INCIDENT 2026-08-29 01:18:54 trigger: php_rss=1501MB ================================================================== load: 2.93 2.94 2.02 3/655 1222973 ncpu:10 mem_avail: 7206MB/13777MB (52.3%) swap_used:1236MB swapout:0/s blocked(D):0 running:2 iowait:0.1% steal:0.0% php: 13 procs / 1501MB heaviest user: madalice (8 procs, 1278MB) apache: 18 procs tcp_estab: 31 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2807 madalice 8 1278 root 256 1190 nobody 17 368 mailman 20 238 netdata 7 198 evolution 9 109 cpanellogin 1 108 dovenull 6 58 wp-toolkit 3 56 kurri 3 37 lowrange 2 29 zabbix 1 26 dovecot 3 23 named 1 16 infinium 1 14 aaa 1 14 mailnull 1 9 polkitd 1 8 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 8 1278 root 2 128 evolution 3 94 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4749 MB Active(file): 2839 MB Inactive(file): 2530 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 1375 MB CommitLimit: 10984 MB Committed_AS: 8212 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 23:00:13 7444 /usr/bin/imunify-agent-proxy 1146763 root 18:52 1228 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2875212 12.9 Ssl 22:59:42 /usr/sbin/mariadbd 1202218 1202214 root 177956 5.2 S 07:52 /usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/scripts/gather_update_log_stats --logfile /var/cpanel/updatelogs/last --upload 508924 1 netdata 175636 2.0 Ssl 22:59:11 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 529389 527476 root 171752 0.0 S 22:54:35 spamd child 1221106 510022 madalice 166152 10.0 S 02:14 php-fpm: pool madalice_com_au 1204128 510022 madalice 164628 24.0 S 06:04 php-fpm: pool madalice_com_au 1205122 510022 madalice 164600 17.6 S 04:03 php-fpm: pool madalice_com_au 1221105 510022 madalice 164284 9.9 S 02:15 php-fpm: pool madalice_com_au 1203860 510022 madalice 163040 25.8 S 06:33 php-fpm: pool madalice_com_au 1221103 510022 madalice 162400 10.8 S 02:15 php-fpm: pool madalice_com_au 1221104 510022 madalice 162172 9.9 S 02:15 php-fpm: pool madalice_com_au 1221108 510022 madalice 161648 10.0 S 02:14 php-fpm: pool madalice_com_au 1113196 1353308 cpanellogin 110864 0.1 S 29:36 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 1203804 1202218 root 94596 96.0 R 06:37 /usr/local/cpanel/3rdparty/bin/php /opt/cpanel/ea-wappspector/wappspector.phar --max=1 --json --depth=9 /home/evolution 527476 1 root 80976 0.0 Ss 22:56:14 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2985227 527476 root 70436 0.0 S 11:40:12 spamd child 509266 1 root 70128 0.0 Ss 22:59:08 /usr/lib/systemd/systemd-journald 509236 509098 root 54668 0.0 Sl 22:59:08 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41444 0.1 Ss 37-22:37:34 cpsrvd (SSL) - waiting for connections 1222944 1205081 evolution 40588 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1222942 1222913 evolution 40416 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 939687 1 root 38096 0.0 Ss 01:18:52 lfd - sleeping 510022 1 root 37368 0.0 Ss 22:59:04 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 33596 0.0 Ss 21:06:45 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 509640 508992 root 28576 0.0 Sl 22:59:06 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 483898 1 zabbix 27320 0.2 Ssl 23:00:25 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1222424 506832 nobody 25772 0.1 S 00:57 /usr/sbin/httpd -k start 1205081 506832 nobody 25048 0.4 S 04:06 /usr/sbin/httpd -k start 1201259 506832 nobody 24672 0.0 S 08:28 /usr/sbin/httpd -k start 1221692 506832 nobody 24628 0.3 S 01:36 /usr/sbin/httpd -k start 1205087 506832 nobody 24624 0.1 S 04:04 /usr/sbin/httpd -k start 1221693 506832 nobody 24252 0.1 S 01:36 /usr/sbin/httpd -k start 1469 1 root 24164 0.1 Ss 60-15:09:03 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1221673 506832 nobody 24148 0.0 S 01:37 /usr/sbin/httpd -k start 1221690 506832 nobody 24020 0.0 S 01:36 /usr/sbin/httpd -k start 1222403 506832 nobody 23792 0.1 S 00:58 /usr/sbin/httpd -k start 1221665 506832 nobody 23696 0.0 S 01:39 /usr/sbin/httpd -k start 1222841 506832 nobody 23676 0.0 S 00:17 /usr/sbin/httpd -k start 1221664 506832 nobody 23376 0.0 S 01:40 /usr/sbin/httpd -k start 1222402 506832 nobody 23164 0.0 S 00:58 /usr/sbin/httpd -k start 1463 1 root 21604 0.0 Ss 60-15:09:03 tailwatchd 938585 1 wp-toolkit 21472 0.0 Ss 21:06:45 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1222849 506832 nobody 21400 0.0 S 00:15 /usr/sbin/httpd -k start 1222913 506832 nobody 20620 0.0 S 00:05 /usr/sbin/httpd -k start 506832 1 root 20020 0.0 Ss 22:59:41 /usr/sbin/httpd -k start 481558 1 root 18252 0.1 Ssl 23:01:35 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 509671 508992 netdata 18176 2.1 Sl 22:59:06 /usr/libexec/netdata/plugins.d/apps.plugin 1 508634 1 named 17192 0.0 Ssl 22:59:16 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1163735 1471 root 16916 0.0 S 16:14 cPhulkd - dbprocessor 4180059 4180015 evolution 15772 0.0 Ss 1-01:18:53 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 1471 1 root 15732 0.0 Ss 60-15:09:03 cPhulkd - processor 1204412 1471 root 15200 0.0 S 05:34 cPhulkd - processor - http socket 245174 508511 aaa 15188 0.0 S 04:43:45 dovecot/imap 607605 508511 lowrange 15164 0.0 S 02:57:35 dovecot/imap 508856 508814 mailman 14960 0.0 S 22:59:14 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508865 508814 mailman 14900 0.0 S 22:59:14 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 798382 508511 lowrange 14616 0.0 S 02:02:49 dovecot/imap 1144954 508511 infinium 14580 0.0 S 22:21 dovecot/imap 504012 508511 kurri 14576 0.0 S 03:28:39 dovecot/imap 1222916 508511 kurri 14536 0.0 S 00:02 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3760320 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 260 tubesupplies/tubesupplies.com.au-ssl_log 153 madalice/madalice.com.au-ssl_log 91 olympic/olympicfencing.com.au-ssl_log 72 customc/customcentral.com.au-ssl_log 45 coscom/swms.coscom.com.au-ssl_log 40 otter2/otterfencing.net.au-ssl_log 37 evolution/portal.evolutionerp.com.au-ssl_log 31 alison/alisonarts.com.au-ssl_log 29 infinium/infinium.net.au-ssl_log 6 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 260 40.115.94.245 146 20.48.147.90 82 20.48.251.3 40 20.197.61.180 39 91.92.42.71 37 158.23.184.117 29 203.54.180.238 20 91.98.156.201 14 213.209.159.84 12 212.227.154.251 8 118.127.40.55 5 57.129.136.36 5 51.75.153.0 4 98.87.4.110 4 170.64.135.172 --- top request paths across all vhosts (last 3 min) --- 135 GET /api/getItem/LWFBW2001KG 43 POST /wp-login.php 41 GET /api/getItem/LWPG2001KG 29 GET /heartbeat.php 24 GET / 6 POST /wp-cron.php 6 GET /wp-json/wp/v2/users 3 GET /store/hand-painted-nike-af1-roosters/ 3 GET /radio.php 2 POST /graphql 2 POST / 2 GET /xmlrpc.php0 2 GET /xmlrpc.php 2 GET /xleet.php 2 GET /wp-json/wp-abilities/v1/v1/users 2 GET /wp-json/wc/v3/customers 2 GET /wp-json/ldlms/v2/users 2 GET /wp-json/buddypress/v1/members 2 GET /wp-json/buddyboss/v1/members 2 GET /wp-admin.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 135 GET /api/getItem/LWFBW2001KG 41 GET /api/getItem/LWPG2001KG 2 GET /api/getItem/GEB12-DL 1 GET /api/getItem/SPHDG15040 1 GET /api/getItem/S6 1 GET /api/getItem/S5 1 GET /api/getItem/S4 1 GET /api/getItem/S3 1 GET /api/getItem/S2 1 GET /api/getItem/S1 1 GET /api/getItem/RGW90 1 GET /api/getItem/RGW80 -- last 10 requests -- 40.115.94.245 - - [29/Aug/2026:01:16:20 +1000] "GET /api/getItem/K150MSGB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:01:16:20 +1000] "GET /api/getItem/RGW90 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:01:16:20 +1000] "GET /api/getItem/RGW100 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:01:16:20 +1000] "GET /api/getItem/RGW120 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:01:16:20 +1000] "GET /api/getItem/RGW160 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:01:16:20 +1000] "GET /api/getItem/RGW117T HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:01:16:20 +1000] "GET /api/getItem/RGW80 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:01:16:20 +1000] "GET /api/getItem/GP150x200x8 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:01:16:20 +1000] "GET /api/getItem/K125MSGB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:01:16:21 +1000] "GET /api/getItem/253-40SP HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 4 GET / 2 POST /wp-login.php 1 POST /wp-cron.php 1 GET /wp-includes/pomo/up 1 GET /wp-includes/media.php 1 GET /wp-includes/js/mpvloi.php 1 GET /wp-includes/js/codemirror/hehe.php 1 GET /wp-includes/js/ 1 GET /wp-includes/fonts/up.php 1 GET /wp-includes/fonts/ 1 GET /wp-includes/as.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php -- last 10 requests -- 20.48.147.90 - - [29/Aug/2026:01:18:20 +1000] "GET /update/wp-damin.php HTTP/1.1" 404 5749 "-" "-" 20.48.147.90 - - [29/Aug/2026:01:18:20 +1000] "GET /img/item.php HTTP/1.1" 404 5749 "-" "-" 20.48.147.90 - - [29/Aug/2026:01:18:21 +1000] "GET /img/mpvloi.php HTTP/1.1" 404 5749 "-" "-" 20.48.147.90 - - [29/Aug/2026:01:18:21 +1000] "GET /images/cong.php HTTP/1.1" 404 5749 "-" "-" 20.48.147.90 - - [29/Aug/2026:01:18:21 +1000] "GET /js/maint.php HTTP/1.1" 404 5749 "-" "-" 20.48.147.90 - - [29/Aug/2026:01:18:22 +1000] "GET /wp-includes/fonts/up.php HTTP/1.1" 404 5749 "-" "-" 20.48.147.90 - - [29/Aug/2026:01:18:22 +1000] "GET /cgi-bin/upload.php HTTP/1.1" 404 5749 "-" "-" 20.48.147.90 - - [29/Aug/2026:01:18:23 +1000] "GET /files/chosen.php HTTP/1.1" 404 5749 "-" "-" 91.92.243.249 - - [29/Aug/2026:01:18:37 +1000] "POST /wp-login.php HTTP/1.1" 200 8144 "-" "Mozilla/5.0" 91.92.243.249 - - [29/Aug/2026:01:18:37 +1000] "POST /wp-login.php HTTP/1.1" 200 8135 "-" "Mozilla/5.0" == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET /store/hand-painted-nike-af1-roosters/ 2 GET /store/hand-painted-nike-af1-rickmortydrip/ 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /xqq.php 1 GET /xa.php 1 GET /wsws.php 1 GET /ws79.php 1 GET /ws61.php 1 GET /wp-jufsis.php 1 GET /wp-info.php -- last 10 requests -- 20.48.251.3 - - [29/Aug/2026:01:18:03 +1000] "GET /sgd.php HTTP/1.1" 404 36644 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:18:05 +1000] "GET /gecko-litespeed.php HTTP/1.1" 404 36650 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:18:07 +1000] "GET /motu.php HTTP/1.1" 404 36644 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:18:08 +1000] "GET /rpk.php HTTP/1.1" 404 36644 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:18:10 +1000] "GET //ms.php HTTP/1.1" 301 1 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:18:12 +1000] "GET /ms.php HTTP/1.1" 404 36642 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:18:13 +1000] "GET /ccou.php HTTP/1.1" 404 36646 "-" "-" 114.119.131.88 - - [29/Aug/2026:01:18:15 +1000] "GET /store/hand-painted-nike-af1-rickmortydrip/?amp%3Bwcpr_page=2&rating=4&wcpr_rating=4&wcpr_verified=1 HTTP/1.1" 404 36673 "https://madalice.com.au/store/hand-painted-ni 20.48.251.3 - - [29/Aug/2026:01:18:15 +1000] "GET /66.php HTTP/1.1" 404 36641 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:18:17 +1000] "GET /wp-act.php HTTP/1.1" 404 36643 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-29 01:16:31 L1=4.17 run=8 blk=1 avail=7294 (52.9%) swpO=0 conn=5 myRSS=2807 php=10 phpRSS=1166 ap=34 tcp=50 topuser=madalice 2026-08-29 01:16:33 L1=4.17 run=6 blk=0 avail=7475 (54.3%) swpO=0 conn=3 myRSS=2807 php=9 phpRSS=962 ap=33 tcp=40 topuser=madalice 2026-08-29 01:16:41 L1=4.30 run=5 blk=0 avail=7045 (51.1%) swpO=5 conn=3 myRSS=2807 php=13 phpRSS=1527 ap=27 tcp=43 topuser=madalice 2026-08-29 01:16:43 L1=4.30 run=4 blk=0 avail=7080 (51.4%) swpO=5 conn=3 myRSS=2807 php=12 phpRSS=1461 ap=27 tcp=41 topuser=madalice 2026-08-29 01:16:51 L1=4.09 run=5 blk=0 avail=7020 (51.0%) swpO=0 conn=3 myRSS=2807 php=13 phpRSS=1574 ap=25 tcp=35 topuser=madalice 2026-08-29 01:16:53 L1=4.09 run=4 blk=0 avail=7040 (51.1%) swpO=0 conn=3 myRSS=2807 php=12 phpRSS=1524 ap=24 tcp=35 topuser=madalice 2026-08-29 01:17:01 L1=4.15 run=4 blk=0 avail=7090 (51.5%) swpO=0 conn=3 myRSS=2807 php=12 phpRSS=1501 ap=21 tcp=27 topuser=madalice 2026-08-29 01:17:03 L1=4.15 run=4 blk=0 avail=7062 (51.3%) swpO=0 conn=3 myRSS=2807 php=12 phpRSS=1547 ap=19 tcp=27 topuser=madalice 2026-08-29 01:17:11 L1=3.90 run=4 blk=0 avail=7188 (52.2%) swpO=0 conn=2 myRSS=2807 php=11 phpRSS=1432 ap=18 tcp=28 topuser=madalice 2026-08-29 01:17:13 L1=3.90 run=3 blk=0 avail=7196 (52.2%) swpO=0 conn=3 myRSS=2807 php=11 phpRSS=1430 ap=17 tcp=58 topuser=madalice 2026-08-29 01:17:21 L1=3.92 run=5 blk=0 avail=6782 (49.2%) swpO=0 conn=5 myRSS=2807 php=14 phpRSS=1750 ap=46 tcp=50 topuser=madalice 2026-08-29 01:17:23 L1=3.92 run=4 blk=0 avail=7001 (50.8%) swpO=0 conn=3 myRSS=2807 php=12 phpRSS=1484 ap=44 tcp=42 topuser=madalice 2026-08-29 01:17:31 L1=3.86 run=2 blk=0 avail=7090 (51.5%) swpO=0 conn=5 myRSS=2808 php=11 phpRSS=1426 ap=36 tcp=40 topuser=madalice 2026-08-29 01:17:33 L1=3.86 run=3 blk=0 avail=7103 (51.6%) swpO=0 conn=3 myRSS=2808 php=11 phpRSS=1425 ap=34 tcp=34 topuser=madalice 2026-08-29 01:17:42 L1=4.23 run=3 blk=0 avail=7102 (51.5%) swpO=0 conn=5 myRSS=2807 php=11 phpRSS=1491 ap=26 tcp=31 topuser=madalice 2026-08-29 01:17:43 L1=4.23 run=5 blk=0 avail=7089 (51.5%) swpO=0 conn=3 myRSS=2807 php=12 phpRSS=1554 ap=24 tcp=32 topuser=madalice 2026-08-29 01:17:52 L1=4.12 run=3 blk=0 avail=7206 (52.3%) swpO=3 conn=5 myRSS=2807 php=11 phpRSS=1438 ap=19 tcp=27 topuser=madalice 2026-08-29 01:17:53 L1=4.12 run=7 blk=0 avail=7183 (52.1%) swpO=3 conn=3 myRSS=2807 php=12 phpRSS=1503 ap=18 tcp=29 topuser=madalice 2026-08-29 01:18:02 L1=3.86 run=4 blk=0 avail=7161 (52.0%) swpO=0 conn=5 myRSS=2807 php=11 phpRSS=1443 ap=24 tcp=29 topuser=madalice 2026-08-29 01:18:03 L1=3.79 run=5 blk=0 avail=7062 (51.3%) swpO=0 conn=4 myRSS=2807 php=14 phpRSS=1647 ap=23 tcp=32 topuser=madalice 2026-08-29 01:18:12 L1=3.81 run=7 blk=0 avail=7160 (52.0%) swpO=0 conn=2 myRSS=2807 php=12 phpRSS=1518 ap=19 tcp=29 topuser=madalice 2026-08-29 01:18:14 L1=3.67 run=5 blk=0 avail=7200 (52.3%) swpO=0 conn=4 myRSS=2807 php=12 phpRSS=1472 ap=19 tcp=32 topuser=madalice 2026-08-29 01:18:22 L1=3.45 run=3 blk=0 avail=7162 (52.0%) swpO=2 conn=2 myRSS=2807 php=11 phpRSS=1499 ap=19 tcp=27 topuser=madalice 2026-08-29 01:18:24 L1=3.33 run=2 blk=0 avail=7217 (52.4%) swpO=2 conn=4 myRSS=2807 php=12 phpRSS=1466 ap=18 tcp=29 topuser=madalice 2026-08-29 01:18:32 L1=3.31 run=5 blk=0 avail=7153 (51.9%) swpO=0 conn=2 myRSS=2807 php=11 phpRSS=1509 ap=18 tcp=25 topuser=madalice 2026-08-29 01:18:34 L1=3.20 run=4 blk=0 avail=7236 (52.5%) swpO=0 conn=3 myRSS=2807 php=13 phpRSS=1503 ap=16 tcp=28 topuser=madalice 2026-08-29 01:18:42 L1=3.19 run=3 blk=0 avail=7250 (52.6%) swpO=0 conn=2 myRSS=2807 php=11 phpRSS=1407 ap=17 tcp=27 topuser=madalice 2026-08-29 01:18:44 L1=3.01 run=4 blk=0 avail=7226 (52.5%) swpO=0 conn=3 myRSS=2807 php=13 phpRSS=1488 ap=17 tcp=27 topuser=madalice 2026-08-29 01:18:52 L1=3.01 run=2 blk=0 avail=7246 (52.6%) swpO=0 conn=2 myRSS=2807 php=11 phpRSS=1405 ap=18 tcp=28 topuser=madalice 2026-08-29 01:18:54 L1=2.93 run=2 blk=0 avail=7206 (52.3%) swpO=0 conn=3 myRSS=2807 php=13 phpRSS=1501 ap=18 tcp=31 topuser=madalice