INCIDENT 2026-08-29 01:16:41 trigger: php_rss=1527MB ================================================================== load: 4.30 2.85 1.84 5/672 1221143 ncpu:10 mem_avail: 7045MB/13777MB (51.1%) swap_used:1236MB swapout:5/s blocked(D):0 running:5 iowait:0.1% steal:0.0% php: 13 procs / 1527MB heaviest user: madalice (8 procs, 1240MB) apache: 27 procs tcp_estab: 43 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2807 root 257 1266 madalice 8 1248 nobody 26 593 mailman 20 238 netdata 7 198 olympic 2 150 cpanellogin 1 107 dovenull 6 58 wp-toolkit 3 56 lowrange 3 44 kurri 3 37 mailnull 3 32 evolution 7 30 zabbix 1 25 dovecot 3 23 named 1 16 infinium 1 14 aaa 1 14 polkitd 1 8 --- php workers by user --- USER PROCS RSS_MB madalice 8 1249 olympic 2 152 root 2 128 evolution 1 15 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4792 MB Active(file): 2814 MB Inactive(file): 2551 MB Dirty: 3 MB Writeback: 0 MB SReclaimable: 1375 MB CommitLimit: 10984 MB Committed_AS: 8560 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 22:58:00 7444 /usr/bin/imunify-agent-proxy 1146763 root 16:39 1228 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 1202337 root 05:34 59788 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2874952 12.9 Ssl 22:57:29 /usr/sbin/mariadbd 1221108 510022 madalice 239320 124 S 00:01 php-fpm: pool madalice_com_au 1202218 1202214 root 177720 7.2 S 05:39 /usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/scripts/gather_update_log_stats --logfile /var/cpanel/updatelogs/last --upload 508924 1 netdata 175772 2.0 Ssl 22:56:58 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 529389 527476 root 171764 0.0 S 22:52:22 spamd child 1205122 510022 madalice 163456 27.1 S 01:50 php-fpm: pool madalice_com_au 1204128 510022 madalice 163136 32.7 S 03:51 php-fpm: pool madalice_com_au 1203860 510022 madalice 162992 33.8 S 04:20 php-fpm: pool madalice_com_au 1221106 510022 madalice 140640 135 S 00:01 php-fpm: pool madalice_com_au 1221103 510022 madalice 140620 68.5 S 00:02 php-fpm: pool madalice_com_au 1221105 510022 madalice 140620 68.0 S 00:02 php-fpm: pool madalice_com_au 1221104 510022 madalice 140576 72.0 S 00:02 php-fpm: pool madalice_com_au 1113196 1353308 cpanellogin 110156 0.1 S 27:23 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 1221111 1205116 olympic 96616 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1203804 1202218 root 94596 94.5 R 04:24 /usr/local/cpanel/3rdparty/bin/php /opt/cpanel/ea-wappspector/wappspector.phar --max=1 --json --depth=9 /home/evolution 527476 1 root 80976 0.0 Ss 22:54:01 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2985227 527476 root 70436 0.0 S 11:37:59 spamd child 509266 1 root 70128 0.0 Ss 22:56:55 /usr/lib/systemd/systemd-journald 1221114 1205118 olympic 67808 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1202337 1 root 59788 0.5 Ssl 05:34 /opt/imunify360/venv/bin/python3 -m imav.run 509236 509098 root 54668 0.0 Sl 22:56:55 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41432 0.1 Ss 37-22:35:21 cpsrvd (SSL) - waiting for connections 939687 1 root 38096 0.0 Ss 01:16:39 lfd - sleeping 510022 1 root 37368 0.0 Ss 22:56:51 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 33596 0.0 Ss 21:04:32 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 509640 508992 root 28576 0.0 Sl 22:56:53 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1185978 506832 nobody 27116 0.1 S 08:14 /usr/sbin/httpd -k start 1204442 506832 nobody 27076 0.0 S 03:19 /usr/sbin/httpd -k start 1186750 506832 nobody 27064 0.0 S 07:13 /usr/sbin/httpd -k start 1203973 506832 nobody 26428 0.0 S 04:10 /usr/sbin/httpd -k start 1205116 506832 nobody 26072 0.0 S 01:50 /usr/sbin/httpd -k start 483898 1 zabbix 26004 0.2 Ssl 22:58:12 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1466 1 root 25628 0.0 Ss 60-15:06:50 dnsadmin - server mode 1185975 506832 nobody 25508 0.1 S 08:14 /usr/sbin/httpd -k start 1203983 506832 nobody 25420 0.6 S 04:09 /usr/sbin/httpd -k start 1205118 506832 nobody 25408 0.3 S 01:50 /usr/sbin/httpd -k start 1205138 506832 nobody 25064 0.5 S 01:49 /usr/sbin/httpd -k start 1205081 506832 nobody 24768 0.5 S 01:53 /usr/sbin/httpd -k start 1220795 506832 nobody 24604 0.1 S 00:25 /usr/sbin/httpd -k start 1205117 506832 nobody 24476 0.5 S 01:50 /usr/sbin/httpd -k start 1469 1 root 24164 0.1 Ss 60-15:06:50 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1201259 506832 nobody 24120 0.0 S 06:15 /usr/sbin/httpd -k start 1220745 506832 nobody 23832 0.0 S 00:28 /usr/sbin/httpd -k start 1220793 506832 nobody 23800 1.0 S 00:25 /usr/sbin/httpd -k start 1220792 506832 nobody 23768 0.1 S 00:25 /usr/sbin/httpd -k start 1205087 506832 nobody 23756 0.3 S 01:51 /usr/sbin/httpd -k start 1220796 506832 nobody 23608 0.1 S 00:25 /usr/sbin/httpd -k start 1220794 506832 nobody 23592 0.0 S 00:25 /usr/sbin/httpd -k start 1220615 506832 nobody 23060 0.0 S 00:33 /usr/sbin/httpd -k start 1220782 506832 nobody 22384 0.0 S 00:26 /usr/sbin/httpd -k start 1220764 506832 nobody 22236 0.0 S 00:27 /usr/sbin/httpd -k start 1220765 506832 nobody 21928 0.0 S 00:27 /usr/sbin/httpd -k start 1463 1 root 21604 0.0 Ss 60-15:06:50 tailwatchd 1220781 506832 nobody 21524 0.0 S 00:26 /usr/sbin/httpd -k start 938585 1 wp-toolkit 21472 0.0 Ss 21:04:32 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 506832 1 root 20020 0.0 Ss 22:57:28 /usr/sbin/httpd -k start 481558 1 root 18252 0.1 Ssl 22:59:22 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 509671 508992 netdata 18176 2.1 Sl 22:56:53 /usr/libexec/netdata/plugins.d/apps.plugin 1 508634 1 named 17192 0.0 Ssl 22:57:03 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1163735 1471 root 16916 0.0 S 14:01 cPhulkd - dbprocessor --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3760088 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 1074 vinesit/vinesit.com.au-ssl_log 96 madalice/madalice.com.au-ssl_log 87 olympic/olympicfencing.com.au-ssl_log 66 alison/alisonarts.com.au-ssl_log 56 customc/customcentral.com.au-ssl_log 54 otter2/otterfencing.net.au-ssl_log 37 evolution/portal.evolutionerp.com.au-ssl_log 31 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 1074 40.115.94.245 90 4.232.148.111 80 20.48.251.3 49 91.92.42.71 37 158.23.184.117 34 91.98.156.201 29 203.54.180.238 13 212.227.154.251 5 57.129.136.36 5 193.70.46.29 5 118.127.40.55 4 51.75.153.0 4 209.133.204.198 4 185.191.171.13 3 69.6.220.159 --- top request paths across all vhosts (last 3 min) --- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 49 POST /wp-login.php 29 GET /heartbeat.php 12 GET / 9 GET /wp-json/wp/v2/users 9 GET /api/getItem/NA 4 POST /wp-cron.php 4 GET /wp-json/buddypress/v1/members 4 GET /api/getItem/PWFBW3151KG 3 GET /wp-json/buddyboss/v1/members 3 GET /robots.txt 2 POST /xmlrpc.php 2 GET /xmlrpc.php 2 GET /wp-json/wp/v2/users/me 2 GET /wp-json/wc/v3/customers 2 GET /wp-json/ldlms/v2/users --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 9 GET /api/getItem/NA 4 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 -- last 10 requests -- 40.115.94.245 - - [29/Aug/2026:01:16:20 +1000] "GET /api/getItem/K150MSGB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:01:16:20 +1000] "GET /api/getItem/RGW90 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:01:16:20 +1000] "GET /api/getItem/RGW100 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:01:16:20 +1000] "GET /api/getItem/RGW120 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:01:16:20 +1000] "GET /api/getItem/RGW160 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:01:16:20 +1000] "GET /api/getItem/RGW117T HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:01:16:20 +1000] "GET /api/getItem/RGW80 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:01:16:20 +1000] "GET /api/getItem/GP150x200x8 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:01:16:20 +1000] "GET /api/getItem/K125MSGB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:01:16:21 +1000] "GET /api/getItem/253-40SP HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == vinesit/vinesit.com.au-ssl_log == -- top paths -- 1 GET /zoom1.php 1 GET /xx.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /ws81.php 1 GET /ws77.php 1 GET /ws37.php 1 GET /wp-trackback.php 1 GET /wp-the.php 1 GET /wp-themes.php 1 GET /wp-sitemap.xml -- last 10 requests -- 4.232.148.111 - - [29/Aug/2026:01:15:13 +1000] "GET /wp-content/about.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [29/Aug/2026:01:15:14 +1000] "GET /wp-includes/assets/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [29/Aug/2026:01:15:14 +1000] "GET /wp-the.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [29/Aug/2026:01:15:14 +1000] "GET /ws81.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [29/Aug/2026:01:15:14 +1000] "GET /3.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [29/Aug/2026:01:15:15 +1000] "GET /a1.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [29/Aug/2026:01:15:15 +1000] "GET /ca5.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [29/Aug/2026:01:15:15 +1000] "GET /install.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [29/Aug/2026:01:15:15 +1000] "GET /radio.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.148.111 - - [29/Aug/2026:01:15:16 +1000] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 2 GET /store/hand-painted-nike-af1-roses/ 1 GET /zaza.php 1 GET /xza.php 1 GET //xza.php 1 GET /xve22.php 1 GET //xve22.php 1 GET /xp.php 1 GET /xin1.php 1 GET /X57.php 1 GET /wsws.php 1 GET /wpver.php 1 GET /wp-tem.php -- last 10 requests -- 20.48.251.3 - - [29/Aug/2026:01:15:55 +1000] "GET /env.php HTTP/1.1" 404 36643 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:15:57 +1000] "GET /ms-edit.php HTTP/1.1" 404 36645 "-" "-" 2601:8d:8700:5a70:14ad:cfce:388a:f230 - - [29/Aug/2026:01:15:58 +1000] "GET /store/nike-af1-baby-sprinkles/?srsltid=ARcRdnrtlCIkT9VXFmi6YzvI09aqvrRhNCWhgVkzwKgfa4Kcbc2AnfGM HTTP/1.1" 200 49749 "-" "Mozilla/5.0 (iPhone; C 20.48.251.3 - - [29/Aug/2026:01:15:59 +1000] "GET /avim.php HTTP/1.1" 404 36643 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:16:00 +1000] "GET /file21.php HTTP/1.1" 404 36645 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:16:02 +1000] "GET /wsws.php HTTP/1.1" 404 36646 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:16:04 +1000] "GET /ebahvhhh.php HTTP/1.1" 404 36646 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:16:06 +1000] "GET /bthil.php HTTP/1.1" 404 36644 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:16:08 +1000] "GET /aws_auth.php HTTP/1.1" 404 36646 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:16:09 +1000] "GET /queue.php HTTP/1.1" 404 36641 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-29 01:14:12 L1=3.07 run=4 blk=0 avail=7958 (57.8%) swpO=2 conn=2 myRSS=2806 php=6 phpRSS=523 ap=19 tcp=32 topuser=madalice 2026-08-29 01:14:20 L1=3.13 run=2 blk=0 avail=7978 (57.9%) swpO=0 conn=4 myRSS=2807 php=5 phpRSS=463 ap=19 tcp=33 topuser=madalice 2026-08-29 01:14:22 L1=3.13 run=3 blk=0 avail=7965 (57.8%) swpO=0 conn=2 myRSS=2807 php=6 phpRSS=506 ap=19 tcp=34 topuser=madalice 2026-08-29 01:14:30 L1=3.27 run=4 blk=0 avail=7883 (57.2%) swpO=0 conn=4 myRSS=2807 php=6 phpRSS=590 ap=19 tcp=33 topuser=madalice 2026-08-29 01:14:32 L1=3.27 run=5 blk=0 avail=7734 (56.1%) swpO=0 conn=2 myRSS=2807 php=7 phpRSS=764 ap=19 tcp=33 topuser=madalice 2026-08-29 01:14:40 L1=3.54 run=5 blk=0 avail=7854 (57.0%) swpO=0 conn=4 myRSS=2807 php=6 phpRSS=626 ap=18 tcp=30 topuser=madalice 2026-08-29 01:14:42 L1=3.54 run=4 blk=0 avail=7885 (57.2%) swpO=0 conn=2 myRSS=2807 php=6 phpRSS=593 ap=18 tcp=32 topuser=madalice 2026-08-29 01:14:50 L1=3.46 run=4 blk=0 avail=7930 (57.6%) swpO=0 conn=4 myRSS=2807 php=5 phpRSS=470 ap=25 tcp=53 topuser=madalice 2026-08-29 01:14:52 L1=3.46 run=7 blk=0 avail=7267 (52.7%) swpO=3 conn=6 myRSS=2807 php=9 phpRSS=1101 ap=49 tcp=56 topuser=madalice 2026-08-29 01:15:00 L1=3.54 run=6 blk=0 avail=7680 (55.7%) swpO=3 conn=4 myRSS=2807 php=6 phpRSS=631 ap=42 tcp=47 topuser=madalice 2026-08-29 01:15:02 L1=3.54 run=12 blk=0 avail=7478 (54.3%) swpO=3 conn=6 myRSS=2806 php=11 phpRSS=952 ap=40 tcp=48 topuser=madalice 2026-08-29 01:15:10 L1=4.14 run=4 blk=0 avail=7695 (55.9%) swpO=3 conn=3 myRSS=2807 php=8 phpRSS=723 ap=32 tcp=40 topuser=madalice 2026-08-29 01:15:12 L1=4.14 run=5 blk=0 avail=7718 (56.0%) swpO=2 conn=6 myRSS=2807 php=8 phpRSS=735 ap=30 tcp=38 topuser=madalice 2026-08-29 01:15:20 L1=3.88 run=4 blk=0 avail=7519 (54.6%) swpO=2 conn=3 myRSS=2807 php=11 phpRSS=1032 ap=24 tcp=38 topuser=madalice 2026-08-29 01:15:22 L1=3.88 run=5 blk=0 avail=7537 (54.7%) swpO=4 conn=6 myRSS=2806 php=10 phpRSS=988 ap=24 tcp=39 topuser=madalice 2026-08-29 01:15:30 L1=4.13 run=4 blk=0 avail=7687 (55.8%) swpO=4 conn=3 myRSS=2806 php=7 phpRSS=772 ap=24 tcp=31 topuser=madalice 2026-08-29 01:15:32 L1=4.13 run=7 blk=0 avail=7667 (55.7%) swpO=0 conn=6 myRSS=2806 php=9 phpRSS=844 ap=22 tcp=32 topuser=madalice 2026-08-29 01:15:40 L1=4.19 run=8 blk=0 avail=7595 (55.1%) swpO=0 conn=3 myRSS=2807 php=9 phpRSS=914 ap=23 tcp=36 topuser=madalice 2026-08-29 01:15:42 L1=4.19 run=5 blk=0 avail=7796 (56.6%) swpO=0 conn=6 myRSS=2807 php=7 phpRSS=664 ap=23 tcp=33 topuser=madalice 2026-08-29 01:15:50 L1=4.16 run=4 blk=0 avail=7695 (55.9%) swpO=0 conn=3 myRSS=2807 php=7 phpRSS=760 ap=22 tcp=36 topuser=madalice 2026-08-29 01:15:52 L1=4.16 run=7 blk=0 avail=7705 (55.9%) swpO=0 conn=3 myRSS=2807 php=8 phpRSS=766 ap=22 tcp=34 topuser=madalice 2026-08-29 01:16:01 L1=4.29 run=8 blk=0 avail=7609 (55.2%) swpO=0 conn=3 myRSS=2807 php=8 phpRSS=857 ap=22 tcp=34 topuser=madalice 2026-08-29 01:16:02 L1=4.29 run=9 blk=0 avail=7590 (55.1%) swpO=0 conn=3 myRSS=2807 php=10 phpRSS=961 ap=22 tcp=36 topuser=madalice 2026-08-29 01:16:11 L1=4.55 run=7 blk=0 avail=7485 (54.3%) swpO=0 conn=5 myRSS=2807 php=10 phpRSS=1044 ap=23 tcp=34 topuser=madalice 2026-08-29 01:16:13 L1=4.55 run=8 blk=0 avail=7513 (54.5%) swpO=0 conn=3 myRSS=2807 php=9 phpRSS=985 ap=23 tcp=54 topuser=madalice 2026-08-29 01:16:21 L1=4.39 run=12 blk=0 avail=7663 (55.6%) swpO=0 conn=5 myRSS=2807 php=8 phpRSS=733 ap=36 tcp=44 topuser=madalice 2026-08-29 01:16:23 L1=4.39 run=3 blk=0 avail=7640 (55.5%) swpO=0 conn=3 myRSS=2807 php=8 phpRSS=771 ap=34 tcp=46 topuser=madalice 2026-08-29 01:16:31 L1=4.17 run=8 blk=1 avail=7294 (52.9%) swpO=0 conn=5 myRSS=2807 php=10 phpRSS=1166 ap=34 tcp=50 topuser=madalice 2026-08-29 01:16:33 L1=4.17 run=6 blk=0 avail=7475 (54.3%) swpO=0 conn=3 myRSS=2807 php=9 phpRSS=962 ap=33 tcp=40 topuser=madalice 2026-08-29 01:16:41 L1=4.30 run=5 blk=0 avail=7045 (51.1%) swpO=5 conn=3 myRSS=2807 php=13 phpRSS=1527 ap=27 tcp=43 topuser=madalice