INCIDENT 2026-08-29 01:19:54 trigger: php_rss=1558MB ================================================================== load: 2.51 2.83 2.04 2/656 1223695 ncpu:10 mem_avail: 7138MB/13777MB (51.8%) swap_used:1237MB swapout:0/s blocked(D):0 running:4 iowait:0.1% steal:0.0% php: 12 procs / 1558MB heaviest user: madalice (8 procs, 1373MB) apache: 16 procs tcp_estab: 32 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2807 madalice 8 1280 root 257 1190 nobody 15 321 mailman 20 238 netdata 7 199 cpanellogin 1 108 evolution 8 71 dovenull 6 58 wp-toolkit 3 56 kurri 3 37 mailnull 3 33 lowrange 2 29 zabbix 1 25 dovecot 3 23 named 1 16 infinium 1 14 candyfabcom 1 14 aaa 1 14 polkitd 1 8 --- php workers by user --- USER PROCS RSS_MB madalice 8 1280 root 2 128 evolution 2 56 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4747 MB Active(file): 2844 MB Inactive(file): 2527 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 1379 MB CommitLimit: 10984 MB Committed_AS: 8073 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 23:01:14 7444 /usr/bin/imunify-agent-proxy 1146763 root 19:53 1228 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2875148 12.9 Ssl 23:00:43 /usr/sbin/mariadbd 1202218 1202214 root 177956 4.6 S 08:53 /usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/scripts/gather_update_log_stats --logfile /var/cpanel/updatelogs/last --upload 508924 1 netdata 176556 2.0 Ssl 23:00:12 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 529389 527476 root 171732 0.0 S 22:55:36 spamd child 1221106 510022 madalice 166144 10.0 S 03:15 php-fpm: pool madalice_com_au 1203860 510022 madalice 164872 23.6 S 07:34 php-fpm: pool madalice_com_au 1221105 510022 madalice 164856 9.8 S 03:16 php-fpm: pool madalice_com_au 1205122 510022 madalice 163608 16.1 S 05:04 php-fpm: pool madalice_com_au 1221103 510022 madalice 163448 10.5 S 03:16 php-fpm: pool madalice_com_au 1204128 510022 madalice 163152 22.0 S 07:05 php-fpm: pool madalice_com_au 1221104 510022 madalice 162992 10.6 S 03:16 php-fpm: pool madalice_com_au 1221108 510022 madalice 161876 9.9 S 03:15 php-fpm: pool madalice_com_au 1113196 1353308 cpanellogin 110864 0.1 S 30:37 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 1203804 1202218 root 94596 96.3 R 07:38 /usr/local/cpanel/3rdparty/bin/php /opt/cpanel/ea-wappspector/wappspector.phar --max=1 --json --depth=9 /home/evolution 527476 1 root 80976 0.0 Ss 22:57:15 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2985227 527476 root 70436 0.0 S 11:41:13 spamd child 509266 1 root 70128 0.0 Ss 23:00:09 /usr/lib/systemd/systemd-journald 509236 509098 root 54668 0.0 Sl 23:00:09 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1223665 1223484 evolution 41636 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 41444 0.1 Ss 37-22:38:35 cpsrvd (SSL) - waiting for connections 939687 1 root 38096 0.0 Ss 01:19:53 lfd - sleeping 510022 1 root 37368 0.0 Ss 23:00:05 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 33596 0.0 Ss 21:07:46 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 509640 508992 root 28576 0.0 Sl 23:00:07 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 483898 1 zabbix 26244 0.2 Ssl 23:01:26 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1201259 506832 nobody 25872 0.0 S 09:29 /usr/sbin/httpd -k start 1222424 506832 nobody 25772 0.4 S 01:58 /usr/sbin/httpd -k start 1205081 506832 nobody 25244 0.4 S 05:07 /usr/sbin/httpd -k start 1205087 506832 nobody 24880 0.1 S 05:05 /usr/sbin/httpd -k start 1221690 506832 nobody 24380 0.0 S 02:37 /usr/sbin/httpd -k start 1469 1 root 24164 0.1 Ss 60-15:10:04 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1222841 506832 nobody 24092 0.0 S 01:18 /usr/sbin/httpd -k start 1222849 506832 nobody 23928 0.0 S 01:16 /usr/sbin/httpd -k start 1221665 506832 nobody 23888 0.0 S 02:40 /usr/sbin/httpd -k start 1223310 506832 nobody 23548 0.0 S 00:46 /usr/sbin/httpd -k start 1221664 506832 nobody 23432 0.0 S 02:41 /usr/sbin/httpd -k start 1223484 506832 nobody 23340 0.0 S 00:21 /usr/sbin/httpd -k start 1222913 506832 nobody 22844 0.0 S 01:06 /usr/sbin/httpd -k start 1463 1 root 21616 0.0 Ss 60-15:10:04 tailwatchd 938585 1 wp-toolkit 21472 0.0 Ss 21:07:46 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 506832 1 root 20020 0.0 Ss 23:00:42 /usr/sbin/httpd -k start 481558 1 root 18252 0.1 Ssl 23:02:36 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 509671 508992 netdata 18176 2.1 Sl 23:00:07 /usr/libexec/netdata/plugins.d/apps.plugin 1 1223666 506832 nobody 17248 0.0 S 00:01 /usr/sbin/httpd -k start 508634 1 named 17192 0.0 Ssl 23:00:17 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1163735 1471 root 16916 0.0 S 17:15 cPhulkd - dbprocessor 4180059 4180015 evolution 15772 0.0 Ss 1-01:19:54 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 1471 1 root 15732 0.0 Ss 60-15:10:04 cPhulkd - processor 1204412 1471 root 15200 0.0 S 06:35 cPhulkd - processor - http socket 245174 508511 aaa 15188 0.0 S 04:44:46 dovecot/imap 607605 508511 lowrange 15164 0.0 S 02:58:36 dovecot/imap 508856 508814 mailman 14960 0.0 S 23:00:15 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508865 508814 mailman 14900 0.0 S 23:00:15 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 798382 508511 lowrange 14616 0.0 S 02:03:50 dovecot/imap 1223638 508511 kurri 14600 0.0 S 00:03 dovecot/imap 1144954 508511 infinium 14580 0.0 S 23:22 dovecot/imap 504012 508511 kurri 14576 0.0 S 03:29:40 dovecot/imap 1223632 508511 candyfabcom 14552 0.0 S 00:06 dovecot/imap 1184485 506832 root 14500 0.0 S 12:57 /usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/bin/leechprotect 508855 508814 mailman 14048 0.0 S 23:00:15 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3760413 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min tubesupplies/tubesupplies.com.au-ssl_log 153 madalice/madalice.com.au-ssl_log 89 customc/customcentral.com.au-ssl_log 69 coscom/swms.coscom.com.au-ssl_log 40 evolution/portal.evolutionerp.com.au-ssl_log 29 olympic/olympicfencing.com.au-ssl_log 18 alison/alisonarts.com.au-ssl_log 11 evolution/my.evolutionerp.com.au-ssl_log 5 corpkicks/corporatekicks.com.au-ssl_log 3 infinium/infinium.net.au-ssl_log 1 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 146 20.48.147.90 83 20.48.251.3 63 91.92.42.71 40 20.197.61.180 29 203.54.180.238 14 213.209.159.84 7 118.127.40.55 2 91.92.243.249 2 52.167.144.193 2 51.75.153.0 2 43.157.172.39 2 34.196.51.17 2 170.64.135.172 2 157.55.39.192 2 146.70.194.246 --- top request paths across all vhosts (last 3 min) --- 67 POST /wp-login.php 29 GET /heartbeat.php 19 GET / 5 POST /wp-cron.php 3 GET /wp-json/wp/v2/users 3 GET /store/hand-painted-nike-af1-rickmortydrip/ 3 GET /index.php 2 POST / 2 HEAD / 2 GET /setup-config.php 2 GET /radio.php 2 GET /chosen.php 1 POST /functions.php 1 GET /xqq.php 1 GET /xmy.php 1 GET /xmlrpc.php0 1 GET /xmlrpc.php 1 GET /xleet.php 1 GET /xa.php 1 GET /wxo.php --- busiest 3 vhosts: top paths + last 10 requests --- == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 4 GET / 2 POST /wp-login.php 1 POST /wp-cron.php 1 GET /wp-includes/pomo/up 1 GET /wp-includes/media.php 1 GET /wp-includes/js/mpvloi.php 1 GET /wp-includes/js/codemirror/hehe.php 1 GET /wp-includes/js/ 1 GET /wp-includes/fonts/up.php 1 GET /wp-includes/fonts/ 1 GET /wp-includes/as.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php -- last 10 requests -- 20.48.147.90 - - [29/Aug/2026:01:18:20 +1000] "GET /update/wp-damin.php HTTP/1.1" 404 5749 "-" "-" 20.48.147.90 - - [29/Aug/2026:01:18:20 +1000] "GET /img/item.php HTTP/1.1" 404 5749 "-" "-" 20.48.147.90 - - [29/Aug/2026:01:18:21 +1000] "GET /img/mpvloi.php HTTP/1.1" 404 5749 "-" "-" 20.48.147.90 - - [29/Aug/2026:01:18:21 +1000] "GET /images/cong.php HTTP/1.1" 404 5749 "-" "-" 20.48.147.90 - - [29/Aug/2026:01:18:21 +1000] "GET /js/maint.php HTTP/1.1" 404 5749 "-" "-" 20.48.147.90 - - [29/Aug/2026:01:18:22 +1000] "GET /wp-includes/fonts/up.php HTTP/1.1" 404 5749 "-" "-" 20.48.147.90 - - [29/Aug/2026:01:18:22 +1000] "GET /cgi-bin/upload.php HTTP/1.1" 404 5749 "-" "-" 20.48.147.90 - - [29/Aug/2026:01:18:23 +1000] "GET /files/chosen.php HTTP/1.1" 404 5749 "-" "-" 91.92.243.249 - - [29/Aug/2026:01:18:37 +1000] "POST /wp-login.php HTTP/1.1" 200 8144 "-" "Mozilla/5.0" 91.92.243.249 - - [29/Aug/2026:01:18:37 +1000] "POST /wp-login.php HTTP/1.1" 200 8135 "-" "Mozilla/5.0" == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET /store/hand-painted-nike-af1-rickmortydrip/ 1 GET /xqq.php 1 GET /xmy.php 1 GET /xa.php 1 GET /wp-jufsis.php 1 GET /wp-info.php 1 GET /w.php 1 GET //w.php 1 GET /wp-content/themes/luJMF.php 1 GET /wp-content/plugin-install.php 1 GET /wp-content/maintenance.php 1 GET /wp-content/admin.php -- last 10 requests -- 20.48.251.3 - - [29/Aug/2026:01:19:05 +1000] "GET /luJMF.php HTTP/1.1" 404 36644 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:19:06 +1000] "GET //drykl.php HTTP/1.1" 301 1 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:19:08 +1000] "GET /drykl.php HTTP/1.1" 404 36645 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:19:09 +1000] "GET /aws.php HTTP/1.1" 404 36642 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:19:11 +1000] "GET /05.php HTTP/1.1" 404 36642 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:19:13 +1000] "GET /xmy.php HTTP/1.1" 404 36644 "-" "-" 114.119.143.14 - - [29/Aug/2026:01:19:14 +1000] "GET /store/hand-painted-nike-af1-rabbitohs/?wcpr_page=2&rating=1 HTTP/1.1" 404 36657 "https://madalice.com.au/store/hand-painted-nike-af1-rabbitohs/?wcpr_page=2" "Mozilla/ 20.48.251.3 - - [29/Aug/2026:01:19:15 +1000] "GET /wp-blog.php HTTP/1.1" 404 36641 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:19:16 +1000] "GET /update.php HTTP/1.1" 404 36645 "-" "-" 20.48.251.3 - - [29/Aug/2026:01:19:18 +1000] "GET /fns.php HTTP/1.1" 404 36644 "-" "-" == customc/customcentral.com.au-ssl_log == -- top paths -- 63 POST /wp-login.php 2 POST /wp-cron.php 2 POST / 1 GET /wp-content/plugins/classic-editor/ 1 GET /wordpress/ -- last 10 requests -- 118.127.40.55 - - [29/Aug/2026:01:19:11 +1000] "POST /wp-cron.php?doing_wp_cron=1787930351.7897779941558837890625 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://customcentral.com.au" 91.92.42.71 - - [29/Aug/2026:01:19:13 +1000] "POST /wp-login.php HTTP/1.1" 503 18040 "https://customdry.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0" 146.70.194.246 - - [29/Aug/2026:01:19:10 +1000] "GET /wordpress/ HTTP/1.1" 404 73279 "-" "-" 91.92.42.71 - - [29/Aug/2026:01:19:15 +1000] "POST /wp-login.php HTTP/1.1" 503 18040 "https://customdry.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0" 91.92.42.71 - - [29/Aug/2026:01:19:18 +1000] "POST /wp-login.php HTTP/1.1" 503 18040 "https://customdry.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0" 91.92.42.71 - - [29/Aug/2026:01:19:20 +1000] "POST /wp-login.php HTTP/1.1" 503 18040 "https://customdry.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0" 91.92.42.71 - - [29/Aug/2026:01:19:26 +1000] "POST /wp-login.php HTTP/1.1" 503 18040 "https://customdry.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0" 91.92.42.71 - - [29/Aug/2026:01:19:30 +1000] "POST /wp-login.php HTTP/1.1" 503 18040 "https://customdry.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0" 91.92.42.71 - - [29/Aug/2026:01:19:32 +1000] "POST /wp-login.php HTTP/1.1" 503 18040 "https://customdry.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0" 91.92.42.71 - - [29/Aug/2026:01:19:34 +1000] "POST /wp-login.php HTTP/1.1" 503 18040 "https://customdry.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0" --- last 30 samples (run-up to this incident) --- 2026-08-29 01:17:31 L1=3.86 run=2 blk=0 avail=7090 (51.5%) swpO=0 conn=5 myRSS=2808 php=11 phpRSS=1426 ap=36 tcp=40 topuser=madalice 2026-08-29 01:17:33 L1=3.86 run=3 blk=0 avail=7103 (51.6%) swpO=0 conn=3 myRSS=2808 php=11 phpRSS=1425 ap=34 tcp=34 topuser=madalice 2026-08-29 01:17:42 L1=4.23 run=3 blk=0 avail=7102 (51.5%) swpO=0 conn=5 myRSS=2807 php=11 phpRSS=1491 ap=26 tcp=31 topuser=madalice 2026-08-29 01:17:43 L1=4.23 run=5 blk=0 avail=7089 (51.5%) swpO=0 conn=3 myRSS=2807 php=12 phpRSS=1554 ap=24 tcp=32 topuser=madalice 2026-08-29 01:17:52 L1=4.12 run=3 blk=0 avail=7206 (52.3%) swpO=3 conn=5 myRSS=2807 php=11 phpRSS=1438 ap=19 tcp=27 topuser=madalice 2026-08-29 01:17:53 L1=4.12 run=7 blk=0 avail=7183 (52.1%) swpO=3 conn=3 myRSS=2807 php=12 phpRSS=1503 ap=18 tcp=29 topuser=madalice 2026-08-29 01:18:02 L1=3.86 run=4 blk=0 avail=7161 (52.0%) swpO=0 conn=5 myRSS=2807 php=11 phpRSS=1443 ap=24 tcp=29 topuser=madalice 2026-08-29 01:18:03 L1=3.79 run=5 blk=0 avail=7062 (51.3%) swpO=0 conn=4 myRSS=2807 php=14 phpRSS=1647 ap=23 tcp=32 topuser=madalice 2026-08-29 01:18:12 L1=3.81 run=7 blk=0 avail=7160 (52.0%) swpO=0 conn=2 myRSS=2807 php=12 phpRSS=1518 ap=19 tcp=29 topuser=madalice 2026-08-29 01:18:14 L1=3.67 run=5 blk=0 avail=7200 (52.3%) swpO=0 conn=4 myRSS=2807 php=12 phpRSS=1472 ap=19 tcp=32 topuser=madalice 2026-08-29 01:18:22 L1=3.45 run=3 blk=0 avail=7162 (52.0%) swpO=2 conn=2 myRSS=2807 php=11 phpRSS=1499 ap=19 tcp=27 topuser=madalice 2026-08-29 01:18:24 L1=3.33 run=2 blk=0 avail=7217 (52.4%) swpO=2 conn=4 myRSS=2807 php=12 phpRSS=1466 ap=18 tcp=29 topuser=madalice 2026-08-29 01:18:32 L1=3.31 run=5 blk=0 avail=7153 (51.9%) swpO=0 conn=2 myRSS=2807 php=11 phpRSS=1509 ap=18 tcp=25 topuser=madalice 2026-08-29 01:18:34 L1=3.20 run=4 blk=0 avail=7236 (52.5%) swpO=0 conn=3 myRSS=2807 php=13 phpRSS=1503 ap=16 tcp=28 topuser=madalice 2026-08-29 01:18:42 L1=3.19 run=3 blk=0 avail=7250 (52.6%) swpO=0 conn=2 myRSS=2807 php=11 phpRSS=1407 ap=17 tcp=27 topuser=madalice 2026-08-29 01:18:44 L1=3.01 run=4 blk=0 avail=7226 (52.5%) swpO=0 conn=3 myRSS=2807 php=13 phpRSS=1488 ap=17 tcp=27 topuser=madalice 2026-08-29 01:18:52 L1=3.01 run=2 blk=0 avail=7246 (52.6%) swpO=0 conn=2 myRSS=2807 php=11 phpRSS=1405 ap=18 tcp=28 topuser=madalice 2026-08-29 01:18:54 L1=2.93 run=2 blk=0 avail=7206 (52.3%) swpO=0 conn=3 myRSS=2807 php=13 phpRSS=1501 ap=18 tcp=31 topuser=madalice 2026-08-29 01:19:02 L1=2.85 run=3 blk=0 avail=7197 (52.2%) swpO=0 conn=2 myRSS=2807 php=11 phpRSS=1463 ap=18 tcp=26 topuser=madalice 2026-08-29 01:19:04 L1=2.87 run=3 blk=0 avail=7130 (51.8%) swpO=0 conn=3 myRSS=2807 php=13 phpRSS=1592 ap=16 tcp=28 topuser=madalice 2026-08-29 01:19:12 L1=2.96 run=6 blk=0 avail=6952 (50.5%) swpO=0 conn=4 myRSS=2807 php=13 phpRSS=1771 ap=17 tcp=27 topuser=madalice 2026-08-29 01:19:14 L1=2.88 run=3 blk=0 avail=7216 (52.4%) swpO=0 conn=4 myRSS=2807 php=13 phpRSS=1507 ap=16 tcp=29 topuser=madalice 2026-08-29 01:19:22 L1=2.81 run=3 blk=0 avail=7263 (52.7%) swpO=2 conn=4 myRSS=2807 php=11 phpRSS=1425 ap=16 tcp=24 topuser=madalice 2026-08-29 01:19:24 L1=2.74 run=3 blk=0 avail=7212 (52.3%) swpO=2 conn=4 myRSS=2807 php=13 phpRSS=1537 ap=14 tcp=27 topuser=madalice 2026-08-29 01:19:32 L1=2.68 run=5 blk=0 avail=7074 (51.3%) swpO=1 conn=3 myRSS=2807 php=13 phpRSS=1673 ap=14 tcp=31 topuser=madalice 2026-08-29 01:19:34 L1=2.71 run=3 blk=0 avail=7227 (52.5%) swpO=1 conn=4 myRSS=2807 php=13 phpRSS=1513 ap=15 tcp=29 topuser=madalice 2026-08-29 01:19:42 L1=2.57 run=3 blk=0 avail=7246 (52.6%) swpO=0 conn=3 myRSS=2807 php=11 phpRSS=1429 ap=15 tcp=25 topuser=madalice 2026-08-29 01:19:44 L1=2.61 run=5 blk=0 avail=7225 (52.4%) swpO=0 conn=3 myRSS=2807 php=13 phpRSS=1504 ap=15 tcp=32 topuser=madalice 2026-08-29 01:19:52 L1=2.56 run=4 blk=0 avail=7209 (52.3%) swpO=0 conn=3 myRSS=2807 php=11 phpRSS=1465 ap=15 tcp=29 topuser=madalice 2026-08-29 01:19:54 L1=2.51 run=4 blk=0 avail=7138 (51.8%) swpO=0 conn=2 myRSS=2807 php=12 phpRSS=1558 ap=16 tcp=32 topuser=madalice