INCIDENT 2026-08-28 21:16:00 trigger: php_rss=1680MB ================================================================== load: 1.28 1.11 0.93 13/698 386599 ncpu:10 mem_avail: 6924MB/13777MB (50.3%) swap_used:972MB swapout:253/s blocked(D):0 running:13 iowait:0.0% steal:0.0% php: 12 procs / 1680MB heaviest user: madalice (10 procs, 1632MB) apache: 114 procs tcp_estab: 165 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2566 nobody 113 1909 madalice 10 1668 root 249 1002 mailman 20 335 netdata 7 207 cpanellogin 1 108 wp-toolkit 3 83 dovenull 6 59 mailnull 4 48 evolution 7 40 lowrange 2 36 infinium 2 32 zabbix 1 24 dovecot 3 24 named 1 23 aaa 1 15 polkitd 1 12 kurri 1 10 rpc 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1715 root 1 25 evolution 1 21 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5726 MB Active(file): 5035 MB Inactive(file): 986 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 660 MB CommitLimit: 10984 MB Committed_AS: 10143 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 18:57:20 11400 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2628080 15.0 Ssl 18:56:49 /usr/sbin/mariadbd 386482 510022 madalice 218124 84.6 S 00:03 php-fpm: pool madalice_com_au 386481 510022 madalice 213716 82.6 R 00:03 php-fpm: pool madalice_com_au 355031 510022 madalice 210548 31.9 R 06:43 php-fpm: pool madalice_com_au 386540 510022 madalice 209932 85.6 S 00:03 php-fpm: pool madalice_com_au 386484 510022 madalice 207616 81.3 R 00:03 php-fpm: pool madalice_com_au 386483 510022 madalice 200436 85.6 R 00:03 php-fpm: pool madalice_com_au 355032 510022 madalice 190848 31.2 S 06:43 php-fpm: pool madalice_com_au 529389 527476 root 186744 0.0 S 18:51:42 spamd child 508924 1 netdata 182344 2.0 Ssl 18:56:18 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 371022 510022 madalice 167764 24.9 R 03:15 php-fpm: pool madalice_com_au 386485 510022 madalice 162024 102 S 00:03 php-fpm: pool madalice_com_au 386480 510022 madalice 161240 76.2 R 00:04 php-fpm: pool madalice_com_au 4074469 1353308 cpanellogin 110740 0.0 S 02:26:35 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 527476 1 root 93120 0.0 Ss 18:53:21 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2985227 527476 root 88312 0.0 S 07:37:19 spamd child 509236 509098 root 63032 0.0 Sl 18:56:15 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509266 1 root 62936 0.0 Ss 18:56:15 /usr/lib/systemd/systemd-journald 938582 1 wp-toolkit 48920 0.0 Ss 17:03:52 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1353308 1 root 41432 0.1 Ss 37-18:34:41 cpsrvd (SSL) - waiting for connections 386571 1469 root 33740 0.0 R 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 938585 1 wp-toolkit 32324 0.0 Ss 17:03:52 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1469 1 root 30004 0.1 Ss 60-11:06:10 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 526869 1 root 29720 0.0 Ss 18:53:44 lfd - sleeping 509640 508992 root 26820 0.0 Sl 18:56:13 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 510022 1 root 26492 0.0 Ss 18:56:11 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 25312 0.2 Ssl 18:57:32 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 481558 1 root 24388 0.1 Ssl 18:58:42 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 508634 1 named 23972 0.0 Ssl 18:56:23 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 336080 506832 nobody 23068 0.0 S 12:34 /usr/sbin/httpd -k start 1463 1 root 22812 0.0 Ss 60-11:06:10 tailwatchd 353080 506832 nobody 22700 0.2 S 08:33 /usr/sbin/httpd -k start 4180059 4180015 evolution 22504 0.0 Ss 21:16:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 370178 508511 lowrange 22436 0.0 S 04:29 dovecot/imap 371216 506832 nobody 22144 0.0 S 02:56 /usr/sbin/httpd -k start 370222 506832 nobody 22004 0.0 S 04:26 /usr/sbin/httpd -k start 371186 506832 nobody 21164 0.2 S 02:59 /usr/sbin/httpd -k start 371784 506832 nobody 21060 0.0 S 01:36 /usr/sbin/httpd -k start 370341 506832 nobody 21016 0.0 S 04:21 /usr/sbin/httpd -k start 371217 506832 nobody 20864 0.0 S 02:56 /usr/sbin/httpd -k start 371795 506832 nobody 20216 0.0 S 01:35 /usr/sbin/httpd -k start 386433 506832 nobody 20060 0.4 S 00:05 /usr/sbin/httpd -k start 371697 506832 nobody 19936 0.0 S 01:44 /usr/sbin/httpd -k start 371196 506832 nobody 19876 0.0 S 02:57 /usr/sbin/httpd -k start 371769 506832 nobody 19784 0.0 S 01:39 /usr/sbin/httpd -k start 371206 506832 nobody 19744 0.0 S 02:56 /usr/sbin/httpd -k start 386451 506832 nobody 19472 0.5 S 00:04 /usr/sbin/httpd -k start 386380 506832 nobody 19428 0.1 S 00:09 /usr/sbin/httpd -k start 371690 506832 nobody 19380 0.0 S 01:46 /usr/sbin/httpd -k start 371219 506832 nobody 19152 0.0 S 02:56 /usr/sbin/httpd -k start 386488 506832 nobody 19092 0.3 S 00:03 /usr/sbin/httpd -k start 370183 508511 infinium 19048 0.0 S 04:29 dovecot/imap 508855 508814 mailman 19040 0.0 S 18:56:21 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 386487 506832 nobody 19028 0.3 S 00:03 /usr/sbin/httpd -k start 508865 508814 mailman 19008 0.0 S 18:56:21 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 386472 506832 nobody 18936 0.5 S 00:04 /usr/sbin/httpd -k start 386428 506832 nobody 18888 0.0 S 00:05 /usr/sbin/httpd -k start 386429 506832 nobody 18868 0.2 S 00:05 /usr/sbin/httpd -k start 386448 506832 nobody 18816 0.0 S 00:04 /usr/sbin/httpd -k start 386431 506832 nobody 18788 0.2 S 00:05 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3685827 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 3685815 | madalice_wp | madalice_wp | Query | 0 | Opening tables | SHOW FULL COLUMNS FROM `AMuqf6qZ_wflivetraffichuman` | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+-------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+-------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3685819 | madalice_wp | 0 | Waiting for table level lock | SELECT option_name, option_value FROM AMuqf6qZ_options WHERE option_name IN ('_site_transient_wp_theme_files_patterns-f39ea77652efdfb7232b6a3a921bfab1','_site_transient_timeout_wp_theme_files_patterns | | 3685818 | madalice_wp | 0 | Waiting for table level lock | SELECT option_name, option_value FROM AMuqf6qZ_options WHERE option_name IN ('_transient_forminator_general_data_protection_cleanup','_transient_timeout_forminator_general_data_protection_cleanup') | | 3685815 | madalice_wp | 0 | Waiting for table level lock | UPDATE `AMuqf6qZ_options` SET `option_value` = 'a:530:{s:24:\"^wc-auth/v([1]{1})/(.*)?\";s:63:\"index.php?wc-auth-version=$matches[1]&wc-auth-route=$matches[2]\";s:21:\"^wc/file/transient/?$\";s:33:\" | +---------+-------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min vinesit/vinesit.com.au-ssl_log 180 olympic/seb-mobile-auth.olympicfencing.com.au-ssl_log 131 olympic/seb-mobile-auth.olympicfencing.com.au 129 madalice/madalice.com.au-ssl_log 68 evolution/portal.evolutionerp.com.au-ssl_log 22 aaa/aaadownunder.com.au-ssl_log 14 cosgrovecreative/cosgrovecreative.com.au-ssl_log 5 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 260 158.158.100.150 178 4.205.62.107 64 52.139.44.162 22 203.54.180.238 9 158.23.184.117 5 34.26.138.52 2 205.185.124.105 1 74.7.227.53 1 45.3.37.157 1 152.228.173.238 1 118.127.40.55 1 114.119.159.70 1 114.119.143.14 1 114.119.143.104 1 114.119.137.101 --- top request paths across all vhosts (last 3 min) --- 22 GET /heartbeat.php 5 GET /admin.php 4 GET /wp-content/themes/index.php 4 GET /ms-edit.php 3 GET /wp-login.php 3 GET /w.php 3 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 GET /wp-content/admin.php 3 GET /verox.php 3 GET /this_is_a_new_hello_world.php 3 GET /sm.php 3 GET /simple.php 3 GET /or.php 3 GET /file59.php 3 GET /f35.php 3 GET /dragonshell.php 3 GET /BDKR28WP.php 3 GET /av.php 3 GET /8.php 3 GET / --- busiest 3 vhosts: top paths + last 10 requests --- == vinesit/vinesit.com.au-ssl_log == -- top paths -- 2 GET /ms-edit.php 1 GET /zz.php 1 GET /zaza.php 1 GET /xza.php 1 GET /xve22.php 1 GET /xqq.php 1 GET /xp.php 1 GET /xin1.php 1 GET /xda.php 1 GET /xa.php 1 GET /X57.php 1 GET /wsws.php -- last 10 requests -- 4.205.62.107 - - [28/Aug/2026:21:15:47 +1000] "GET /infos.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:15:47 +1000] "GET /vx.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:15:48 +1000] "GET /radio.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:15:48 +1000] "GET /BDKR28WP.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:15:49 +1000] "GET /setup-config.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:15:50 +1000] "GET /hiquido.com/index.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:15:51 +1000] "GET /app_local.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:15:51 +1000] "GET /xqq.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:15:52 +1000] "GET /or.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:15:52 +1000] "GET /i.php HTTP/1.1" 401 36 "-" "-" == olympic/seb-mobile-auth.olympicfencing.com.au-ssl_log == -- top paths -- 3 GET /admin.php 2 GET /wp-content/themes/index.php 2 GET /av.php 1 GET /zoo1.php 1 GET /yj09.php 1 GET /xnm-apc.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp-temp.php 1 GET /wp.php 1 GET /wp-manager.php 1 GET /wp-mails.php -- last 10 requests -- 158.158.100.150 - - [28/Aug/2026:21:15:06 +1000] "GET /cgi-bin/index.php HTTP/1.1" 404 - "-" "-" 158.158.100.150 - - [28/Aug/2026:21:15:07 +1000] "GET /wp-includes/l10n/ HTTP/1.1" 404 - "-" "-" 158.158.100.150 - - [28/Aug/2026:21:15:07 +1000] "GET /wp-manager.php HTTP/1.1" 404 - "-" "-" 158.158.100.150 - - [28/Aug/2026:21:15:08 +1000] "GET /wp-includes/Text/Diff/Engine/about.php HTTP/1.1" 404 - "-" "-" 158.158.100.150 - - [28/Aug/2026:21:15:08 +1000] "GET /cgi-bin/admin.php HTTP/1.1" 404 - "-" "-" 158.158.100.150 - - [28/Aug/2026:21:15:09 +1000] "GET /wp-content/ HTTP/1.1" 404 - "-" "-" 158.158.100.150 - - [28/Aug/2026:21:15:09 +1000] "GET /wp-admin/css/colors/blue/ HTTP/1.1" 404 - "-" "-" 158.158.100.150 - - [28/Aug/2026:21:15:10 +1000] "GET /wp-includes/block-bindings/ HTTP/1.1" 404 - "-" "-" 158.158.100.150 - - [28/Aug/2026:21:15:11 +1000] "GET /wp-includes/assets/ HTTP/1.1" 404 - "-" "-" 158.158.100.150 - - [28/Aug/2026:21:15:11 +1000] "GET /wp-admin/css/colors/sunrise/ HTTP/1.1" 404 - "-" "-" == olympic/seb-mobile-auth.olympicfencing.com.au == -- top paths -- 2 GET /wp-content/themes/index.php 1 GET /zoo1.php 1 GET /yj09.php 1 GET /xnm-apc.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp-temp.php 1 GET /wp.php 1 GET /wp-manager.php 1 GET /wp-mails.php 1 GET /wp-includes/Text/Diff/Engine/about.php 1 GET //wp-includes/Requests/ -- last 10 requests -- 158.158.100.150 - - [28/Aug/2026:21:15:05 +1000] "GET /wp-blog.php HTTP/1.1" 301 305 "-" "-" 158.158.100.150 - - [28/Aug/2026:21:15:06 +1000] "GET //wp-includes/js/jquery/ HTTP/1.1" 301 316 "-" "-" 158.158.100.150 - - [28/Aug/2026:21:15:06 +1000] "GET //cgi-bin/index.php HTTP/1.1" 301 311 "-" "-" 158.158.100.150 - - [28/Aug/2026:21:15:07 +1000] "GET //wp-includes/l10n/ HTTP/1.1" 301 311 "-" "-" 158.158.100.150 - - [28/Aug/2026:21:15:07 +1000] "GET /wp-manager.php HTTP/1.1" 301 308 "-" "-" 158.158.100.150 - - [28/Aug/2026:21:15:08 +1000] "GET /wp-includes/Text/Diff/Engine/about.php HTTP/1.1" 301 332 "-" "-" 158.158.100.150 - - [28/Aug/2026:21:15:08 +1000] "GET //cgi-bin/admin.php HTTP/1.1" 301 311 "-" "-" 158.158.100.150 - - [28/Aug/2026:21:15:09 +1000] "GET /wp-content/ HTTP/1.1" 301 305 "-" "-" 158.158.100.150 - - [28/Aug/2026:21:15:09 +1000] "GET /wp-admin/css/colors/blue/ HTTP/1.1" 301 319 "-" "-" 158.158.100.150 - - [28/Aug/2026:21:15:10 +1000] "GET //wp-includes/block-bindings/ HTTP/1.1" 301 321 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-28 21:13:37 L1=1.24 run=2 blk=0 avail=8361 (60.7%) swpO=0 conn=2 myRSS=2567 php=5 phpRSS=612 ap=23 tcp=39 topuser=madalice 2026-08-28 21:13:39 L1=1.24 run=2 blk=0 avail=8396 (60.9%) swpO=0 conn=3 myRSS=2567 php=5 phpRSS=579 ap=23 tcp=35 topuser=madalice 2026-08-28 21:13:47 L1=1.20 run=2 blk=0 avail=8476 (61.5%) swpO=0 conn=2 myRSS=2567 php=5 phpRSS=527 ap=19 tcp=32 topuser=madalice 2026-08-28 21:13:49 L1=1.20 run=3 blk=0 avail=8485 (61.6%) swpO=0 conn=2 myRSS=2567 php=5 phpRSS=523 ap=18 tcp=33 topuser=madalice 2026-08-28 21:13:57 L1=1.09 run=3 blk=0 avail=8513 (61.8%) swpO=0 conn=2 myRSS=2567 php=5 phpRSS=524 ap=17 tcp=32 topuser=madalice 2026-08-28 21:13:59 L1=1.09 run=1 blk=0 avail=8509 (61.8%) swpO=0 conn=2 myRSS=2567 php=5 phpRSS=523 ap=17 tcp=33 topuser=madalice 2026-08-28 21:14:07 L1=1.08 run=2 blk=0 avail=8508 (61.8%) swpO=0 conn=2 myRSS=2567 php=5 phpRSS=529 ap=17 tcp=32 topuser=madalice 2026-08-28 21:14:09 L1=1.08 run=2 blk=0 avail=8535 (62.0%) swpO=0 conn=2 myRSS=2567 php=5 phpRSS=525 ap=17 tcp=28 topuser=madalice 2026-08-28 21:14:17 L1=0.99 run=2 blk=0 avail=8534 (61.9%) swpO=0 conn=2 myRSS=2567 php=5 phpRSS=524 ap=19 tcp=33 topuser=madalice 2026-08-28 21:14:20 L1=0.99 run=2 blk=0 avail=8465 (61.4%) swpO=0 conn=2 myRSS=2567 php=5 phpRSS=592 ap=20 tcp=31 topuser=madalice 2026-08-28 21:14:27 L1=1.14 run=4 blk=0 avail=8421 (61.1%) swpO=0 conn=2 myRSS=2567 php=6 phpRSS=647 ap=24 tcp=31 topuser=madalice 2026-08-28 21:14:30 L1=1.14 run=2 blk=0 avail=8450 (61.3%) swpO=0 conn=2 myRSS=2567 php=5 phpRSS=592 ap=24 tcp=31 topuser=madalice 2026-08-28 21:14:37 L1=1.12 run=2 blk=0 avail=8460 (61.4%) swpO=0 conn=2 myRSS=2567 php=5 phpRSS=582 ap=24 tcp=31 topuser=madalice 2026-08-28 21:14:40 L1=1.12 run=2 blk=0 avail=8516 (61.8%) swpO=0 conn=2 myRSS=2567 php=5 phpRSS=519 ap=24 tcp=32 topuser=madalice 2026-08-28 21:14:47 L1=1.10 run=3 blk=0 avail=8522 (61.9%) swpO=0 conn=2 myRSS=2567 php=5 phpRSS=528 ap=22 tcp=33 topuser=madalice 2026-08-28 21:14:50 L1=1.10 run=2 blk=1 avail=8528 (61.9%) swpO=0 conn=2 myRSS=2567 php=5 phpRSS=524 ap=22 tcp=31 topuser=madalice 2026-08-28 21:14:57 L1=1.23 run=2 blk=0 avail=8526 (61.9%) swpO=0 conn=2 myRSS=2567 php=5 phpRSS=524 ap=22 tcp=31 topuser=madalice 2026-08-28 21:15:00 L1=1.23 run=3 blk=0 avail=8234 (59.8%) swpO=0 conn=2 myRSS=2567 php=7 phpRSS=850 ap=22 tcp=33 topuser=madalice 2026-08-28 21:15:07 L1=1.52 run=3 blk=0 avail=8463 (61.4%) swpO=0 conn=2 myRSS=2567 php=6 phpRSS=599 ap=22 tcp=34 topuser=madalice 2026-08-28 21:15:10 L1=1.52 run=4 blk=0 avail=8491 (61.6%) swpO=0 conn=2 myRSS=2567 php=6 phpRSS=594 ap=22 tcp=34 topuser=madalice 2026-08-28 21:15:17 L1=1.67 run=5 blk=0 avail=8478 (61.5%) swpO=0 conn=2 myRSS=2567 php=6 phpRSS=594 ap=22 tcp=38 topuser=madalice 2026-08-28 21:15:20 L1=1.67 run=4 blk=0 avail=8340 (60.5%) swpO=0 conn=2 myRSS=2567 php=8 phpRSS=793 ap=22 tcp=36 topuser=madalice 2026-08-28 21:15:27 L1=1.64 run=5 blk=0 avail=8353 (60.6%) swpO=0 conn=2 myRSS=2567 php=6 phpRSS=728 ap=22 tcp=28 topuser=madalice 2026-08-28 21:15:30 L1=1.64 run=5 blk=0 avail=8253 (59.9%) swpO=0 conn=2 myRSS=2567 php=7 phpRSS=673 ap=21 tcp=30 topuser=madalice 2026-08-28 21:15:37 L1=1.47 run=3 blk=0 avail=8505 (61.7%) swpO=0 conn=2 myRSS=2567 php=6 phpRSS=574 ap=20 tcp=31 topuser=madalice 2026-08-28 21:15:40 L1=1.47 run=2 blk=0 avail=8501 (61.7%) swpO=0 conn=2 myRSS=2567 php=6 phpRSS=582 ap=20 tcp=31 topuser=madalice 2026-08-28 21:15:47 L1=1.32 run=1 blk=0 avail=8535 (61.9%) swpO=0 conn=2 myRSS=2567 php=5 phpRSS=523 ap=19 tcp=32 topuser=madalice 2026-08-28 21:15:50 L1=1.32 run=2 blk=0 avail=8542 (62.0%) swpO=0 conn=1 myRSS=2567 php=5 phpRSS=523 ap=19 tcp=29 topuser=madalice 2026-08-28 21:15:57 L1=1.28 run=16 blk=0 avail=7730 (56.1%) swpO=0 conn=2 myRSS=2567 php=12 phpRSS=1008 ap=114 tcp=153 topuser=madalice 2026-08-28 21:16:00 L1=1.28 run=13 blk=0 avail=6924 (50.3%) swpO=253 conn=11 myRSS=2566 php=12 phpRSS=1680 ap=114 tcp=165 topuser=madalice