INCIDENT 2026-08-29 06:13:27 trigger: php_rss=1710MB ================================================================== load: 2.58 2.18 2.01 15/720 2263556 ncpu:10 mem_avail: 6786MB/13777MB (49.3%) swap_used:1260MB swapout:0/s blocked(D):0 running:15 iowait:0.0% steal:0.0% php: 13 procs / 1710MB heaviest user: madalice (10 procs, 1611MB) apache: 77 procs tcp_estab: 62 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2828 madalice 10 1897 nobody 75 1327 root 256 1123 mailman 20 228 netdata 7 207 cpanellogin 1 110 vinesit 1 61 dovenull 6 59 wp-toolkit 3 52 mailnull 4 49 kurri 3 37 lowrange 2 29 evolution 7 29 infinium 2 28 zabbix 1 23 dovecot 3 23 named 1 16 aaa 1 14 candyfabcom 1 13 --- php workers by user --- USER PROCS RSS_MB madalice 10 1961 vinesit 1 63 root 1 30 evolution 1 14 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4317 MB Active(file): 4421 MB Inactive(file): 887 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 1008 MB CommitLimit: 10984 MB Committed_AS: 9891 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-03:54:48 7504 /usr/bin/imunify-agent-proxy 2211045 root 13:28 1256 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2896232 11.3 Ssl 1-03:54:17 /usr/sbin/mariadbd 2263086 510022 madalice 249852 22.0 R 00:31 php-fpm: pool madalice_com_au 2263093 510022 madalice 249008 16.4 R 00:30 php-fpm: pool madalice_com_au 2263488 510022 madalice 248972 58.5 S 00:04 php-fpm: pool madalice_com_au 2263098 510022 madalice 248884 19.8 R 00:30 php-fpm: pool madalice_com_au 2263487 510022 madalice 247812 81.0 R 00:04 php-fpm: pool madalice_com_au 2263085 510022 madalice 232296 19.2 R 00:31 php-fpm: pool madalice_com_au 2263084 510022 madalice 223992 21.3 R 00:31 php-fpm: pool madalice_com_au 2263486 510022 madalice 207756 54.0 R 00:04 php-fpm: pool madalice_com_au 1502903 1451906 root 184960 0.0 S 03:37:06 spamd child 508924 1 netdata 182504 2.0 Ssl 1-03:53:46 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2263519 510022 madalice 176736 88.0 S 00:01 php-fpm: pool madalice_com_au 1451906 1 root 175500 0.0 Ss 03:50:21 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1502904 1451906 root 163688 0.0 S 03:37:06 spamd child 2263521 510022 madalice 161116 76.0 R 00:01 php-fpm: pool madalice_com_au 1416362 1353308 cpanellogin 112548 0.0 S 03:59:20 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 509266 1 root 84484 0.0 Ss 1-03:53:43 /usr/lib/systemd/systemd-journald 2263524 2261334 vinesit 73428 33.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509236 509098 root 49280 0.0 Sl 1-03:53:43 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41080 0.1 Ss 38-03:32:09 cpsrvd (SSL) - waiting for connections 2263585 2262215 olympic 39352 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1451116 1 root 36748 0.0 Ss 03:51:14 lfd - sleeping 509640 508992 root 31996 0.0 Sl 1-03:53:41 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 510022 1 root 31272 0.0 Ss 1-03:53:39 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 30968 0.0 Ss 1-02:01:20 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2263542 1469 root 29412 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1469 1 root 24172 0.1 Ss 60-20:03:38 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 483898 1 zabbix 23424 0.2 Ssl 1-03:55:00 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2246370 506832 nobody 21924 0.0 S 03:51 /usr/sbin/httpd -k start 2261356 506832 nobody 21768 0.1 S 02:07 /usr/sbin/httpd -k start 1463 1 root 21760 0.0 Ss 60-20:03:38 tailwatchd 2246427 506832 nobody 21516 0.0 S 03:50 /usr/sbin/httpd -k start 2246413 506832 nobody 20980 0.1 S 03:50 /usr/sbin/httpd -k start 2261769 506832 nobody 20812 0.0 S 01:35 /usr/sbin/httpd -k start 2261353 506832 nobody 20620 0.0 S 02:07 /usr/sbin/httpd -k start 2261337 506832 nobody 20496 0.0 S 02:08 /usr/sbin/httpd -k start 2246390 506832 nobody 20236 0.0 S 03:51 /usr/sbin/httpd -k start 2246430 506832 nobody 20236 0.0 S 03:50 /usr/sbin/httpd -k start 2261525 506832 nobody 20132 0.0 S 01:51 /usr/sbin/httpd -k start 2261340 506832 nobody 20112 0.0 S 02:08 /usr/sbin/httpd -k start 938585 1 wp-toolkit 20104 0.0 Ss 1-02:01:20 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2261349 506832 nobody 20052 0.0 S 02:07 /usr/sbin/httpd -k start 2261781 506832 nobody 20052 0.0 S 01:35 /usr/sbin/httpd -k start 2261784 506832 nobody 20000 0.0 S 01:35 /usr/sbin/httpd -k start 2261770 506832 nobody 19992 0.0 S 01:35 /usr/sbin/httpd -k start 2261738 506832 nobody 19948 0.0 S 01:36 /usr/sbin/httpd -k start 2261347 506832 nobody 19856 0.0 S 02:07 /usr/sbin/httpd -k start 2261697 506832 nobody 19856 0.0 S 01:37 /usr/sbin/httpd -k start 2246372 506832 nobody 19752 0.0 S 03:51 /usr/sbin/httpd -k start 2261325 506832 nobody 19532 0.0 S 02:09 /usr/sbin/httpd -k start 2261334 506832 nobody 19440 0.0 S 02:08 /usr/sbin/httpd -k start 2262356 506832 nobody 19432 0.0 S 01:11 /usr/sbin/httpd -k start 2262368 506832 nobody 19416 0.0 S 01:11 /usr/sbin/httpd -k start 2261751 506832 nobody 19384 0.0 S 01:36 /usr/sbin/httpd -k start 2262169 506832 nobody 19172 0.0 S 01:16 /usr/sbin/httpd -k start 2262248 506832 nobody 19104 0.0 S 01:13 /usr/sbin/httpd -k start 2261793 506832 nobody 18988 0.0 S 01:35 /usr/sbin/httpd -k start 2261326 506832 nobody 18948 0.0 S 02:09 /usr/sbin/httpd -k start 2261764 506832 nobody 18948 0.0 S 01:35 /usr/sbin/httpd -k start 2262355 506832 nobody 18764 0.0 S 01:11 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3849763 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min corpkicks/corporatekicks.com.au-ssl_log 190 tubesupplies/tubesupplies.com.au-ssl_log 166 coscom/coscom.com.au-ssl_log 150 infinium/infinium.net.au-ssl_log 122 olympic/olympicfencing.com.au-ssl_log 83 olympic/olympicfencing.com.au 82 aaa/aaadownunder.com.au-ssl_log 53 coscom/coscom.com.au 34 madalice/madalice.com.au-ssl_log 29 evolution/portal.evolutionerp.com.au-ssl_log 22 customc/customcentral.com.au-ssl_log 3 alison/alisonarts.com.au-ssl_log 2 kurri/kurrimotorinn.com.au-ssl_log 2 aaa/aaadownunder.com.au 1 corpkicks/corporatekicks.com.au 1 (total vhosts taking traffic: 17) --- top client IPs across all vhosts (last 3 min) --- 230 34.78.110.28 186 158.23.147.79 164 143.244.57.82 140 4.204.200.136 113 52.139.44.162 22 203.54.180.238 19 18.138.238.149 7 118.127.40.55 6 151.80.234.64 5 212.227.154.251 4 20.151.200.44 3 188.166.239.157 3 160.250.130.168 2 66.29.137.231 2 50.6.169.131 --- top request paths across all vhosts (last 3 min) --- 121 GET /autodiscover/autodiscover.xml 22 GET /heartbeat.php 17 GET / 13 GET /config.yml 13 GET /config.yaml 13 GET /config/settings.py 13 GET /config/database.yml 13 GET /api/config 13 GET /actuator/env 11 GET /.env.local 11 GET /.env 10 GET /.git/HEAD 10 GET /.env.staging 10 GET /.env.stage 10 GET /.env.production 10 GET /.env.prod 10 GET /.env.development 10 GET /.env.dev 7 POST /wp-cron.php 4 GET /wp-login.php --- busiest 3 vhosts: top paths + last 10 requests --- == corpkicks/corporatekicks.com.au-ssl_log == -- top paths -- 2 POST /wp-cron.php 2 HEAD / 1 GET /xxx.php 1 GET /xx.php 1 GET /xpw.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /wp-signup.php 1 GET /wp-seo.php 1 GET /wp-load.php 1 GET /wp-links.php 1 GET /wp-includes/Text/autoload_classmap.php -- last 10 requests -- 158.23.147.79 - - [29/Aug/2026:06:13:12 +1000] "GET /login.php HTTP/1.1" 404 5749 "-" "-" 34.196.51.17 - - [29/Aug/2026:06:13:10 +1000] "HEAD / HTTP/1.1" 200 - "https://corporatekicks.com.au/" "WPMUDEV Uptime Monitor 5.0 (https://wpmudev.com)" 118.127.40.55 - - [29/Aug/2026:06:13:11 +1000] "POST /wp-cron.php?doing_wp_cron=1787947991.2455720901489257812500 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://corporatekicks.com.au" 158.23.147.79 - - [29/Aug/2026:06:13:12 +1000] "GET /search/label/PHP-Shells HTTP/1.1" 404 5749 "-" "-" 158.23.147.79 - - [29/Aug/2026:06:13:12 +1000] "GET /aged.php HTTP/1.1" 404 5749 "-" "-" 158.23.147.79 - - [29/Aug/2026:06:13:13 +1000] "GET /vv.php HTTP/1.1" 404 5749 "-" "-" 158.23.147.79 - - [29/Aug/2026:06:13:13 +1000] "GET /user-edit.php HTTP/1.1" 404 5749 "-" "-" 158.23.147.79 - - [29/Aug/2026:06:13:14 +1000] "GET /cgi-bin/xmrlpc.php HTTP/1.1" 404 5749 "-" "-" 158.23.147.79 - - [29/Aug/2026:06:13:14 +1000] "GET /engine.php HTTP/1.1" 404 5749 "-" "-" 158.23.147.79 - - [29/Aug/2026:06:13:14 +1000] "GET /edit-comments.php HTTP/1.1" 404 5749 "-" "-" == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 4 GET /wp-json/wp/v2/users 4 GET / 3 GET /admin.php 2 GET /wp-json/buddypress/v1/members 2 GET /wp-content/themes/index.php 2 GET /av.php 1 POST /wp-cron.php 1 GET /zoo1.php 1 GET /yj09.php 1 GET /xnm-apc.php 1 GET /xiugai.php 1 GET /xamp.php -- last 10 requests -- 4.204.200.136 - - [29/Aug/2026:06:12:42 +1000] "GET /qazwsx.php HTTP/1.1" 404 5750 "-" "-" 4.204.200.136 - - [29/Aug/2026:06:12:42 +1000] "GET /elp.php?p= HTTP/1.1" 404 5750 "-" "-" 4.204.200.136 - - [29/Aug/2026:06:12:43 +1000] "GET /wp-content/uploads/ HTTP/1.1" 404 5750 "-" "-" 4.204.200.136 - - [29/Aug/2026:06:12:43 +1000] "GET /dorps.php HTTP/1.1" 404 5750 "-" "-" 4.204.200.136 - - [29/Aug/2026:06:12:43 +1000] "GET /cagor.php HTTP/1.1" 404 5750 "-" "-" 49.232.189.33 - - [29/Aug/2026:06:12:42 +1000] "GET /wp-json/wp/v2/comments?per_page=100&_fields=author_name,author_url HTTP/1.1" 200 6 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko 4.204.200.136 - - [29/Aug/2026:06:12:44 +1000] "GET /billzgs.php HTTP/1.1" 404 5750 "-" "-" 4.204.200.136 - - [29/Aug/2026:06:12:44 +1000] "GET /BDKR28_u7cn8y3b.php HTTP/1.1" 404 5750 "-" "-" 213.227.139.244 - - [29/Aug/2026:06:12:43 +1000] "GET /wp-json/wp/v2/users?_jsonp=callback&per_page=100&_fields=id,slug HTTP/1.1" 200 60 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Geck 4.204.200.136 - - [29/Aug/2026:06:12:45 +1000] "GET /dftwg.php HTTP/1.1" 404 5750 "-" "-" == coscom/coscom.com.au-ssl_log == -- top paths -- 11 GET /config.yml 11 GET /config.yaml 11 GET /config/settings.py 11 GET /config/database.yml 11 GET /api/config 11 GET /actuator/env 8 GET /.git/HEAD 8 GET /.env.staging 8 GET /.env.stage 8 GET /.env.production 8 GET /.env.prod 8 GET /.env.local -- last 10 requests -- 34.78.110.28 - - [29/Aug/2026:06:12:16 +1000] "GET /actuator/env HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.78.110.28 - - [29/Aug/2026:06:12:16 +1000] "GET /config.yaml HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.78.110.28 - - [29/Aug/2026:06:12:16 +1000] "GET /config.yml HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.78.110.28 - - [29/Aug/2026:06:12:16 +1000] "GET /api/config HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.78.110.28 - - [29/Aug/2026:06:12:17 +1000] "GET /config/settings.py HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.78.110.28 - - [29/Aug/2026:06:12:17 +1000] "GET /api/config HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.78.110.28 - - [29/Aug/2026:06:12:17 +1000] "GET /config.yml HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.78.110.28 - - [29/Aug/2026:06:12:17 +1000] "GET /config/database.yml HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.78.110.28 - - [29/Aug/2026:06:12:17 +1000] "GET /config.yaml HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.78.110.28 - - [29/Aug/2026:06:12:18 +1000] "GET /actuator/env HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-29 06:11:02 L1=1.35 run=2 blk=0 avail=8111 (58.9%) swpO=1 conn=2 myRSS=2828 php=4 phpRSS=353 ap=38 tcp=43 topuser=madalice 2026-08-29 06:11:07 L1=1.24 run=4 blk=0 avail=8043 (58.4%) swpO=1 conn=2 myRSS=2828 php=5 phpRSS=477 ap=33 tcp=46 topuser=madalice 2026-08-29 06:11:12 L1=1.22 run=1 blk=0 avail=8172 (59.3%) swpO=0 conn=2 myRSS=2828 php=4 phpRSS=353 ap=30 tcp=34 topuser=madalice 2026-08-29 06:11:17 L1=1.12 run=2 blk=0 avail=8424 (61.1%) swpO=0 conn=2 myRSS=2828 php=3 phpRSS=130 ap=25 tcp=33 topuser=olympic 2026-08-29 06:11:22 L1=1.11 run=3 blk=0 avail=8128 (59.0%) swpO=0 conn=2 myRSS=2828 php=5 phpRSS=249 ap=55 tcp=79 topuser=madalice 2026-08-29 06:11:27 L1=1.10 run=2 blk=0 avail=8125 (59.0%) swpO=0 conn=2 myRSS=2828 php=4 phpRSS=281 ap=51 tcp=37 topuser=madalice 2026-08-29 06:11:32 L1=1.09 run=3 blk=0 avail=8244 (59.8%) swpO=0 conn=2 myRSS=2828 php=3 phpRSS=166 ap=46 tcp=37 topuser=madalice 2026-08-29 06:11:37 L1=1.25 run=2 blk=0 avail=8150 (59.2%) swpO=0 conn=2 myRSS=2828 php=3 phpRSS=274 ap=42 tcp=63 topuser=madalice 2026-08-29 06:11:42 L1=1.28 run=1 blk=0 avail=8238 (59.8%) swpO=0 conn=1 myRSS=2828 php=3 phpRSS=201 ap=42 tcp=39 topuser=madalice 2026-08-29 06:11:47 L1=1.42 run=2 blk=0 avail=8259 (60.0%) swpO=0 conn=2 myRSS=2828 php=3 phpRSS=202 ap=38 tcp=48 topuser=madalice 2026-08-29 06:11:52 L1=1.95 run=3 blk=0 avail=8098 (58.8%) swpO=0 conn=1 myRSS=2828 php=5 phpRSS=314 ap=51 tcp=108 topuser=madalice 2026-08-29 06:11:57 L1=1.95 run=2 blk=0 avail=7817 (56.7%) swpO=0 conn=2 myRSS=2828 php=4 phpRSS=278 ap=97 tcp=98 topuser=madalice 2026-08-29 06:12:02 L1=1.96 run=2 blk=0 avail=7873 (57.1%) swpO=0 conn=1 myRSS=2828 php=4 phpRSS=254 ap=92 tcp=64 topuser=madalice 2026-08-29 06:12:07 L1=1.88 run=2 blk=0 avail=7923 (57.5%) swpO=0 conn=2 myRSS=2828 php=3 phpRSS=207 ap=87 tcp=66 topuser=madalice 2026-08-29 06:12:12 L1=2.05 run=3 blk=0 avail=7855 (57.0%) swpO=0 conn=1 myRSS=2828 php=5 phpRSS=358 ap=82 tcp=89 topuser=madalice 2026-08-29 06:12:17 L1=1.96 run=1 blk=0 avail=7741 (56.2%) swpO=0 conn=2 myRSS=2828 php=3 phpRSS=204 ap=113 tcp=130 topuser=madalice 2026-08-29 06:12:22 L1=1.89 run=3 blk=0 avail=7462 (54.2%) swpO=0 conn=1 myRSS=2828 php=5 phpRSS=351 ap=142 tcp=61 topuser=madalice 2026-08-29 06:12:27 L1=1.90 run=7 blk=0 avail=7301 (53.0%) swpO=0 conn=4 myRSS=2828 php=6 phpRSS=565 ap=137 tcp=56 topuser=olympic 2026-08-29 06:12:32 L1=1.82 run=1 blk=0 avail=7619 (55.3%) swpO=1 conn=1 myRSS=2828 php=3 phpRSS=203 ap=132 tcp=53 topuser=madalice 2026-08-29 06:12:37 L1=1.76 run=1 blk=0 avail=7650 (55.5%) swpO=1 conn=4 myRSS=2828 php=3 phpRSS=203 ap=127 tcp=38 topuser=madalice 2026-08-29 06:12:42 L1=1.62 run=1 blk=0 avail=7683 (55.8%) swpO=0 conn=1 myRSS=2828 php=3 phpRSS=203 ap=122 tcp=38 topuser=madalice 2026-08-29 06:12:47 L1=1.65 run=3 blk=0 avail=7663 (55.6%) swpO=0 conn=4 myRSS=2828 php=4 phpRSS=287 ap=117 tcp=41 topuser=madalice 2026-08-29 06:12:52 L1=1.52 run=1 blk=0 avail=7699 (55.9%) swpO=0 conn=1 myRSS=2828 php=3 phpRSS=202 ap=112 tcp=36 topuser=madalice 2026-08-29 06:12:57 L1=1.47 run=3 blk=0 avail=7707 (55.9%) swpO=0 conn=4 myRSS=2828 php=4 phpRSS=302 ap=107 tcp=36 topuser=madalice 2026-08-29 06:13:02 L1=1.68 run=4 blk=0 avail=6968 (50.6%) swpO=0 conn=1 myRSS=2828 php=11 phpRSS=1227 ap=102 tcp=68 topuser=madalice 2026-08-29 06:13:07 L1=1.86 run=2 blk=0 avail=7080 (51.4%) swpO=0 conn=4 myRSS=2828 php=9 phpRSS=1099 ap=97 tcp=61 topuser=madalice 2026-08-29 06:13:12 L1=2.03 run=4 blk=0 avail=7007 (50.9%) swpO=0 conn=1 myRSS=2828 php=10 phpRSS=1233 ap=92 tcp=41 topuser=madalice 2026-08-29 06:13:17 L1=2.11 run=2 blk=0 avail=7199 (52.3%) swpO=0 conn=4 myRSS=2828 php=8 phpRSS=1017 ap=87 tcp=42 topuser=madalice 2026-08-29 06:13:22 L1=2.10 run=2 blk=0 avail=7197 (52.2%) swpO=0 conn=1 myRSS=2828 php=9 phpRSS=1077 ap=82 tcp=38 topuser=madalice 2026-08-29 06:13:27 L1=2.58 run=15 blk=0 avail=6786 (49.3%) swpO=0 conn=12 myRSS=2828 php=13 phpRSS=1710 ap=77 tcp=62 topuser=madalice