INCIDENT 2026-08-28 17:16:45 trigger: php_rss=1781MB ================================================================== load: 1.71 1.70 1.20 3/609 3765447 ncpu:10 mem_avail: 7575MB/13777MB (55.0%) swap_used:977MB swapout:0/s blocked(D):0 running:2 iowait:0.0% steal:0.0% php: 14 procs / 1781MB heaviest user: madalice (10 procs, 1565MB) apache: 24 procs tcp_estab: 33 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2460 madalice 10 1565 root 250 967 nobody 23 381 mailman 20 341 netdata 7 197 olympic 1 131 cpanellogin 1 117 wp-toolkit 3 85 evolution 8 80 mailnull 5 61 dovenull 6 59 zabbix 1 24 dovecot 3 24 named 1 23 lowrange 1 14 polkitd 1 12 kurri 1 10 rpc 1 5 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1565 olympic 1 132 evolution 2 61 root 1 26 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6135 MB Active(file): 4925 MB Inactive(file): 1463 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 753 MB CommitLimit: 10984 MB Committed_AS: 8478 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 14:58:04 11448 /usr/bin/imunify-agent-proxy 3698658 root 16:43 3152 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2519540 17.8 Ssl 14:57:33 /usr/sbin/mariadbd 508924 1 netdata 171640 2.0 Ssl 14:57:02 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 529389 527476 root 164472 0.0 S 14:52:26 spamd child 3747684 510022 madalice 163440 24.9 S 05:39 php-fpm: pool madalice_com_au 3748934 510022 madalice 162188 12.0 S 03:10 php-fpm: pool madalice_com_au 3748931 510022 madalice 161816 11.7 S 03:10 php-fpm: pool madalice_com_au 3748938 510022 madalice 160304 12.5 S 03:10 php-fpm: pool madalice_com_au 3749517 510022 madalice 159940 11.6 R 02:42 php-fpm: pool madalice_com_au 3747467 510022 madalice 159816 27.9 S 06:11 php-fpm: pool madalice_com_au 3748930 510022 madalice 159208 13.0 S 03:10 php-fpm: pool madalice_com_au 3748935 510022 madalice 159112 12.6 S 03:10 php-fpm: pool madalice_com_au 3749516 510022 madalice 158892 12.2 S 02:42 php-fpm: pool madalice_com_au 3748932 510022 madalice 158412 12.5 S 03:10 php-fpm: pool madalice_com_au 3765413 3749589 olympic 141668 109 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1890416 1353308 cpanellogin 120356 0.0 S 08:31:42 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 527476 1 root 94760 0.0 Ss 14:54:05 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2985227 527476 root 89996 0.0 S 03:38:03 spamd child 509236 509098 root 62876 0.0 Sl 14:56:59 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509266 1 root 52884 0.0 Ss 14:56:59 /usr/lib/systemd/systemd-journald 938582 1 wp-toolkit 50080 0.0 Ss 13:04:36 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1353308 1 root 42172 0.0 Ss 37-14:35:25 cpsrvd (SSL) - waiting for connections 3765417 3765197 evolution 40376 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3765467 1469 root 33044 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3765416 1469 root 33036 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 938585 1 wp-toolkit 33012 0.0 Ss 13:04:36 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1469 1 root 30168 0.1 Ss 60-07:06:54 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 526869 1 root 29520 0.0 Ss 14:54:28 lfd - sleeping 510022 1 root 26828 0.0 Ss 14:56:55 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 25436 0.2 Ssl 14:58:16 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 481558 1 root 24744 0.1 Ssl 14:59:26 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 509640 508992 root 24192 0.0 Sl 14:56:57 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 508634 1 named 23728 0.0 Ssl 14:57:07 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1463 1 root 22860 0.0 Ss 60-07:06:54 tailwatchd 4180059 4180015 evolution 22788 0.0 Ss 17:16:44 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 3733341 506832 nobody 22604 0.3 S 07:11 /usr/sbin/httpd -k start 3748611 506832 nobody 22400 0.1 S 03:27 /usr/sbin/httpd -k start 3749589 506832 nobody 21784 0.0 S 02:41 /usr/sbin/httpd -k start 3749615 506832 nobody 21496 0.0 S 02:37 /usr/sbin/httpd -k start 3749614 506832 nobody 21152 0.0 S 02:37 /usr/sbin/httpd -k start 3749613 506832 nobody 21108 0.0 S 02:37 /usr/sbin/httpd -k start 3749740 506832 nobody 20744 0.0 S 02:29 /usr/sbin/httpd -k start 3749729 506832 nobody 20740 0.2 S 02:30 /usr/sbin/httpd -k start 3764954 506832 nobody 20232 0.0 S 00:56 /usr/sbin/httpd -k start 3765130 508720 mailnull 20184 0.0 S 00:33 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3765197 506832 nobody 20028 0.0 S 00:24 /usr/sbin/httpd -k start 508867 508814 mailman 19512 0.0 S 14:57:05 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 508864 508814 mailman 19348 0.0 S 14:57:05 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 3764967 506832 nobody 19344 0.0 S 00:54 /usr/sbin/httpd -k start 508855 508814 mailman 19096 0.0 S 14:57:05 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 508865 508814 mailman 19016 0.0 S 14:57:05 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 508856 508814 mailman 18908 0.0 S 14:57:05 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 3749726 506832 nobody 18880 0.0 S 02:30 /usr/sbin/httpd -k start 508857 508814 mailman 18628 0.0 S 14:57:05 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 508861 508814 mailman 18628 0.0 S 14:57:05 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 508866 508814 mailman 18508 0.0 S 14:57:05 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 508854 508814 mailman 18460 0.0 S 14:57:05 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 3749730 506832 nobody 18400 0.0 S 02:30 /usr/sbin/httpd -k start 508862 508814 mailman 18216 0.0 S 14:57:05 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 509671 508992 netdata 18152 2.1 Sl 14:56:57 /usr/libexec/netdata/plugins.d/apps.plugin 1 508850 508814 mailman 18088 0.0 S 14:57:05 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:0:2 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3593745 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 157 evolution/evolutionerp.com.au-ssl_log 115 kamcool/kamcool.com.au-ssl_log 84 evolution/portal.evolutionerp.com.au-ssl_log 30 bigdeals/bigdeals.com.au-ssl_log 26 evolution/my.evolutionerp.com.au-ssl_log 26 alison/alisonarts.com.au-ssl_log 6 aaa/aaadownunder.com.au-ssl_log 5 tubesupplies/tubesupplies.com.au-ssl_log 5 corpkicks/2025.corporatekicks.com.au-ssl_log 3 customc/customcentral.com.au-ssl_log 3 olympic/olympicfencing.com.au-ssl_log 3 corpkicks/corporatekicks.com.au-ssl_log 2 evolution/staging.evolutionerp.com.au-ssl_log 2 olympic/olympicfencing.com.au 1 (total vhosts taking traffic: 16) --- top client IPs across all vhosts (last 3 min) --- 113 20.63.81.20 97 20.48.147.90 84 172.213.25.50 47 13.214.146.72 33 203.54.180.238 26 52.139.37.240 14 120.21.147.42 7 147.161.213.78 7 118.127.40.55 4 2407:3640:2338:8467::1 3 20.104.104.62 2 91.92.243.243 2 65.109.125.252 2 52.167.144.169 2 50.6.200.195 --- top request paths across all vhosts (last 3 min) --- 28 GET /heartbeat.php 14 POST /functions.php 7 POST /wp-login.php 5 POST /wp-cron.php 5 GET /app/ajax.php 5 GET / 4 POST /wp-admin/admin-ajax.php 4 GET /wp-login.php 4 GET /wp-content/plugins/hellopress/wp_filemanager.php 4 GET /store/toys-kids-custom-shoes/ 4 GET /admin.php 3 GET /index.php 3 GET /atomlib.php 2 POST /clienteditsave.php 2 GET /zup.php73 2 GET /zoo1.php 2 GET /ww5.php 2 GET /wp.php 2 GET /wp-json/wc/store/v1/products 2 GET /wp-includes/js/codemirror/hehe.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 4 POST /wp-admin/admin-ajax.php 4 GET /store/toys-kids-custom-shoes/ 2 GET /wp-includes/js/codemirror/hehe.php 2 GET /wp-content/plugins/defaults.php 2 GET /wp-content/mu-plugins/jp.php 2 GET /wp-admin/user/rk2.php 2 GET /wp-admin/jp.php 2 GET /wp-admin/ 2 GET /users/login 2 GET /user/login 2 GET /update/ty.php 2 GET /update/manager.php -- last 10 requests -- 20.48.147.90 - - [28/Aug/2026:17:16:06 +1000] "GET /mpvloi.php HTTP/1.1" 301 1 "-" "-" 20.48.147.90 - - [28/Aug/2026:17:16:07 +1000] "GET /mpvloi.php HTTP/1.1" 404 36643 "-" "-" 20.48.147.90 - - [28/Aug/2026:17:16:09 +1000] "GET /images/mar.php HTTP/1.1" 301 1 "-" "-" 20.48.147.90 - - [28/Aug/2026:17:16:10 +1000] "GET /images/mar.php HTTP/1.1" 404 36640 "-" "-" 20.48.147.90 - - [28/Aug/2026:17:16:12 +1000] "GET /files/moon.php HTTP/1.1" 301 1 "-" "-" 20.48.147.90 - - [28/Aug/2026:17:16:13 +1000] "GET /files/moon.php HTTP/1.1" 404 36644 "-" "-" 20.48.147.90 - - [28/Aug/2026:17:16:15 +1000] "GET /img/ty.php HTTP/1.1" 301 1 "-" "-" 20.48.147.90 - - [28/Aug/2026:17:16:16 +1000] "GET /img/ty.php HTTP/1.1" 404 36641 "-" "-" 20.48.147.90 - - [28/Aug/2026:17:16:17 +1000] "GET /js/wp-login.php HTTP/1.1" 301 1 "-" "-" 20.48.147.90 - - [28/Aug/2026:17:16:19 +1000] "GET /js/wp-login.php HTTP/1.1" 404 36641 "-" "-" == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /goods.php 2 GET /admin.php 1 POST /wp-login.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /X.php 1 GET /wsd.php 1 GET /ws85.php 1 GET /ws55.php 1 GET /wp.php 1 GET /wp-login.php -- last 10 requests -- 20.63.81.20 - - [28/Aug/2026:17:15:34 +1000] "GET /dapa.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [28/Aug/2026:17:15:35 +1000] "GET /wp-content/l.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [28/Aug/2026:17:15:35 +1000] "GET /wp-admin/w.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [28/Aug/2026:17:15:35 +1000] "GET /wp-content/k.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [28/Aug/2026:17:15:36 +1000] "GET /os.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [28/Aug/2026:17:15:36 +1000] "GET /htio.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [28/Aug/2026:17:15:37 +1000] "GET /dev.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [28/Aug/2026:17:15:37 +1000] "GET /gos.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [28/Aug/2026:17:15:38 +1000] "GET /132.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [28/Aug/2026:17:15:38 +1000] "GET /v22.php HTTP/1.1" 401 36 "-" "-" == kamcool/kamcool.com.au-ssl_log == -- top paths -- 2 GET /admin.php 1 GET /zoo1.php 1 GET /xnm-apc.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp.php 1 GET /wp-mails.php 1 GET /vpn.php 1 GET /system_log.php 1 GET /ssg.php 1 GET /sm.php 1 GET /site.php -- last 10 requests -- 172.213.25.50 - - [28/Aug/2026:17:14:45 +1000] "GET /class-t.api.php HTTP/1.1" 401 36 "-" "-" 172.213.25.50 - - [28/Aug/2026:17:14:45 +1000] "GET /a.php HTTP/1.1" 401 36 "-" "-" 172.213.25.50 - - [28/Aug/2026:17:14:46 +1000] "GET /ass.php HTTP/1.1" 401 36 "-" "-" 172.213.25.50 - - [28/Aug/2026:17:14:46 +1000] "GET /sb.php HTTP/1.1" 401 36 "-" "-" 172.213.25.50 - - [28/Aug/2026:17:14:47 +1000] "GET /in.php HTTP/1.1" 401 36 "-" "-" 172.213.25.50 - - [28/Aug/2026:17:14:48 +1000] "GET /ssg.php HTTP/1.1" 401 36 "-" "-" 172.213.25.50 - - [28/Aug/2026:17:14:48 +1000] "GET /gigi.php HTTP/1.1" 401 36 "-" "-" 172.213.25.50 - - [28/Aug/2026:17:14:49 +1000] "GET /credit.php HTTP/1.1" 401 36 "-" "-" 172.213.25.50 - - [28/Aug/2026:17:14:49 +1000] "GET /xnm-apc.php HTTP/1.1" 401 36 "-" "-" 172.213.25.50 - - [28/Aug/2026:17:14:50 +1000] "GET /adminimagess.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-28 17:14:23 L1=4.08 run=3 blk=0 avail=7353 (53.4%) swpO=0 conn=2 myRSS=2459 php=12 phpRSS=1611 ap=66 tcp=31 topuser=madalice 2026-08-28 17:14:24 L1=4.08 run=8 blk=0 avail=7338 (53.3%) swpO=0 conn=3 myRSS=2459 php=13 phpRSS=1656 ap=66 tcp=31 topuser=madalice 2026-08-28 17:14:34 L1=3.77 run=4 blk=0 avail=7447 (54.1%) swpO=0 conn=3 myRSS=2459 php=13 phpRSS=1650 ap=56 tcp=28 topuser=madalice 2026-08-28 17:14:34 L1=3.77 run=3 blk=0 avail=7444 (54.0%) swpO=0 conn=3 myRSS=2459 php=13 phpRSS=1652 ap=56 tcp=28 topuser=madalice 2026-08-28 17:14:44 L1=3.42 run=2 blk=0 avail=7509 (54.5%) swpO=0 conn=3 myRSS=2459 php=13 phpRSS=1652 ap=46 tcp=31 topuser=madalice 2026-08-28 17:14:44 L1=3.42 run=7 blk=0 avail=7505 (54.5%) swpO=0 conn=3 myRSS=2459 php=13 phpRSS=1652 ap=46 tcp=31 topuser=madalice 2026-08-28 17:14:54 L1=3.12 run=3 blk=0 avail=7539 (54.7%) swpO=0 conn=4 myRSS=2459 php=13 phpRSS=1697 ap=36 tcp=35 topuser=madalice 2026-08-28 17:14:54 L1=3.12 run=5 blk=0 avail=7515 (54.5%) swpO=0 conn=4 myRSS=2459 php=13 phpRSS=1734 ap=35 tcp=35 topuser=madalice 2026-08-28 17:15:04 L1=2.87 run=2 blk=0 avail=7590 (55.1%) swpO=0 conn=3 myRSS=2460 php=14 phpRSS=1715 ap=26 tcp=35 topuser=madalice 2026-08-28 17:15:04 L1=2.87 run=4 blk=0 avail=7596 (55.1%) swpO=0 conn=4 myRSS=2460 php=14 phpRSS=1717 ap=25 tcp=35 topuser=madalice 2026-08-28 17:15:14 L1=2.58 run=1 blk=0 avail=7638 (55.4%) swpO=0 conn=3 myRSS=2460 php=14 phpRSS=1719 ap=21 tcp=32 topuser=madalice 2026-08-28 17:15:14 L1=2.58 run=1 blk=0 avail=7637 (55.4%) swpO=0 conn=3 myRSS=2460 php=14 phpRSS=1719 ap=20 tcp=32 topuser=madalice 2026-08-28 17:15:24 L1=2.34 run=3 blk=0 avail=7634 (55.4%) swpO=0 conn=4 myRSS=2460 php=14 phpRSS=1722 ap=20 tcp=33 topuser=madalice 2026-08-28 17:15:24 L1=2.34 run=2 blk=0 avail=7636 (55.4%) swpO=0 conn=4 myRSS=2460 php=14 phpRSS=1724 ap=20 tcp=33 topuser=madalice 2026-08-28 17:15:34 L1=2.12 run=2 blk=0 avail=7689 (55.8%) swpO=0 conn=3 myRSS=2460 php=13 phpRSS=1649 ap=19 tcp=31 topuser=madalice 2026-08-28 17:15:34 L1=2.12 run=2 blk=0 avail=7685 (55.8%) swpO=0 conn=3 myRSS=2460 php=13 phpRSS=1653 ap=19 tcp=31 topuser=madalice 2026-08-28 17:15:44 L1=2.03 run=3 blk=0 avail=7603 (55.2%) swpO=0 conn=5 myRSS=2460 php=13 phpRSS=1747 ap=19 tcp=28 topuser=madalice 2026-08-28 17:15:44 L1=2.03 run=4 blk=0 avail=7575 (55.0%) swpO=0 conn=5 myRSS=2460 php=13 phpRSS=1775 ap=19 tcp=28 topuser=madalice 2026-08-28 17:15:54 L1=1.87 run=1 blk=0 avail=7654 (55.6%) swpO=0 conn=2 myRSS=2460 php=13 phpRSS=1652 ap=25 tcp=32 topuser=madalice 2026-08-28 17:15:54 L1=1.87 run=4 blk=0 avail=7642 (55.5%) swpO=0 conn=4 myRSS=2460 php=14 phpRSS=1693 ap=25 tcp=32 topuser=madalice 2026-08-28 17:16:04 L1=1.73 run=3 blk=0 avail=7708 (55.9%) swpO=0 conn=4 myRSS=2460 php=14 phpRSS=1695 ap=17 tcp=25 topuser=madalice 2026-08-28 17:16:05 L1=1.73 run=3 blk=0 avail=7712 (56.0%) swpO=0 conn=3 myRSS=2460 php=13 phpRSS=1654 ap=17 tcp=25 topuser=madalice 2026-08-28 17:16:15 L1=1.61 run=1 blk=0 avail=7711 (56.0%) swpO=0 conn=2 myRSS=2460 php=14 phpRSS=1696 ap=17 tcp=30 topuser=madalice 2026-08-28 17:16:15 L1=1.61 run=2 blk=0 avail=7720 (56.0%) swpO=0 conn=3 myRSS=2460 php=13 phpRSS=1655 ap=17 tcp=30 topuser=madalice 2026-08-28 17:16:25 L1=1.59 run=1 blk=0 avail=7697 (55.9%) swpO=0 conn=2 myRSS=2460 php=14 phpRSS=1694 ap=20 tcp=32 topuser=madalice 2026-08-28 17:16:25 L1=1.59 run=2 blk=0 avail=7706 (55.9%) swpO=0 conn=2 myRSS=2460 php=13 phpRSS=1654 ap=20 tcp=32 topuser=madalice 2026-08-28 17:16:35 L1=1.66 run=3 blk=0 avail=7576 (55.0%) swpO=0 conn=3 myRSS=2460 php=14 phpRSS=1807 ap=20 tcp=35 topuser=madalice 2026-08-28 17:16:35 L1=1.66 run=2 blk=0 avail=7688 (55.8%) swpO=0 conn=3 myRSS=2460 php=13 phpRSS=1659 ap=20 tcp=35 topuser=madalice 2026-08-28 17:16:45 L1=1.71 run=2 blk=0 avail=7575 (55.0%) swpO=0 conn=3 myRSS=2460 php=14 phpRSS=1781 ap=24 tcp=33 topuser=madalice 2026-08-28 17:16:45 L1=1.71 run=7 blk=0 avail=7560 (54.9%) swpO=0 conn=4 myRSS=2460 php=14 phpRSS=1791 ap=24 tcp=31 topuser=madalice