INCIDENT 2026-08-28 03:44:41 trigger: php_rss=1504MB ================================================================== load: 2.29 1.60 1.29 10/591 837949 ncpu:10 mem_avail: 9238MB/13777MB (67.1%) swap_used:386MB swapout:0/s blocked(D):0 running:8 iowait:0.0% steal:0.0% php: 13 procs / 1504MB heaviest user: customc (4 procs, 486MB) apache: 22 procs tcp_estab: 45 --- RSS by user (all processes) --- USER PROCS RSS_MB root 256 1245 mysql 1 862 customc 4 514 madalice 3 473 mailman 20 412 evolution 7 395 nobody 21 378 netdata 7 236 wp-toolkit 3 128 olympic 1 83 cpanellogin 1 83 dovenull 6 68 corpkicks 1 65 named 1 57 infinium 4 57 kurri 3 42 mailnull 2 35 zabbix 1 28 dovecot 3 28 polkitd 1 24 --- php workers by user --- USER PROCS RSS_MB customc 4 519 madalice 3 473 evolution 3 383 olympic 1 86 corpkicks 1 67 root 1 31 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7937 MB Active(file): 4949 MB Inactive(file): 3416 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 758 MB CommitLimit: 10984 MB Committed_AS: 7961 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 01:26:01 14760 /usr/bin/imunify-agent-proxy 751976 root 16:41 3160 /bin/bash /etc/cron.daily/imunify-antivirus.cron 751977 root 16:41 1304 sed 1i\ /etc/cron.daily/imunify-antivirus.cron:\ 751978 root 16:41 8768 /usr/libexec/report-command-error /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py 751990 root 16:41 14544 /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 883364 3.3 Ssl 01:25:30 /usr/sbin/mariadbd 837907 837748 customc 190164 40.0 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 837903 837170 evolution 189260 31.0 S 00:03 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 529388 527476 root 185980 0.0 S 01:20:23 spamd child 508924 1 netdata 183388 1.9 Ssl 01:24:59 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 527476 1 root 174724 0.0 Ss 01:22:02 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 529389 527476 root 167328 0.0 S 01:20:23 spamd child 835531 510022 madalice 162420 42.9 S 04:13 php-fpm: pool madalice_com_au 835848 510022 madalice 162128 44.0 R 03:33 php-fpm: pool madalice_com_au 836697 510022 madalice 160008 47.4 S 01:58 php-fpm: pool madalice_com_au 837911 836512 evolution 156080 69.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 837914 837171 customc 141396 54.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 837918 836485 customc 117172 41.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 837916 837769 customc 113564 41.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 837915 837106 olympic 91944 55.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 508149 1353308 cpanellogin 85888 0.0 S 01:25:15 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 837919 820877 corpkicks 84244 24.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 483542 1 wp-toolkit 72896 0.0 Ss 01:26:21 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 509236 509098 root 69480 0.0 Sl 01:24:56 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 508634 1 named 58600 0.0 Ssl 01:25:04 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 4180059 4180015 evolution 54988 0.0 Ss 03:44:41 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 483546 1 wp-toolkit 47008 0.0 Ss 01:26:21 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 509098 1 root 42216 0.0 Ss 01:24:57 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion 1353308 1 root 41932 0.0 Ss 37-01:03:22 cpsrvd (SSL) - waiting for connections 1469 1 root 41644 0.1 Ss 59-17:34:51 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 526869 1 root 36944 0.0 Ss 01:22:25 lfd - sleeping 482788 1 root 36832 0.0 Ss 01:27:20 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 837982 837165 customc 34012 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 481558 1 root 31996 0.1 Ssl 01:27:23 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 510022 1 root 31856 0.0 Ss 01:24:52 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 28728 0.2 Ssl 01:26:13 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 508591 1 polkitd 25176 0.0 Ssl 01:25:04 /usr/lib/polkit-1/polkitd --no-debug 1463 1 root 24752 0.0 Ss 59-17:34:51 tailwatchd 836237 506832 nobody 22536 0.0 S 02:39 /usr/sbin/httpd -k start 819444 506832 nobody 22308 0.0 S 08:00 /usr/sbin/httpd -k start 508863 508814 mailman 22240 0.0 S 01:25:02 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 508851 508814 mailman 22224 0.0 S 01:25:02 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 508857 508814 mailman 22224 0.0 S 01:25:02 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 508856 508814 mailman 22148 0.0 S 01:25:02 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508855 508814 mailman 22116 0.0 S 01:25:02 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 508864 508814 mailman 22072 0.0 S 01:25:02 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 508867 508814 mailman 22056 0.0 S 01:25:02 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 508858 508814 mailman 22036 0.0 S 01:25:02 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s 508861 508814 mailman 22036 0.0 S 01:25:02 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 508860 508814 mailman 21964 0.0 S 01:25:02 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 508865 508814 mailman 21964 0.0 S 01:25:02 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 508850 508814 mailman 21952 0.0 S 01:25:02 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:0:2 -s 508854 508814 mailman 21940 0.0 S 01:25:02 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 508852 508814 mailman 21936 0.0 S 01:25:02 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s 508866 508814 mailman 21832 0.0 S 01:25:02 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 508853 508814 mailman 21804 0.0 S 01:25:02 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 508849 508814 mailman 21768 0.0 S 01:25:02 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=ArchRunner:0:1 -s 508859 508814 mailman 21764 0.0 S 01:25:02 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 508862 508814 mailman 21764 0.0 S 01:25:02 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 836512 506832 nobody 21540 0.2 S 02:15 /usr/sbin/httpd -k start 837192 506832 nobody 20748 0.0 S 01:15 /usr/sbin/httpd -k start 837106 506832 nobody 20676 0.0 S 01:19 /usr/sbin/httpd -k start 836760 506832 nobody 20388 0.6 S 01:54 /usr/sbin/httpd -k start 837115 506832 nobody 20316 0.4 S 01:18 /usr/sbin/httpd -k start 837186 506832 nobody 19884 0.0 S 01:15 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 12224 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min cosgrovecreative/cosgrovecreative.com.au-ssl_log 276 madalice/madalice.com.au-ssl_log 188 corpkicks/2025.corporatekicks.com.au-ssl_log 144 corpkicks/2025.corporatekicks.com.au 76 aaa/aaadownunder.com.au-ssl_log 23 evolution/portal.evolutionerp.com.au-ssl_log 23 kamcool/kamcool.com.au-ssl_log 12 evolution/evolutionerp.com.au-ssl_log 3 evolution/my.evolutionerp.com.au-ssl_log 3 olympic/olympicfencing.com.au-ssl_log 2 otterfencing/otterfencing.com.au-ssl_log 2 tubesupplies/tubesupplies.com.au-ssl_log 2 alison/alisonarts.com.au-ssl_log 1 coscom/coscom.com.au-ssl_log 1 nrg/nrgservices.net.au 1 (total vhosts taking traffic: 17) --- top client IPs across all vhosts (last 3 min) --- 217 20.104.50.220 165 20.63.64.130 163 158.23.184.117 113 20.104.18.15 23 203.54.180.238 17 34.32.94.88 12 34.135.129.216 12 34.121.163.30 6 118.127.40.55 2 209.141.48.118 2 184.73.195.18 2 167.71.240.77 2 162.241.63.88 2 114.119.153.220 1 66.249.73.171 --- top request paths across all vhosts (last 3 min) --- 23 GET /heartbeat.php 9 GET /wp-login.php 6 GET /wp.php 5 GET /simple.php 5 GET /new.php 5 GET /k.php 5 GET / 4 POST /wp-login.php 4 POST /wp-cron.php 4 GET /wp-content/about.php 4 GET /makeasmtp.php 4 GET /info.php 4 GET /index/function.php 4 GET /file.php 4 GET /drykl.php 4 GET /ccou.php 4 GET /byp.php 4 GET /berlin.php 4 GET /as.php 3 GET /yanz.php --- busiest 3 vhosts: top paths + last 10 requests --- == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 3 GET /goods.php 3 GET /admin.php 2 GET /wp-content/uploads/ 2 GET /radio.php 2 GET /m.php 2 GET /k.php 2 GET /info.php 2 GET /chosen.php 2 GET /atomlib.php 2 GET /adminfuns.php 2 GET /aa.php 2 GET /1.php -- last 10 requests -- 158.23.184.117 - - [28/Aug/2026:03:43:47 +1000] "GET /mm.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:03:43:48 +1000] "GET /ms-edit.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:03:43:48 +1000] "GET /ms-themes.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:03:43:48 +1000] "GET /options-general.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:03:43:48 +1000] "GET /options-reading.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:03:43:48 +1000] "GET /options-writing.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:03:43:49 +1000] "GET /ova.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:03:43:49 +1000] "GET /pages.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:03:43:49 +1000] "GET /php.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:03:43:49 +1000] "GET /php8.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET /store/design-your-own-sliders/ 2 POST /wp-admin/admin-ajax.php 2 GET /xty.php 2 GET /x1da.php 2 GET /wp-login.php 2 GET /wp-includes/Text/Diff/Engine/file_ed27.php 2 GET /wp-content/cong.php 2 GET /wp-admin/privacy.php 2 GET /txets.php 2 GET /run.php 2 GET /ot.php 2 GET /new.php -- last 10 requests -- 20.63.64.130 - - [28/Aug/2026:03:44:26 +1000] "GET /txets.php HTTP/1.1" 403 13 "-" "-" 20.63.64.130 - - [28/Aug/2026:03:44:25 +1000] "GET /css.php HTTP/1.1" 404 36645 "-" "-" 20.63.64.130 - - [28/Aug/2026:03:44:26 +1000] "GET /mifta.php HTTP/1.1" 404 36644 "-" "-" 43.166.226.186 - - [28/Aug/2026:03:44:27 +1000] "GET / HTTP/1.1" 200 42738 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" 20.63.64.130 - - [28/Aug/2026:03:44:27 +1000] "GET /wp-content/xyn.php HTTP/1.1" 404 36646 "-" "-" 20.63.64.130 - - [28/Aug/2026:03:44:28 +1000] "GET /av.php HTTP/1.1" 404 36646 "-" "-" 20.63.64.130 - - [28/Aug/2026:03:44:29 +1000] "GET /talkxkej.php HTTP/1.1" 404 36648 "-" "-" 20.63.64.130 - - [28/Aug/2026:03:44:29 +1000] "GET /wp-includes/Text/Diff/Engine/file_ed27.php HTTP/1.1" 404 36666 "-" "-" 20.63.64.130 - - [28/Aug/2026:03:44:31 +1000] "GET /nwflm.php HTTP/1.1" 404 36647 "-" "-" 20.63.64.130 - - [28/Aug/2026:03:44:31 +1000] "GET /ho.php HTTP/1.1" 404 36644 "-" "-" == corpkicks/2025.corporatekicks.com.au-ssl_log == -- top paths -- 4 GET /wp.php 3 GET /wp-login.php 2 GET /yanz.php 2 GET /xxx.php 2 GET /xper1.php 2 GET /xex.php 2 GET /wp-xx.php 2 GET /wp-slss.php 2 GET /wp-links.php 2 GET /wp-includes/l10n/themes.php 2 GET /wp-includes/customize/wp-login.php 2 GET /wp-file.php -- last 10 requests -- 20.104.50.220 - - [28/Aug/2026:03:44:07 +1000] "GET /csa.php HTTP/1.1" 301 - "-" "-" 20.104.50.220 - - [28/Aug/2026:03:44:08 +1000] "GET /csa.php HTTP/1.1" 404 59983 "-" "-" 20.104.50.220 - - [28/Aug/2026:03:44:10 +1000] "GET /wp-includes/css/wp-conflg.php HTTP/1.1" 403 13 "-" "-" 20.104.50.220 - - [28/Aug/2026:03:44:10 +1000] "GET /403.php HTTP/1.1" 301 - "-" "-" 20.104.50.220 - - [28/Aug/2026:03:44:11 +1000] "GET /403.php HTTP/1.1" 404 59983 "-" "-" 20.104.50.220 - - [28/Aug/2026:03:44:12 +1000] "GET /wp-content/config.php HTTP/1.1" 301 - "-" "-" 20.104.50.220 - - [28/Aug/2026:03:44:13 +1000] "GET /wp-content/config.php HTTP/1.1" 404 59983 "-" "-" 20.104.50.220 - - [28/Aug/2026:03:44:14 +1000] "GET /b.php HTTP/1.1" 301 - "-" "-" 20.104.50.220 - - [28/Aug/2026:03:44:15 +1000] "GET /b.php HTTP/1.1" 404 59983 "-" "-" 20.104.50.220 - - [28/Aug/2026:03:44:16 +1000] "GET /wp-content/themes/admin.php HTTP/1.1" 301 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-28 03:42:14 L1=1.56 run=3 blk=0 avail=10109(73.4%) swpO=0 conn=1 myRSS=862 php=5 phpRSS=500 ap=18 tcp=32 topuser=madalice 2026-08-28 03:42:20 L1=1.68 run=3 blk=0 avail=10065(73.1%) swpO=0 conn=3 myRSS=862 php=6 phpRSS=575 ap=18 tcp=33 topuser=madalice 2026-08-28 03:42:24 L1=1.71 run=2 blk=0 avail=10157(73.7%) swpO=0 conn=1 myRSS=862 php=5 phpRSS=436 ap=21 tcp=58 topuser=madalice 2026-08-28 03:42:30 L1=1.65 run=3 blk=0 avail=9937 (72.1%) swpO=0 conn=3 myRSS=862 php=6 phpRSS=515 ap=47 tcp=52 topuser=madalice 2026-08-28 03:42:34 L1=1.60 run=2 blk=0 avail=9942 (72.2%) swpO=0 conn=1 myRSS=862 php=4 phpRSS=476 ap=43 tcp=41 topuser=madalice 2026-08-28 03:42:40 L1=1.79 run=2 blk=0 avail=10035(72.8%) swpO=0 conn=3 myRSS=862 php=5 phpRSS=442 ap=37 tcp=38 topuser=madalice 2026-08-28 03:42:44 L1=1.89 run=6 blk=0 avail=9890 (71.8%) swpO=0 conn=1 myRSS=862 php=6 phpRSS=636 ap=33 tcp=40 topuser=madalice 2026-08-28 03:42:50 L1=1.98 run=3 blk=0 avail=9821 (71.3%) swpO=0 conn=3 myRSS=862 php=6 phpRSS=603 ap=47 tcp=47 topuser=madalice 2026-08-28 03:42:54 L1=1.98 run=3 blk=0 avail=9869 (71.6%) swpO=0 conn=1 myRSS=862 php=5 phpRSS=568 ap=44 tcp=36 topuser=madalice 2026-08-28 03:43:00 L1=1.98 run=3 blk=0 avail=9841 (71.4%) swpO=0 conn=3 myRSS=862 php=7 phpRSS=689 ap=38 tcp=33 topuser=madalice 2026-08-28 03:43:04 L1=2.22 run=8 blk=0 avail=9509 (69.0%) swpO=0 conn=1 myRSS=862 php=10 phpRSS=1154 ap=34 tcp=40 topuser=madalice 2026-08-28 03:43:10 L1=2.28 run=8 blk=0 avail=9708 (70.5%) swpO=0 conn=7 myRSS=862 php=9 phpRSS=967 ap=28 tcp=34 topuser=madalice 2026-08-28 03:43:14 L1=2.34 run=2 blk=0 avail=9935 (72.1%) swpO=0 conn=1 myRSS=862 php=6 phpRSS=667 ap=24 tcp=30 topuser=madalice 2026-08-28 03:43:20 L1=2.23 run=3 blk=0 avail=9944 (72.2%) swpO=0 conn=7 myRSS=862 php=6 phpRSS=689 ap=19 tcp=33 topuser=madalice 2026-08-28 03:43:24 L1=2.22 run=2 blk=0 avail=9894 (71.8%) swpO=0 conn=3 myRSS=862 php=6 phpRSS=688 ap=26 tcp=61 topuser=madalice 2026-08-28 03:43:31 L1=2.20 run=5 blk=0 avail=9777 (71.0%) swpO=0 conn=7 myRSS=862 php=7 phpRSS=712 ap=47 tcp=45 topuser=madalice 2026-08-28 03:43:34 L1=2.26 run=4 blk=0 avail=9844 (71.5%) swpO=0 conn=3 myRSS=862 php=5 phpRSS=594 ap=43 tcp=43 topuser=madalice 2026-08-28 03:43:41 L1=2.24 run=5 blk=0 avail=9742 (70.7%) swpO=0 conn=7 myRSS=862 php=7 phpRSS=807 ap=37 tcp=37 topuser=madalice 2026-08-28 03:43:44 L1=2.30 run=4 blk=0 avail=9812 (71.2%) swpO=0 conn=3 myRSS=862 php=6 phpRSS=727 ap=34 tcp=43 topuser=madalice 2026-08-28 03:43:51 L1=2.36 run=4 blk=0 avail=9856 (71.5%) swpO=0 conn=7 myRSS=862 php=7 phpRSS=732 ap=32 tcp=32 topuser=madalice 2026-08-28 03:43:55 L1=2.33 run=1 blk=0 avail=9989 (72.5%) swpO=0 conn=3 myRSS=862 php=5 phpRSS=557 ap=28 tcp=37 topuser=madalice 2026-08-28 03:44:01 L1=2.14 run=5 blk=0 avail=9920 (72.0%) swpO=0 conn=7 myRSS=862 php=6 phpRSS=699 ap=22 tcp=32 topuser=madalice 2026-08-28 03:44:05 L1=1.97 run=6 blk=0 avail=9813 (71.2%) swpO=0 conn=3 myRSS=862 php=8 phpRSS=796 ap=20 tcp=39 topuser=madalice 2026-08-28 03:44:11 L1=1.97 run=3 blk=0 avail=9965 (72.3%) swpO=0 conn=4 myRSS=862 php=6 phpRSS=658 ap=20 tcp=34 topuser=madalice 2026-08-28 03:44:15 L1=2.22 run=4 blk=0 avail=9769 (70.9%) swpO=0 conn=3 myRSS=862 php=6 phpRSS=855 ap=20 tcp=38 topuser=madalice 2026-08-28 03:44:21 L1=2.12 run=4 blk=0 avail=9935 (72.1%) swpO=0 conn=4 myRSS=862 php=7 phpRSS=708 ap=22 tcp=37 topuser=madalice 2026-08-28 03:44:25 L1=2.19 run=6 blk=0 avail=9905 (71.9%) swpO=0 conn=4 myRSS=862 php=6 phpRSS=710 ap=22 tcp=37 topuser=madalice 2026-08-28 03:44:31 L1=2.25 run=5 blk=0 avail=9978 (72.4%) swpO=0 conn=4 myRSS=862 php=6 phpRSS=632 ap=22 tcp=35 topuser=madalice 2026-08-28 03:44:35 L1=2.31 run=4 blk=0 avail=10007(72.6%) swpO=0 conn=4 myRSS=862 php=6 phpRSS=602 ap=22 tcp=37 topuser=madalice 2026-08-28 03:44:41 L1=2.29 run=8 blk=0 avail=9238 (67.1%) swpO=0 conn=9 myRSS=862 php=13 phpRSS=1504 ap=22 tcp=45 topuser=customc