INCIDENT 2026-08-28 17:14:44 trigger: php_rss=1652MB ================================================================== load: 3.42 1.88 1.18 3/634 3750033 ncpu:10 mem_avail: 7509MB/13777MB (54.5%) swap_used:978MB swapout:0/s blocked(D):0 running:2 iowait:0.0% steal:0.0% php: 13 procs / 1652MB heaviest user: madalice (10 procs, 1563MB) apache: 46 procs tcp_estab: 31 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2459 madalice 10 1563 root 254 981 nobody 45 789 mailman 20 341 netdata 7 201 cpanellogin 1 117 wp-toolkit 3 85 evolution 8 81 mailnull 6 69 dovenull 6 59 zabbix 1 26 dovecot 3 24 named 1 23 lowrange 1 14 kamcool 1 13 polkitd 1 12 kurri 1 10 rpc 1 5 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1563 evolution 2 62 root 1 26 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5940 MB Active(file): 4713 MB Inactive(file): 1542 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 754 MB CommitLimit: 10984 MB Committed_AS: 8733 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 14:56:03 11448 /usr/bin/imunify-agent-proxy 3698658 root 14:42 3152 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2518932 17.8 Ssl 14:55:32 /usr/sbin/mariadbd 508924 1 netdata 175944 2.0 Ssl 14:55:01 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3747467 510022 madalice 164628 37.3 R 04:10 php-fpm: pool madalice_com_au 529389 527476 root 164472 0.0 S 14:50:25 spamd child 3747684 510022 madalice 163412 33.7 S 03:38 php-fpm: pool madalice_com_au 3748931 510022 madalice 161788 18.1 S 01:09 php-fpm: pool madalice_com_au 3748930 510022 madalice 159704 21.5 S 01:09 php-fpm: pool madalice_com_au 3748934 510022 madalice 159252 18.7 S 01:09 php-fpm: pool madalice_com_au 3749517 510022 madalice 159196 20.4 S 00:41 php-fpm: pool madalice_com_au 3749516 510022 madalice 158856 24.7 S 00:41 php-fpm: pool madalice_com_au 3748938 510022 madalice 158852 20.0 S 01:09 php-fpm: pool madalice_com_au 3748935 510022 madalice 158360 20.8 S 01:09 php-fpm: pool madalice_com_au 3748932 510022 madalice 156936 20.3 S 01:09 php-fpm: pool madalice_com_au 1890416 1353308 cpanellogin 120368 0.0 S 08:29:41 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 527476 1 root 94760 0.0 Ss 14:52:04 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2985227 527476 root 89996 0.0 S 03:36:02 spamd child 509236 509098 root 62876 0.0 Sl 14:54:58 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509266 1 root 52884 0.0 Ss 14:54:58 /usr/lib/systemd/systemd-journald 938582 1 wp-toolkit 50080 0.0 Ss 13:02:35 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1353308 1 root 42172 0.0 Ss 37-14:33:24 cpsrvd (SSL) - waiting for connections 3750004 3749615 evolution 41720 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3750003 1469 root 33048 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 938585 1 wp-toolkit 33012 0.0 Ss 13:02:35 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1469 1 root 30168 0.1 Ss 60-07:04:53 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 526869 1 root 29520 0.0 Ss 14:52:27 lfd - sleeping 510022 1 root 26828 0.0 Ss 14:54:54 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 26668 0.2 Ssl 14:56:15 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 481558 1 root 24744 0.1 Ssl 14:57:25 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 509640 508992 root 24192 0.0 Sl 14:54:56 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 508634 1 named 23728 0.0 Ssl 14:55:06 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 3733344 506832 nobody 22968 0.0 S 05:10 /usr/sbin/httpd -k start 1463 1 root 22860 0.0 Ss 60-07:04:53 tailwatchd 4180059 4180015 evolution 22788 0.0 Ss 17:14:43 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 3747765 506832 nobody 22696 0.0 S 03:25 /usr/sbin/httpd -k start 3733341 506832 nobody 22248 0.3 S 05:10 /usr/sbin/httpd -k start 3747761 506832 nobody 22092 0.0 S 03:27 /usr/sbin/httpd -k start 3748611 506832 nobody 21768 0.1 S 01:26 /usr/sbin/httpd -k start 3748950 506832 nobody 20836 0.1 S 01:07 /usr/sbin/httpd -k start 3748855 506832 nobody 20688 0.0 S 01:15 /usr/sbin/httpd -k start 3749607 506832 nobody 20480 0.1 S 00:37 /usr/sbin/httpd -k start 3731616 506832 nobody 20312 0.0 S 07:32 /usr/sbin/httpd -k start 3749747 506832 nobody 19588 0.0 S 00:28 /usr/sbin/httpd -k start 3748610 506832 nobody 19560 0.0 S 01:27 /usr/sbin/httpd -k start 3748943 506832 nobody 19540 0.1 S 01:08 /usr/sbin/httpd -k start 508867 508814 mailman 19512 0.0 S 14:55:04 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 3748958 506832 nobody 19444 0.0 S 01:06 /usr/sbin/httpd -k start 3748951 506832 nobody 19408 0.0 S 01:07 /usr/sbin/httpd -k start 508864 508814 mailman 19348 0.0 S 14:55:04 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 3749589 506832 nobody 19184 0.0 S 00:40 /usr/sbin/httpd -k start 3749608 506832 nobody 19156 0.0 S 00:37 /usr/sbin/httpd -k start 3749613 506832 nobody 19156 0.0 S 00:36 /usr/sbin/httpd -k start 3749714 506832 nobody 19156 0.0 S 00:30 /usr/sbin/httpd -k start 3749314 506832 nobody 19148 0.0 S 00:59 /usr/sbin/httpd -k start 3749614 506832 nobody 19124 0.0 S 00:36 /usr/sbin/httpd -k start 508855 508814 mailman 19096 0.0 S 14:55:04 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 3749724 506832 nobody 19096 0.0 S 00:29 /usr/sbin/httpd -k start 3749615 506832 nobody 19092 0.0 S 00:36 /usr/sbin/httpd -k start 3749616 506832 nobody 19092 0.0 S 00:36 /usr/sbin/httpd -k start 3749713 506832 nobody 19092 0.0 S 00:30 /usr/sbin/httpd -k start 3749715 506832 nobody 19068 0.0 S 00:30 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3592156 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min aaa/aaadownunder.com.au-ssl_log 259 madalice/madalice.com.au-ssl_log 153 bigdeals/bigdeals.com.au-ssl_log 144 kurri/kurrimotorinn.com.au 92 kamcool/kamcool.com.au-ssl_log 89 evolution/evolutionerp.com.au-ssl_log 39 evolution/portal.evolutionerp.com.au-ssl_log 22 olympic/olympicfencing.com.au-ssl_log 10 corpkicks/corporatekicks.com.au-ssl_log 7 evolution/my.evolutionerp.com.au-ssl_log 5 alison/alisonarts.com.au-ssl_log 3 otterfencing/otterfencing.com.au-ssl_log 2 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 257 195.178.110.31 144 52.139.37.240 96 20.48.147.90 92 74.248.96.44 88 172.213.25.50 50 13.214.146.72 36 158.23.184.117 24 203.54.180.238 7 118.127.40.55 2 97.74.87.194 2 209.42.21.221 2 198.38.94.67 2 173.252.95.9 2 114.119.143.104 1 91.92.243.239 --- top request paths across all vhosts (last 3 min) --- 22 GET /heartbeat.php 21 POST /wordpress/ 21 POST /blog/ 15 POST /wp/ 15 POST /wordpress/index.php 15 POST /blog/index.php 10 POST /wp/index.php 9 GET /wp/ 9 GET /wordpress/ 8 GET /admin.php 7 POST /wordpress/wp-json/Batch/v1 7 POST /wordpress/wp-json/batch/v1/ 7 POST /wordpress/wp-json/batch/v1 7 POST /wordpress//wp-json/batch/v1 7 POST /wordpress/wordpress/wp-json/batch/v1 7 POST /wordpress/blog/wp-json/batch/v1 7 POST /blog/wp-json/Batch/v1 7 POST /blog/wp-json/batch/v1/ 7 POST /blog/wp-json/batch/v1 7 POST /blog//wp-json/batch/v1 --- busiest 3 vhosts: top paths + last 10 requests --- == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 21 POST /wordpress/ 21 POST /blog/ 15 POST /wp/ 15 POST /wordpress/index.php 15 POST /blog/index.php 10 POST /wp/index.php 9 GET /wp/ 9 GET /wordpress/ 7 POST /wordpress/wp-json/Batch/v1 7 POST /wordpress/wp-json/batch/v1/ 7 POST /wordpress/wp-json/batch/v1 7 POST /wordpress//wp-json/batch/v1 -- last 10 requests -- 195.178.110.31 - - [28/Aug/2026:17:13:27 +1000] "POST /blog/blog/wp-json/batch/v1 HTTP/1.1" 404 - "https://aaadownunder.com.au/blog/wp-admin/" "WordPress/6.4.3" 195.178.110.31 - - [28/Aug/2026:17:13:28 +1000] "POST /blog/wordpress/wp-json/batch/v1 HTTP/1.1" 404 - "https://aaadownunder.com.au/blog/wp-admin/" "WordPress/6.4.3" 195.178.110.31 - - [28/Aug/2026:17:13:28 +1000] "GET /blog/wp/v2/posts/999999 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.31 - - [28/Aug/2026:17:13:28 +1000] "GET /blog/?rest_route=/wp/v2/posts/999999 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537 195.178.110.31 - - [28/Aug/2026:17:13:29 +1000] "GET /blog/wp/v2/pages HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.31 - - [28/Aug/2026:17:13:29 +1000] "GET /blog/?rest_route=/wp/v2/pages HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.31 - - [28/Aug/2026:17:13:30 +1000] "GET /blog/wp/v2/media HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.31 - - [28/Aug/2026:17:13:30 +1000] "GET /blog/?rest_route=/wp/v2/media HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.31 - - [28/Aug/2026:17:13:30 +1000] "GET /blog/wp/v2/categories HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.31 - - [28/Aug/2026:17:13:31 +1000] "GET /blog/?rest_route=/wp/v2/categories HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 == madalice/madalice.com.au-ssl_log == -- top paths -- 4 GET /store/toys-kids-custom-shoes/ 2 GET /wp-includes/js/mpvloi.php 2 GET /wp-content/f35.php 2 GET /wp-admin/user/f35.php 2 GET /wp-admin/network/mah.php 2 GET /wp-admin/js/fm.php 2 GET /wp-admin/css/colors/coffee/getid3s.php 2 GET /wp-admin/buy.php 2 GET /wp-admin/ 2 GET /users/login 2 GET /user/login 2 GET /uploads/mar.php -- last 10 requests -- 13.214.146.72 - - [28/Aug/2026:17:14:14 +1000] "GET /backoffice HTTP/1.1" 404 36612 "https://www.madalice.com.au/backoffice" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mob 13.214.146.72 - - [28/Aug/2026:17:14:14 +1000] "GET /account HTTP/1.1" 404 36619 "https://www.madalice.com.au/account" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Sa 13.214.146.72 - - [28/Aug/2026:17:14:14 +1000] "GET /panel HTTP/1.1" 404 36607 "https://www.madalice.com.au/panel" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari 13.214.146.72 - - [28/Aug/2026:17:14:14 +1000] "GET /app HTTP/1.1" 404 36618 "https://www.madalice.com.au/app" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537 13.214.146.72 - - [28/Aug/2026:17:14:14 +1000] "GET /wp-admin/ HTTP/1.1" 302 1 "https://madalice.com.au/dashboard" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari 20.48.147.90 - - [28/Aug/2026:17:14:14 +1000] "GET /js/f35.php HTTP/1.1" 404 36640 "-" "-" 13.214.146.72 - - [28/Aug/2026:17:14:14 +1000] "GET /wp-admin/ HTTP/1.1" 302 1 "https://madalice.com.au/admin" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537 13.214.146.72 - - [28/Aug/2026:17:14:15 +1000] "GET /portal HTTP/1.1" 404 36619 "https://www.madalice.com.au/portal" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safa 20.48.147.90 - - [28/Aug/2026:17:14:16 +1000] "GET /js/0x.php HTTP/1.1" 301 1 "-" "-" 20.48.147.90 - - [28/Aug/2026:17:14:17 +1000] "GET /js/0x.php HTTP/1.1" 404 36643 "-" "-" == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 2 GET /zup.php73 2 GET /x.php 2 GET /xleet.php 2 GET /ws83.php 2 GET /ws54.php 2 GET /wp-mail.php 2 GET /wp-good.php 2 GET /wpc.php 2 GET /wp-content/uploads/index.php 2 GET /wp-content/uploads/ 2 GET /wp-content/themes/admin.php 2 GET /wp-content/index.php -- last 10 requests -- 52.139.37.240 - - [28/Aug/2026:17:14:02 +1000] "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:17:14:02 +1000] "GET /fone1.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:17:14:02 +1000] "GET /wp-content/ HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:17:14:03 +1000] "GET /ncx.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:17:14:03 +1000] "GET /ww5.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:17:14:03 +1000] "GET /wp-admin/js/index.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:17:14:04 +1000] "GET /wp-admin/classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:17:14:04 +1000] "GET /atomlib.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:17:14:04 +1000] "GET /zup.php73 HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [28/Aug/2026:17:14:05 +1000] "GET /rip.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-28 17:12:22 L1=1.10 run=3 blk=0 avail=8676 (63.0%) swpO=0 conn=1 myRSS=2463 php=5 phpRSS=497 ap=19 tcp=31 topuser=madalice 2026-08-28 17:12:23 L1=1.41 run=5 blk=0 avail=8654 (62.8%) swpO=0 conn=3 myRSS=2463 php=5 phpRSS=515 ap=19 tcp=31 topuser=madalice 2026-08-28 17:12:32 L1=1.62 run=3 blk=0 avail=8538 (62.0%) swpO=0 conn=3 myRSS=2463 php=5 phpRSS=635 ap=19 tcp=30 topuser=madalice 2026-08-28 17:12:33 L1=1.65 run=2 blk=0 avail=8485 (61.6%) swpO=0 conn=3 myRSS=2463 php=5 phpRSS=688 ap=19 tcp=30 topuser=madalice 2026-08-28 17:12:42 L1=1.60 run=3 blk=0 avail=8779 (63.7%) swpO=0 conn=3 myRSS=2463 php=4 phpRSS=375 ap=18 tcp=29 topuser=madalice 2026-08-28 17:12:43 L1=1.71 run=3 blk=0 avail=8651 (62.8%) swpO=0 conn=3 myRSS=2463 php=4 phpRSS=515 ap=18 tcp=29 topuser=madalice 2026-08-28 17:12:52 L1=1.65 run=2 blk=0 avail=8779 (63.7%) swpO=0 conn=3 myRSS=2463 php=4 phpRSS=367 ap=19 tcp=27 topuser=madalice 2026-08-28 17:12:53 L1=1.76 run=2 blk=0 avail=8755 (63.6%) swpO=0 conn=3 myRSS=2463 php=4 phpRSS=394 ap=19 tcp=27 topuser=madalice 2026-08-28 17:13:02 L1=1.78 run=2 blk=0 avail=8769 (63.7%) swpO=0 conn=3 myRSS=2463 php=4 phpRSS=368 ap=18 tcp=29 topuser=madalice 2026-08-28 17:13:03 L1=1.88 run=3 blk=0 avail=8753 (63.5%) swpO=0 conn=3 myRSS=2463 php=4 phpRSS=395 ap=17 tcp=29 topuser=madalice 2026-08-28 17:13:12 L1=1.89 run=1 blk=0 avail=8783 (63.8%) swpO=0 conn=3 myRSS=2463 php=4 phpRSS=366 ap=19 tcp=25 topuser=madalice 2026-08-28 17:13:13 L1=1.90 run=2 blk=0 avail=8781 (63.7%) swpO=0 conn=3 myRSS=2463 php=4 phpRSS=375 ap=18 tcp=26 topuser=madalice 2026-08-28 17:13:23 L1=1.99 run=3 blk=0 avail=8737 (63.4%) swpO=0 conn=3 myRSS=2463 php=4 phpRSS=368 ap=21 tcp=34 topuser=madalice 2026-08-28 17:13:23 L1=2.23 run=3 blk=0 avail=8721 (63.3%) swpO=0 conn=2 myRSS=2463 php=4 phpRSS=376 ap=21 tcp=34 topuser=madalice 2026-08-28 17:13:33 L1=2.37 run=2 blk=0 avail=8713 (63.2%) swpO=0 conn=2 myRSS=2463 php=4 phpRSS=397 ap=22 tcp=36 topuser=madalice 2026-08-28 17:13:33 L1=2.58 run=1 blk=0 avail=8735 (63.4%) swpO=0 conn=2 myRSS=2463 php=4 phpRSS=370 ap=22 tcp=37 topuser=madalice 2026-08-28 17:13:43 L1=2.69 run=6 blk=0 avail=7638 (55.4%) swpO=0 conn=4 myRSS=2463 php=13 phpRSS=1577 ap=36 tcp=53 topuser=madalice 2026-08-28 17:13:43 L1=2.96 run=5 blk=0 avail=7630 (55.4%) swpO=0 conn=4 myRSS=2463 php=13 phpRSS=1581 ap=36 tcp=57 topuser=madalice 2026-08-28 17:13:53 L1=2.81 run=2 blk=0 avail=7834 (56.9%) swpO=0 conn=4 myRSS=2463 php=10 phpRSS=1306 ap=34 tcp=32 topuser=madalice 2026-08-28 17:13:53 L1=2.81 run=2 blk=0 avail=7829 (56.8%) swpO=0 conn=4 myRSS=2463 php=10 phpRSS=1311 ap=34 tcp=31 topuser=madalice 2026-08-28 17:14:03 L1=3.48 run=15 blk=0 avail=7112 (51.6%) swpO=353 conn=7 myRSS=2459 php=12 phpRSS=2097 ap=25 tcp=42 topuser=madalice 2026-08-28 17:14:03 L1=3.48 run=13 blk=0 avail=7309 (53.1%) swpO=581 conn=7 myRSS=2458 php=13 phpRSS=1768 ap=25 tcp=43 topuser=madalice 2026-08-28 17:14:13 L1=4.36 run=4 blk=0 avail=7290 (52.9%) swpO=316 conn=5 myRSS=2459 php=14 phpRSS=1886 ap=44 tcp=68 topuser=madalice 2026-08-28 17:14:14 L1=4.36 run=4 blk=0 avail=7232 (52.5%) swpO=80 conn=5 myRSS=2459 php=14 phpRSS=1946 ap=44 tcp=69 topuser=madalice 2026-08-28 17:14:23 L1=4.08 run=3 blk=0 avail=7353 (53.4%) swpO=0 conn=2 myRSS=2459 php=12 phpRSS=1611 ap=66 tcp=31 topuser=madalice 2026-08-28 17:14:24 L1=4.08 run=8 blk=0 avail=7338 (53.3%) swpO=0 conn=3 myRSS=2459 php=13 phpRSS=1656 ap=66 tcp=31 topuser=madalice 2026-08-28 17:14:34 L1=3.77 run=4 blk=0 avail=7447 (54.1%) swpO=0 conn=3 myRSS=2459 php=13 phpRSS=1650 ap=56 tcp=28 topuser=madalice 2026-08-28 17:14:34 L1=3.77 run=3 blk=0 avail=7444 (54.0%) swpO=0 conn=3 myRSS=2459 php=13 phpRSS=1652 ap=56 tcp=28 topuser=madalice 2026-08-28 17:14:44 L1=3.42 run=2 blk=0 avail=7509 (54.5%) swpO=0 conn=3 myRSS=2459 php=13 phpRSS=1652 ap=46 tcp=31 topuser=madalice 2026-08-28 17:14:44 L1=3.42 run=7 blk=0 avail=7505 (54.5%) swpO=0 conn=3 myRSS=2459 php=13 phpRSS=1652 ap=46 tcp=31 topuser=madalice