INCIDENT 2026-08-28 19:16:01 trigger: php_rss=2105MB ================================================================== load: 2.87 1.67 1.22 7/610 4172706 ncpu:10 mem_avail: 6980MB/13777MB (50.7%) swap_used:960MB swapout:0/s blocked(D):0 running:10 iowait:0.0% steal:0.0% php: 11 procs / 2105MB heaviest user: madalice (8 procs, 1966MB) apache: 33 procs tcp_estab: 54 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2481 madalice 8 1981 root 246 949 nobody 32 575 mailman 20 340 netdata 7 204 wp-toolkit 3 85 cpanellogin 1 77 dovenull 6 59 kurri 4 53 evolution 7 41 zabbix 1 26 mailnull 2 26 dovecot 3 24 named 1 23 aaa 1 15 polkitd 1 12 rpc 1 5 nscd 1 5 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 8 1984 root 1 26 evolution 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6065 MB Active(file): 5451 MB Inactive(file): 944 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 693 MB CommitLimit: 10984 MB Committed_AS: 8663 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 16:57:20 11448 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2541000 16.4 Ssl 16:56:49 /usr/sbin/mariadbd 4156577 510022 madalice 258540 23.0 S 02:52 php-fpm: pool madalice_com_au 4156574 510022 madalice 258296 22.6 S 02:53 php-fpm: pool madalice_com_au 4172587 510022 madalice 254148 37.1 S 00:07 php-fpm: pool madalice_com_au 4172588 510022 madalice 254124 37.8 S 00:07 php-fpm: pool madalice_com_au 4172584 510022 madalice 253880 37.5 S 00:07 php-fpm: pool madalice_com_au 4172590 510022 madalice 253864 35.7 S 00:07 php-fpm: pool madalice_com_au 4172586 510022 madalice 253616 39.4 S 00:07 php-fpm: pool madalice_com_au 4172642 510022 madalice 249440 129 R 00:01 php-fpm: pool madalice_com_au 529389 527476 root 179752 0.0 S 16:51:42 spamd child 508924 1 netdata 179476 2.0 Ssl 16:56:18 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 527476 1 root 94736 0.0 Ss 16:53:21 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2985227 527476 root 89972 0.0 S 05:37:19 spamd child 4074469 1353308 cpanellogin 79192 0.1 S 26:35 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 509236 509098 root 64244 0.0 Sl 16:56:15 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509266 1 root 56984 0.0 Ss 16:56:15 /usr/lib/systemd/systemd-journald 938582 1 wp-toolkit 50080 0.0 Ss 15:03:52 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1353308 1 root 41972 0.0 Ss 37-16:34:41 cpsrvd (SSL) - waiting for connections 938585 1 wp-toolkit 33012 0.0 Ss 15:03:52 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1469 1 root 30332 0.1 Ss 60-09:06:10 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 526869 1 root 29684 0.0 Ss 16:53:44 lfd - sleeping 510022 1 root 27012 0.0 Ss 16:56:11 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 26760 0.2 Ssl 16:57:32 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 509640 508992 root 25248 0.0 Sl 16:56:13 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 481558 1 root 24688 0.1 Ssl 16:58:42 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 508634 1 named 23992 0.0 Ssl 16:56:23 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 4157223 506832 nobody 23028 0.1 S 01:45 /usr/sbin/httpd -k start 1463 1 root 22888 0.0 Ss 60-09:06:10 tailwatchd 4180059 4180015 evolution 22784 0.0 Ss 19:16:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 4156333 506832 nobody 22536 0.5 S 03:29 /usr/sbin/httpd -k start 4156901 506832 nobody 22500 0.0 S 02:11 /usr/sbin/httpd -k start 4139684 506832 nobody 22352 0.0 S 08:59 /usr/sbin/httpd -k start 4156650 506832 nobody 22064 0.1 S 02:42 /usr/sbin/httpd -k start 4156652 506832 nobody 21676 0.0 S 02:41 /usr/sbin/httpd -k start 4156328 506832 nobody 21084 0.1 S 03:30 /usr/sbin/httpd -k start 4156653 506832 nobody 20996 0.0 S 02:41 /usr/sbin/httpd -k start 4140831 506832 nobody 20940 0.0 S 06:47 /usr/sbin/httpd -k start 4156645 506832 nobody 20872 0.0 S 02:43 /usr/sbin/httpd -k start 4156655 506832 nobody 20656 0.0 S 02:41 /usr/sbin/httpd -k start 4172184 506832 nobody 20488 0.1 S 00:30 /usr/sbin/httpd -k start 4157705 506832 nobody 20240 0.1 S 01:14 /usr/sbin/httpd -k start 4157689 506832 nobody 19596 0.0 S 01:15 /usr/sbin/httpd -k start 4156332 506832 nobody 19564 0.0 S 03:29 /usr/sbin/httpd -k start 508867 508814 mailman 19400 0.0 S 16:56:21 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 4156959 506832 nobody 19264 0.1 S 02:10 /usr/sbin/httpd -k start 508864 508814 mailman 19216 0.0 S 16:56:21 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 508855 508814 mailman 19096 0.0 S 16:56:21 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 4172327 506832 nobody 19080 0.1 S 00:23 /usr/sbin/httpd -k start 508865 508814 mailman 19016 0.0 S 16:56:21 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 508856 508814 mailman 18860 0.0 S 16:56:21 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 4155518 506832 nobody 18712 0.0 S 05:31 /usr/sbin/httpd -k start 508857 508814 mailman 18628 0.0 S 16:56:21 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 4172315 506832 nobody 18620 0.0 S 00:24 /usr/sbin/httpd -k start 508861 508814 mailman 18532 0.0 S 16:56:21 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 508866 508814 mailman 18508 0.0 S 16:56:21 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 508854 508814 mailman 18448 0.0 S 16:56:21 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 508862 508814 mailman 18216 0.0 S 16:56:21 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 509671 508992 netdata 18152 2.1 Sl 16:56:13 /usr/libexec/netdata/plugins.d/apps.plugin 1 508850 508814 mailman 18088 0.0 S 16:56:21 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:0:2 -s 508849 508814 mailman 18004 0.0 S 16:56:21 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=ArchRunner:0:1 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3632914 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 3632908 | madalice_wp | madalice_wp | Query | 0 | Creating sort index | SELECT post_id, meta_key, meta_value FROM AMuqf6qZ_postmeta WHERE post_id IN (8811,33647,28292,20717,30757,30681,30743,15842,15423,15904,30626,130,33108,120) ORDER BY meta_id ASC | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min otterfencing/otterfencing.com.au-ssl_log 205 evolution/my.evolutionerp.com.au-ssl_log 115 madalice/madalice.com.au-ssl_log 100 evolution/release.evolutionerp.com.au 91 nrg/nrgservices.net.au-ssl_log 91 vinesit/vinesit.com.au-ssl_log 81 customc/customcentral.com.au 62 vinesit/vinesit.com.au 62 customc/customcentral.com.au-ssl_log 55 bigdeals/bigdeals.com.au-ssl_log 37 kurri/kurrimotorinn.com.au-ssl_log 34 evolution/portal.evolutionerp.com.au-ssl_log 14 evolution/staging.evolutionerp.com.au-ssl_log 12 (total vhosts taking traffic: 13) --- top client IPs across all vhosts (last 3 min) --- 205 68.155.159.216 197 20.104.18.15 143 20.104.50.220 114 20.220.10.235 90 20.48.160.90 50 4.204.200.136 48 35.201.146.95 37 158.23.184.117 34 31.59.160.30 18 202.153.211.134 14 203.54.180.238 3 118.127.40.55 1 52.167.144.230 1 40.77.167.7 1 192.42.116.14 --- top request paths across all vhosts (last 3 min) --- 14 GET /heartbeat.php 14 GET / 10 POST / 7 GET /goods.php 6 POST /index.php 6 POST /functions.php 6 GET /admin.php 4 GET /wp-content/uploads/ 4 GET /wp-content/plugins/hellopress/wp_filemanager.php 4 GET /this_is_a_new_hello_world.php 4 GET /new.php 4 GET /k.php 4 GET /chosen.php 4 GET /backup.php 4 GET /atomlib.php 4 GET /1.php 3 POST /wp-cron.php 3 GET /zoo2.php 3 GET /zoo1.php 3 GET /zi.php --- busiest 3 vhosts: top paths + last 10 requests --- == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 1 GET /xxx.php 1 GET /xx.php 1 GET /xpw.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /wp-signup.php 1 GET /wp-seo.php 1 GET /wp-load.php 1 GET /wp-links.php 1 GET /wp-includes/Text/autoload_classmap.php 1 GET /wp-includes/SimplePie/admin.php 1 GET /wp-includes/Requests/chosen.php -- last 10 requests -- 68.155.159.216 - - [28/Aug/2026:19:15:53 +1000] "GET /wp-admin/css/index.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [28/Aug/2026:19:15:53 +1000] "GET /wp-admin/maint/index.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [28/Aug/2026:19:15:54 +1000] "GET /wp-admin/user/xmrlpc.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [28/Aug/2026:19:15:54 +1000] "GET /site/wp-admin/ HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [28/Aug/2026:19:15:55 +1000] "GET /filebrowser.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [28/Aug/2026:19:15:55 +1000] "GET /wp-content/plugins/index.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [28/Aug/2026:19:15:55 +1000] "GET /makeasmtp.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [28/Aug/2026:19:15:57 +1000] "GET /admin/function.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [28/Aug/2026:19:15:57 +1000] "GET /wp-includes/Requests/chosen.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [28/Aug/2026:19:15:58 +1000] "GET /wp-content/themes/about.php HTTP/1.1" 404 5750 "-" "-" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 3 POST /functions.php 2 GET /index.php 2 GET /goods.php 2 GET /admin.php 2 GET / 1 POST /login.php 1 POST /login2save.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /wsd.php 1 GET /ws85.php -- last 10 requests -- 202.153.211.134 - - [28/Aug/2026:19:15:31 +1000] "POST /login.php HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safa 180.181.236.49 - - [28/Aug/2026:19:15:31 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=timesheetHistory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 202.153.211.134 - - [28/Aug/2026:19:15:31 +1000] "GET / HTTP/1.1" 200 32974 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537. 20.104.18.15 - - [28/Aug/2026:19:15:32 +1000] "GET /os.php HTTP/1.1" 404 - "-" "-" 20.104.18.15 - - [28/Aug/2026:19:15:32 +1000] "GET /htio.php HTTP/1.1" 404 - "-" "-" 20.104.18.15 - - [28/Aug/2026:19:15:33 +1000] "GET /dev.php?p HTTP/1.1" 404 - "-" "-" 202.153.211.134 - - [28/Aug/2026:19:15:33 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 51 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Ch 20.104.18.15 - - [28/Aug/2026:19:15:33 +1000] "GET /gos.php HTTP/1.1" 404 - "-" "-" 20.104.18.15 - - [28/Aug/2026:19:15:34 +1000] "GET /132.php HTTP/1.1" 404 - "-" "-" 202.153.211.134 - - [28/Aug/2026:19:15:33 +1000] "POST /login2save.php HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 == madalice/madalice.com.au-ssl_log == -- top paths -- 5 GET / 1 GET /zi.php 1 GET /yj.php 1 GET /xr.php 1 GET /xl2023.php 1 GET /wp-easy.php 1 GET /v5.php 1 GET /V2.php 1 GET /up-kon.php 1 GET /ue.php 1 GET /TNT.php 1 GET /tinny.php -- last 10 requests -- 35.201.146.95 - - [28/Aug/2026:19:15:59 +1000] "GET /@fs/root/.aws/sso/cache/?raw?? HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Linux; Android 15; SM-S918B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.3107.219 Mobile Safar 35.201.146.95 - - [28/Aug/2026:19:15:59 +1000] "GET /@fs/home/ubuntu/.env?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Claude-User/1.0; +https://www.anthropic.com/claude-user)" 35.201.146.95 - - [28/Aug/2026:19:15:59 +1000] "GET /@fs/app/.env.production?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 35.201.146.95 - - [28/Aug/2026:19:15:59 +1000] "GET /@fs/var/www/.env?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Applebot/0.1; +http://www.apple.com/go/applebot)" 35.201.146.95 - - [28/Aug/2026:19:15:59 +1000] "GET /@fs/app/.env.local?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Claude-User/1.0; +Claude-User@anthropic.com)" 35.201.146.95 - - [28/Aug/2026:19:15:59 +1000] "GET /@fs/var/www/html/.env?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; LinkedInBot/1.0; +http://www.linkedin.com)" 35.201.146.95 - - [28/Aug/2026:19:15:59 +1000] "GET /@fs/usr/src/app/.env?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.8333.44 Safari/537.36; c 35.201.146.95 - - [28/Aug/2026:19:15:59 +1000] "GET /@fs/app/.terraform/terraform.tfstate?raw?? HTTP/1.1" 404 215121 "-" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amzn-S 35.201.146.95 - - [28/Aug/2026:19:15:59 +1000] "GET /@fs/app/terraform.tfstate?raw?? HTTP/1.1" 404 215110 "-" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot 35.201.146.95 - - [28/Aug/2026:19:15:59 +1000] "GET /@fs/root/terraform.tfstate?raw?? HTTP/1.1" 404 215111 "-" "Mozilla/5.0 (compatible; meta-externalagent/1.1; +https://developers.facebook.com/docs/sharing/webmasters/cr --- last 30 samples (run-up to this incident) --- 2026-08-28 19:13:40 L1=1.25 run=2 blk=0 avail=8553 (62.1%) swpO=0 conn=2 myRSS=2481 php=6 phpRSS=571 ap=20 tcp=28 topuser=madalice 2026-08-28 19:13:40 L1=1.25 run=2 blk=0 avail=8553 (62.1%) swpO=0 conn=4 myRSS=2481 php=6 phpRSS=576 ap=20 tcp=28 topuser=madalice 2026-08-28 19:13:50 L1=1.59 run=2 blk=0 avail=8608 (62.5%) swpO=0 conn=2 myRSS=2481 php=6 phpRSS=584 ap=20 tcp=34 topuser=madalice 2026-08-28 19:13:50 L1=1.59 run=4 blk=0 avail=8591 (62.4%) swpO=0 conn=4 myRSS=2481 php=7 phpRSS=634 ap=20 tcp=34 topuser=madalice 2026-08-28 19:14:00 L1=1.81 run=1 blk=0 avail=8627 (62.6%) swpO=0 conn=1 myRSS=2481 php=5 phpRSS=518 ap=22 tcp=33 topuser=madalice 2026-08-28 19:14:00 L1=1.81 run=2 blk=0 avail=8626 (62.6%) swpO=0 conn=4 myRSS=2481 php=6 phpRSS=528 ap=22 tcp=33 topuser=madalice 2026-08-28 19:14:10 L1=1.99 run=4 blk=0 avail=8539 (62.0%) swpO=0 conn=1 myRSS=2481 php=7 phpRSS=675 ap=22 tcp=31 topuser=madalice 2026-08-28 19:14:10 L1=1.99 run=4 blk=0 avail=8516 (61.8%) swpO=0 conn=2 myRSS=2481 php=7 phpRSS=679 ap=22 tcp=31 topuser=madalice 2026-08-28 19:14:20 L1=2.00 run=3 blk=0 avail=8572 (62.2%) swpO=0 conn=1 myRSS=2481 php=6 phpRSS=597 ap=23 tcp=30 topuser=madalice 2026-08-28 19:14:20 L1=2.00 run=2 blk=0 avail=8563 (62.2%) swpO=0 conn=2 myRSS=2481 php=6 phpRSS=602 ap=23 tcp=30 topuser=madalice 2026-08-28 19:14:30 L1=2.00 run=1 blk=0 avail=8638 (62.7%) swpO=0 conn=1 myRSS=2481 php=5 phpRSS=516 ap=21 tcp=28 topuser=madalice 2026-08-28 19:14:30 L1=2.00 run=2 blk=0 avail=8638 (62.7%) swpO=0 conn=2 myRSS=2481 php=6 phpRSS=545 ap=21 tcp=28 topuser=madalice 2026-08-28 19:14:40 L1=2.00 run=3 blk=0 avail=8632 (62.7%) swpO=0 conn=1 myRSS=2481 php=5 phpRSS=516 ap=21 tcp=29 topuser=madalice 2026-08-28 19:14:40 L1=2.00 run=3 blk=0 avail=8628 (62.6%) swpO=0 conn=2 myRSS=2481 php=5 phpRSS=516 ap=21 tcp=29 topuser=madalice 2026-08-28 19:14:50 L1=2.15 run=3 blk=0 avail=8607 (62.5%) swpO=0 conn=1 myRSS=2481 php=5 phpRSS=516 ap=24 tcp=34 topuser=madalice 2026-08-28 19:14:50 L1=2.15 run=1 blk=0 avail=8609 (62.5%) swpO=0 conn=2 myRSS=2481 php=5 phpRSS=516 ap=24 tcp=34 topuser=madalice 2026-08-28 19:15:00 L1=2.28 run=4 blk=0 avail=8288 (60.2%) swpO=0 conn=4 myRSS=2481 php=8 phpRSS=935 ap=24 tcp=33 topuser=madalice 2026-08-28 19:15:00 L1=2.28 run=5 blk=0 avail=8280 (60.1%) swpO=0 conn=2 myRSS=2481 php=7 phpRSS=847 ap=24 tcp=33 topuser=madalice 2026-08-28 19:15:10 L1=2.54 run=4 blk=0 avail=8369 (60.7%) swpO=0 conn=4 myRSS=2481 php=8 phpRSS=830 ap=26 tcp=33 topuser=madalice 2026-08-28 19:15:10 L1=2.54 run=6 blk=0 avail=8367 (60.7%) swpO=0 conn=4 myRSS=2481 php=8 phpRSS=833 ap=26 tcp=33 topuser=madalice 2026-08-28 19:15:21 L1=2.54 run=2 blk=0 avail=8512 (61.8%) swpO=0 conn=4 myRSS=2481 php=7 phpRSS=657 ap=26 tcp=30 topuser=madalice 2026-08-28 19:15:21 L1=2.54 run=3 blk=0 avail=8508 (61.8%) swpO=0 conn=4 myRSS=2481 php=7 phpRSS=659 ap=26 tcp=30 topuser=madalice 2026-08-28 19:15:31 L1=2.53 run=2 blk=0 avail=8500 (61.7%) swpO=0 conn=4 myRSS=2481 php=6 phpRSS=609 ap=30 tcp=39 topuser=madalice 2026-08-28 19:15:31 L1=2.53 run=4 blk=0 avail=8496 (61.7%) swpO=0 conn=4 myRSS=2481 php=6 phpRSS=601 ap=30 tcp=39 topuser=madalice 2026-08-28 19:15:41 L1=2.29 run=2 blk=0 avail=8468 (61.5%) swpO=0 conn=4 myRSS=2481 php=6 phpRSS=608 ap=33 tcp=38 topuser=madalice 2026-08-28 19:15:41 L1=2.29 run=3 blk=0 avail=8466 (61.5%) swpO=0 conn=4 myRSS=2481 php=6 phpRSS=609 ap=33 tcp=38 topuser=madalice 2026-08-28 19:15:51 L1=2.31 run=4 blk=0 avail=8644 (62.7%) swpO=0 conn=4 myRSS=2481 php=5 phpRSS=451 ap=29 tcp=34 topuser=madalice 2026-08-28 19:15:51 L1=2.31 run=7 blk=0 avail=8644 (62.7%) swpO=0 conn=4 myRSS=2481 php=5 phpRSS=452 ap=29 tcp=34 topuser=madalice 2026-08-28 19:16:01 L1=2.87 run=10 blk=0 avail=6980 (50.7%) swpO=0 conn=6 myRSS=2481 php=11 phpRSS=2105 ap=33 tcp=54 topuser=madalice 2026-08-28 19:16:01 L1=2.87 run=16 blk=0 avail=6976 (50.6%) swpO=0 conn=4 myRSS=2481 php=11 phpRSS=2109 ap=33 tcp=54 topuser=madalice