INCIDENT 2026-08-28 19:43:29 trigger: php_rss=1674MB ================================================================== load: 4.03 1.85 1.25 14/618 66267 ncpu:10 mem_avail: 7498MB/13777MB (54.4%) swap_used:962MB swapout:0/s blocked(D):0 running:14 iowait:0.0% steal:0.0% php: 12 procs / 1674MB heaviest user: madalice (10 procs, 1626MB) apache: 38 procs tcp_estab: 35 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2481 madalice 10 1947 root 249 965 nobody 36 604 mailman 20 339 netdata 7 207 infinium 3 99 cpanellogin 1 87 wp-toolkit 3 84 dovenull 6 59 evolution 7 40 zabbix 1 25 dovecot 3 24 named 1 23 aaa 1 14 polkitd 1 12 mailnull 1 12 kurri 1 10 rpc 1 5 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 2009 root 1 25 evolution 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6012 MB Active(file): 5257 MB Inactive(file): 1063 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 679 MB CommitLimit: 10984 MB Committed_AS: 8787 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 17:24:50 11400 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2541128 16.0 Ssl 17:24:19 /usr/sbin/mariadbd 66147 510022 madalice 217968 35.1 S 00:11 php-fpm: pool madalice_com_au 66142 510022 madalice 212912 42.9 R 00:11 php-fpm: pool madalice_com_au 66143 510022 madalice 206092 35.1 R 00:11 php-fpm: pool madalice_com_au 66146 510022 madalice 200836 34.4 R 00:11 php-fpm: pool madalice_com_au 508924 1 netdata 182436 2.0 Ssl 17:23:48 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 529389 527476 root 181652 0.0 S 17:19:12 spamd child 65914 510022 madalice 160540 21.8 S 00:43 php-fpm: pool madalice_com_au 66144 510022 madalice 159332 45.1 S 00:11 php-fpm: pool madalice_com_au 66140 510022 madalice 159324 44.0 S 00:11 php-fpm: pool madalice_com_au 66139 510022 madalice 159284 34.6 S 00:11 php-fpm: pool madalice_com_au 66141 510022 madalice 159260 36.2 S 00:11 php-fpm: pool madalice_com_au 66145 510022 madalice 159256 33.2 R 00:11 php-fpm: pool madalice_com_au 527476 1 root 94232 0.0 Ss 17:20:51 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4074469 1353308 cpanellogin 89568 0.0 S 54:05 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 2985227 527476 root 89440 0.0 S 06:04:49 spamd child 509236 509098 root 64116 0.0 Sl 17:23:45 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509266 1 root 57512 0.0 Ss 17:23:45 /usr/lib/systemd/systemd-journald 64692 1353308 infinium 54872 0.0 S 03:02 webmaild - serving 1.41.252.211 938582 1 wp-toolkit 49544 0.0 Ss 15:31:22 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1353308 1 root 41420 0.0 Ss 37-17:02:11 cpsrvd (SSL) - waiting for connections 938585 1 wp-toolkit 32576 0.0 Ss 15:31:22 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 50085 938407 infinium 32112 0.1 S 04:04 php-fpm: pool user_infinium 1469 1 root 30288 0.1 Ss 60-09:33:40 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 526869 1 root 29724 0.0 Ss 17:21:14 lfd - sleeping 510022 1 root 26556 0.0 Ss 17:23:41 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 25736 0.2 Ssl 17:25:02 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 509640 508992 root 25512 0.0 Sl 17:23:43 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 481558 1 root 24620 0.1 Ssl 17:26:12 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 508634 1 named 23976 0.0 Ssl 17:23:53 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1463 1 root 22796 0.0 Ss 60-09:33:40 tailwatchd 4180059 4180015 evolution 22756 0.0 Ss 19:43:30 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 65472 506832 nobody 21680 0.0 S 01:33 /usr/sbin/httpd -k start 49273 506832 nobody 20644 0.0 S 04:55 /usr/sbin/httpd -k start 65486 506832 nobody 20584 0.0 S 01:32 /usr/sbin/httpd -k start 65980 506832 nobody 20500 0.0 S 00:40 /usr/sbin/httpd -k start 65978 506832 nobody 20460 0.0 S 00:40 /usr/sbin/httpd -k start 65981 506832 nobody 20456 0.0 S 00:40 /usr/sbin/httpd -k start 50393 506832 nobody 19860 0.0 S 03:45 /usr/sbin/httpd -k start 64873 506832 nobody 19424 0.0 S 02:39 /usr/sbin/httpd -k start 65488 506832 nobody 19256 0.0 S 01:32 /usr/sbin/httpd -k start 65972 506832 nobody 19256 0.1 S 00:41 /usr/sbin/httpd -k start 508867 508814 mailman 19232 0.0 S 17:23:51 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 65970 506832 nobody 19144 0.0 S 00:41 /usr/sbin/httpd -k start 65976 506832 nobody 19128 0.0 S 00:40 /usr/sbin/httpd -k start 66200 506832 nobody 19112 0.1 S 00:09 /usr/sbin/httpd -k start 66201 506832 nobody 19112 0.1 S 00:08 /usr/sbin/httpd -k start 66202 506832 nobody 19112 0.1 S 00:08 /usr/sbin/httpd -k start 65990 506832 nobody 19104 0.0 S 00:39 /usr/sbin/httpd -k start 508855 508814 mailman 19096 0.0 S 17:23:51 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 508864 508814 mailman 19044 0.0 S 17:23:51 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 508865 508814 mailman 19008 0.0 S 17:23:51 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 508856 508814 mailman 18788 0.0 S 17:23:51 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508857 508814 mailman 18628 0.0 S 17:23:51 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 508861 508814 mailman 18504 0.0 S 17:23:51 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 64939 506832 nobody 18480 0.0 S 02:35 /usr/sbin/httpd -k start 508866 508814 mailman 18432 0.0 S 17:23:51 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 508854 508814 mailman 18308 0.0 S 17:23:51 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 508862 508814 mailman 18216 0.0 S 17:23:51 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 509671 508992 netdata 18180 2.1 Sl 17:23:43 /usr/libexec/netdata/plugins.d/apps.plugin 1 --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3635228 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 3635218 | madalice_wp | madalice_wp | Query | 0 | Sending data | SELECT option_value FROM AMuqf6qZ_options WHERE option_name LIKE 'wc_square_background_sync_job_%' AND ( option_value LIKE '%\"status\":\"queued\"%' OR option_value LIKE '%\"status\":\"processing\"%' ) ORDER BY option_id ASC LIMIT 1 | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/portal.evolutionerp.com.au-ssl_log 140 whiz/whizengineering.com.au 93 evolution/my.evolutionerp.com.au-ssl_log 81 evolution/portal.evolutionerp.com.au 79 candyfabcom/candyfab.com.au-ssl_log 78 evolution/my.evolutionerp.com.au 66 olympic/olympicfencing.com.au-ssl_log 54 madalice/madalice.com.au-ssl_log 24 corpkicks/corporatekicks.com.au-ssl_log 11 aaa/aaadownunder.com.au-ssl_log 1 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 238 20.220.10.235 200 20.104.18.15 78 20.48.160.90 52 89.16.233.114 34 3.239.104.87 19 203.54.180.238 7 20.220.227.7 4 118.127.40.55 2 216.73.217.55 2 114.119.130.40 2 106.55.254.60 1 66.249.73.166 1 65.111.15.185 1 34.196.51.17 1 207.46.13.54 --- top request paths across all vhosts (last 3 min) --- 19 GET /heartbeat.php 5 GET /store/hand-painted-nike-bandana/ 5 GET /goods.php 4 POST /wp-cron.php 4 GET / 3 GET /zs.php 3 GET /zq.php 3 GET /yw.php 3 GET /ys.php 3 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 GET /.well-known/webmcp 3 GET /vw.php 3 GET /vr.php 3 GET /vf.php 3 GET /this_is_a_new_hello_world.php 3 GET /sr.php 3 GET /simple.php 3 GET /shiny.php 3 GET /radio.php 3 GET /qr.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 19 GET /heartbeat.php 2 GET /goods.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /x.php 1 GET /ws85.php 1 GET /ws55.php 1 GET /wp-trackback.php 1 GET /wp-safe.php 1 GET /wp.php 1 GET /wp-includes/index.php -- last 10 requests -- 20.104.18.15 - - [28/Aug/2026:19:41:52 +1000] "GET /wp-includes/ID3/moon.php HTTP/1.1" 404 - "-" "-" 203.54.180.238 - - [28/Aug/2026:19:41:53 +1000] "GET /heartbeat.php?sentAt=1787910114&bytes=106,145,87,226&_=1787897041662 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [28/Aug/2026:19:41:54 +1000] "GET /heartbeat.php?sentAt=1787910115&bytes=106,145,87,227&_=1787896313005 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [28/Aug/2026:19:42:03 +1000] "GET /heartbeat.php?sentAt=1787910124&bytes=106,145,87,236&_=1787897041663 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [28/Aug/2026:19:42:04 +1000] "GET /heartbeat.php?sentAt=1787910125&bytes=106,145,87,237&_=1787896313006 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [28/Aug/2026:19:42:13 +1000] "GET /heartbeat.php?sentAt=1787910134&bytes=106,145,87,246&_=1787897041664 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [28/Aug/2026:19:42:14 +1000] "GET /heartbeat.php?sentAt=1787910135&bytes=106,145,87,247&_=1787896313007 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [28/Aug/2026:19:42:23 +1000] "GET /heartbeat.php?sentAt=1787910144&bytes=106,145,88,0&_=1787897041665 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" " 203.54.180.238 - - [28/Aug/2026:19:42:24 +1000] "GET /heartbeat.php?sentAt=1787910145&bytes=106,145,88,1&_=1787896313008 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" " 203.54.180.238 - - [28/Aug/2026:19:42:33 +1000] "GET /heartbeat.php?sentAt=1787910154&bytes=106,145,88,10&_=1787897041666 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" == whiz/whizengineering.com.au == -- top paths -- 2 GET /wp5.php 1 GET /zwq13.php 1 GET /zs.php 1 GET /zq.php 1 GET /zogy1.php 1 GET /zi.php 1 GET /yw.php 1 GET /ys.php 1 GET /yj.php 1 GET /xxw.php 1 GET /xwx1.php 1 GET /xmr.php -- last 10 requests -- 20.220.10.235 - - [28/Aug/2026:19:43:18 +1000] "GET /qb.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:19:43:19 +1000] "GET /vr.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:19:43:19 +1000] "GET /hr.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:19:43:19 +1000] "GET /mz.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:19:43:19 +1000] "GET /jb.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:19:43:19 +1000] "GET /bj.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:19:43:20 +1000] "GET /qr.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:19:43:20 +1000] "GET /jn.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:19:43:20 +1000] "GET /vw.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:19:43:20 +1000] "GET /me.php HTTP/1.1" 404 - "-" "-" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /index.php 1 GET /zv.php 1 GET /zs.php 1 GET /zq.php 1 GET /yw.php 1 GET /ys.php 1 GET /yn.php 1 GET /yl.php 1 GET /xu.php 1 GET /xj.php 1 GET /xi.php 1 GET /xf.php -- last 10 requests -- 20.220.10.235 - - [28/Aug/2026:19:41:29 +1000] "GET /xf.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:19:41:30 +1000] "GET /yn.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:19:41:30 +1000] "GET /je.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:19:41:30 +1000] "GET /vm.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:19:41:31 +1000] "GET /xi.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:19:41:31 +1000] "GET /xd.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:19:41:32 +1000] "GET /vj.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:19:41:32 +1000] "GET /bm.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:19:41:32 +1000] "GET /bg.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [28/Aug/2026:19:41:33 +1000] "GET /hf.php HTTP/1.1" 404 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-28 19:41:08 L1=1.58 run=9 blk=0 avail=7779 (56.5%) swpO=0 conn=2 myRSS=2481 php=9 phpRSS=1089 ap=71 tcp=38 topuser=madalice 2026-08-28 19:41:09 L1=1.58 run=13 blk=0 avail=7503 (54.5%) swpO=0 conn=9 myRSS=2481 php=10 phpRSS=1410 ap=71 tcp=38 topuser=madalice 2026-08-28 19:41:19 L1=1.79 run=1 blk=0 avail=7767 (56.4%) swpO=0 conn=1 myRSS=2481 php=9 phpRSS=1138 ap=61 tcp=38 topuser=madalice 2026-08-28 19:41:19 L1=1.79 run=1 blk=0 avail=7765 (56.4%) swpO=0 conn=9 myRSS=2481 php=9 phpRSS=1138 ap=61 tcp=37 topuser=madalice 2026-08-28 19:41:29 L1=1.60 run=1 blk=0 avail=7839 (56.9%) swpO=0 conn=1 myRSS=2481 php=9 phpRSS=1138 ap=51 tcp=38 topuser=madalice 2026-08-28 19:41:29 L1=1.60 run=2 blk=0 avail=7806 (56.7%) swpO=0 conn=9 myRSS=2481 php=10 phpRSS=1202 ap=51 tcp=38 topuser=madalice 2026-08-28 19:41:39 L1=1.50 run=2 blk=0 avail=8855 (64.3%) swpO=0 conn=1 myRSS=2481 php=2 phpRSS=48 ap=41 tcp=32 topuser=root 2026-08-28 19:41:39 L1=1.50 run=1 blk=0 avail=8856 (64.3%) swpO=0 conn=9 myRSS=2481 php=2 phpRSS=48 ap=41 tcp=33 topuser=root 2026-08-28 19:41:49 L1=2.70 run=2 blk=0 avail=8667 (62.9%) swpO=0 conn=1 myRSS=2481 php=4 phpRSS=349 ap=32 tcp=30 topuser=otterfencing 2026-08-28 19:41:49 L1=2.70 run=1 blk=0 avail=8655 (62.8%) swpO=0 conn=9 myRSS=2481 php=4 phpRSS=357 ap=32 tcp=29 topuser=otterfencing 2026-08-28 19:41:59 L1=2.45 run=14 blk=0 avail=8243 (59.8%) swpO=0 conn=1 myRSS=2481 php=11 phpRSS=1007 ap=32 tcp=42 topuser=olympic 2026-08-28 19:41:59 L1=2.45 run=12 blk=0 avail=8309 (60.3%) swpO=0 conn=9 myRSS=2481 php=10 phpRSS=894 ap=32 tcp=43 topuser=olympic 2026-08-28 19:42:09 L1=2.59 run=1 blk=0 avail=8960 (65.0%) swpO=0 conn=1 myRSS=2481 php=2 phpRSS=48 ap=27 tcp=26 topuser=root 2026-08-28 19:42:09 L1=2.59 run=1 blk=0 avail=8961 (65.0%) swpO=0 conn=1 myRSS=2481 php=2 phpRSS=48 ap=27 tcp=26 topuser=root 2026-08-28 19:42:19 L1=2.35 run=2 blk=0 avail=8894 (64.6%) swpO=0 conn=1 myRSS=2481 php=3 phpRSS=203 ap=19 tcp=30 topuser=madalice 2026-08-28 19:42:19 L1=2.35 run=1 blk=0 avail=8893 (64.6%) swpO=0 conn=1 myRSS=2481 php=3 phpRSS=203 ap=19 tcp=31 topuser=madalice 2026-08-28 19:42:29 L1=2.15 run=1 blk=0 avail=8900 (64.6%) swpO=0 conn=1 myRSS=2481 php=3 phpRSS=203 ap=17 tcp=28 topuser=madalice 2026-08-28 19:42:29 L1=2.15 run=1 blk=0 avail=8900 (64.6%) swpO=0 conn=1 myRSS=2481 php=3 phpRSS=203 ap=17 tcp=28 topuser=madalice 2026-08-28 19:42:39 L1=1.90 run=2 blk=0 avail=8916 (64.7%) swpO=0 conn=1 myRSS=2481 php=3 phpRSS=170 ap=20 tcp=31 topuser=madalice 2026-08-28 19:42:39 L1=1.90 run=2 blk=0 avail=8871 (64.4%) swpO=0 conn=1 myRSS=2481 php=3 phpRSS=211 ap=20 tcp=31 topuser=madalice 2026-08-28 19:42:49 L1=1.84 run=4 blk=0 avail=8075 (58.6%) swpO=0 conn=1 myRSS=2481 php=9 phpRSS=1143 ap=22 tcp=38 topuser=madalice 2026-08-28 19:42:49 L1=1.84 run=3 blk=0 avail=8233 (59.8%) swpO=0 conn=1 myRSS=2481 php=8 phpRSS=956 ap=22 tcp=38 topuser=madalice 2026-08-28 19:42:59 L1=1.86 run=1 blk=0 avail=8032 (58.3%) swpO=0 conn=1 myRSS=2481 php=8 phpRSS=979 ap=47 tcp=33 topuser=madalice 2026-08-28 19:42:59 L1=1.86 run=1 blk=0 avail=8032 (58.3%) swpO=0 conn=1 myRSS=2481 php=8 phpRSS=979 ap=47 tcp=33 topuser=madalice 2026-08-28 19:43:09 L1=1.73 run=1 blk=0 avail=8104 (58.8%) swpO=0 conn=1 myRSS=2481 php=8 phpRSS=979 ap=37 tcp=22 topuser=madalice 2026-08-28 19:43:09 L1=1.73 run=1 blk=0 avail=8104 (58.8%) swpO=0 conn=1 myRSS=2481 php=8 phpRSS=979 ap=37 tcp=22 topuser=madalice 2026-08-28 19:43:19 L1=1.47 run=11 blk=0 avail=8553 (62.1%) swpO=0 conn=11 myRSS=2481 php=12 phpRSS=681 ap=27 tcp=35 topuser=madalice 2026-08-28 19:43:19 L1=2.87 run=19 blk=0 avail=8209 (59.6%) swpO=0 conn=1 myRSS=2481 php=12 phpRSS=1069 ap=27 tcp=34 topuser=madalice 2026-08-28 19:43:29 L1=4.03 run=14 blk=0 avail=7498 (54.4%) swpO=0 conn=11 myRSS=2481 php=12 phpRSS=1674 ap=38 tcp=35 topuser=madalice 2026-08-28 19:43:30 L1=4.03 run=17 blk=0 avail=7362 (53.4%) swpO=0 conn=9 myRSS=2481 php=12 phpRSS=1919 ap=37 tcp=34 topuser=madalice