INCIDENT 2026-08-28 20:47:39 trigger: php_rss=1737MB ================================================================== load: 1.28 0.92 1.00 16/636 284817 ncpu:10 mem_avail: 7251MB/13777MB (52.6%) swap_used:962MB swapout:0/s blocked(D):0 running:15 iowait:0.0% steal:0.0% php: 12 procs / 1737MB heaviest user: madalice (10 procs, 1689MB) apache: 57 procs tcp_estab: 75 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2567 madalice 10 1528 root 252 1012 nobody 56 982 mailman 20 339 netdata 7 204 cpanellogin 1 104 wp-toolkit 3 84 dovenull 6 59 evolution 7 40 mailnull 2 26 zabbix 1 25 dovecot 3 24 named 1 23 aaa 1 15 polkitd 1 12 kurri 1 10 rpc 1 5 nscd 1 5 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1531 root 1 25 evolution 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6042 MB Active(file): 5308 MB Inactive(file): 1050 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 678 MB CommitLimit: 10984 MB Committed_AS: 8734 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 18:28:59 11400 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2629012 15.3 Ssl 18:28:28 /usr/sbin/mariadbd 284681 510022 madalice 220844 53.1 R 00:07 php-fpm: pool madalice_com_au 529389 527476 root 186764 0.0 S 18:23:21 spamd child 508924 1 netdata 178940 2.0 Ssl 18:27:57 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 284288 510022 madalice 165464 46.1 R 00:33 php-fpm: pool madalice_com_au 284677 510022 madalice 164204 59.0 R 00:07 php-fpm: pool madalice_com_au 284685 510022 madalice 164168 47.7 R 00:07 php-fpm: pool madalice_com_au 284285 510022 madalice 163788 47.6 R 00:34 php-fpm: pool madalice_com_au 284678 510022 madalice 159484 55.1 R 00:07 php-fpm: pool madalice_com_au 284686 510022 madalice 159404 50.0 S 00:07 php-fpm: pool madalice_com_au 284679 510022 madalice 159252 55.4 R 00:07 php-fpm: pool madalice_com_au 284746 510022 madalice 139496 85.5 R 00:02 php-fpm: pool madalice_com_au 4074469 1353308 cpanellogin 106552 0.0 S 01:58:14 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 284761 510022 madalice 94268 41.0 R 00:01 php-fpm: pool madalice_com_au 527476 1 root 93448 0.0 Ss 18:25:00 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2985227 527476 root 88656 0.0 S 07:08:58 spamd child 509236 509098 root 64372 0.0 Sl 18:27:54 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509266 1 root 61016 0.0 Ss 18:27:54 /usr/lib/systemd/systemd-journald 938582 1 wp-toolkit 49544 0.0 Ss 16:35:31 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1353308 1 root 41444 0.1 Ss 37-18:06:20 cpsrvd (SSL) - waiting for connections 284762 1469 root 33224 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 938585 1 wp-toolkit 32576 0.0 Ss 16:35:31 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1469 1 root 30344 0.1 Ss 60-10:37:49 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 526869 1 root 29760 0.0 Ss 18:25:23 lfd - sleeping 510022 1 root 26516 0.0 Ss 18:27:50 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 509640 508992 root 26292 0.0 Sl 18:27:52 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 483898 1 zabbix 25792 0.2 Ssl 18:29:11 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 481558 1 root 24620 0.1 Ssl 18:30:21 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 508634 1 named 23992 0.0 Ssl 18:28:02 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1463 1 root 22812 0.0 Ss 60-10:37:49 tailwatchd 275876 506832 nobody 22784 0.1 S 02:33 /usr/sbin/httpd -k start 4180059 4180015 evolution 22756 0.0 Ss 20:47:39 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 283845 506832 nobody 22692 0.1 S 01:03 /usr/sbin/httpd -k start 267013 506832 nobody 21964 0.0 S 04:36 /usr/sbin/httpd -k start 283825 506832 nobody 21868 0.1 S 01:04 /usr/sbin/httpd -k start 283978 506832 nobody 21748 0.2 S 00:54 /usr/sbin/httpd -k start 271277 506832 nobody 21264 0.0 S 02:36 /usr/sbin/httpd -k start 283815 506832 nobody 21228 0.1 S 01:05 /usr/sbin/httpd -k start 272828 506832 nobody 21152 0.1 S 02:35 /usr/sbin/httpd -k start 274361 506832 nobody 20192 0.1 S 02:34 /usr/sbin/httpd -k start 283482 506832 nobody 20112 0.0 S 01:40 /usr/sbin/httpd -k start 283841 506832 nobody 19996 0.1 S 01:03 /usr/sbin/httpd -k start 283816 506832 nobody 19816 0.1 S 01:05 /usr/sbin/httpd -k start 283838 506832 nobody 19640 0.1 S 01:03 /usr/sbin/httpd -k start 284538 506832 nobody 19468 0.2 S 00:16 /usr/sbin/httpd -k start 266995 506832 nobody 19464 0.1 S 04:36 /usr/sbin/httpd -k start 284740 506832 nobody 19276 0.3 S 00:03 /usr/sbin/httpd -k start 508867 508814 mailman 19192 0.0 S 18:28:00 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 275887 506832 nobody 19180 0.0 S 02:33 /usr/sbin/httpd -k start 508855 508814 mailman 19096 0.0 S 18:28:00 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 284731 506832 nobody 19084 0.3 S 00:03 /usr/sbin/httpd -k start 284718 506832 nobody 19048 0.2 S 00:04 /usr/sbin/httpd -k start 284719 506832 nobody 19028 0.5 S 00:04 /usr/sbin/httpd -k start 284720 506832 nobody 19024 0.2 S 00:04 /usr/sbin/httpd -k start 508865 508814 mailman 19008 0.0 S 18:28:00 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 283976 506832 nobody 18968 0.0 S 00:54 /usr/sbin/httpd -k start 284715 506832 nobody 18964 0.2 S 00:04 /usr/sbin/httpd -k start 284717 506832 nobody 18964 0.2 S 00:04 /usr/sbin/httpd -k start 508864 508814 mailman 18920 0.0 S 18:28:00 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 284787 283482 nobody 18808 0.0 S 00:00 /usr/local/cpanel/cgi-sys/autodiscover.cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3650832 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min vinesit/vinesit.com.au-ssl_log 230 cosgrovecreative/cosgrovecreative.com.au-ssl_log 168 aaa/aaadownunder.com.au-ssl_log 99 olympic/seb-mobile-auth.olympicfencing.com.au-ssl_log 70 olympic/seb-mobile-auth.olympicfencing.com.au 65 customc/customcentral.com.au-ssl_log 61 madalice/madalice.com.au-ssl_log 46 nrg/nrgservices.net.au-ssl_log 44 kamcool/kamcool.com.au-ssl_log 38 evolution/portal.evolutionerp.com.au-ssl_log 30 tubesupplies/tubesupplies.com.au-ssl_log 1 (total vhosts taking traffic: 11) --- top client IPs across all vhosts (last 3 min) --- 254 20.104.50.220 179 20.104.18.15 135 20.104.104.62 97 20.203.141.11 38 4.205.62.107 30 203.54.180.238 25 34.175.66.59 23 40.83.93.50 22 52.139.44.162 11 104.196.115.188 4 160.153.252.100 2 34.146.12.12 2 213.32.77.104 2 162.144.21.160 2 162.144.20.85 --- top request paths across all vhosts (last 3 min) --- 121 GET /autodiscover/autodiscover.xml 30 GET /heartbeat.php 7 GET / 4 GET /wp-trackback.php 4 GET /store/hand-painted-nike-af1-pink-butterfly/ 3 GET /wp-json/wp/v2/users 3 GET /sf.php 3 GET /av.php 2 POST /wp-cron.php 2 GET /zv.php 2 GET /zs.php 2 GET /zq.php 2 GET /yw.php 2 GET /ys.php 2 GET /yl.php 2 GET /xu.php 2 GET /x.php 2 GET /xj.php 2 GET /ws.php 2 GET /wq.php --- busiest 3 vhosts: top paths + last 10 requests --- == vinesit/vinesit.com.au-ssl_log == -- top paths -- 108 GET /autodiscover/autodiscover.xml 2 GET /goods.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /x.php 1 GET /ws85.php 1 GET /ws55.php 1 GET /wp-trackback.php 1 GET /wp-safe.php 1 GET /wp.php 1 GET /wp-includes/index.php -- last 10 requests -- 20.104.50.220 - - [28/Aug/2026:20:46:59 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [28/Aug/2026:20:47:00 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [28/Aug/2026:20:47:01 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [28/Aug/2026:20:47:02 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [28/Aug/2026:20:47:03 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [28/Aug/2026:20:47:04 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [28/Aug/2026:20:47:05 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [28/Aug/2026:20:47:06 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [28/Aug/2026:20:47:07 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [28/Aug/2026:20:47:08 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /this_is_a_new_hello_world.php 1 GET /wsd.php 1 GET /wp-includes/pomo/up 1 GET /wp-includes/media.php 1 GET /wp-includes/js/mpvloi.php 1 GET /wp-includes/js/codemirror/hehe.php 1 GET /wp-includes/js/ 1 GET /wp-includes/fonts/up.php 1 GET /wp-includes/fonts/ 1 GET /wp-includes/as.php 1 GET /wp-content/plugins/defaults.php -- last 10 requests -- 52.139.44.162 - - [28/Aug/2026:20:47:33 +1000] "GET /ops.php HTTP/1.1" 401 36 "-" "-" 52.139.44.162 - - [28/Aug/2026:20:47:33 +1000] "GET /coffexium.php HTTP/1.1" 401 36 "-" "-" 52.139.44.162 - - [28/Aug/2026:20:47:33 +1000] "GET /BDKR28WP.php HTTP/1.1" 401 36 "-" "-" 52.139.44.162 - - [28/Aug/2026:20:47:34 +1000] "GET /sf.php HTTP/1.1" 401 36 "-" "-" 52.139.44.162 - - [28/Aug/2026:20:47:34 +1000] "GET /k.php HTTP/1.1" 401 36 "-" "-" 52.139.44.162 - - [28/Aug/2026:20:47:35 +1000] "GET /82.php HTTP/1.1" 401 36 "-" "-" 52.139.44.162 - - [28/Aug/2026:20:47:35 +1000] "GET /dex.php HTTP/1.1" 401 36 "-" "-" 52.139.44.162 - - [28/Aug/2026:20:47:36 +1000] "GET /inso.php HTTP/1.1" 401 36 "-" "-" 52.139.44.162 - - [28/Aug/2026:20:47:36 +1000] "GET /aa.php HTTP/1.1" 401 36 "-" "-" 52.139.44.162 - - [28/Aug/2026:20:47:37 +1000] "GET /img.php HTTP/1.1" 401 36 "-" "-" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 1 GET /zoom1.php 1 GET /xx.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /ws81.php 1 GET /ws77.php 1 GET /ws37.php 1 GET /wp-trackback.php 1 GET /wp-the.php 1 GET /wp-themes.php 1 GET /wp-signin.php -- last 10 requests -- 20.203.141.11 - - [28/Aug/2026:20:45:48 +1000] "GET /ca5.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [28/Aug/2026:20:45:48 +1000] "GET /install.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [28/Aug/2026:20:45:48 +1000] "GET /radio.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [28/Aug/2026:20:45:49 +1000] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [28/Aug/2026:20:45:49 +1000] "GET /wp-signin.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [28/Aug/2026:20:45:49 +1000] "GET /Ov-Simple1.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [28/Aug/2026:20:45:49 +1000] "GET /fm.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [28/Aug/2026:20:45:50 +1000] "GET /ftde.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [28/Aug/2026:20:45:50 +1000] "GET /hplfuns.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [28/Aug/2026:20:45:50 +1000] "GET /log.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-28 20:45:18 L1=0.63 run=3 blk=0 avail=8544 (62.0%) swpO=0 conn=1 myRSS=2567 php=5 phpRSS=393 ap=43 tcp=30 topuser=customc 2026-08-28 20:45:18 L1=0.63 run=6 blk=0 avail=8548 (62.0%) swpO=0 conn=1 myRSS=2567 php=5 phpRSS=395 ap=43 tcp=30 topuser=customc 2026-08-28 20:45:28 L1=0.69 run=2 blk=0 avail=8738 (63.4%) swpO=0 conn=2 myRSS=2567 php=4 phpRSS=243 ap=33 tcp=34 topuser=madalice 2026-08-28 20:45:28 L1=0.69 run=6 blk=0 avail=8730 (63.4%) swpO=0 conn=1 myRSS=2567 php=4 phpRSS=247 ap=33 tcp=34 topuser=madalice 2026-08-28 20:45:38 L1=0.81 run=6 blk=0 avail=8668 (62.9%) swpO=0 conn=2 myRSS=2567 php=5 phpRSS=376 ap=25 tcp=37 topuser=olympic 2026-08-28 20:45:38 L1=0.81 run=4 blk=0 avail=8663 (62.9%) swpO=0 conn=4 myRSS=2567 php=5 phpRSS=382 ap=25 tcp=37 topuser=olympic 2026-08-28 20:45:48 L1=0.84 run=1 blk=0 avail=8846 (64.2%) swpO=0 conn=2 myRSS=2567 php=3 phpRSS=169 ap=22 tcp=29 topuser=madalice 2026-08-28 20:45:48 L1=0.84 run=3 blk=0 avail=8844 (64.2%) swpO=0 conn=4 myRSS=2567 php=3 phpRSS=169 ap=22 tcp=29 topuser=madalice 2026-08-28 20:45:58 L1=0.79 run=2 blk=0 avail=8876 (64.4%) swpO=0 conn=2 myRSS=2567 php=3 phpRSS=169 ap=18 tcp=27 topuser=madalice 2026-08-28 20:45:59 L1=0.79 run=2 blk=0 avail=8876 (64.4%) swpO=0 conn=4 myRSS=2567 php=3 phpRSS=169 ap=18 tcp=27 topuser=madalice 2026-08-28 20:46:09 L1=0.97 run=2 blk=0 avail=8814 (64.0%) swpO=0 conn=2 myRSS=2567 php=3 phpRSS=225 ap=19 tcp=26 topuser=madalice 2026-08-28 20:46:09 L1=0.97 run=10 blk=0 avail=8809 (63.9%) swpO=0 conn=4 myRSS=2567 php=3 phpRSS=227 ap=19 tcp=26 topuser=madalice 2026-08-28 20:46:19 L1=1.29 run=1 blk=0 avail=8847 (64.2%) swpO=0 conn=2 myRSS=2567 php=3 phpRSS=203 ap=17 tcp=28 topuser=madalice 2026-08-28 20:46:19 L1=1.29 run=3 blk=0 avail=8847 (64.2%) swpO=0 conn=4 myRSS=2567 php=3 phpRSS=203 ap=17 tcp=25 topuser=madalice 2026-08-28 20:46:29 L1=1.09 run=3 blk=0 avail=8844 (64.2%) swpO=0 conn=4 myRSS=2567 php=3 phpRSS=203 ap=17 tcp=28 topuser=madalice 2026-08-28 20:46:29 L1=1.09 run=5 blk=0 avail=8844 (64.2%) swpO=0 conn=1 myRSS=2567 php=3 phpRSS=203 ap=17 tcp=28 topuser=madalice 2026-08-28 20:46:39 L1=0.93 run=2 blk=0 avail=8679 (63.0%) swpO=0 conn=1 myRSS=2567 php=4 phpRSS=290 ap=32 tcp=37 topuser=madalice 2026-08-28 20:46:39 L1=0.93 run=1 blk=0 avail=8679 (63.0%) swpO=0 conn=1 myRSS=2567 php=4 phpRSS=290 ap=32 tcp=37 topuser=madalice 2026-08-28 20:46:49 L1=0.78 run=2 blk=0 avail=8621 (62.6%) swpO=0 conn=1 myRSS=2567 php=4 phpRSS=321 ap=35 tcp=37 topuser=madalice 2026-08-28 20:46:49 L1=0.78 run=2 blk=0 avail=8621 (62.6%) swpO=0 conn=1 myRSS=2567 php=4 phpRSS=321 ap=35 tcp=37 topuser=madalice 2026-08-28 20:46:59 L1=0.66 run=2 blk=0 avail=8694 (63.1%) swpO=0 conn=1 myRSS=2567 php=4 phpRSS=321 ap=26 tcp=29 topuser=madalice 2026-08-28 20:46:59 L1=0.66 run=3 blk=0 avail=8695 (63.1%) swpO=0 conn=1 myRSS=2567 php=4 phpRSS=321 ap=26 tcp=29 topuser=madalice 2026-08-28 20:47:09 L1=0.79 run=2 blk=0 avail=8707 (63.2%) swpO=0 conn=1 myRSS=2567 php=4 phpRSS=336 ap=21 tcp=29 topuser=madalice 2026-08-28 20:47:09 L1=0.79 run=3 blk=0 avail=8707 (63.2%) swpO=0 conn=1 myRSS=2567 php=4 phpRSS=336 ap=21 tcp=29 topuser=madalice 2026-08-28 20:47:19 L1=0.75 run=2 blk=0 avail=8596 (62.4%) swpO=0 conn=1 myRSS=2567 php=4 phpRSS=411 ap=21 tcp=29 topuser=madalice 2026-08-28 20:47:19 L1=0.75 run=5 blk=0 avail=8594 (62.4%) swpO=0 conn=1 myRSS=2567 php=4 phpRSS=359 ap=21 tcp=29 topuser=madalice 2026-08-28 20:47:29 L1=1.24 run=5 blk=0 avail=8643 (62.7%) swpO=0 conn=1 myRSS=2567 php=4 phpRSS=366 ap=24 tcp=35 topuser=madalice 2026-08-28 20:47:29 L1=1.24 run=3 blk=0 avail=8645 (62.7%) swpO=0 conn=2 myRSS=2567 php=4 phpRSS=366 ap=24 tcp=35 topuser=madalice 2026-08-28 20:47:39 L1=1.28 run=15 blk=0 avail=7251 (52.6%) swpO=0 conn=10 myRSS=2567 php=12 phpRSS=1737 ap=57 tcp=75 topuser=madalice 2026-08-28 20:47:39 L1=1.28 run=15 blk=0 avail=7227 (52.5%) swpO=0 conn=9 myRSS=2567 php=12 phpRSS=1689 ap=56 tcp=74 topuser=madalice