INCIDENT 2026-08-28 22:00:15 trigger: php_rss=1697MB ================================================================== load: 2.43 1.11 0.86 14/630 537340 ncpu:10 mem_avail: 7467MB/13777MB (54.2%) swap_used:970MB swapout:0/s blocked(D):0 running:12 iowait:0.0% steal:0.0% php: 14 procs / 1697MB heaviest user: madalice (9 procs, 1342MB) apache: 46 procs tcp_estab: 46 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2574 madalice 9 1504 root 253 983 nobody 45 716 mailman 20 334 netdata 7 209 alison 1 143 olympic 1 125 evolution 8 109 cpanellogin 1 109 infinium 2 85 wp-toolkit 3 83 dovenull 6 59 zabbix 1 24 kurri 2 24 dovecot 3 24 named 1 23 aaa 1 15 mailnull 1 12 polkitd 1 11 --- php workers by user --- USER PROCS RSS_MB madalice 9 1528 alison 1 144 olympic 1 126 evolution 2 90 root 1 25 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5741 MB Active(file): 5111 MB Inactive(file): 786 MB Dirty: 163 MB Writeback: 0 MB SReclaimable: 632 MB CommitLimit: 10984 MB Committed_AS: 9100 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 19:41:35 11384 /usr/bin/imunify-agent-proxy 523397 root 00:14 1408 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2636016 14.5 Ssl 19:41:04 /usr/sbin/mariadbd 522887 510022 madalice 235560 15.3 R 00:56 php-fpm: pool madalice_com_au 522915 510022 madalice 221048 14.5 R 00:55 php-fpm: pool madalice_com_au 522558 510022 madalice 215820 19.9 R 01:26 php-fpm: pool madalice_com_au 522634 510022 madalice 213800 17.7 R 01:19 php-fpm: pool madalice_com_au 537303 510022 madalice 211700 71.0 R 00:03 php-fpm: pool madalice_com_au 537304 510022 madalice 208500 102 R 00:02 php-fpm: pool madalice_com_au 529389 527476 root 186728 0.0 S 19:35:57 spamd child 508924 1 netdata 183772 2.0 Ssl 19:40:33 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 537310 523227 olympic 142572 114 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 537308 510022 madalice 133880 64.0 S 00:02 php-fpm: pool madalice_com_au 537307 510022 madalice 129872 63.0 S 00:02 php-fpm: pool madalice_com_au 537311 510022 madalice 123404 0.0 R 00:00 php-fpm: pool madalice_com_au 4074469 1353308 cpanellogin 111840 0.0 S 03:10:50 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 527476 1 root 93032 0.0 Ss 19:37:36 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2985227 527476 root 88212 0.0 S 08:21:34 spamd child 523456 523405 evolution 70556 1.7 Ss 00:14 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509266 1 root 64224 0.0 Ss 19:40:30 /usr/lib/systemd/systemd-journald 509236 509098 root 62996 0.0 Sl 19:40:30 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 536220 1353308 infinium 54752 2.2 S 00:05 webmaild - serving 1.41.252.211 938582 1 wp-toolkit 48920 0.0 Ss 17:48:07 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1353308 1 root 41456 0.1 Ss 37-19:18:56 cpsrvd (SSL) - waiting for connections 422130 938407 infinium 32928 0.0 S 30:33 php-fpm: pool user_infinium 938585 1 wp-toolkit 32324 0.0 Ss 17:48:07 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1469 1 root 30032 0.1 Ss 60-11:50:25 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 526869 1 root 29784 0.0 Ss 19:37:59 lfd - sleeping 509640 508992 root 27028 0.0 Sl 19:40:28 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 510022 1 root 26300 0.0 Ss 19:40:26 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 25208 0.2 Ssl 19:41:47 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 481558 1 root 24364 0.1 Ssl 19:42:57 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 508634 1 named 23936 0.0 Ssl 19:40:38 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1463 1 root 22800 0.0 Ss 60-11:50:25 tailwatchd 4180059 4180015 evolution 22452 0.0 Ss 22:00:15 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 522752 506832 nobody 20720 0.0 S 01:10 /usr/sbin/httpd -k start 522278 506832 nobody 20540 0.0 S 01:58 /usr/sbin/httpd -k start 504308 506832 nobody 20324 0.0 S 09:30 /usr/sbin/httpd -k start 521064 506832 nobody 19656 0.0 S 03:55 /usr/sbin/httpd -k start 522750 506832 nobody 19520 0.0 S 01:10 /usr/sbin/httpd -k start 520716 506832 nobody 19392 0.0 S 04:34 /usr/sbin/httpd -k start 522776 506832 nobody 19248 0.0 S 01:09 /usr/sbin/httpd -k start 522718 506832 nobody 19236 0.0 S 01:11 /usr/sbin/httpd -k start 522754 506832 nobody 19232 0.1 S 01:10 /usr/sbin/httpd -k start 508855 508814 mailman 19008 0.0 S 19:40:36 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 508865 508814 mailman 19008 0.0 S 19:40:36 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 522749 506832 nobody 18968 0.0 S 01:10 /usr/sbin/httpd -k start 530694 506832 nobody 18912 0.1 S 00:09 /usr/sbin/httpd -k start 522767 506832 nobody 18872 0.0 S 01:09 /usr/sbin/httpd -k start 530698 506832 nobody 18780 0.0 S 00:09 /usr/sbin/httpd -k start 522751 506832 nobody 18764 0.0 S 01:10 /usr/sbin/httpd -k start 508856 508814 mailman 18668 0.0 S 19:40:36 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508864 508814 mailman 18604 0.0 S 19:40:36 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 522717 506832 nobody 18432 0.0 S 01:11 /usr/sbin/httpd -k start 508857 508814 mailman 18424 0.0 S 19:40:36 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 508867 508814 mailman 18380 0.0 S 19:40:36 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 523216 506832 nobody 18380 0.0 S 00:27 /usr/sbin/httpd -k start 530682 506832 nobody 18320 0.0 S 00:09 /usr/sbin/httpd -k start 509671 508992 netdata 18264 2.1 Sl 19:40:28 /usr/libexec/netdata/plugins.d/apps.plugin 1 527400 506832 nobody 18260 0.0 S 00:11 /usr/sbin/httpd -k start 508861 508814 mailman 18184 0.0 S 19:40:36 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 508862 508814 mailman 18140 0.0 S 19:40:36 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3697314 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/apps.evolutionerp.com.au-ssl_log 121 evolution/apps.evolutionerp.com.au 120 kurri/kurrimotorinn.com.au-ssl_log 109 customkidscom/customkids.com.au-ssl_log 101 coscom/coscom.com.au 86 lowrange/lowrange.com.au-ssl_log 62 madalice/madalice.com.au-ssl_log 34 vinesit/vinesit.com.au-ssl_log 25 evolution/portal.evolutionerp.com.au-ssl_log 24 aaa/aaadownunder.com.au-ssl_log 4 corpkicks/corporatekicks.com.au-ssl_log 3 evolution/my.evolutionerp.com.au-ssl_log 3 speedlin/speedlinefencing.com.au-ssl_log 3 tubesupplies/tubesupplies.com.au-ssl_log 3 alison/alisonarts.com.au-ssl_log 2 (total vhosts taking traffic: 21) --- top client IPs across all vhosts (last 3 min) --- 241 20.104.18.15 107 4.205.62.107 101 20.48.160.90 86 4.204.200.136 62 52.139.37.240 29 34.74.127.213 24 203.54.180.238 5 118.127.40.55 4 160.250.130.168 2 97.74.87.194 2 91.92.243.243 2 66.116.251.167 2 52.167.144.173 2 216.73.217.13 2 20.237.250.71 --- top request paths across all vhosts (last 3 min) --- 24 GET /heartbeat.php 8 GET /goods.php 8 GET / 6 GET /admin.php 5 GET /simple.php 5 GET /robots.txt 5 GET /radio.php 5 GET /1.php 4 GET /wp-json/wp/v2/users 4 GET /w.php 4 GET /wp-content/uploads/ 4 GET /wp-content/plugins/hellopress/wp_filemanager.php 4 GET /this_is_a_new_hello_world.php 4 GET /store/gift-card-2/ 4 GET /store/gift-card/ 4 GET /shiny.php 4 GET /samll.php 4 GET /ops.php 4 GET /media.php 4 GET /mac.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/apps.evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /goods.php 2 GET /admin.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /X.php 1 GET /wsd.php 1 GET /ws85.php 1 GET /ws55.php 1 GET /wp-trackback.php 1 GET /wp.php 1 GET /wp-includes/index.php -- last 10 requests -- 20.104.18.15 - - [28/Aug/2026:22:00:11 +1000] "GET /dev.php?p HTTP/1.1" 404 - "-" "-" 20.104.18.15 - - [28/Aug/2026:22:00:12 +1000] "GET /gos.php HTTP/1.1" 404 - "-" "-" 20.104.18.15 - - [28/Aug/2026:22:00:12 +1000] "GET /132.php HTTP/1.1" 404 - "-" "-" 20.104.18.15 - - [28/Aug/2026:22:00:13 +1000] "GET /v22.php HTTP/1.1" 404 - "-" "-" 20.104.18.15 - - [28/Aug/2026:22:00:13 +1000] "GET /wp-activate.php HTTP/1.1" 404 - "-" "-" 20.104.18.15 - - [28/Aug/2026:22:00:13 +1000] "GET /wp-trackback.php HTTP/1.1" 404 - "-" "-" 20.104.18.15 - - [28/Aug/2026:22:00:14 +1000] "GET /pri.php HTTP/1.1" 404 - "-" "-" 20.104.18.15 - - [28/Aug/2026:22:00:14 +1000] "GET /wp_blog_footer.php HTTP/1.1" 404 - "-" "-" 20.104.18.15 - - [28/Aug/2026:22:00:15 +1000] "GET /sushi.php HTTP/1.1" 404 - "-" "-" 20.104.18.15 - - [28/Aug/2026:22:00:15 +1000] "GET /manga.php HTTP/1.1" 404 - "-" "-" == evolution/apps.evolutionerp.com.au == -- top paths -- 2 GET /goods.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /X.php 1 GET /wsd.php 1 GET /ws85.php 1 GET /ws55.php 1 GET /wp-trackback.php 1 GET /wp.php 1 GET /wp-includes/index.php 1 GET /w.php -- last 10 requests -- 20.104.18.15 - - [28/Aug/2026:22:00:11 +1000] "GET /htio.php HTTP/1.1" 301 293 "-" "-" 20.104.18.15 - - [28/Aug/2026:22:00:11 +1000] "GET /dev.php?p HTTP/1.1" 301 294 "-" "-" 20.104.18.15 - - [28/Aug/2026:22:00:11 +1000] "GET /gos.php HTTP/1.1" 301 292 "-" "-" 20.104.18.15 - - [28/Aug/2026:22:00:12 +1000] "GET /132.php HTTP/1.1" 301 292 "-" "-" 20.104.18.15 - - [28/Aug/2026:22:00:12 +1000] "GET /v22.php HTTP/1.1" 301 292 "-" "-" 20.104.18.15 - - [28/Aug/2026:22:00:13 +1000] "GET /wp-activate.php HTTP/1.1" 301 300 "-" "-" 20.104.18.15 - - [28/Aug/2026:22:00:13 +1000] "GET /wp-trackback.php HTTP/1.1" 301 301 "-" "-" 20.104.18.15 - - [28/Aug/2026:22:00:14 +1000] "GET /pri.php HTTP/1.1" 301 292 "-" "-" 20.104.18.15 - - [28/Aug/2026:22:00:14 +1000] "GET /wp_blog_footer.php HTTP/1.1" 301 303 "-" "-" 20.104.18.15 - - [28/Aug/2026:22:00:14 +1000] "GET /sushi.php HTTP/1.1" 301 294 "-" "-" == kurri/kurrimotorinn.com.au-ssl_log == -- top paths -- 1 GET /xqq.php 1 GET /xmy.php 1 GET /xa.php 1 GET /ws79.php 1 GET /ws61.php 1 GET /wp-jufsis.php 1 GET /w.php 1 GET /wp-content/themes/luJMF.php 1 GET /wp-content/plugin-install.php 1 GET /wp-content/maintenance.php 1 GET /wp-content/admin.php 1 GET /wp-blog.php -- last 10 requests -- 4.205.62.107 - - [28/Aug/2026:21:58:56 +1000] "GET /v4.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:58:56 +1000] "GET /debuggen.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:58:57 +1000] "GET /wp-admin/sc.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:58:57 +1000] "GET /application.config.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:58:58 +1000] "GET /v2.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:58:58 +1000] "GET /cli_bootstrap.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:58:59 +1000] "GET /wander.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:58:59 +1000] "GET /ah25.php HTTP/1.1" 401 36 "-" "-" 97.74.87.194 - - [28/Aug/2026:21:59:51 +1000] "GET /feed/atom/ HTTP/1.1" 301 284 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36, Mozilla/5.0 (Macintos 97.74.87.194 - - [28/Aug/2026:21:59:53 +1000] "GET /author-sitemap.xml HTTP/1.1" 301 292 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36, Mozilla/5.0 ( --- last 30 samples (run-up to this incident) --- 2026-08-28 21:57:50 L1=0.41 run=1 blk=0 avail=8974 (65.1%) swpO=0 conn=1 myRSS=2574 php=2 phpRSS=47 ap=16 tcp=22 topuser=root 2026-08-28 21:57:55 L1=0.45 run=1 blk=0 avail=8827 (64.1%) swpO=0 conn=4 myRSS=2574 php=4 phpRSS=242 ap=16 tcp=24 topuser=madalice 2026-08-28 21:58:00 L1=0.42 run=1 blk=0 avail=8842 (64.2%) swpO=0 conn=1 myRSS=2574 php=3 phpRSS=201 ap=16 tcp=22 topuser=madalice 2026-08-28 21:58:05 L1=0.47 run=2 blk=0 avail=8825 (64.1%) swpO=0 conn=2 myRSS=2574 php=4 phpRSS=242 ap=16 tcp=23 topuser=madalice 2026-08-28 21:58:10 L1=0.51 run=2 blk=0 avail=8833 (64.1%) swpO=0 conn=1 myRSS=2574 php=3 phpRSS=201 ap=16 tcp=23 topuser=madalice 2026-08-28 21:58:15 L1=0.47 run=1 blk=0 avail=8827 (64.1%) swpO=0 conn=2 myRSS=2574 php=4 phpRSS=242 ap=15 tcp=25 topuser=madalice 2026-08-28 21:58:20 L1=0.43 run=3 blk=0 avail=8854 (64.3%) swpO=0 conn=1 myRSS=2574 php=4 phpRSS=220 ap=16 tcp=25 topuser=speedlin 2026-08-28 21:58:25 L1=0.48 run=1 blk=0 avail=8828 (64.1%) swpO=0 conn=2 myRSS=2574 php=3 phpRSS=201 ap=16 tcp=25 topuser=madalice 2026-08-28 21:58:30 L1=0.44 run=1 blk=0 avail=8841 (64.2%) swpO=0 conn=1 myRSS=2574 php=3 phpRSS=201 ap=16 tcp=22 topuser=madalice 2026-08-28 21:58:35 L1=0.40 run=1 blk=0 avail=8848 (64.2%) swpO=0 conn=2 myRSS=2574 php=3 phpRSS=201 ap=16 tcp=23 topuser=madalice 2026-08-28 21:58:40 L1=0.37 run=1 blk=0 avail=8838 (64.1%) swpO=0 conn=1 myRSS=2574 php=3 phpRSS=201 ap=16 tcp=22 topuser=madalice 2026-08-28 21:58:45 L1=0.34 run=2 blk=0 avail=8973 (65.1%) swpO=0 conn=2 myRSS=2574 php=2 phpRSS=47 ap=15 tcp=25 topuser=root 2026-08-28 21:58:50 L1=0.31 run=2 blk=0 avail=8899 (64.6%) swpO=0 conn=2 myRSS=2574 php=3 phpRSS=141 ap=15 tcp=25 topuser=madalice 2026-08-28 21:58:55 L1=0.37 run=1 blk=0 avail=8845 (64.2%) swpO=0 conn=2 myRSS=2574 php=3 phpRSS=201 ap=15 tcp=26 topuser=madalice 2026-08-28 21:59:00 L1=0.42 run=3 blk=0 avail=8581 (62.3%) swpO=0 conn=2 myRSS=2574 php=5 phpRSS=506 ap=17 tcp=25 topuser=madalice 2026-08-28 21:59:05 L1=0.39 run=2 blk=0 avail=8644 (62.7%) swpO=0 conn=1 myRSS=2574 php=4 phpRSS=353 ap=26 tcp=46 topuser=madalice 2026-08-28 21:59:10 L1=0.51 run=1 blk=0 avail=8503 (61.7%) swpO=0 conn=2 myRSS=2574 php=4 phpRSS=356 ap=48 tcp=36 topuser=madalice 2026-08-28 21:59:15 L1=0.55 run=3 blk=0 avail=8500 (61.7%) swpO=0 conn=1 myRSS=2574 php=4 phpRSS=383 ap=43 tcp=33 topuser=madalice 2026-08-28 21:59:20 L1=0.51 run=2 blk=0 avail=8531 (61.9%) swpO=0 conn=2 myRSS=2574 php=5 phpRSS=403 ap=38 tcp=35 topuser=madalice 2026-08-28 21:59:25 L1=0.79 run=2 blk=0 avail=8336 (60.5%) swpO=0 conn=1 myRSS=2574 php=6 phpRSS=660 ap=33 tcp=36 topuser=madalice 2026-08-28 21:59:30 L1=0.81 run=2 blk=0 avail=8350 (60.6%) swpO=0 conn=2 myRSS=2574 php=6 phpRSS=671 ap=28 tcp=32 topuser=madalice 2026-08-28 21:59:35 L1=0.82 run=1 blk=0 avail=8386 (60.9%) swpO=0 conn=1 myRSS=2574 php=6 phpRSS=674 ap=23 tcp=32 topuser=madalice 2026-08-28 21:59:40 L1=0.84 run=1 blk=0 avail=8393 (60.9%) swpO=0 conn=2 myRSS=2574 php=6 phpRSS=675 ap=23 tcp=28 topuser=madalice 2026-08-28 21:59:45 L1=0.77 run=1 blk=0 avail=8383 (60.8%) swpO=0 conn=1 myRSS=2574 php=6 phpRSS=675 ap=21 tcp=35 topuser=madalice 2026-08-28 21:59:50 L1=0.79 run=3 blk=0 avail=8309 (60.3%) swpO=0 conn=2 myRSS=2574 php=6 phpRSS=732 ap=24 tcp=35 topuser=madalice 2026-08-28 21:59:55 L1=0.80 run=3 blk=0 avail=8367 (60.7%) swpO=0 conn=1 myRSS=2574 php=6 phpRSS=677 ap=24 tcp=33 topuser=madalice 2026-08-28 22:00:00 L1=0.82 run=1 blk=0 avail=8386 (60.9%) swpO=0 conn=2 myRSS=2574 php=6 phpRSS=677 ap=24 tcp=27 topuser=madalice 2026-08-28 22:00:05 L1=2.52 run=5 blk=0 avail=8178 (59.4%) swpO=0 conn=5 myRSS=2574 php=9 phpRSS=923 ap=29 tcp=54 topuser=madalice 2026-08-28 22:00:10 L1=2.56 run=10 blk=0 avail=8104 (58.8%) swpO=0 conn=2 myRSS=2574 php=7 phpRSS=756 ap=51 tcp=46 topuser=madalice 2026-08-28 22:00:15 L1=2.43 run=12 blk=0 avail=7467 (54.2%) swpO=0 conn=11 myRSS=2574 php=14 phpRSS=1697 ap=46 tcp=46 topuser=madalice