INCIDENT 2026-08-29 09:49:33 trigger: php_rss=2278MB ================================================================== load: 2.64 1.93 1.53 15/700 3007798 ncpu:10 mem_avail: 6139MB/13777MB (44.6%) swap_used:1224MB swapout:616/s blocked(D):0 running:13 iowait:0.0% steal:0.0% php: 14 procs / 2278MB heaviest user: madalice (10 procs, 1986MB) apache: 68 procs tcp_estab: 50 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2822 madalice 10 1860 nobody 67 1160 root 250 1098 mailman 20 225 netdata 7 203 infinium 2 161 speedlin 1 135 cpanellogin 1 69 dovenull 6 59 wp-toolkit 3 51 alison 1 44 kurri 3 37 evolution 7 29 zabbix 1 23 dovecot 3 23 named 1 16 mailnull 1 9 polkitd 1 7 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1872 infinium 2 171 speedlin 1 137 alison 1 53 root 1 30 evolution 1 14 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4400 MB Active(file): 4464 MB Inactive(file): 786 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 907 MB CommitLimit: 10984 MB Committed_AS: 9720 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-07:30:53 7768 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2890656 10.4 Ssl 1-07:30:22 /usr/sbin/mariadbd 3007606 510022 madalice 249888 20.9 R 00:28 php-fpm: pool madalice_com_au 3007760 510022 madalice 244124 62.5 R 00:04 php-fpm: pool madalice_com_au 3007601 510022 madalice 209208 18.9 R 00:30 php-fpm: pool madalice_com_au 3007759 510022 madalice 208896 58.5 R 00:04 php-fpm: pool madalice_com_au 1502903 1451906 root 191340 0.0 S 07:13:11 spamd child 508924 1 netdata 178004 2.0 Ssl 1-07:29:51 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1451906 1 root 173948 0.0 Ss 07:26:26 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3007236 510022 madalice 164132 23.0 R 01:08 php-fpm: pool madalice_com_au 3007600 510022 madalice 162500 23.1 R 00:30 php-fpm: pool madalice_com_au 3007596 510022 madalice 159188 23.6 S 00:30 php-fpm: pool madalice_com_au 3007762 510022 madalice 158972 65.2 S 00:04 php-fpm: pool madalice_com_au 3007761 510022 madalice 158952 60.5 S 00:04 php-fpm: pool madalice_com_au 3007764 510022 madalice 158904 59.7 S 00:04 php-fpm: pool madalice_com_au 1502904 1451906 root 155148 0.0 S 07:13:11 spamd child 3007765 3006558 speedlin 149792 68.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3007766 3007293 infinium 127540 58.0 S 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 509266 1 root 91732 0.0 Ss 1-07:29:48 /usr/lib/systemd/systemd-journald 2971632 1353308 cpanellogin 71212 0.1 S 12:38 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 509236 509098 root 64384 0.0 Sl 1-07:29:48 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3007793 3007313 infinium 63996 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1353308 1 root 42164 0.1 Ss 38-07:08:14 cpsrvd (SSL) - waiting for connections 3007807 3007283 evolution 40504 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1451116 1 root 35988 0.0 Ss 07:27:19 lfd - sleeping 509640 508992 root 34636 0.0 Sl 1-07:29:46 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 510022 1 root 31260 0.0 Ss 1-07:29:44 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 30760 0.0 Ss 1-05:37:25 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1469 1 root 24176 0.1 Ss 60-23:39:43 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 483898 1 zabbix 23892 0.2 Ssl 1-07:31:05 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2990065 506832 nobody 22760 0.0 S 04:46 /usr/sbin/httpd -k start 1463 1 root 21888 0.0 Ss 60-23:39:43 tailwatchd 3006605 506832 nobody 20392 0.0 S 02:31 /usr/sbin/httpd -k start 3006512 506832 nobody 20320 0.0 S 02:33 /usr/sbin/httpd -k start 3007304 506832 nobody 20304 0.0 S 01:01 /usr/sbin/httpd -k start 3006611 506832 nobody 20200 0.0 S 02:31 /usr/sbin/httpd -k start 3007376 506832 nobody 20176 0.0 S 01:00 /usr/sbin/httpd -k start 938585 1 wp-toolkit 19848 0.0 Ss 1-05:37:25 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3007372 506832 nobody 19760 0.0 S 01:00 /usr/sbin/httpd -k start 3007383 506832 nobody 19760 0.0 S 01:00 /usr/sbin/httpd -k start 3006598 506832 nobody 19724 0.0 S 02:31 /usr/sbin/httpd -k start 3007374 506832 nobody 19692 0.0 S 01:00 /usr/sbin/httpd -k start 3006545 506832 nobody 19684 0.0 S 02:32 /usr/sbin/httpd -k start 3007371 506832 nobody 19680 0.0 S 01:00 /usr/sbin/httpd -k start 3007302 506832 nobody 19636 0.0 S 01:01 /usr/sbin/httpd -k start 3007283 506832 nobody 19552 0.0 S 01:02 /usr/sbin/httpd -k start 3007278 506832 nobody 19488 0.0 S 01:02 /usr/sbin/httpd -k start 3007370 506832 nobody 19472 0.0 S 01:00 /usr/sbin/httpd -k start 3007303 506832 nobody 19468 0.0 S 01:01 /usr/sbin/httpd -k start 3007359 506832 nobody 19452 0.0 S 01:00 /usr/sbin/httpd -k start 3007271 506832 nobody 19424 0.0 S 01:03 /usr/sbin/httpd -k start 3007263 506832 nobody 19412 0.0 S 01:05 /usr/sbin/httpd -k start 3007272 506832 nobody 19400 0.0 S 01:03 /usr/sbin/httpd -k start 3007279 506832 nobody 19352 0.0 S 01:02 /usr/sbin/httpd -k start 3006557 506832 nobody 19032 0.0 S 02:32 /usr/sbin/httpd -k start 2990076 506832 nobody 18864 0.0 S 04:45 /usr/sbin/httpd -k start 3007288 506832 nobody 18852 0.0 S 01:02 /usr/sbin/httpd -k start 3006552 506832 nobody 18708 0.0 S 02:32 /usr/sbin/httpd -k start 3006540 506832 nobody 18624 0.0 S 02:32 /usr/sbin/httpd -k start 3007318 506832 nobody 18416 0.0 S 01:01 /usr/sbin/httpd -k start 3007300 506832 nobody 18388 0.0 S 01:01 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3921413 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min speedlin/speedlinefencing.com.au-ssl_log 115 speedlin/speedlinefencing.com.au 101 madalice/madalice.com.au-ssl_log 32 evolution/portal.evolutionerp.com.au-ssl_log 24 cosgrovecreative/cosgrovecreative.com.au-ssl_log 23 aaa/aaadownunder.com.au-ssl_log 15 infinium/infinium.net.au-ssl_log 6 tubesupplies/tubesupplies.com.au-ssl_log 1 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 132 20.48.179.39 83 20.48.160.90 24 203.54.180.238 23 104.197.125.25 21 3.238.192.159 6 209.42.29.39 4 130.185.123.55 3 2a09:bac2:42b:34b::54:2b 3 143.244.57.120 3 118.127.40.55 2 209.127.27.15 1 64.105.95.197 1 62.60.130.235 1 54.166.43.22 1 44.218.170.184 --- top request paths across all vhosts (last 3 min) --- 24 GET /heartbeat.php 6 GET /wp-login.php 4 POST /wp-login.php 4 GET /zi.php 4 GET /yj.php 4 GET /ue.php 4 GET /tf.php 4 GET /px.php 4 GET /or.php 4 GET /nv.php 4 GET /ke.php 4 GET /jw.php 4 GET /jg.php 4 GET /im.php 4 GET /ile56.php 4 GET /hypo.php 4 GET /Hd.php 4 GET /fc.php 4 GET /em.php 4 GET /emmh.php --- busiest 3 vhosts: top paths + last 10 requests --- == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 2 GET /zi.php 2 GET /yj.php 2 GET /ue.php 2 GET /tf.php 2 GET /sg.php 2 GET /rsjlrria.php 2 GET /replace.php 2 GET /px.php 2 GET /or.php 2 GET /okxoby.php 2 GET /nv.php 2 GET /ke.php -- last 10 requests -- 209.127.27.15 - - [29/Aug/2026:09:49:01 +1000] "GET /wp-login.php HTTP/1.1" 200 7556 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 209.127.27.15 - - [29/Aug/2026:09:49:02 +1000] "POST /wp-login.php HTTP/1.1" 503 18956 "https://speedlinefencing.com.au:443/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) 20.48.179.39 - - [29/Aug/2026:09:49:02 +1000] "GET /gelap1.php HTTP/1.1" 404 45250 "-" "-" 118.127.40.55 - - [29/Aug/2026:09:49:03 +1000] "POST /wp-cron.php?doing_wp_cron=1787960943.4070310592651367187500 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://speedlinefencing.com.au" 20.48.179.39 - - [29/Aug/2026:09:49:04 +1000] "GET /rsjlrria.php HTTP/1.1" 404 45250 "-" "-" 20.48.179.39 - - [29/Aug/2026:09:49:06 +1000] "GET /AxAo.php HTTP/1.1" 404 45250 "-" "-" 20.48.179.39 - - [29/Aug/2026:09:49:09 +1000] "GET /class17.php HTTP/1.1" 404 45250 "-" "-" 20.48.179.39 - - [29/Aug/2026:09:49:11 +1000] "GET /okxoby.php HTTP/1.1" 404 45250 "-" "-" 20.48.179.39 - - [29/Aug/2026:09:49:13 +1000] "GET /esuutzzx.php HTTP/1.1" 404 45250 "-" "-" 20.48.179.39 - - [29/Aug/2026:09:49:15 +1000] "GET /replace.php HTTP/1.1" 404 45250 "-" "-" == speedlin/speedlinefencing.com.au == -- top paths -- 2 GET /zi.php 2 GET /yj.php 2 GET /ue.php 2 GET /tf.php 2 GET /px.php 2 GET /or.php 2 GET /nv.php 2 GET /ke.php 2 GET /jw.php 2 GET /jg.php 2 GET /im.php 2 GET /ile56.php -- last 10 requests -- 20.48.179.39 - - [29/Aug/2026:09:48:41 +1000] "GET /ue.php HTTP/1.1" 301 286 "-" "-" 20.48.179.39 - - [29/Aug/2026:09:48:43 +1000] "GET /nv.php HTTP/1.1" 301 286 "-" "-" 20.48.179.39 - - [29/Aug/2026:09:48:45 +1000] "GET /jw.php HTTP/1.1" 301 286 "-" "-" 20.48.179.39 - - [29/Aug/2026:09:48:47 +1000] "GET /or.php HTTP/1.1" 301 286 "-" "-" 20.48.179.39 - - [29/Aug/2026:09:48:49 +1000] "GET /ile56.php HTTP/1.1" 301 289 "-" "-" 20.48.179.39 - - [29/Aug/2026:09:48:51 +1000] "GET /emmh.php HTTP/1.1" 301 288 "-" "-" 20.48.179.39 - - [29/Aug/2026:09:48:53 +1000] "GET /em.php HTTP/1.1" 301 286 "-" "-" 20.48.179.39 - - [29/Aug/2026:09:48:55 +1000] "GET /dvve.php HTTP/1.1" 301 288 "-" "-" 20.48.179.39 - - [29/Aug/2026:09:48:57 +1000] "GET /doo.php HTTP/1.1" 301 287 "-" "-" 20.48.179.39 - - [29/Aug/2026:09:48:59 +1000] "GET /adminer-4.6.6.php HTTP/1.1" 301 297 "-" "-" == madalice/madalice.com.au-ssl_log == -- top paths -- 2 GET /users/login 2 GET /signin 2 GET /sign-in 2 GET /register 2 GET /auth 2 GET / 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 POST / 1 GET /user/login 1 GET /store/hand-dyed-nike-crew-socks-red-heart-edition/ -- last 10 requests -- 3.238.192.159 - - [29/Aug/2026:09:49:29 +1000] "GET /user/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 3.238.192.159 - - [29/Aug/2026:09:49:29 +1000] "GET /users/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 3.238.192.159 - - [29/Aug/2026:09:49:29 +1000] "GET /sign-in HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 3.238.192.159 - - [29/Aug/2026:09:49:29 +1000] "GET /forgot-password HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 3.238.192.159 - - [29/Aug/2026:09:49:29 +1000] "GET /account/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 3.238.192.159 - - [29/Aug/2026:09:49:32 +1000] "GET /auth HTTP/1.1" 404 36642 "https://www.madalice.com.au/auth" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/5 3.238.192.159 - - [29/Aug/2026:09:49:32 +1000] "GET /signin HTTP/1.1" 404 36645 "https://www.madalice.com.au/signin" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safa 3.238.192.159 - - [29/Aug/2026:09:49:32 +1000] "GET /sign-in HTTP/1.1" 404 36645 "https://www.madalice.com.au/sign-in" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Sa 3.238.192.159 - - [29/Aug/2026:09:49:32 +1000] "GET /users/login HTTP/1.1" 404 36647 "https://www.madalice.com.au/users/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 M 3.238.192.159 - - [29/Aug/2026:09:49:32 +1000] "GET /register HTTP/1.1" 404 36642 "https://www.madalice.com.au/register" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile --- last 30 samples (run-up to this incident) --- 2026-08-29 09:47:06 L1=2.29 run=4 blk=0 avail=7486 (54.3%) swpO=0 conn=2 myRSS=2837 php=6 phpRSS=570 ap=113 tcp=77 topuser=corpkicks 2026-08-29 09:47:12 L1=2.19 run=3 blk=0 avail=7663 (55.6%) swpO=0 conn=1 myRSS=2837 php=5 phpRSS=398 ap=106 tcp=44 topuser=speedlin 2026-08-29 09:47:16 L1=2.17 run=3 blk=0 avail=7866 (57.1%) swpO=0 conn=2 myRSS=2837 php=4 phpRSS=181 ap=103 tcp=38 topuser=speedlin 2026-08-29 09:47:22 L1=2.00 run=4 blk=0 avail=7865 (57.1%) swpO=0 conn=1 myRSS=2837 php=5 phpRSS=248 ap=96 tcp=31 topuser=speedlin 2026-08-29 09:47:26 L1=2.00 run=1 blk=0 avail=7895 (57.3%) swpO=0 conn=2 myRSS=2837 php=4 phpRSS=208 ap=93 tcp=27 topuser=madalice 2026-08-29 09:47:33 L1=2.16 run=3 blk=0 avail=7884 (57.2%) swpO=1 conn=3 myRSS=2837 php=5 phpRSS=292 ap=86 tcp=26 topuser=madalice 2026-08-29 09:47:36 L1=2.14 run=1 blk=0 avail=7959 (57.8%) swpO=1 conn=2 myRSS=2837 php=3 phpRSS=177 ap=83 tcp=28 topuser=madalice 2026-08-29 09:47:43 L1=2.21 run=3 blk=0 avail=7966 (57.8%) swpO=0 conn=3 myRSS=2837 php=5 phpRSS=282 ap=76 tcp=23 topuser=madalice 2026-08-29 09:47:46 L1=2.04 run=2 blk=0 avail=8128 (59.0%) swpO=0 conn=1 myRSS=2837 php=3 phpRSS=92 ap=73 tcp=25 topuser=customc 2026-08-29 09:47:53 L1=2.03 run=1 blk=0 avail=8187 (59.4%) swpO=0 conn=3 myRSS=2837 php=2 phpRSS=45 ap=66 tcp=22 topuser=root 2026-08-29 09:47:56 L1=1.87 run=2 blk=0 avail=8112 (58.9%) swpO=0 conn=1 myRSS=2837 php=3 phpRSS=173 ap=63 tcp=25 topuser=alison 2026-08-29 09:48:03 L1=1.96 run=2 blk=0 avail=8161 (59.2%) swpO=2 conn=3 myRSS=2837 php=3 phpRSS=177 ap=56 tcp=23 topuser=madalice 2026-08-29 09:48:06 L1=1.80 run=2 blk=0 avail=8065 (58.5%) swpO=2 conn=1 myRSS=2837 php=4 phpRSS=328 ap=53 tcp=24 topuser=speedlin 2026-08-29 09:48:13 L1=1.82 run=3 blk=0 avail=8099 (58.8%) swpO=0 conn=3 myRSS=2837 php=5 phpRSS=360 ap=46 tcp=28 topuser=alison 2026-08-29 09:48:16 L1=1.67 run=2 blk=0 avail=8204 (59.6%) swpO=0 conn=1 myRSS=2837 php=4 phpRSS=244 ap=43 tcp=32 topuser=madalice 2026-08-29 09:48:23 L1=1.86 run=1 blk=0 avail=8299 (60.2%) swpO=0 conn=3 myRSS=2837 php=3 phpRSS=177 ap=36 tcp=25 topuser=madalice 2026-08-29 09:48:26 L1=1.79 run=4 blk=0 avail=8191 (59.5%) swpO=0 conn=1 myRSS=2837 php=3 phpRSS=220 ap=32 tcp=27 topuser=madalice 2026-08-29 09:48:33 L1=1.73 run=3 blk=0 avail=7889 (57.3%) swpO=0 conn=1 myRSS=2837 php=3 phpRSS=197 ap=94 tcp=105 topuser=madalice 2026-08-29 09:48:36 L1=1.67 run=3 blk=0 avail=7481 (54.3%) swpO=0 conn=1 myRSS=2837 php=5 phpRSS=467 ap=125 tcp=94 topuser=madalice 2026-08-29 09:48:43 L1=1.62 run=3 blk=0 avail=7715 (56.0%) swpO=0 conn=1 myRSS=2837 php=3 phpRSS=202 ap=118 tcp=42 topuser=madalice 2026-08-29 09:48:47 L1=1.57 run=3 blk=0 avail=7630 (55.4%) swpO=0 conn=3 myRSS=2837 php=4 phpRSS=337 ap=114 tcp=50 topuser=madalice 2026-08-29 09:48:53 L1=1.44 run=2 blk=0 avail=7782 (56.5%) swpO=0 conn=1 myRSS=2837 php=3 phpRSS=208 ap=108 tcp=25 topuser=madalice 2026-08-29 09:48:57 L1=1.40 run=2 blk=0 avail=7716 (56.0%) swpO=0 conn=3 myRSS=2837 php=4 phpRSS=330 ap=104 tcp=23 topuser=madalice 2026-08-29 09:49:03 L1=1.29 run=3 blk=0 avail=7647 (55.5%) swpO=0 conn=1 myRSS=2837 php=6 phpRSS=509 ap=98 tcp=23 topuser=speedlin 2026-08-29 09:49:07 L1=1.59 run=4 blk=0 avail=7286 (52.9%) swpO=0 conn=3 myRSS=2837 php=8 phpRSS=925 ap=94 tcp=52 topuser=madalice 2026-08-29 09:49:13 L1=1.94 run=3 blk=0 avail=7341 (53.3%) swpO=0 conn=1 myRSS=2837 php=8 phpRSS=890 ap=88 tcp=31 topuser=madalice 2026-08-29 09:49:17 L1=1.87 run=4 blk=0 avail=7257 (52.7%) swpO=0 conn=3 myRSS=2837 php=10 phpRSS=1066 ap=84 tcp=50 topuser=madalice 2026-08-29 09:49:23 L1=1.80 run=1 blk=0 avail=7445 (54.0%) swpO=0 conn=1 myRSS=2837 php=7 phpRSS=823 ap=78 tcp=20 topuser=madalice 2026-08-29 09:49:27 L1=1.73 run=1 blk=0 avail=7475 (54.3%) swpO=0 conn=3 myRSS=2837 php=7 phpRSS=823 ap=74 tcp=23 topuser=madalice 2026-08-29 09:49:33 L1=2.64 run=13 blk=0 avail=6139 (44.6%) swpO=616 conn=10 myRSS=2822 php=14 phpRSS=2278 ap=68 tcp=50 topuser=madalice