INCIDENT 2026-08-29 12:53:48 trigger: php_rss=1754MB ================================================================== load: 3.53 2.04 1.58 18/699 3644874 ncpu:10 mem_avail: 6691MB/13777MB (48.6%) swap_used:1410MB swapout:0/s blocked(D):0 running:18 iowait:0.0% steal:0.0% php: 14 procs / 1754MB heaviest user: madalice (10 procs, 1576MB) apache: 69 procs tcp_estab: 81 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2713 madalice 10 1612 nobody 68 1195 root 247 1090 mailman 20 199 netdata 7 194 tubesupplies 1 90 cpanellogin 1 61 olympic 1 60 dovenull 6 55 wp-toolkit 3 45 mailnull 3 31 evolution 7 27 zabbix 1 22 dovecot 3 22 named 1 14 candyfabcom 1 14 kurri 1 9 polkitd 1 6 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1619 tubesupplies 1 91 olympic 1 61 root 1 27 evolution 1 14 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4396 MB Active(file): 4039 MB Inactive(file): 899 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 584 MB CommitLimit: 10984 MB Committed_AS: 9490 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-10:35:08 7532 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2778200 9.8 Ssl 1-10:34:37 /usr/sbin/mariadbd 3644724 510022 madalice 201984 50.8 R 00:09 php-fpm: pool madalice_com_au 1502903 1451906 root 196968 0.0 S 10:17:26 spamd child 3644826 510022 madalice 191596 49.5 R 00:02 php-fpm: pool madalice_com_au 508924 1 netdata 173024 2.0 Ssl 1-10:34:06 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3644732 510022 madalice 172768 52.1 S 00:08 php-fpm: pool madalice_com_au 3643670 510022 madalice 168448 16.9 R 01:11 php-fpm: pool madalice_com_au 3644733 510022 madalice 166548 52.6 R 00:08 php-fpm: pool madalice_com_au 1502904 1451906 root 165000 0.0 S 10:17:26 spamd child 3644727 510022 madalice 161612 42.1 R 00:09 php-fpm: pool madalice_com_au 3644725 510022 madalice 161080 40.8 R 00:09 php-fpm: pool madalice_com_au 3644812 510022 madalice 159456 92.3 S 00:03 php-fpm: pool madalice_com_au 1451906 1 root 144468 0.0 Ss 10:30:41 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3644823 510022 madalice 129876 86.5 R 00:02 php-fpm: pool madalice_com_au 3644825 510022 madalice 127776 72.5 R 00:02 php-fpm: pool madalice_com_au 3644836 3643403 tubesupplies 103288 80.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509266 1 root 96292 0.0 Ss 1-10:34:03 /usr/lib/systemd/systemd-journald 3644840 3627499 olympic 67244 25.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509236 509098 root 64140 0.0 Sl 1-10:34:03 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3627144 1353308 cpanellogin 63484 0.2 S 05:46 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 1353308 1 root 42220 0.1 Ss 38-10:12:29 cpsrvd (SSL) - waiting for connections 509640 508992 root 35536 0.0 Sl 1-10:34:01 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 34096 0.0 Ss 10:31:34 lfd - sleeping 510022 1 root 28408 0.0 Ss 1-10:33:59 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 26812 0.0 Ss 1-08:41:40 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 3627587 506832 nobody 25128 0.0 S 05:10 /usr/sbin/httpd -k start 483898 1 zabbix 23444 0.2 Ssl 1-10:35:20 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1469 1 root 22648 0.1 Ss 61-02:43:58 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3642921 506832 nobody 22632 0.0 S 02:35 /usr/sbin/httpd -k start 3626710 506832 nobody 22472 0.0 S 06:32 /usr/sbin/httpd -k start 3643403 506832 nobody 22296 0.3 S 01:43 /usr/sbin/httpd -k start 3626751 506832 nobody 22140 0.0 S 06:26 /usr/sbin/httpd -k start 3627499 506832 nobody 22052 0.1 S 05:17 /usr/sbin/httpd -k start 3643407 506832 nobody 22048 0.0 S 01:42 /usr/sbin/httpd -k start 3627768 506832 nobody 22024 0.0 S 04:55 /usr/sbin/httpd -k start 3626323 506832 nobody 21660 0.0 S 07:23 /usr/sbin/httpd -k start 3642514 506832 nobody 21320 0.1 S 03:19 /usr/sbin/httpd -k start 1463 1 root 21240 0.0 Ss 61-02:43:58 tailwatchd 3643453 506832 nobody 20896 0.0 S 01:40 /usr/sbin/httpd -k start 3627804 506832 nobody 20724 0.0 S 04:54 /usr/sbin/httpd -k start 3643956 506832 nobody 20612 0.0 S 00:44 /usr/sbin/httpd -k start 3643408 506832 nobody 20340 0.0 S 01:42 /usr/sbin/httpd -k start 3644590 506832 nobody 19460 0.1 S 00:13 /usr/sbin/httpd -k start 3643948 506832 nobody 19404 0.0 S 00:45 /usr/sbin/httpd -k start 3644809 506832 nobody 19252 0.6 S 00:03 /usr/sbin/httpd -k start 3644607 506832 nobody 19224 0.1 S 00:12 /usr/sbin/httpd -k start 3644779 506832 nobody 19216 0.2 S 00:04 /usr/sbin/httpd -k start 3644785 506832 nobody 19216 0.2 S 00:04 /usr/sbin/httpd -k start 3644782 506832 nobody 19196 0.2 S 00:04 /usr/sbin/httpd -k start 3644781 506832 nobody 19192 0.2 S 00:04 /usr/sbin/httpd -k start 3644783 506832 nobody 19124 0.2 S 00:04 /usr/sbin/httpd -k start 3643896 506832 nobody 18960 0.0 S 00:49 /usr/sbin/httpd -k start 3643438 506832 nobody 18864 0.1 S 01:41 /usr/sbin/httpd -k start 3643497 506832 nobody 18812 0.0 S 01:39 /usr/sbin/httpd -k start 3643450 506832 nobody 18756 0.0 S 01:40 /usr/sbin/httpd -k start 3643486 506832 nobody 18548 0.0 S 01:39 /usr/sbin/httpd -k start 3643446 506832 nobody 18160 0.0 S 01:40 /usr/sbin/httpd -k start 3643955 506832 nobody 17964 0.1 S 00:44 /usr/sbin/httpd -k start 3644591 506832 nobody 17896 0.1 S 00:13 /usr/sbin/httpd -k start 3644800 506832 nobody 17844 0.3 S 00:03 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3998307 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min aaa/aaadownunder.com.au-ssl_log 365 speedlin/speedlinefencing.com.au-ssl_log 211 coscom/coscom.com.au 133 aaa/aaadownunder.com.au 111 olympic/olympicfencing.com.au-ssl_log 109 kamcool/kamcool.com.au-ssl_log 75 evolution/my.evolutionerp.com.au-ssl_log 74 tubesupplies/tubesupplies.com.au-ssl_log 48 olympic/olympicfencing.com.au 43 nrg/nrgservices.net.au-ssl_log 41 lowrange/lowrange.com.au-ssl_log 40 madalice/madalice.com.au-ssl_log 25 otterfencing/otterfencing.com.au-ssl_log 25 evolution/portal.evolutionerp.com.au-ssl_log 24 corpkicks/corporatekicks.com.au-ssl_log 12 (total vhosts taking traffic: 22) --- top client IPs across all vhosts (last 3 min) --- 281 4.204.200.136 261 3.238.139.70 211 103.215.75.19 178 20.48.250.41 75 93.123.109.163 74 175.36.227.212 48 20.104.68.135 41 20.63.81.20 40 158.23.184.117 28 136.107.101.181 25 143.244.57.120 24 203.54.180.238 18 136.108.89.82 12 118.127.40.55 4 130.211.61.255 --- top request paths across all vhosts (last 3 min) --- 42 POST /wp/ 28 POST /wp/index.php 24 GET /heartbeat.php 21 POST /wordpress/ 15 GET / 14 POST /wp/wp-json/Batch/v1 14 POST /wp/wp-json/batch/v1 14 POST /functions.php 14 GET /app/ajax.php 13 POST /wp/wp-json/batch/v1/ 13 POST /wp//wp-json/batch/v1 13 POST /wp/wordpress/wp-json/batch/v1 13 POST /wp/blog/wp-json/batch/v1 13 POST /wordpress/index.php 11 POST /wp-cron.php 11 GET /index.php 10 POST /plugins/csvexporter/plugin.php 9 GET /wordpress/ 8 GET /wp/ 8 GET /goods.php --- busiest 3 vhosts: top paths + last 10 requests --- == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 4 POST / 2 GET /wp-content/plugins/fix/up.php 2 GET / 1 POST /wp-cron.php 1 GET /zu.php 1 GET /zoo.php 1 GET /zend/.env 1 GET /yii/.env 1 GET /xs.php 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /ww.php -- last 10 requests -- 3.238.139.70 - - [29/Aug/2026:12:53:32 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 3.238.139.70 - - [29/Aug/2026:12:53:32 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 20.48.250.41 - - [29/Aug/2026:12:53:32 +1000] "GET /baixy.php HTTP/1.1" 404 - "-" "-" 20.48.250.41 - - [29/Aug/2026:12:53:32 +1000] "GET /ava.php HTTP/1.1" 404 - "-" "-" 20.48.250.41 - - [29/Aug/2026:12:53:33 +1000] "GET /gdn.php HTTP/1.1" 404 - "-" "-" 143.244.57.120 - - [29/Aug/2026:12:53:33 +1000] "GET /wp-includes/sodium_compat/src/Core32/HSalsa20.php HTTP/1.1" 500 - "-" "-" 20.48.250.41 - - [29/Aug/2026:12:53:33 +1000] "GET /f2.php HTTP/1.1" 404 - "-" "-" 20.48.250.41 - - [29/Aug/2026:12:53:33 +1000] "GET /grsiuk.php HTTP/1.1" 404 - "-" "-" 20.48.250.41 - - [29/Aug/2026:12:53:34 +1000] "GET /wp-scr1pts.php HTTP/1.1" 404 - "-" "-" 20.48.250.41 - - [29/Aug/2026:12:53:34 +1000] "GET /num.php HTTP/1.1" 404 - "-" "-" == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 21 POST /wp/ 21 POST /wordpress/ 14 POST /wp/index.php 13 POST /wordpress/index.php 9 GET /wordpress/ 8 GET /wp/ 7 POST /wp/wp-json/Batch/v1 7 POST /wp/wp-json/batch/v1/ 7 POST /wp/wp-json/batch/v1 7 POST /wp//wp-json/batch/v1 7 POST /wp/wordpress/wp-json/batch/v1 7 POST /wp/blog/wp-json/batch/v1 -- last 10 requests -- 103.215.75.19 - - [29/Aug/2026:12:53:32 +1000] "POST /blog/index.php?rest_route=%2Fbatch%2Fv1 HTTP/1.1" 401 53 "https://cpcontacts.speedlinefencing.com.au/blog/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 103.215.75.19 - - [29/Aug/2026:12:53:32 +1000] "POST /blog/?rest_route=%2Fbatch%2Fv1 HTTP/1.1" 401 53 "https://cpcontacts.speedlinefencing.com.au/blog/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 103.215.75.19 - - [29/Aug/2026:12:53:32 +1000] "POST /blog/?rest_route=/batch%2Fv1 HTTP/1.1" 401 53 "https://cpcontacts.speedlinefencing.com.au/blog/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 103.215.75.19 - - [29/Aug/2026:12:53:33 +1000] "POST /blog/?rest_route=/batch/v1 HTTP/1.1" 401 53 "https://cpcontacts.speedlinefencing.com.au/blog/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 103.215.75.19 - - [29/Aug/2026:12:53:33 +1000] "POST /blog/wp-json/batch/v1 HTTP/1.1" 401 53 "https://cpcontacts.speedlinefencing.com.au/blog/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM 103.215.75.19 - - [29/Aug/2026:12:53:33 +1000] "POST /blog/wp-json/Batch/v1 HTTP/1.1" 401 53 "https://cpcontacts.speedlinefencing.com.au/blog/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM 103.215.75.19 - - [29/Aug/2026:12:53:33 +1000] "POST /blog//wp-json/batch/v1 HTTP/1.1" 401 53 "https://cpcontacts.speedlinefencing.com.au/blog/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT 103.215.75.19 - - [29/Aug/2026:12:53:34 +1000] "POST /blog/wp-json/batch/v1/ HTTP/1.1" 401 53 "https://cpcontacts.speedlinefencing.com.au/blog/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT 103.215.75.19 - - [29/Aug/2026:12:53:35 +1000] "POST /blog/blog/wp-json/batch/v1 HTTP/1.1" 401 53 "https://cpcontacts.speedlinefencing.com.au/blog/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 103.215.75.19 - - [29/Aug/2026:12:53:35 +1000] "POST /blog/wordpress/wp-json/batch/v1 HTTP/1.1" 401 53 "https://cpcontacts.speedlinefencing.com.au/blog/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 == coscom/coscom.com.au == -- top paths -- 2 GET /wp-conffg.php 1 GET /zi.php 1 GET /yj.php 1 GET /xr.php 1 GET /xmini4.php 1 GET /xl2023.php 1 GET /xcc.php 1 GET /wp_xiPu52Ut.php 1 GET /wp-ws68.php 1 GET /wp-validate.php 1 GET /wp-tymanage.php 1 GET /wp-theme.php -- last 10 requests -- 4.204.200.136 - - [29/Aug/2026:12:53:39 +1000] "GET /AxAo.php HTTP/1.1" 404 - "-" "-" 4.204.200.136 - - [29/Aug/2026:12:53:39 +1000] "GET /class17.php HTTP/1.1" 404 - "-" "-" 4.204.200.136 - - [29/Aug/2026:12:53:39 +1000] "GET /okxoby.php HTTP/1.1" 404 - "-" "-" 4.204.200.136 - - [29/Aug/2026:12:53:39 +1000] "GET /esuutzzx.php HTTP/1.1" 404 - "-" "-" 4.204.200.136 - - [29/Aug/2026:12:53:39 +1000] "GET /replace.php HTTP/1.1" 404 - "-" "-" 4.204.200.136 - - [29/Aug/2026:12:53:40 +1000] "GET /gulu.php HTTP/1.1" 404 - "-" "-" 4.204.200.136 - - [29/Aug/2026:12:53:40 +1000] "GET /gtghklk.php HTTP/1.1" 404 - "-" "-" 4.204.200.136 - - [29/Aug/2026:12:53:40 +1000] "GET /comand.php HTTP/1.1" 404 - "-" "-" 4.204.200.136 - - [29/Aug/2026:12:53:40 +1000] "GET /wp_motu_myk3v.php HTTP/1.1" 404 - "-" "-" 4.204.200.136 - - [29/Aug/2026:12:53:40 +1000] "GET /wp_motu_ypdat.php HTTP/1.1" 404 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-29 12:51:27 L1=1.82 run=2 blk=0 avail=8161 (59.2%) swpO=0 conn=3 myRSS=2713 php=6 phpRSS=560 ap=25 tcp=33 topuser=madalice 2026-08-29 12:51:29 L1=1.82 run=2 blk=0 avail=8229 (59.7%) swpO=0 conn=1 myRSS=2713 php=5 phpRSS=463 ap=25 tcp=32 topuser=madalice 2026-08-29 12:51:37 L1=1.85 run=2 blk=0 avail=8147 (59.1%) swpO=1 conn=3 myRSS=2713 php=6 phpRSS=562 ap=24 tcp=36 topuser=madalice 2026-08-29 12:51:39 L1=1.85 run=2 blk=0 avail=8365 (60.7%) swpO=1 conn=1 myRSS=2713 php=5 phpRSS=344 ap=24 tcp=37 topuser=madalice 2026-08-29 12:51:47 L1=1.73 run=4 blk=0 avail=8244 (59.8%) swpO=1 conn=4 myRSS=2713 php=5 phpRSS=471 ap=24 tcp=33 topuser=corpkicks 2026-08-29 12:51:49 L1=1.73 run=3 blk=0 avail=8352 (60.6%) swpO=1 conn=1 myRSS=2713 php=5 phpRSS=355 ap=24 tcp=32 topuser=madalice 2026-08-29 12:51:57 L1=1.62 run=3 blk=0 avail=8062 (58.5%) swpO=2 conn=4 myRSS=2713 php=7 phpRSS=719 ap=22 tcp=33 topuser=evolution 2026-08-29 12:51:59 L1=1.62 run=5 blk=0 avail=8183 (59.4%) swpO=2 conn=1 myRSS=2713 php=6 phpRSS=555 ap=22 tcp=32 topuser=madalice 2026-08-29 12:52:07 L1=1.45 run=3 blk=0 avail=8204 (59.5%) swpO=0 conn=4 myRSS=2713 php=6 phpRSS=514 ap=25 tcp=51 topuser=madalice 2026-08-29 12:52:09 L1=1.45 run=2 blk=0 avail=8310 (60.3%) swpO=0 conn=1 myRSS=2713 php=4 phpRSS=307 ap=37 tcp=55 topuser=madalice 2026-08-29 12:52:17 L1=1.30 run=2 blk=0 avail=8249 (59.9%) swpO=0 conn=4 myRSS=2713 php=4 phpRSS=280 ap=47 tcp=34 topuser=madalice 2026-08-29 12:52:19 L1=1.30 run=4 blk=0 avail=8247 (59.9%) swpO=0 conn=1 myRSS=2713 php=4 phpRSS=298 ap=45 tcp=32 topuser=madalice 2026-08-29 12:52:27 L1=1.26 run=2 blk=0 avail=8311 (60.3%) swpO=0 conn=4 myRSS=2713 php=4 phpRSS=298 ap=37 tcp=28 topuser=madalice 2026-08-29 12:52:29 L1=1.26 run=1 blk=0 avail=8393 (60.9%) swpO=0 conn=1 myRSS=2713 php=4 phpRSS=224 ap=35 tcp=28 topuser=madalice 2026-08-29 12:52:37 L1=1.14 run=4 blk=0 avail=8428 (61.2%) swpO=0 conn=4 myRSS=2713 php=4 phpRSS=247 ap=27 tcp=30 topuser=olympic 2026-08-29 12:52:39 L1=1.14 run=2 blk=0 avail=8439 (61.3%) swpO=0 conn=1 myRSS=2713 php=4 phpRSS=244 ap=25 tcp=31 topuser=madalice 2026-08-29 12:52:47 L1=1.05 run=4 blk=0 avail=8311 (60.3%) swpO=0 conn=2 myRSS=2713 php=5 phpRSS=422 ap=23 tcp=31 topuser=madalice 2026-08-29 12:52:49 L1=1.05 run=3 blk=0 avail=8406 (61.0%) swpO=0 conn=1 myRSS=2713 php=4 phpRSS=291 ap=23 tcp=30 topuser=madalice 2026-08-29 12:52:58 L1=1.20 run=3 blk=0 avail=8005 (58.1%) swpO=1 conn=2 myRSS=2713 php=6 phpRSS=748 ap=23 tcp=37 topuser=corpkicks 2026-08-29 12:52:59 L1=1.20 run=3 blk=0 avail=8234 (59.8%) swpO=1 conn=1 myRSS=2713 php=5 phpRSS=490 ap=23 tcp=37 topuser=corpkicks 2026-08-29 12:53:08 L1=1.18 run=4 blk=0 avail=8354 (60.6%) swpO=0 conn=2 myRSS=2713 php=4 phpRSS=290 ap=27 tcp=36 topuser=madalice 2026-08-29 12:53:09 L1=1.18 run=5 blk=0 avail=8286 (60.1%) swpO=0 conn=1 myRSS=2713 php=5 phpRSS=398 ap=27 tcp=39 topuser=madalice 2026-08-29 12:53:18 L1=1.60 run=6 blk=0 avail=8226 (59.7%) swpO=1 conn=2 myRSS=2713 php=5 phpRSS=421 ap=34 tcp=38 topuser=madalice 2026-08-29 12:53:19 L1=1.60 run=3 blk=0 avail=8256 (59.9%) swpO=1 conn=1 myRSS=2713 php=5 phpRSS=410 ap=33 tcp=37 topuser=madalice 2026-08-29 12:53:28 L1=1.82 run=4 blk=0 avail=8249 (59.9%) swpO=1 conn=2 myRSS=2713 php=5 phpRSS=408 ap=29 tcp=40 topuser=madalice 2026-08-29 12:53:29 L1=1.82 run=2 blk=0 avail=8333 (60.5%) swpO=1 conn=2 myRSS=2713 php=4 phpRSS=288 ap=29 tcp=40 topuser=madalice 2026-08-29 12:53:38 L1=2.40 run=7 blk=0 avail=7958 (57.8%) swpO=0 conn=2 myRSS=2713 php=9 phpRSS=787 ap=36 tcp=43 topuser=olympic 2026-08-29 12:53:39 L1=2.40 run=2 blk=0 avail=8332 (60.5%) swpO=0 conn=2 myRSS=2713 php=5 phpRSS=290 ap=36 tcp=44 topuser=madalice 2026-08-29 12:53:48 L1=3.53 run=18 blk=0 avail=6691 (48.6%) swpO=0 conn=13 myRSS=2713 php=14 phpRSS=1754 ap=69 tcp=81 topuser=madalice 2026-08-29 12:53:49 L1=3.53 run=19 blk=1 avail=6603 (47.9%) swpO=0 conn=11 myRSS=2713 php=13 phpRSS=2017 ap=69 tcp=78 topuser=madalice