INCIDENT 2026-08-28 17:17:45 trigger: php_rss=1653MB ================================================================== load: 2.02 1.79 1.26 1/618 3766538 ncpu:10 mem_avail: 7615MB/13777MB (55.3%) swap_used:977MB swapout:0/s blocked(D):0 running:1 iowait:0.0% steal:0.0% php: 13 procs / 1653MB heaviest user: madalice (10 procs, 1565MB) apache: 31 procs tcp_estab: 37 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2460 madalice 10 1565 root 250 949 nobody 30 531 mailman 20 341 netdata 7 200 cpanellogin 1 117 wp-toolkit 3 85 evolution 8 80 dovenull 6 59 mailnull 5 55 zabbix 1 25 dovecot 3 24 named 1 23 lowrange 1 14 candyfabcom 1 14 aaa 1 14 kamcool 1 13 polkitd 1 12 kurri 1 10 --- php workers by user --- USER PROCS RSS_MB madalice 10 1565 evolution 2 61 root 1 26 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6071 MB Active(file): 4938 MB Inactive(file): 1454 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 753 MB CommitLimit: 10984 MB Committed_AS: 8402 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 14:59:05 11448 /usr/bin/imunify-agent-proxy 3698658 root 17:44 3152 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2519576 17.8 Ssl 14:58:34 /usr/sbin/mariadbd 508924 1 netdata 174732 2.0 Ssl 14:58:03 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 529389 527476 root 164628 0.0 S 14:53:27 spamd child 3747684 510022 madalice 163240 22.6 S 06:40 php-fpm: pool madalice_com_au 3748934 510022 madalice 162772 11.8 S 04:11 php-fpm: pool madalice_com_au 3748931 510022 madalice 162132 11.3 S 04:11 php-fpm: pool madalice_com_au 3749517 510022 madalice 160264 11.4 S 03:43 php-fpm: pool madalice_com_au 3747467 510022 madalice 160080 25.3 S 07:12 php-fpm: pool madalice_com_au 3748938 510022 madalice 159692 12.3 S 04:11 php-fpm: pool madalice_com_au 3748930 510022 madalice 159560 12.5 S 04:11 php-fpm: pool madalice_com_au 3748935 510022 madalice 159096 11.7 R 04:11 php-fpm: pool madalice_com_au 3748932 510022 madalice 158784 12.1 S 04:11 php-fpm: pool madalice_com_au 3749516 510022 madalice 157564 11.2 S 03:43 php-fpm: pool madalice_com_au 1890416 1353308 cpanellogin 120352 0.0 S 08:32:43 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 527476 1 root 94756 0.0 Ss 14:55:06 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2985227 527476 root 89992 0.0 S 03:39:04 spamd child 509236 509098 root 62876 0.0 Sl 14:58:00 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509266 1 root 52884 0.0 Ss 14:58:00 /usr/lib/systemd/systemd-journald 938582 1 wp-toolkit 50080 0.0 Ss 13:05:37 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1353308 1 root 42172 0.0 Ss 37-14:36:26 cpsrvd (SSL) - waiting for connections 3766506 3766034 evolution 40512 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 938585 1 wp-toolkit 33012 0.0 Ss 13:05:37 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1469 1 root 30168 0.1 Ss 60-07:07:55 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 526869 1 root 29532 0.0 Ss 14:55:29 lfd - sleeping 510022 1 root 26828 0.0 Ss 14:57:56 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 25844 0.2 Ssl 14:59:17 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 481558 1 root 24744 0.1 Ssl 15:00:27 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 509640 508992 root 24192 0.0 Sl 14:57:58 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 508634 1 named 23728 0.0 Ssl 14:58:08 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1463 1 root 22860 0.0 Ss 60-07:07:55 tailwatchd 4180059 4180015 evolution 22788 0.0 Ss 17:17:45 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 3749615 506832 nobody 22360 0.0 S 03:38 /usr/sbin/httpd -k start 3764954 506832 nobody 22192 0.0 S 01:57 /usr/sbin/httpd -k start 3749589 506832 nobody 21788 0.0 S 03:42 /usr/sbin/httpd -k start 3749740 506832 nobody 21752 0.0 S 03:30 /usr/sbin/httpd -k start 3749614 506832 nobody 21152 0.0 S 03:38 /usr/sbin/httpd -k start 3749613 506832 nobody 21124 0.0 S 03:38 /usr/sbin/httpd -k start 3749729 506832 nobody 20740 0.2 S 03:31 /usr/sbin/httpd -k start 3765194 506832 nobody 20624 0.0 S 01:26 /usr/sbin/httpd -k start 3766034 506832 nobody 20616 0.1 S 00:44 /usr/sbin/httpd -k start 3766290 506832 nobody 20320 0.1 S 00:27 /usr/sbin/httpd -k start 3766412 506832 nobody 20228 0.2 S 00:15 /usr/sbin/httpd -k start 3765197 506832 nobody 20096 0.0 S 01:25 /usr/sbin/httpd -k start 3766166 506832 nobody 19936 0.0 S 00:38 /usr/sbin/httpd -k start 3766395 506832 nobody 19872 0.0 S 00:19 /usr/sbin/httpd -k start 3765360 506832 nobody 19700 0.0 S 01:09 /usr/sbin/httpd -k start 3765353 506832 nobody 19588 0.0 S 01:10 /usr/sbin/httpd -k start 3766023 506832 nobody 19568 0.0 S 00:45 /usr/sbin/httpd -k start 3766087 506832 nobody 19532 0.0 S 00:41 /usr/sbin/httpd -k start 508867 508814 mailman 19512 0.0 S 14:58:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 3766071 506832 nobody 19380 0.0 S 00:43 /usr/sbin/httpd -k start 508864 508814 mailman 19348 0.0 S 14:58:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 3749730 506832 nobody 19156 0.0 S 03:31 /usr/sbin/httpd -k start 508855 508814 mailman 19096 0.0 S 14:58:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 508865 508814 mailman 19016 0.0 S 14:58:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 3766289 506832 nobody 18980 0.0 S 00:27 /usr/sbin/httpd -k start 508856 508814 mailman 18908 0.0 S 14:58:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 3766070 506832 nobody 18860 0.0 S 00:43 /usr/sbin/httpd -k start 3765198 506832 nobody 18708 0.0 S 01:25 /usr/sbin/httpd -k start 3765374 506832 nobody 18680 0.0 S 01:08 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3593912 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 123 evolution/portal.evolutionerp.com.au-ssl_log 114 speedlin/speedlinefencing.com.au-ssl_log 92 evolution/portal.evolutionerp.com.au 90 evolution/evolutionerp.com.au-ssl_log 84 olympic/olympicfencing.com.au-ssl_log 45 evolution/my.evolutionerp.com.au-ssl_log 23 tubesupplies/tubesupplies.com.au-ssl_log 5 alison/alisonarts.com.au-ssl_log 3 aaa/aaadownunder.com.au-ssl_log 2 corpkicks/corporatekicks.com.au-ssl_log 2 evolution/staging.evolutionerp.com.au-ssl_log 1 olympic/olympicfencing.com.au 1 (total vhosts taking traffic: 13) --- top client IPs across all vhosts (last 3 min) --- 173 20.220.10.235 105 20.48.147.90 89 20.48.179.39 84 20.63.81.20 42 20.104.104.62 34 203.54.180.238 14 120.21.147.42 8 20.197.61.180 5 147.161.213.78 5 118.127.40.55 4 2407:3640:2338:8467::1 2 91.92.243.243 2 54.234.188.149 2 52.167.144.169 2 192.250.229.214 --- top request paths across all vhosts (last 3 min) --- 31 GET /heartbeat.php 10 POST /functions.php 6 GET /wp-content/plugins/hellopress/wp_filemanager.php 6 GET /wp5.php 5 GET /this_is_a_new_hello_world.php 5 GET /app/ajax.php 4 POST /wp-login.php 4 POST /wp-cron.php 4 GET /zogy1.php 4 GET /xxw.php 4 GET /ws84.php 4 GET /wp-ver.php 4 GET /wp-blogs.php 4 GET /wefile.php 4 GET /store/toys-kids-custom-shoes/ 4 GET /sc.php 4 GET /R57.php 4 GET /mis.php 4 GET /knmt.php 4 GET /inege.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 4 GET /store/toys-kids-custom-shoes/ 3 POST /wp-admin/admin-ajax.php 2 GET /wp-includes/js/codemirror/hehe.php 2 GET /wp-includes/fonts/up.php 2 GET /wp-includes/as.php 2 GET /wp-admin/user/rk2.php 2 GET /wp-admin/jp.php 2 GET /wp-admin/css/wp.php 2 GET /wp-admin/css/media.php 2 GET /wp-admin/class.php 2 GET /wp-admin/cc.php 2 GET /update/wp-damin.php -- last 10 requests -- 20.48.147.90 - - [28/Aug/2026:17:17:27 +1000] "GET /js/maint.php HTTP/1.1" 301 1 "-" "-" 20.197.61.180 - - [28/Aug/2026:17:17:28 +1000] "GET /admin.php HTTP/1.1" 404 36621 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 65.111.20.21 - - [28/Aug/2026:17:17:28 +1000] "GET /kaws-inspired-hand-painted-af1-shoes/ HTTP/1.1" 200 36980 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/ 20.48.147.90 - - [28/Aug/2026:17:17:29 +1000] "GET /js/maint.php HTTP/1.1" 404 36639 "-" "-" 20.197.61.180 - - [28/Aug/2026:17:17:29 +1000] "GET /13.php HTTP/1.1" 404 36618 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.197.61.180 - - [28/Aug/2026:17:17:31 +1000] "GET /222.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.48.147.90 - - [28/Aug/2026:17:17:31 +1000] "GET /wp-includes/fonts/up.php HTTP/1.1" 301 1 "-" "-" 20.197.61.180 - - [28/Aug/2026:17:17:31 +1000] "GET /aa.php HTTP/1.1" 404 36619 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.48.147.90 - - [28/Aug/2026:17:17:32 +1000] "GET /wp-includes/fonts/up.php HTTP/1.1" 404 36646 "-" "-" 20.197.61.180 - - [28/Aug/2026:17:17:32 +1000] "GET /abcd.php HTTP/1.1" 404 36622 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 31 GET /heartbeat.php 2 GET /wp5.php 1 GET /zwq13.php 1 GET /zq.php 1 GET /zogy1.php 1 GET /zi.php 1 GET /yw.php 1 GET /ys.php 1 GET /yj.php 1 GET /xxw.php 1 GET /xwx1.php 1 GET /xmr.php -- last 10 requests -- 20.220.10.235 - - [28/Aug/2026:17:17:31 +1000] "GET /ft.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:17:17:32 +1000] "GET /pf.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:17:17:32 +1000] "GET /yw.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:17:17:32 +1000] "GET /lz.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:17:17:33 +1000] "GET /qf.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:17:17:33 +1000] "GET /is.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:17:17:34 +1000] "GET /zq.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:17:17:34 +1000] "GET /ys.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:17:17:34 +1000] "GET /sr.php HTTP/1.1" 404 - "-" "-" 203.54.180.238 - - [28/Aug/2026:17:17:33 +1000] "GET /heartbeat.php?sentAt=1787901454&bytes=106,145,54,14&_=1787897040796 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 2 GET /goods.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /X.php 1 GET /wsd.php 1 GET /ws85.php 1 GET /ws55.php 1 GET /wp.php 1 GET /w.php 1 GET /wp-content/uploads/ 1 GET /wp-content/plugins/hellopress/wp_filemanager.php -- last 10 requests -- 20.48.179.39 - - [28/Aug/2026:17:17:13 +1000] "GET /drykl.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [28/Aug/2026:17:17:13 +1000] "GET /backup.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [28/Aug/2026:17:17:13 +1000] "GET /indo.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [28/Aug/2026:17:17:14 +1000] "GET /sign.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [28/Aug/2026:17:17:14 +1000] "GET /wnnjpsby.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [28/Aug/2026:17:17:15 +1000] "GET /gigi.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [28/Aug/2026:17:17:15 +1000] "GET /info.php/new.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [28/Aug/2026:17:17:16 +1000] "GET /wp-content/uploads/ HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [28/Aug/2026:17:17:16 +1000] "GET /w.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [28/Aug/2026:17:17:17 +1000] "GET /X.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-28 17:15:24 L1=2.34 run=3 blk=0 avail=7634 (55.4%) swpO=0 conn=4 myRSS=2460 php=14 phpRSS=1722 ap=20 tcp=33 topuser=madalice 2026-08-28 17:15:24 L1=2.34 run=2 blk=0 avail=7636 (55.4%) swpO=0 conn=4 myRSS=2460 php=14 phpRSS=1724 ap=20 tcp=33 topuser=madalice 2026-08-28 17:15:34 L1=2.12 run=2 blk=0 avail=7689 (55.8%) swpO=0 conn=3 myRSS=2460 php=13 phpRSS=1649 ap=19 tcp=31 topuser=madalice 2026-08-28 17:15:34 L1=2.12 run=2 blk=0 avail=7685 (55.8%) swpO=0 conn=3 myRSS=2460 php=13 phpRSS=1653 ap=19 tcp=31 topuser=madalice 2026-08-28 17:15:44 L1=2.03 run=3 blk=0 avail=7603 (55.2%) swpO=0 conn=5 myRSS=2460 php=13 phpRSS=1747 ap=19 tcp=28 topuser=madalice 2026-08-28 17:15:44 L1=2.03 run=4 blk=0 avail=7575 (55.0%) swpO=0 conn=5 myRSS=2460 php=13 phpRSS=1775 ap=19 tcp=28 topuser=madalice 2026-08-28 17:15:54 L1=1.87 run=1 blk=0 avail=7654 (55.6%) swpO=0 conn=2 myRSS=2460 php=13 phpRSS=1652 ap=25 tcp=32 topuser=madalice 2026-08-28 17:15:54 L1=1.87 run=4 blk=0 avail=7642 (55.5%) swpO=0 conn=4 myRSS=2460 php=14 phpRSS=1693 ap=25 tcp=32 topuser=madalice 2026-08-28 17:16:04 L1=1.73 run=3 blk=0 avail=7708 (55.9%) swpO=0 conn=4 myRSS=2460 php=14 phpRSS=1695 ap=17 tcp=25 topuser=madalice 2026-08-28 17:16:05 L1=1.73 run=3 blk=0 avail=7712 (56.0%) swpO=0 conn=3 myRSS=2460 php=13 phpRSS=1654 ap=17 tcp=25 topuser=madalice 2026-08-28 17:16:15 L1=1.61 run=1 blk=0 avail=7711 (56.0%) swpO=0 conn=2 myRSS=2460 php=14 phpRSS=1696 ap=17 tcp=30 topuser=madalice 2026-08-28 17:16:15 L1=1.61 run=2 blk=0 avail=7720 (56.0%) swpO=0 conn=3 myRSS=2460 php=13 phpRSS=1655 ap=17 tcp=30 topuser=madalice 2026-08-28 17:16:25 L1=1.59 run=1 blk=0 avail=7697 (55.9%) swpO=0 conn=2 myRSS=2460 php=14 phpRSS=1694 ap=20 tcp=32 topuser=madalice 2026-08-28 17:16:25 L1=1.59 run=2 blk=0 avail=7706 (55.9%) swpO=0 conn=2 myRSS=2460 php=13 phpRSS=1654 ap=20 tcp=32 topuser=madalice 2026-08-28 17:16:35 L1=1.66 run=3 blk=0 avail=7576 (55.0%) swpO=0 conn=3 myRSS=2460 php=14 phpRSS=1807 ap=20 tcp=35 topuser=madalice 2026-08-28 17:16:35 L1=1.66 run=2 blk=0 avail=7688 (55.8%) swpO=0 conn=3 myRSS=2460 php=13 phpRSS=1659 ap=20 tcp=35 topuser=madalice 2026-08-28 17:16:45 L1=1.71 run=2 blk=0 avail=7575 (55.0%) swpO=0 conn=3 myRSS=2460 php=14 phpRSS=1781 ap=24 tcp=33 topuser=madalice 2026-08-28 17:16:45 L1=1.71 run=7 blk=0 avail=7560 (54.9%) swpO=0 conn=4 myRSS=2460 php=14 phpRSS=1791 ap=24 tcp=31 topuser=madalice 2026-08-28 17:16:55 L1=1.83 run=4 blk=0 avail=7547 (54.8%) swpO=0 conn=4 myRSS=2460 php=14 phpRSS=1778 ap=22 tcp=34 topuser=madalice 2026-08-28 17:16:55 L1=1.83 run=4 blk=0 avail=7621 (55.3%) swpO=0 conn=3 myRSS=2460 php=13 phpRSS=1658 ap=22 tcp=34 topuser=madalice 2026-08-28 17:17:05 L1=1.78 run=3 blk=0 avail=7548 (54.8%) swpO=0 conn=4 myRSS=2460 php=14 phpRSS=1765 ap=30 tcp=43 topuser=madalice 2026-08-28 17:17:05 L1=1.78 run=4 blk=0 avail=7454 (54.1%) swpO=0 conn=4 myRSS=2460 php=14 phpRSS=1862 ap=30 tcp=44 topuser=madalice 2026-08-28 17:17:15 L1=1.96 run=2 blk=0 avail=7554 (54.8%) swpO=0 conn=3 myRSS=2460 php=14 phpRSS=1743 ap=32 tcp=44 topuser=madalice 2026-08-28 17:17:15 L1=1.96 run=3 blk=0 avail=7517 (54.6%) swpO=0 conn=4 myRSS=2460 php=14 phpRSS=1781 ap=32 tcp=42 topuser=madalice 2026-08-28 17:17:25 L1=1.74 run=5 blk=0 avail=7447 (54.1%) swpO=0 conn=4 myRSS=2460 php=14 phpRSS=1760 ap=35 tcp=46 topuser=madalice 2026-08-28 17:17:25 L1=1.74 run=4 blk=0 avail=7431 (53.9%) swpO=0 conn=4 myRSS=2460 php=13 phpRSS=1813 ap=35 tcp=49 topuser=madalice 2026-08-28 17:17:35 L1=1.93 run=7 blk=0 avail=7243 (52.6%) swpO=0 conn=7 myRSS=2460 php=16 phpRSS=2056 ap=39 tcp=52 topuser=madalice 2026-08-28 17:17:36 L1=1.93 run=5 blk=0 avail=7312 (53.1%) swpO=0 conn=6 myRSS=2460 php=16 phpRSS=1973 ap=39 tcp=52 topuser=madalice 2026-08-28 17:17:45 L1=2.02 run=1 blk=0 avail=7615 (55.3%) swpO=0 conn=2 myRSS=2460 php=13 phpRSS=1653 ap=31 tcp=37 topuser=madalice 2026-08-28 17:17:46 L1=2.02 run=4 blk=0 avail=7586 (55.1%) swpO=0 conn=3 myRSS=2460 php=13 phpRSS=1684 ap=31 tcp=38 topuser=madalice