INCIDENT 2026-08-28 20:26:02 trigger: php_rss=1680MB ================================================================== load: 1.90 0.99 0.89 2/636 215357 ncpu:10 mem_avail: 7420MB/13777MB (53.9%) swap_used:963MB swapout:0/s blocked(D):0 running:2 iowait:0.2% steal:0.0% php: 13 procs / 1680MB heaviest user: madalice (10 procs, 1532MB) apache: 51 procs tcp_estab: 49 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2481 madalice 10 1532 root 250 966 nobody 50 772 mailman 20 339 netdata 7 200 evolution 8 146 infinium 3 102 cpanellogin 1 101 wp-toolkit 3 84 dovenull 6 59 mailnull 3 39 candyfabcom 2 27 zabbix 1 24 dovecot 3 24 named 1 23 aaa 1 15 polkitd 1 12 kurri 1 10 rpc 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1532 evolution 2 130 root 1 25 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5937 MB Active(file): 5280 MB Inactive(file): 965 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 679 MB CommitLimit: 10984 MB Committed_AS: 8788 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 18:07:22 11400 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2541176 15.5 Ssl 18:06:51 /usr/sbin/mariadbd 529389 527476 root 181756 0.0 S 18:01:44 spamd child 508924 1 netdata 175164 2.0 Ssl 18:06:20 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 215222 510022 madalice 162968 72.8 S 00:07 php-fpm: pool madalice_com_au 215223 510022 madalice 161924 42.8 S 00:07 php-fpm: pool madalice_com_au 215225 510022 madalice 161316 42.1 S 00:07 php-fpm: pool madalice_com_au 215240 510022 madalice 161312 49.5 S 00:06 php-fpm: pool madalice_com_au 215224 510022 madalice 161304 42.5 S 00:07 php-fpm: pool madalice_com_au 215227 510022 madalice 161304 41.1 S 00:07 php-fpm: pool madalice_com_au 215230 510022 madalice 161300 41.2 S 00:07 php-fpm: pool madalice_com_au 215235 510022 madalice 161296 42.8 S 00:07 php-fpm: pool madalice_com_au 215221 510022 madalice 140540 20.8 S 00:07 php-fpm: pool madalice_com_au 215266 510022 madalice 136412 28.8 S 00:05 php-fpm: pool madalice_com_au 215328 183920 evolution 123124 41.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4074469 1353308 cpanellogin 103660 0.0 S 01:36:37 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 527476 1 root 93684 0.0 Ss 18:03:23 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2985227 527476 root 88892 0.0 S 06:47:21 spamd child 509236 509098 root 64404 0.0 Sl 18:06:17 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509266 1 root 58564 0.0 Ss 18:06:17 /usr/lib/systemd/systemd-journald 183230 1353308 infinium 55360 0.0 S 08:11 webmaild - serving 1.41.252.211 938582 1 wp-toolkit 49544 0.0 Ss 16:13:54 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1353308 1 root 41444 0.0 Ss 37-17:44:43 cpsrvd (SSL) - waiting for connections 938585 1 wp-toolkit 32576 0.0 Ss 16:13:54 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 183232 938407 infinium 30604 0.0 S 08:11 php-fpm: pool user_infinium 1469 1 root 30316 0.1 Ss 60-10:16:12 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 526869 1 root 29752 0.0 Ss 18:03:46 lfd - sleeping 510022 1 root 26512 0.0 Ss 18:06:13 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 509640 508992 root 26028 0.0 Sl 18:06:15 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 483898 1 zabbix 25004 0.2 Ssl 18:07:34 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 481558 1 root 24620 0.1 Ssl 18:08:44 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 508634 1 named 23976 0.0 Ssl 18:06:25 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1463 1 root 22812 0.0 Ss 60-10:16:12 tailwatchd 4180059 4180015 evolution 22756 0.0 Ss 20:26:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 183705 506832 nobody 22564 0.0 S 07:05 /usr/sbin/httpd -k start 200417 506832 nobody 22436 0.0 S 01:44 /usr/sbin/httpd -k start 200182 506832 nobody 22224 0.0 S 02:15 /usr/sbin/httpd -k start 183787 506832 nobody 21540 0.0 S 06:56 /usr/sbin/httpd -k start 199793 506832 nobody 21428 0.1 S 02:59 /usr/sbin/httpd -k start 199134 506832 nobody 21360 0.0 S 03:53 /usr/sbin/httpd -k start 184184 506832 nobody 21304 0.1 S 06:02 /usr/sbin/httpd -k start 183920 506832 nobody 21036 0.0 S 06:36 /usr/sbin/httpd -k start 199102 506832 nobody 20696 0.0 S 03:58 /usr/sbin/httpd -k start 200648 506832 nobody 20560 0.0 S 01:28 /usr/sbin/httpd -k start 200175 506832 nobody 19688 0.0 S 02:16 /usr/sbin/httpd -k start 200184 506832 nobody 19584 0.0 S 02:15 /usr/sbin/httpd -k start 200185 506832 nobody 19280 0.0 S 02:15 /usr/sbin/httpd -k start 508867 508814 mailman 19192 0.0 S 18:06:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 200567 506832 nobody 19184 0.0 S 01:32 /usr/sbin/httpd -k start 508855 508814 mailman 19096 0.0 S 18:06:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 215273 506832 nobody 19060 0.2 S 00:04 /usr/sbin/httpd -k start 130201 508511 infinium 19048 0.0 S 25:30 dovecot/imap 215274 506832 nobody 19048 0.5 S 00:04 /usr/sbin/httpd -k start 215270 506832 nobody 19028 0.5 S 00:04 /usr/sbin/httpd -k start 508865 508814 mailman 19008 0.0 S 18:06:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 215268 506832 nobody 18996 0.2 S 00:04 /usr/sbin/httpd -k start 215271 506832 nobody 18996 0.2 S 00:04 /usr/sbin/httpd -k start 215272 506832 nobody 18996 0.2 S 00:04 /usr/sbin/httpd -k start 508864 508814 mailman 18964 0.0 S 18:06:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 508856 508814 mailman 18788 0.0 S 18:06:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508857 508814 mailman 18628 0.0 S 18:06:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3648866 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min candyfabcom/candyfab.com.au-ssl_log 92 tubesupplies/tubesupplies.com.au-ssl_log 61 madalice/madalice.com.au-ssl_log 35 evolution/evolutionerp.com.au 34 evolution/evolutionerp.com.au-ssl_log 28 evolution/portal.evolutionerp.com.au-ssl_log 22 alison/alisonarts.com.au-ssl_log 5 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 92 20.203.162.73 61 20.48.160.90 56 20.196.209.81 22 203.54.180.238 19 34.106.193.135 11 118.127.40.55 1 64.23.190.23 1 45.3.50.5 1 45.120.190.124 1 36.151.177.212 1 3.213.85.234 1 216.26.228.115 1 18.209.201.119 1 17.166.152.43 1 17.166.152.120 --- top request paths across all vhosts (last 3 min) --- 22 GET /heartbeat.php 9 POST / 5 GET /goods.php 5 GET / 4 GET /radio.php 4 GET /aaa.php 4 GET /1.php 3 GET /wp-ws68.php 3 GET /store/hand-painted-nike-af1-roosters/ 3 GET /simple.php 3 GET /shiny.php 3 GET /ops.php 3 GET /media.php 3 GET /mac.php 3 GET /images.php 3 GET /dex.php 3 GET /about.php 3 GET /4PJcpMFsD8B.php 3 GET /3PJcpMFsD8B.php 2 POST /wp-cron.php --- busiest 3 vhosts: top paths + last 10 requests --- == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 2 GET /goods.php 2 GET /admin.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /X.php 1 GET /wsd.php 1 GET /ws85.php 1 GET /ws55.php 1 GET /wp.php 1 GET /w.php 1 GET /wp-content/uploads/ -- last 10 requests -- 20.203.162.73 - - [28/Aug/2026:20:25:16 +1000] "GET /sign.php HTTP/1.1" 401 36 "-" "-" 20.203.162.73 - - [28/Aug/2026:20:25:17 +1000] "GET /wnnjpsby.php HTTP/1.1" 401 36 "-" "-" 20.203.162.73 - - [28/Aug/2026:20:25:18 +1000] "GET /gigi.php HTTP/1.1" 401 36 "-" "-" 20.203.162.73 - - [28/Aug/2026:20:25:18 +1000] "GET /info.php/new.php HTTP/1.1" 401 36 "-" "-" 20.203.162.73 - - [28/Aug/2026:20:25:19 +1000] "GET /wp-content/uploads/ HTTP/1.1" 401 36 "-" "-" 20.203.162.73 - - [28/Aug/2026:20:25:20 +1000] "GET /w.php HTTP/1.1" 401 36 "-" "-" 20.203.162.73 - - [28/Aug/2026:20:25:20 +1000] "GET /X.php HTTP/1.1" 401 36 "-" "-" 20.203.162.73 - - [28/Aug/2026:20:25:21 +1000] "GET /admin.php HTTP/1.1" 401 36 "-" "-" 20.203.162.73 - - [28/Aug/2026:20:25:22 +1000] "GET /ssla.php HTTP/1.1" 401 36 "-" "-" 20.203.162.73 - - [28/Aug/2026:20:25:22 +1000] "GET /wp-admin/maint/wp-is.php HTTP/1.1" 401 36 "-" "-" == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 2 GET / 1 POST /wp-cron.php 1 GET /xmlrpc.php0 1 GET /xmlrpc.php 1 GET /xleet.php 1 GET /wxo.php 1 GET /wp-contentt.php 1 GET /wp-content/plugins/elementor-pro/modules/loop-filter/widgets/ 1 GET /wp-content/plugins/elementor/modules/page-templates/templates/ 1 GET /wp-content/plugins/elementor/modules/editor-one/classes/ 1 GET /wp-configs.php 1 GET /wp-admin.php -- last 10 requests -- 20.196.209.81 - - [28/Aug/2026:20:24:31 +1000] "GET /cloud.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.196.209.81 - - [28/Aug/2026:20:24:32 +1000] "GET /configs.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.196.209.81 - - [28/Aug/2026:20:24:32 +1000] "GET /wp-configs.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.196.209.81 - - [28/Aug/2026:20:24:32 +1000] "GET /update.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.196.209.81 - - [28/Aug/2026:20:24:32 +1000] "GET /2.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.196.209.81 - - [28/Aug/2026:20:24:32 +1000] "GET /aaa.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 64.23.190.23 - - [28/Aug/2026:20:24:51 +1000] "GET / HTTP/1.1" 301 - "-" "Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0" 118.127.40.55 - - [28/Aug/2026:20:24:53 +1000] "POST /wp-cron.php?doing_wp_cron=1787912693.1206729412078857421875 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://tubesupplies.com.au" 18.209.201.119 - - [28/Aug/2026:20:24:59 +1000] "GET /wp-content/plugins/elementor-pro/modules/loop-filter/widgets/?C=D;O%3DD HTTP/1.1" 200 985 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbo 3.213.85.234 - - [28/Aug/2026:20:25:06 +1000] "GET /wp-content/plugins/elementor/modules/editor-one/classes/?C=N;O%3DD HTTP/1.1" 200 1922 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; == madalice/madalice.com.au-ssl_log == -- top paths -- 9 POST / 3 GET /store/hand-painted-nike-af1-roosters/ 1 GET /wp-config.php.swp 1 GET /wp-config.php.bak 1 GET /wp-config.php~ 1 GET /tag/selwood/ 1 GET /store/hand-painted-nike-af1-roses/ 1 GET /store/custom-nike-af1-scribble/ 1 GET /storage/logs/laravel.log 1 GET /robots.txt 1 GET /_ignition/health-check 1 GET /.env.save -- last 10 requests -- 118.127.40.55 - - [28/Aug/2026:20:25:58 +1000] "POST /?wordfence_syncAttackData=1787912756.3283 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://madalice.com.au" 34.106.193.135 - - [28/Aug/2026:20:25:56 +1000] "GET /storage/logs/laravel.log HTTP/1.1" 404 122872 "-" "crusader-worker/1.0" 118.127.40.55 - - [28/Aug/2026:20:25:59 +1000] "POST /?wordfence_syncAttackData=1787912756.42 HTTP/1.1" 200 42766 "-" "WordPress/7.1; https://madalice.com.au" 118.127.40.55 - - [28/Aug/2026:20:25:59 +1000] "POST /?wordfence_syncAttackData=1787912756.6425 HTTP/1.1" 200 42770 "-" "WordPress/7.1; https://madalice.com.au" 118.127.40.55 - - [28/Aug/2026:20:25:59 +1000] "POST /?wordfence_syncAttackData=1787912756.4382 HTTP/1.1" 200 42770 "-" "WordPress/7.1; https://madalice.com.au" 118.127.40.55 - - [28/Aug/2026:20:25:59 +1000] "POST /?wordfence_syncAttackData=1787912756.7751 HTTP/1.1" 200 42775 "-" "WordPress/7.1; https://madalice.com.au" 118.127.40.55 - - [28/Aug/2026:20:25:59 +1000] "POST /?wordfence_syncAttackData=1787912756.7448 HTTP/1.1" 200 42775 "-" "WordPress/7.1; https://madalice.com.au" 118.127.40.55 - - [28/Aug/2026:20:25:59 +1000] "POST /?wordfence_syncAttackData=1787912757.0665 HTTP/1.1" 200 42775 "-" "WordPress/7.1; https://madalice.com.au" 118.127.40.55 - - [28/Aug/2026:20:25:59 +1000] "POST /?wordfence_syncAttackData=1787912757.3299 HTTP/1.1" 200 42766 "-" "WordPress/7.1; https://madalice.com.au" 118.127.40.55 - - [28/Aug/2026:20:25:59 +1000] "POST /?wordfence_syncAttackData=1787912756.6592 HTTP/1.1" 200 42773 "-" "WordPress/7.1; https://madalice.com.au" --- last 30 samples (run-up to this incident) --- 2026-08-28 20:23:32 L1=0.81 run=2 blk=0 avail=9039 (65.6%) swpO=0 conn=2 myRSS=2481 php=3 phpRSS=71 ap=16 tcp=21 topuser=root 2026-08-28 20:23:41 L1=0.76 run=1 blk=0 avail=8948 (65.0%) swpO=0 conn=1 myRSS=2481 php=3 phpRSS=180 ap=15 tcp=22 topuser=madalice 2026-08-28 20:23:42 L1=0.76 run=1 blk=0 avail=8947 (64.9%) swpO=0 conn=2 myRSS=2481 php=3 phpRSS=180 ap=15 tcp=22 topuser=madalice 2026-08-28 20:23:52 L1=0.64 run=1 blk=0 avail=8883 (64.5%) swpO=0 conn=1 myRSS=2481 php=3 phpRSS=203 ap=21 tcp=26 topuser=madalice 2026-08-28 20:23:52 L1=0.64 run=1 blk=0 avail=8891 (64.5%) swpO=0 conn=2 myRSS=2481 php=3 phpRSS=203 ap=21 tcp=24 topuser=madalice 2026-08-28 20:24:02 L1=0.62 run=3 blk=0 avail=8815 (64.0%) swpO=0 conn=1 myRSS=2481 php=4 phpRSS=331 ap=17 tcp=25 topuser=madalice 2026-08-28 20:24:02 L1=0.62 run=2 blk=0 avail=8904 (64.6%) swpO=0 conn=2 myRSS=2481 php=3 phpRSS=210 ap=17 tcp=26 topuser=madalice 2026-08-28 20:24:12 L1=0.60 run=1 blk=0 avail=8909 (64.7%) swpO=0 conn=1 myRSS=2481 php=3 phpRSS=203 ap=17 tcp=26 topuser=madalice 2026-08-28 20:24:12 L1=0.60 run=1 blk=0 avail=8910 (64.7%) swpO=0 conn=2 myRSS=2481 php=3 phpRSS=203 ap=17 tcp=25 topuser=madalice 2026-08-28 20:24:22 L1=0.58 run=1 blk=0 avail=8885 (64.5%) swpO=0 conn=1 myRSS=2481 php=3 phpRSS=204 ap=19 tcp=30 topuser=madalice 2026-08-28 20:24:22 L1=0.58 run=2 blk=0 avail=8828 (64.1%) swpO=0 conn=2 myRSS=2481 php=4 phpRSS=287 ap=19 tcp=34 topuser=madalice 2026-08-28 20:24:32 L1=0.57 run=7 blk=0 avail=8616 (62.5%) swpO=0 conn=1 myRSS=2481 php=5 phpRSS=530 ap=20 tcp=32 topuser=madalice 2026-08-28 20:24:32 L1=0.57 run=5 blk=0 avail=8555 (62.1%) swpO=0 conn=3 myRSS=2481 php=6 phpRSS=615 ap=20 tcp=32 topuser=madalice 2026-08-28 20:24:42 L1=0.63 run=1 blk=0 avail=8768 (63.6%) swpO=0 conn=1 myRSS=2481 php=4 phpRSS=337 ap=21 tcp=26 topuser=madalice 2026-08-28 20:24:42 L1=0.63 run=1 blk=0 avail=8766 (63.6%) swpO=0 conn=3 myRSS=2481 php=4 phpRSS=337 ap=21 tcp=25 topuser=madalice 2026-08-28 20:24:52 L1=0.61 run=2 blk=0 avail=8728 (63.4%) swpO=0 conn=1 myRSS=2481 php=5 phpRSS=404 ap=20 tcp=30 topuser=madalice 2026-08-28 20:24:52 L1=0.61 run=2 blk=0 avail=8833 (64.1%) swpO=0 conn=3 myRSS=2481 php=4 phpRSS=277 ap=20 tcp=32 topuser=madalice 2026-08-28 20:25:02 L1=0.59 run=3 blk=0 avail=8756 (63.6%) swpO=0 conn=1 myRSS=2481 php=3 phpRSS=286 ap=20 tcp=30 topuser=madalice 2026-08-28 20:25:02 L1=0.59 run=2 blk=0 avail=8857 (64.3%) swpO=0 conn=3 myRSS=2481 php=3 phpRSS=180 ap=20 tcp=30 topuser=madalice 2026-08-28 20:25:12 L1=1.02 run=2 blk=0 avail=8886 (64.5%) swpO=0 conn=1 myRSS=2481 php=3 phpRSS=180 ap=20 tcp=31 topuser=madalice 2026-08-28 20:25:12 L1=1.02 run=1 blk=0 avail=8890 (64.5%) swpO=0 conn=3 myRSS=2481 php=3 phpRSS=180 ap=20 tcp=30 topuser=madalice 2026-08-28 20:25:22 L1=0.93 run=1 blk=0 avail=8901 (64.6%) swpO=0 conn=1 myRSS=2481 php=3 phpRSS=180 ap=19 tcp=30 topuser=madalice 2026-08-28 20:25:22 L1=0.93 run=1 blk=0 avail=8906 (64.6%) swpO=0 conn=3 myRSS=2481 php=3 phpRSS=180 ap=19 tcp=30 topuser=madalice 2026-08-28 20:25:32 L1=0.86 run=1 blk=0 avail=9012 (65.4%) swpO=0 conn=1 myRSS=2481 php=2 phpRSS=48 ap=19 tcp=30 topuser=root 2026-08-28 20:25:32 L1=0.86 run=2 blk=0 avail=8947 (64.9%) swpO=0 conn=2 myRSS=2481 php=3 phpRSS=147 ap=19 tcp=30 topuser=evolution 2026-08-28 20:25:42 L1=0.89 run=2 blk=0 avail=8844 (64.2%) swpO=0 conn=1 myRSS=2481 php=4 phpRSS=275 ap=19 tcp=29 topuser=madalice 2026-08-28 20:25:42 L1=0.89 run=2 blk=0 avail=8782 (63.7%) swpO=0 conn=2 myRSS=2481 php=4 phpRSS=332 ap=19 tcp=29 topuser=evolution 2026-08-28 20:25:52 L1=0.91 run=3 blk=0 avail=8730 (63.4%) swpO=0 conn=1 myRSS=2481 php=4 phpRSS=323 ap=22 tcp=32 topuser=evolution 2026-08-28 20:25:52 L1=0.91 run=3 blk=1 avail=8831 (64.1%) swpO=0 conn=2 myRSS=2481 php=3 phpRSS=180 ap=22 tcp=32 topuser=madalice 2026-08-28 20:26:02 L1=1.90 run=2 blk=0 avail=7420 (53.9%) swpO=0 conn=2 myRSS=2481 php=13 phpRSS=1680 ap=51 tcp=49 topuser=madalice