.com.au-ssl_log 167 madalice/auction.madalice.com.au-ssl_log 129 infinium/infinium.net.au 83 otterfencing/otterfencing.com.au-ssl_log 46 nrg/nrgservices.net.au-ssl_log 45 customc/customcentral.com.au-ssl_log 44 evolution/evolutionerp.com.au-ssl_log 36 evolution/portal.evolutionerp.com.au-ssl_log 28 kurri/kurrimotorinn.com.au-ssl_log 13 evolution/apps.evolutionerp.com.au-ssl_log 9 cosgrovecreative/cosgrovecreative.com.au-ssl_log 3 evolution/apps.evolutionerp.com.au 2 (total vhosts taking traffic: 15) --- top client IPs across all vhosts (last 3 min) --- 326 20.220.10.235 195 158.94.210.233 193 158.23.147.79 129 20.104.50.220 129 158.23.184.117 89 20.48.250.41 80 52.139.37.240 46 20.104.18.15 45 20.220.227.7 36 103.168.67.253 35 4.204.200.136 28 203.54.180.238 12 47.128.228.221 11 4.205.62.107 6 118.127.40.55 --- top request paths across all vhosts (last 3 min) --- 128 GET /autodiscover/autodiscover.xml 28 GET /heartbeat.php 10 POST / 10 GET / 7 POST /index.php 6 POST /wp-cron.php 6 GET /about.php 5 GET /wp-content/plugins/hellopress/wp_filemanager.php 5 GET /this_is_a_new_hello_world.php 5 GET /file61.php 4 POST /wordpress/wp-json/batch/v1 4 POST /blog/wp-json/batch/v1 4 GET /wp-content/plugins/index.php 4 GET /wp-admin/images/index.php 4 GET /wp-admin/images/admin.php 4 GET /store/hand-painted-nike-af1-pink-pastel-flower/ 4 GET /new.php 4 GET /makeasmtp.php 4 GET /init.php 4 GET /alfa-rex.php7 --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 4 GET /store/hand-painted-nike-af1-pink-pastel-flower/ 3 GET / 2 GET /www/.env 2 GET /wp-content/.env 2 GET /wp-admin/.env 2 GET /web/.env 2 GET /vendor/.env 2 GET /users/.env 2 GET /test/.env.example 2 GET /test/.env 2 GET /system/.env.example 2 GET /system/.env -- last 10 requests -- 158.94.210.233 - - [28/Aug/2026:00:57:39 +1000] "GET /app/config/.env HTTP/1.1" 403 12 "http://madalice.com.au/app/config/.env" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89. 47.128.228.221 - - [28/Aug/2026:00:57:38 +1000] "GET /reset-password HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 158.94.210.233 - - [28/Aug/2026:00:57:37 +1000] "GET /.env~ HTTP/1.1" 404 36632 "http://madalice.com.au/.env~" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/ 47.128.228.221 - - [28/Aug/2026:00:57:38 +1000] "GET /auth/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 47.128.228.221 - - [28/Aug/2026:00:57:38 +1000] "GET /user/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 47.128.228.221 - - [28/Aug/2026:00:57:38 +1000] "GET /users/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 47.128.228.221 - - [28/Aug/2026:00:57:38 +1000] "GET /register HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 158.94.210.233 - - [28/Aug/2026:00:57:39 +1000] "GET /conf/.env HTTP/1.1" 403 12 "http://madalice.com.au/conf/.env" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Sa 158.94.210.233 - - [28/Aug/2026:00:57:39 +1000] "GET /lib/.env HTTP/1.1" 403 12 "http://madalice.com.au/lib/.env" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safa 158.94.210.233 - - [28/Aug/2026:00:57:39 +1000] "GET /functions/.env HTTP/1.1" 403 12 "http://madalice.com.au/functions/.env" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0. == kamcool/kamcool.com.au-ssl_log == -- top paths -- 2 GET /wp-load.php 2 GET /wp-includes/Text/index.php 2 GET /wp-content/themes/seotheme/mar.php 2 GET /wp-content/themes/about.php 2 GET /wp-admin/images/index.php 2 GET /wp-admin/images/admin.php 2 GET /s.php 2 GET /mini.php 2 GET /makeasmtp.php 2 GET /content.php 2 GET /about/function.php 2 GET /0x.php -- last 10 requests -- 52.139.37.240 - - [28/Aug/2026:00:57:18 +1000] "GET /mah.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:00:57:18 +1000] "GET /mini.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:00:57:18 +1000] "GET /system_log.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:00:57:19 +1000] "GET /v.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:00:57:19 +1000] "GET /wp-admin/css/colors/ HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:00:57:19 +1000] "GET /wp-admin/images/admin.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:00:57:19 +1000] "GET /wp-content/themes/seotheme/mar.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 52.139.37.240 - - [28/Aug/2026:00:57:19 +1000] "GET /wp-includes/Text/index.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:00:57:20 +1000] "GET /wp-includes/rest-api/fields/ HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:00:57:20 +1000] "GET /wp-index.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == infinium/infinium.net.au-ssl_log == -- top paths -- 5 POST /wp-cron.php 3 GET / 2 GET /xty.php 2 GET /wp-admin/js/index.php 2 GET /new.php 2 GET /meninbox.php 1 POST /wp-login.php 1 GET /Zoo.php 1 GET /zoo2.php 1 GET /z43agz.php 1 GET /yawa.php 1 GET /xmini4.php -- last 10 requests -- 20.220.10.235 - - [28/Aug/2026:00:57:22 +1000] "GET /v2.php HTTP/1.1" 404 68278 "-" "-" 20.220.10.235 - - [28/Aug/2026:00:57:23 +1000] "GET /wp-wlx.php HTTP/1.1" 404 68278 "-" "-" 20.220.10.235 - - [28/Aug/2026:00:57:25 +1000] "GET /xty.php?p= HTTP/1.1" 301 - "-" "-" 20.220.10.235 - - [28/Aug/2026:00:57:25 +1000] "GET /xty.php HTTP/1.1" 404 68278 "-" "-" 20.220.10.235 - - [28/Aug/2026:00:57:27 +1000] "GET /3PJcpMFsD8B.php HTTP/1.1" 404 68278 "-" "-" 20.220.10.235 - - [28/Aug/2026:00:57:28 +1000] "GET /adjig.php HTTP/1.1" 404 68278 "-" "-" 20.220.10.235 - - [28/Aug/2026:00:57:29 +1000] "GET /gr.php HTTP/1.1" 404 68278 "-" "-" 118.127.40.55 - - [28/Aug/2026:00:57:31 +1000] "POST /wp-cron.php?doing_wp_cron=1787842651.8962290287017822265625 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://infinium.net.au" 20.220.10.235 - - [28/Aug/2026:00:57:31 +1000] "GET /berlin.php HTTP/1.1" 404 68278 "-" "-" 20.220.10.235 - - [28/Aug/2026:00:57:32 +1000] "GET /a1vx.php HTTP/1.1" 404 68278 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-28 00:55:21 L1=1.43 run=3 blk=0 avail=8279 (60.1%) swpO=0 conn=4 myRSS=2789 php=5 phpRSS=301 ap=49 tcp=34 topuser=infinium 2026-08-28 00:55:21 L1=1.43 run=1 blk=0 avail=8368 (60.7%) swpO=0 conn=5 myRSS=2789 php=4 phpRSS=182 ap=49 tcp=34 topuser=evolution 2026-08-28 00:55:31 L1=1.44 run=3 blk=0 avail=8066 (58.5%) swpO=0 conn=4 myRSS=2789 php=8 phpRSS=647 ap=39 tcp=41 topuser=tubesupplies 2026-08-28 00:55:31 L1=1.44 run=3 blk=0 avail=8042 (58.4%) swpO=0 conn=5 myRSS=2789 php=10 phpRSS=696 ap=39 tcp=41 topuser=tubesupplies 2026-08-28 00:55:41 L1=1.37 run=3 blk=0 avail=8398 (61.0%) swpO=0 conn=4 myRSS=2789 php=5 phpRSS=304 ap=29 tcp=37 topuser=madalice 2026-08-28 00:55:41 L1=1.37 run=1 blk=0 avail=8407 (61.0%) swpO=0 conn=5 myRSS=2789 php=4 phpRSS=263 ap=29 tcp=39 topuser=madalice 2026-08-28 00:55:51 L1=1.16 run=3 blk=0 avail=8521 (61.8%) swpO=0 conn=4 myRSS=2789 php=4 phpRSS=182 ap=24 tcp=37 topuser=evolution 2026-08-28 00:55:51 L1=1.16 run=3 blk=0 avail=8532 (61.9%) swpO=0 conn=5 myRSS=2789 php=4 phpRSS=186 ap=24 tcp=35 topuser=root 2026-08-28 00:56:01 L1=1.06 run=2 blk=0 avail=8528 (61.9%) swpO=0 conn=4 myRSS=2789 php=3 phpRSS=141 ap=23 tcp=36 topuser=root 2026-08-28 00:56:01 L1=1.06 run=1 blk=0 avail=8533 (61.9%) swpO=0 conn=5 myRSS=2789 php=3 phpRSS=141 ap=23 tcp=36 topuser=root 2026-08-28 00:56:11 L1=1.04 run=3 blk=0 avail=8439 (61.3%) swpO=0 conn=4 myRSS=2789 php=4 phpRSS=263 ap=23 tcp=37 topuser=madalice 2026-08-28 00:56:11 L1=1.04 run=1 blk=0 avail=8445 (61.3%) swpO=0 conn=5 myRSS=2789 php=4 phpRSS=263 ap=23 tcp=37 topuser=madalice 2026-08-28 00:56:21 L1=0.88 run=3 blk=0 avail=8455 (61.4%) swpO=0 conn=2 myRSS=2789 php=4 phpRSS=263 ap=23 tcp=31 topuser=madalice 2026-08-28 00:56:21 L1=0.88 run=1 blk=0 avail=8464 (61.4%) swpO=0 conn=5 myRSS=2789 php=4 phpRSS=263 ap=23 tcp=32 topuser=madalice 2026-08-28 00:56:31 L1=0.83 run=2 blk=0 avail=8376 (60.8%) swpO=0 conn=2 myRSS=2789 php=5 phpRSS=388 ap=21 tcp=35 topuser=infinium 2026-08-28 00:56:31 L1=0.83 run=1 blk=0 avail=8566 (62.2%) swpO=0 conn=2 myRSS=2789 php=3 phpRSS=141 ap=21 tcp=33 topuser=root 2026-08-28 00:56:41 L1=0.78 run=1 blk=0 avail=8585 (62.3%) swpO=0 conn=2 myRSS=2789 php=3 phpRSS=141 ap=19 tcp=31 topuser=root 2026-08-28 00:56:41 L1=0.78 run=1 blk=0 avail=8585 (62.3%) swpO=0 conn=2 myRSS=2789 php=3 phpRSS=141 ap=19 tcp=31 topuser=root 2026-08-28 00:56:51 L1=0.74 run=1 blk=0 avail=8456 (61.4%) swpO=0 conn=2 myRSS=2789 php=4 phpRSS=263 ap=22 tcp=108 topuser=madalice 2026-08-28 00:56:51 L1=0.74 run=2 blk=0 avail=8447 (61.3%) swpO=0 conn=2 myRSS=2789 php=5 phpRSS=304 ap=22 tcp=108 topuser=madalice 2026-08-28 00:57:01 L1=0.86 run=2 blk=0 avail=7666 (55.6%) swpO=0 conn=2 myRSS=2789 php=6 phpRSS=494 ap=112 tcp=78 topuser=madalice 2026-08-28 00:57:01 L1=0.86 run=2 blk=0 avail=7655 (55.6%) swpO=0 conn=2 myRSS=2789 php=6 phpRSS=509 ap=111 tcp=76 topuser=madalice 2026-08-28 00:57:11 L1=0.80 run=4 blk=0 avail=7667 (55.7%) swpO=0 conn=2 myRSS=2789 php=7 phpRSS=584 ap=101 tcp=61 topuser=madalice 2026-08-28 00:57:11 L1=0.80 run=4 blk=0 avail=7624 (55.3%) swpO=0 conn=2 myRSS=2789 php=7 phpRSS=636 ap=101 tcp=62 topuser=madalice 2026-08-28 00:57:21 L1=1.15 run=2 blk=0 avail=7091 (51.5%) swpO=0 conn=3 myRSS=2789 php=11 phpRSS=1305 ap=91 tcp=45 topuser=madalice 2026-08-28 00:57:21 L1=1.15 run=3 blk=0 avail=7077 (51.4%) swpO=0 conn=2 myRSS=2789 php=11 phpRSS=1319 ap=91 tcp=41 topuser=madalice 2026-08-28 00:57:31 L1=1.36 run=2 blk=0 avail=7103 (51.6%) swpO=0 conn=3 myRSS=2789 php=11 phpRSS=1351 ap=81 tcp=42 topuser=madalice 2026-08-28 00:57:31 L1=1.36 run=2 blk=0 avail=7089 (51.5%) swpO=0 conn=3 myRSS=2789 php=12 phpRSS=1394 ap=81 tcp=45 topuser=madalice 2026-08-28 00:57:41 L1=1.63 run=11 blk=0 avail=6667 (48.4%) swpO=0 conn=9 myRSS=2789 php=14 phpRSS=1932 ap=71 tcp=67 topuser=madalice 2026-08-28 00:57:41 L1=1.63 run=11 blk=0 avail=6588 (47.8%) swpO=0 conn=8 myRSS=2789 php=14 phpRSS=2030 ap=71 tcp=66 topuser=madalice