INCIDENT 2026-08-28 19:17:01 trigger: php_rss=1783MB ================================================================== load: 6.34 2.81 1.64 2/621 4174247 ncpu:10 mem_avail: 7388MB/13777MB (53.6%) swap_used:962MB swapout:0/s blocked(D):0 running:2 iowait:0.1% steal:0.0% php: 12 procs / 1783MB heaviest user: madalice (10 procs, 1735MB) apache: 43 procs tcp_estab: 36 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2481 madalice 10 1741 root 250 981 nobody 42 725 mailman 20 340 netdata 7 207 wp-toolkit 3 84 cpanellogin 1 77 dovenull 6 59 evolution 7 40 zabbix 1 24 dovecot 3 24 named 1 23 aaa 1 15 polkitd 1 12 mailnull 1 12 kurri 1 10 rpc 1 5 nscd 1 5 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1741 root 1 25 evolution 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5758 MB Active(file): 4971 MB Inactive(file): 1085 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 683 MB CommitLimit: 10984 MB Committed_AS: 8633 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 16:58:21 11400 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2541040 16.4 Ssl 16:57:50 /usr/sbin/mariadbd 4173292 510022 madalice 254488 37.5 S 00:54 php-fpm: pool madalice_com_au 4156574 510022 madalice 232120 24.8 R 03:54 php-fpm: pool madalice_com_au 508924 1 netdata 182004 2.0 Ssl 16:57:19 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 529389 527476 root 179732 0.0 S 16:52:43 spamd child 4172584 510022 madalice 164360 31.7 S 01:08 php-fpm: pool madalice_com_au 4156577 510022 madalice 164264 25.7 S 03:53 php-fpm: pool madalice_com_au 4172586 510022 madalice 163680 30.2 S 01:08 php-fpm: pool madalice_com_au 4172587 510022 madalice 163628 30.5 S 01:08 php-fpm: pool madalice_com_au 4173293 510022 madalice 163356 30.6 S 00:54 php-fpm: pool madalice_com_au 4172642 510022 madalice 163288 32.7 S 01:02 php-fpm: pool madalice_com_au 4172588 510022 madalice 163280 30.7 S 01:08 php-fpm: pool madalice_com_au 4172590 510022 madalice 160316 32.9 S 01:08 php-fpm: pool madalice_com_au 527476 1 root 94324 0.0 Ss 16:54:22 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2985227 527476 root 89560 0.0 S 05:38:20 spamd child 4074469 1353308 cpanellogin 79192 0.1 S 27:36 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 509236 509098 root 64132 0.0 Sl 16:57:16 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509266 1 root 56984 0.0 Ss 16:57:16 /usr/lib/systemd/systemd-journald 938582 1 wp-toolkit 49544 0.0 Ss 15:04:53 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1353308 1 root 41348 0.0 Ss 37-16:35:42 cpsrvd (SSL) - waiting for connections 4174190 1469 root 33164 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 938585 1 wp-toolkit 32524 0.0 Ss 15:04:53 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1469 1 root 30280 0.1 Ss 60-09:07:11 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 526869 1 root 29664 0.0 Ss 16:54:45 lfd - sleeping 510022 1 root 26532 0.0 Ss 16:57:12 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 25288 0.2 Ssl 16:58:33 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 509640 508992 root 25248 0.0 Sl 16:57:14 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 481558 1 root 24620 0.1 Ssl 16:59:43 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 508634 1 named 23976 0.0 Ssl 16:57:24 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 4156901 506832 nobody 23716 0.0 S 03:12 /usr/sbin/httpd -k start 4157223 506832 nobody 23224 0.1 S 02:46 /usr/sbin/httpd -k start 1463 1 root 22812 0.0 Ss 60-09:07:11 tailwatchd 4180059 4180015 evolution 22756 0.0 Ss 19:17:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 4156333 506832 nobody 22608 0.4 S 04:30 /usr/sbin/httpd -k start 4157705 506832 nobody 22000 0.1 S 02:15 /usr/sbin/httpd -k start 4156328 506832 nobody 21328 0.0 S 04:31 /usr/sbin/httpd -k start 4156653 506832 nobody 21076 0.0 S 03:42 /usr/sbin/httpd -k start 4156959 506832 nobody 20824 0.1 S 03:11 /usr/sbin/httpd -k start 4172615 506832 nobody 20816 0.0 S 01:05 /usr/sbin/httpd -k start 4173323 506832 nobody 20416 0.0 S 00:51 /usr/sbin/httpd -k start 4155518 506832 nobody 20128 0.0 S 06:32 /usr/sbin/httpd -k start 4173329 506832 nobody 20024 0.0 S 00:51 /usr/sbin/httpd -k start 4157689 506832 nobody 19996 0.0 S 02:16 /usr/sbin/httpd -k start 4172641 506832 nobody 19768 0.0 S 01:02 /usr/sbin/httpd -k start 4173328 506832 nobody 19760 0.0 S 00:51 /usr/sbin/httpd -k start 4173816 506832 nobody 19720 0.0 S 00:23 /usr/sbin/httpd -k start 4156332 506832 nobody 19704 0.0 S 04:30 /usr/sbin/httpd -k start 4173236 506832 nobody 19688 0.0 S 01:00 /usr/sbin/httpd -k start 4173819 506832 nobody 19480 0.1 S 00:23 /usr/sbin/httpd -k start 4173369 506832 nobody 19364 0.0 S 00:50 /usr/sbin/httpd -k start 508867 508814 mailman 19288 0.0 S 16:57:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 508855 508814 mailman 19096 0.0 S 16:57:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 508864 508814 mailman 19044 0.0 S 16:57:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 508865 508814 mailman 19016 0.0 S 16:57:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 508856 508814 mailman 18788 0.0 S 16:57:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508857 508814 mailman 18628 0.0 S 16:57:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 508866 508814 mailman 18508 0.0 S 16:57:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 508861 508814 mailman 18504 0.0 S 16:57:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 4173304 506832 nobody 18396 0.0 S 00:53 /usr/sbin/httpd -k start 4172616 506832 nobody 18348 0.0 S 01:05 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3633328 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min otterfencing/otterfencing.com.au-ssl_log 254 madalice/madalice.com.au-ssl_log 200 vinesit/vinesit.com.au-ssl_log 104 evolution/my.evolutionerp.com.au-ssl_log 84 kurri/kurrimotorinn.com.au-ssl_log 61 evolution/release.evolutionerp.com.au 59 otter2/otterfencing.net.au-ssl_log 46 nrg/nrgservices.net.au-ssl_log 42 evolution/staging.evolutionerp.com.au-ssl_log 28 vinesit/vinesit.com.au 28 customc/customcentral.com.au 26 candyfabcom/candyfab.com.au-ssl_log 20 customc/customcentral.com.au-ssl_log 18 evolution/portal.evolutionerp.com.au-ssl_log 14 corpkicks/corporatekicks.com.au-ssl_log 13 (total vhosts taking traffic: 16) --- top client IPs across all vhosts (last 3 min) --- 254 68.155.159.216 177 35.201.146.95 136 20.104.18.15 132 20.104.50.220 92 20.48.179.39 61 31.59.160.30 42 20.48.160.90 42 20.220.10.235 34 202.153.211.134 20 158.23.184.117 14 4.204.200.136 13 203.54.180.238 12 118.127.40.55 2 50.6.169.131 1 92.205.239.73 --- top request paths across all vhosts (last 3 min) --- 25 POST / 17 GET / 13 GET /heartbeat.php 10 POST /functions.php 8 GET /goods.php 7 GET /app/ajax.php 7 GET /admin.php 6 POST /index.php 5 POST /api/auth/signin 5 GET /wp.php 4 POST /wp-cron.php 4 POST /signup 4 POST /signin 4 GET /w.php 4 GET /wp-content/uploads/ 4 GET /simple.php 4 GET /shiny.php 4 GET /nofile.php 4 GET /mac.php 4 GET /inx.php --- busiest 3 vhosts: top paths + last 10 requests --- == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-signup.php 1 GET /wp-seo.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-load.php 1 GET /wp-includes/wp-includes_function.php 1 GET /wp-includes/wp-class.php 1 GET /wp-includes/widgets/include.php 1 GET /wp-includes/widgets/about.php -- last 10 requests -- 68.155.159.216 - - [28/Aug/2026:19:16:45 +1000] "GET /comfunctions.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [28/Aug/2026:19:16:45 +1000] "GET /images/class-config.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [28/Aug/2026:19:16:45 +1000] "GET /wp-includes/widgets/include.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [28/Aug/2026:19:16:46 +1000] "GET /install.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [28/Aug/2026:19:16:46 +1000] "GET /.well-known/acme-challenge/admin.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [28/Aug/2026:19:16:47 +1000] "GET /wp-includes/wp-includes_function.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [28/Aug/2026:19:16:47 +1000] "GET /.well-known/file.php/ HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [28/Aug/2026:19:16:47 +1000] "GET /wp-includes/SimplePie/gzdecodes.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [28/Aug/2026:19:16:48 +1000] "GET /wp-back.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [28/Aug/2026:19:16:48 +1000] "GET /wp-admin/css/colors/blue/about.php HTTP/1.1" 404 5750 "-" "-" == madalice/madalice.com.au-ssl_log == -- top paths -- 8 POST / 5 GET / 2 GET /@fs/proc/self/environ 1 GET /wp-login.php 1 GET /wp-config.php.old 1 GET /wp-config.php.bak 1 GET /wp-config.php 1 GET /web/.env 1 GET /@vite/env 1 GET /v2/.env 1 GET /v1/graphql 1 GET /v1/.env -- last 10 requests -- 35.201.146.95 - - [28/Aug/2026:19:16:53 +1000] "GET /admin HTTP/1.1" 302 - "-" "Mozilla/5.0 (compatible; LinkedInBot/1.0; +http://www.linkedin.com)" 35.201.146.95 - - [28/Aug/2026:19:16:53 +1000] "GET /health HTTP/1.1" 404 215087 "-" "Mozilla/5.0 (compatible; Claude-User/1.0; +Claude-User@anthropic.com)" 35.201.146.95 - - [28/Aug/2026:19:16:53 +1000] "GET /metrics HTTP/1.1" 404 215088 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)" 35.201.146.95 - - [28/Aug/2026:19:16:57 +1000] "GET /Dockerfile HTTP/1.1" 404 215091 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; facebookexternalhit/1.1; +http://www.facebook.com/externalhit_uate 35.201.146.95 - - [28/Aug/2026:19:16:57 +1000] "GET /wp-login.php HTTP/1.1" 200 4023 "https://mail.madalice.com.au/login" "Mozilla/5.0 (compatible; Applebot/0.1; +http://www.apple.com/go/applebot)" 35.201.146.95 - - [28/Aug/2026:19:16:59 +1000] "GET /.env.prod HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; TelegramBot/1.0" 35.201.146.95 - - [28/Aug/2026:19:16:59 +1000] "GET /application.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 35.201.146.95 - - [28/Aug/2026:19:16:59 +1000] "GET /_next/../.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Applebot/0.1; +http://www.apple.com/go/applebot)" 35.201.146.95 - - [28/Aug/2026:19:16:58 +1000] "GET /i.php HTTP/1.1" 404 215086 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.4) Gecko/20100101 Firefox/78.4; compatible; Perplexity-User/1.0; +https://perplexit 35.201.146.95 - - [28/Aug/2026:19:16:59 +1000] "GET /pi.php HTTP/1.1" 404 215087 "-" "Mozilla/5.0 (compatible; Twitterbot/1.0)" == vinesit/vinesit.com.au-ssl_log == -- top paths -- 2 GET /wp-content/mu-plugins/jp.php 2 GET /wp-admin/user/rk2.php 2 GET /wp-admin/network/mah.php 2 GET /wp-admin/jp.php 2 GET /wp-admin/css/colors/coffee/getid3s.php 2 GET /wp-admin/buy.php 2 GET /uploads/mar.php 2 GET /uploads/mail.php 2 GET /update/manager.php 2 GET /update/jp.php 2 GET /update/cong.php 2 GET /update/buy.php -- last 10 requests -- 20.104.50.220 - - [28/Aug/2026:19:16:36 +1000] "GET /files/cc.php HTTP/1.1" 301 - "-" "-" 20.104.50.220 - - [28/Aug/2026:19:16:36 +1000] "GET /files/cc.php HTTP/1.1" 404 27678 "-" "-" 20.104.50.220 - - [28/Aug/2026:19:16:38 +1000] "GET /wp-admin/js/widgets/alfa.php HTTP/1.1" 403 13 "-" "-" 20.104.50.220 - - [28/Aug/2026:19:16:38 +1000] "GET /wp-includes/js/codemirror/hehe.php HTTP/1.1" 403 6 "-" "-" 20.104.50.220 - - [28/Aug/2026:19:16:39 +1000] "GET /wp-admin/user/rk2.php HTTP/1.1" 301 - "-" "-" 20.104.50.220 - - [28/Aug/2026:19:16:40 +1000] "GET /wp-admin/user/rk2.php HTTP/1.1" 404 27678 "-" "-" 20.104.50.220 - - [28/Aug/2026:19:16:41 +1000] "GET /cgi-bin/cgi-bin/admin.php HTTP/1.1" 301 - "-" "-" 20.104.50.220 - - [28/Aug/2026:19:16:42 +1000] "GET /cgi-bin/cgi-bin/admin.php HTTP/1.1" 404 27678 "-" "-" 20.104.50.220 - - [28/Aug/2026:19:16:43 +1000] "GET /wp-content/uploads/2024/02.php HTTP/1.1" 403 12 "-" "-" 20.104.50.220 - - [28/Aug/2026:19:16:44 +1000] "GET /update/ty.php HTTP/1.1" 301 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-28 19:14:30 L1=2.00 run=2 blk=0 avail=8638 (62.7%) swpO=0 conn=2 myRSS=2481 php=6 phpRSS=545 ap=21 tcp=28 topuser=madalice 2026-08-28 19:14:40 L1=2.00 run=3 blk=0 avail=8632 (62.7%) swpO=0 conn=1 myRSS=2481 php=5 phpRSS=516 ap=21 tcp=29 topuser=madalice 2026-08-28 19:14:40 L1=2.00 run=3 blk=0 avail=8628 (62.6%) swpO=0 conn=2 myRSS=2481 php=5 phpRSS=516 ap=21 tcp=29 topuser=madalice 2026-08-28 19:14:50 L1=2.15 run=3 blk=0 avail=8607 (62.5%) swpO=0 conn=1 myRSS=2481 php=5 phpRSS=516 ap=24 tcp=34 topuser=madalice 2026-08-28 19:14:50 L1=2.15 run=1 blk=0 avail=8609 (62.5%) swpO=0 conn=2 myRSS=2481 php=5 phpRSS=516 ap=24 tcp=34 topuser=madalice 2026-08-28 19:15:00 L1=2.28 run=4 blk=0 avail=8288 (60.2%) swpO=0 conn=4 myRSS=2481 php=8 phpRSS=935 ap=24 tcp=33 topuser=madalice 2026-08-28 19:15:00 L1=2.28 run=5 blk=0 avail=8280 (60.1%) swpO=0 conn=2 myRSS=2481 php=7 phpRSS=847 ap=24 tcp=33 topuser=madalice 2026-08-28 19:15:10 L1=2.54 run=4 blk=0 avail=8369 (60.7%) swpO=0 conn=4 myRSS=2481 php=8 phpRSS=830 ap=26 tcp=33 topuser=madalice 2026-08-28 19:15:10 L1=2.54 run=6 blk=0 avail=8367 (60.7%) swpO=0 conn=4 myRSS=2481 php=8 phpRSS=833 ap=26 tcp=33 topuser=madalice 2026-08-28 19:15:21 L1=2.54 run=2 blk=0 avail=8512 (61.8%) swpO=0 conn=4 myRSS=2481 php=7 phpRSS=657 ap=26 tcp=30 topuser=madalice 2026-08-28 19:15:21 L1=2.54 run=3 blk=0 avail=8508 (61.8%) swpO=0 conn=4 myRSS=2481 php=7 phpRSS=659 ap=26 tcp=30 topuser=madalice 2026-08-28 19:15:31 L1=2.53 run=2 blk=0 avail=8500 (61.7%) swpO=0 conn=4 myRSS=2481 php=6 phpRSS=609 ap=30 tcp=39 topuser=madalice 2026-08-28 19:15:31 L1=2.53 run=4 blk=0 avail=8496 (61.7%) swpO=0 conn=4 myRSS=2481 php=6 phpRSS=601 ap=30 tcp=39 topuser=madalice 2026-08-28 19:15:41 L1=2.29 run=2 blk=0 avail=8468 (61.5%) swpO=0 conn=4 myRSS=2481 php=6 phpRSS=608 ap=33 tcp=38 topuser=madalice 2026-08-28 19:15:41 L1=2.29 run=3 blk=0 avail=8466 (61.5%) swpO=0 conn=4 myRSS=2481 php=6 phpRSS=609 ap=33 tcp=38 topuser=madalice 2026-08-28 19:15:51 L1=2.31 run=4 blk=0 avail=8644 (62.7%) swpO=0 conn=4 myRSS=2481 php=5 phpRSS=451 ap=29 tcp=34 topuser=madalice 2026-08-28 19:15:51 L1=2.31 run=7 blk=0 avail=8644 (62.7%) swpO=0 conn=4 myRSS=2481 php=5 phpRSS=452 ap=29 tcp=34 topuser=madalice 2026-08-28 19:16:01 L1=2.87 run=10 blk=0 avail=6980 (50.7%) swpO=0 conn=6 myRSS=2481 php=11 phpRSS=2105 ap=33 tcp=54 topuser=madalice 2026-08-28 19:16:01 L1=2.87 run=16 blk=0 avail=6976 (50.6%) swpO=0 conn=4 myRSS=2481 php=11 phpRSS=2109 ap=33 tcp=54 topuser=madalice 2026-08-28 19:16:11 L1=3.54 run=17 blk=0 avail=6956 (50.5%) swpO=50 conn=10 myRSS=2481 php=14 phpRSS=2069 ap=51 tcp=71 topuser=madalice 2026-08-28 19:16:12 L1=3.54 run=11 blk=0 avail=7323 (53.2%) swpO=45 conn=10 myRSS=2481 php=13 phpRSS=1750 ap=68 tcp=55 topuser=madalice 2026-08-28 19:16:21 L1=3.22 run=2 blk=0 avail=7391 (53.6%) swpO=0 conn=1 myRSS=2481 php=13 phpRSS=1655 ap=59 tcp=31 topuser=madalice 2026-08-28 19:16:22 L1=3.22 run=2 blk=0 avail=7382 (53.6%) swpO=0 conn=2 myRSS=2481 php=13 phpRSS=1671 ap=58 tcp=33 topuser=madalice 2026-08-28 19:16:31 L1=4.61 run=2 blk=0 avail=7391 (53.6%) swpO=0 conn=2 myRSS=2481 php=13 phpRSS=1710 ap=50 tcp=41 topuser=madalice 2026-08-28 19:16:32 L1=4.61 run=3 blk=0 avail=7425 (53.9%) swpO=0 conn=2 myRSS=2481 php=13 phpRSS=1684 ap=49 tcp=33 topuser=madalice 2026-08-28 19:16:41 L1=5.17 run=8 blk=0 avail=7031 (51.0%) swpO=0 conn=7 myRSS=2481 php=15 phpRSS=2175 ap=50 tcp=42 topuser=madalice 2026-08-28 19:16:42 L1=5.17 run=8 blk=0 avail=7071 (51.3%) swpO=0 conn=6 myRSS=2481 php=15 phpRSS=2146 ap=49 tcp=37 topuser=madalice 2026-08-28 19:16:51 L1=5.41 run=2 blk=0 avail=7519 (54.6%) swpO=0 conn=1 myRSS=2481 php=13 phpRSS=1682 ap=43 tcp=31 topuser=madalice 2026-08-28 19:16:52 L1=5.41 run=1 blk=0 avail=7541 (54.7%) swpO=0 conn=1 myRSS=2481 php=12 phpRSS=1631 ap=42 tcp=65 topuser=madalice 2026-08-28 19:17:01 L1=6.34 run=2 blk=0 avail=7388 (53.6%) swpO=0 conn=3 myRSS=2481 php=12 phpRSS=1783 ap=43 tcp=36 topuser=madalice