INCIDENT 2026-08-29 14:11:05 trigger: php_rss=1750MB ================================================================== load: 1.54 1.49 1.41 5/667 3916633 ncpu:10 mem_avail: 7285MB/13777MB (52.9%) swap_used:1499MB swapout:0/s blocked(D):0 running:4 iowait:0.0% steal:0.0% php: 14 procs / 1750MB heaviest user: madalice (9 procs, 1384MB) apache: 25 procs tcp_estab: 41 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2652 madalice 9 1384 root 255 1092 nobody 24 414 netdata 7 196 mailman 20 190 evolution 8 157 alison 4 151 olympic 1 98 dovenull 6 54 mailnull 4 50 wp-toolkit 3 43 kurri 3 42 zabbix 1 23 dovecot 3 22 vinesit 1 14 named 1 14 lowrange 1 14 corpkicks 1 14 cpanellogin 1 13 --- php workers by user --- USER PROCS RSS_MB madalice 9 1384 evolution 2 146 olympic 1 98 root 1 27 alison 1 23 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4186 MB Active(file): 3861 MB Inactive(file): 810 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 534 MB CommitLimit: 10984 MB Committed_AS: 8281 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-11:52:25 7112 /usr/bin/imunify-agent-proxy 3867466 root 11:04 1228 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2715900 9.6 Ssl 1-11:51:54 /usr/sbin/mariadbd 1502903 1451906 root 192876 0.0 S 11:34:43 spamd child 508924 1 netdata 175508 2.0 Ssl 1-11:51:23 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3901642 510022 madalice 163264 8.7 S 02:35 php-fpm: pool madalice_com_au 3901643 510022 madalice 160328 8.1 S 02:35 php-fpm: pool madalice_com_au 1502904 1451906 root 160228 0.0 S 11:34:43 spamd child 3902259 510022 madalice 160224 4.7 S 01:18 php-fpm: pool madalice_com_au 3902257 510022 madalice 159908 7.2 S 01:18 php-fpm: pool madalice_com_au 3902258 510022 madalice 159128 6.2 S 01:18 php-fpm: pool madalice_com_au 3902261 510022 madalice 156520 7.5 S 01:17 php-fpm: pool madalice_com_au 3916396 510022 madalice 154420 9.6 S 00:26 php-fpm: pool madalice_com_au 3916395 510022 madalice 152152 9.7 S 00:26 php-fpm: pool madalice_com_au 3916398 510022 madalice 152068 9.3 S 00:26 php-fpm: pool madalice_com_au 3916604 3916565 evolution 145916 53.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1451906 1 root 131876 0.0 Ss 11:47:58 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3916603 3916566 olympic 104520 72.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509266 1 root 101384 0.0 Ss 1-11:51:20 /usr/lib/systemd/systemd-journald 509236 509098 root 63144 0.0 Sl 1-11:51:20 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41964 0.1 Ss 38-11:29:46 cpsrvd (SSL) - waiting for connections 509640 508992 root 36296 0.0 Sl 1-11:51:18 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 33320 0.0 Ss 11:48:51 lfd - sleeping 510022 1 root 28324 0.0 Ss 1-11:51:16 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 25652 0.0 Ss 1-09:58:57 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 483898 1 zabbix 23656 0.2 Ssl 1-11:52:37 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3901915 3885323 root 23348 0.0 S 02:02 /usr/sbin/exim -q 1469 1 root 22388 0.1 Ss 61-04:01:15 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3899930 506832 nobody 21812 0.0 S 05:12 /usr/sbin/httpd -k start 1463 1 root 21368 0.0 Ss 61-04:01:15 tailwatchd 3902252 506832 nobody 20964 0.0 S 01:18 /usr/sbin/httpd -k start 3902254 506832 nobody 20768 0.0 S 01:18 /usr/sbin/httpd -k start 3901576 506832 nobody 20632 0.0 S 02:40 /usr/sbin/httpd -k start 3901604 506832 nobody 20616 0.0 S 02:37 /usr/sbin/httpd -k start 3916241 506832 nobody 20472 0.0 S 00:49 /usr/sbin/httpd -k start 3901917 3901915 mailnull 20404 0.0 S 02:02 /usr/sbin/exim -q 3902174 506832 nobody 20236 0.0 S 01:22 /usr/sbin/httpd -k start 3916173 506832 nobody 20008 0.1 S 00:52 /usr/sbin/httpd -k start 3902238 506832 nobody 19824 0.0 S 01:19 /usr/sbin/httpd -k start 3916235 506832 nobody 19580 0.0 S 00:50 /usr/sbin/httpd -k start 3916242 506832 nobody 19456 0.0 S 00:49 /usr/sbin/httpd -k start 3916565 506832 nobody 19308 0.5 S 00:04 /usr/sbin/httpd -k start 3916239 506832 nobody 19300 0.0 S 00:49 /usr/sbin/httpd -k start 3902247 506832 nobody 19244 0.0 S 01:18 /usr/sbin/httpd -k start 3902249 506832 nobody 19144 0.0 S 01:18 /usr/sbin/httpd -k start 3916237 506832 nobody 18848 0.0 S 00:49 /usr/sbin/httpd -k start 3902231 506832 nobody 18528 0.0 S 01:19 /usr/sbin/httpd -k start 3916538 506832 nobody 17908 0.2 S 00:05 /usr/sbin/httpd -k start 3916566 506832 nobody 17260 0.2 S 00:04 /usr/sbin/httpd -k start 3916572 506832 nobody 17152 0.5 S 00:02 /usr/sbin/httpd -k start 509671 508992 netdata 17032 2.1 Sl 1-11:51:18 /usr/libexec/netdata/plugins.d/apps.plugin 1 938585 1 wp-toolkit 16232 0.0 Ss 1-09:58:57 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2766563 1471 root 16228 0.0 S 05:33:17 cPhulkd - dbprocessor 1471 1 root 16036 0.0 Ss 61-04:01:15 cPhulkd - processor 3884305 508511 kurri 15292 0.0 S 07:58 dovecot/imap 508634 1 named 15256 0.0 Ssl 1-11:51:28 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 3916533 1471 root 15048 0.1 S 00:07 cPhulkd - processor - http socket 3916410 508511 alison 14748 0.2 S 00:22 dovecot/imap 3916573 508511 vinesit 14720 0.0 S 00:02 dovecot/imap 3865928 508511 lowrange 14580 0.0 S 12:59 dovecot/imap 3884763 508511 kurri 14556 0.0 S 07:08 dovecot/imap 3916532 508511 corpkicks 14548 0.0 S 00:07 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4029086 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min lowrange/lowrange.com.au-ssl_log 159 alison/alisonarts.com.au-ssl_log 95 madalice/madalice.com.au-ssl_log 37 evolution/portal.evolutionerp.com.au-ssl_log 22 evolution/evolutionerp.com.au-ssl_log 21 evolution/evolutionerp.com.au 11 vinesit/vinesit.com.au 9 corpkicks/corporatekicks.com.au-ssl_log 8 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 159 74.248.24.12 78 161.118.192.206 29 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 22 203.54.180.238 20 213.35.106.249 18 118.127.40.55 9 169.58.234.141 8 192.241.143.75 5 34.84.207.182 2 114.119.143.104 1 91.92.243.239 1 83.99.206.93 1 34.196.51.17 1 216.26.229.253 1 209.50.171.238 --- top request paths across all vhosts (last 3 min) --- 53 GET /wp-admin/index.php 27 POST /wp-login.php 22 GET /heartbeat.php 14 POST /wp-admin/admin-ajax.php 11 POST / 6 GET /wp-includes/fonts/ 4 POST /wp-cron.php 4 GET /wp-json/wc-admin/options 4 GET /store/posty-af1/ 3 GET /wp-includes/css/dist/ 2 GET /wp-json/wc-analytics/products/reviews 2 GET /wp-json/wc-analytics/products/count-low-in-stock 2 GET /wp-json/wc-analytics/orders 2 GET /wp-json/wc-analytics/admin/notes 2 GET /wp-includes/PHPMailer/ 2 GET /wp-includes/images/ 2 GET /wp-includes/ID3/ 2 GET /wp-includes/fonts/class-wp-font-utils.php 2 GET /wp-includes/fonts/class-wp-font-library.php 2 GET /wp-includes/fonts/class-wp-font-face-resolver.php --- busiest 3 vhosts: top paths + last 10 requests --- == lowrange/lowrange.com.au-ssl_log == -- top paths -- 2 GET /222.php 1 GET /zoom1.php 1 GET /yanz.php 1 GET /xxx.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-themes.php 1 GET /wp-mail.php 1 GET /wp-logs.php -- last 10 requests -- 74.248.24.12 - - [29/Aug/2026:14:10:44 +1000] "GET /m.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [29/Aug/2026:14:10:44 +1000] "GET /wp-admin/css/wp-login.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [29/Aug/2026:14:10:44 +1000] "GET /222.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [29/Aug/2026:14:10:44 +1000] "GET /mini.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [29/Aug/2026:14:10:45 +1000] "GET /aa.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [29/Aug/2026:14:10:45 +1000] "GET /c.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [29/Aug/2026:14:10:45 +1000] "GET /f.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [29/Aug/2026:14:10:45 +1000] "GET /av.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [29/Aug/2026:14:10:46 +1000] "GET /file.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [29/Aug/2026:14:10:46 +1000] "GET /wp-includes/customize/index.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == alison/alisonarts.com.au-ssl_log == -- top paths -- 52 GET /wp-admin/index.php 27 POST /wp-login.php 11 POST / 2 GET /robots.txt 1 GET /tag/motorcycel/ 1 GET /tag/fine/ 1 GET /sociosqu-ad-litora-torquent/ -- last 10 requests -- 161.118.192.206 - - [29/Aug/2026:14:10:47 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 18948 "https://alisonarts.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chro 161.118.192.206 - - [29/Aug/2026:14:10:48 +1000] "POST /wp-login.php HTTP/1.1" 503 18035 "https://alisonarts.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/605.1.15 (KHTML, like Gecko) Versio 161.118.192.206 - - [29/Aug/2026:14:10:49 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 18948 "https://alisonarts.com.au/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4 118.127.40.55 - - [29/Aug/2026:14:10:50 +1000] "POST /?wordfence_syncAttackData=1787976650.56 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://alisonarts.com.au" 161.118.192.206 - - [29/Aug/2026:14:10:52 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 18948 "https://alisonarts.com.au/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4 161.118.192.206 - - [29/Aug/2026:14:10:54 +1000] "POST /wp-login.php HTTP/1.1" 503 18035 "https://alisonarts.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0.1" 161.118.192.206 - - [29/Aug/2026:14:10:55 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 18948 "https://alisonarts.com.au/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4 161.118.192.206 - - [29/Aug/2026:14:10:56 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 18948 "https://alisonarts.com.au/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4 161.118.192.206 - - [29/Aug/2026:14:10:58 +1000] "POST /wp-login.php HTTP/1.1" 503 18035 "https://alisonarts.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0" 161.118.192.206 - - [29/Aug/2026:14:10:59 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 18948 "https://alisonarts.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Geck == madalice/madalice.com.au-ssl_log == -- top paths -- 14 POST /wp-admin/admin-ajax.php 4 GET /wp-json/wc-admin/options 4 GET /store/posty-af1/ 2 GET /wp-json/wc-analytics/products/reviews 2 GET /wp-json/wc-analytics/products/count-low-in-stock 2 GET /wp-json/wc-analytics/orders 2 GET /wp-json/wc-analytics/admin/notes 2 GET /wp-admin/post.php 2 GET /wp-admin/admin-ajax.php 1 POST /wp-json/wc-push-notifications/send 1 GET /wp-admin/edit.php 1 GET /store/custom-rabbitohs-kids/ -- last 10 requests -- 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 - - [29/Aug/2026:14:10:39 +1000] "GET /wp-json/wc-admin/options?options=woocommerce_ces_tracks_queue&_locale=user HTTP/1.1" 200 39 "https://madalice.com.au/wp-admin/post.php?post=3 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 - - [29/Aug/2026:14:10:39 +1000] "GET /wp-json/wc-analytics/products/count-low-in-stock?status=publish&page=1&per_page=1&_locale=user HTTP/1.1" 200 17 "https://madalice.com.au/wp-a 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 - - [29/Aug/2026:14:10:39 +1000] "GET /wp-json/wc-analytics/orders?page=1&per_page=1&status%5B0%5D=processing&status%5B1%5D=on-hold&_fields%5B0%5D=id&_locale=user HTTP/1.1" 200 18 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 - - [29/Aug/2026:14:10:39 +1000] "GET /wp-json/wc-analytics/admin/notes?page=1&per_page=25&type=error%2Cupdate&status=unactioned&_locale=user HTTP/1.1" 200 6 "https://madalice.com. 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 - - [29/Aug/2026:14:10:40 +1000] "GET /wp-json/wc-admin/options?options=woocommerce_admin_transient_notices_queue%2Cwoocommerce_admin_install_timestamp&_locale=user HTTP/1.1" 200 7 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 - - [29/Aug/2026:14:10:39 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 77 "https://madalice.com.au/wp-admin/post.php?post=34670&action=edit" "Mozilla/5.0 (Windows NT 10.0; W 118.127.40.55 - - [29/Aug/2026:14:10:35 +1000] "POST /wp-admin/admin-ajax.php?action=as_async_request_queue_runner&nonce=7f15ebcfcf HTTP/1.1" 200 1 "-" "WordPress/7.1; https://madalice.com.au" 114.119.130.40 - - [29/Aug/2026:14:10:46 +1000] "GET /store/posty-af1/?amp%3Brating=2&wcpr_rating=5 HTTP/1.1" 404 36644 "https://madalice.com.au/store/posty-af1/?amp%3Brating=2&wcpr_rating=3" "Mozilla/5.0 (Linux; Android 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 - - [29/Aug/2026:14:10:49 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 77 "https://madalice.com.au/wp-admin/post.php?post=34670&action=edit" "Mozilla/5.0 (Windows NT 10.0; W 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 - - [29/Aug/2026:14:10:57 +1000] "GET /wp-admin/edit.php?post_type=shop_order HTTP/1.1" 200 123844 "https://madalice.com.au/wp-admin/post.php?post=34670&action=edit" "Mozilla/5.0 ( --- last 30 samples (run-up to this incident) --- 2026-08-29 14:08:43 L1=1.56 run=2 blk=0 avail=7626 (55.4%) swpO=0 conn=1 myRSS=2652 php=10 phpRSS=1029 ap=70 tcp=23 topuser=madalice 2026-08-29 14:08:44 L1=1.56 run=3 blk=0 avail=7552 (54.8%) swpO=0 conn=6 myRSS=2652 php=12 phpRSS=1169 ap=68 tcp=28 topuser=madalice 2026-08-29 14:08:53 L1=1.39 run=1 blk=0 avail=7615 (55.3%) swpO=0 conn=1 myRSS=2652 php=9 phpRSS=1073 ap=60 tcp=32 topuser=madalice 2026-08-29 14:08:54 L1=1.39 run=2 blk=0 avail=7844 (56.9%) swpO=0 conn=3 myRSS=2652 php=9 phpRSS=861 ap=58 tcp=35 topuser=madalice 2026-08-29 14:09:03 L1=1.34 run=3 blk=0 avail=7732 (56.1%) swpO=0 conn=1 myRSS=2652 php=8 phpRSS=869 ap=49 tcp=30 topuser=madalice 2026-08-29 14:09:04 L1=1.34 run=2 blk=0 avail=7888 (57.3%) swpO=0 conn=3 myRSS=2652 php=9 phpRSS=867 ap=48 tcp=32 topuser=madalice 2026-08-29 14:09:13 L1=1.29 run=2 blk=0 avail=8171 (59.3%) swpO=2 conn=2 myRSS=2652 php=6 phpRSS=585 ap=41 tcp=61 topuser=madalice 2026-08-29 14:09:14 L1=1.29 run=2 blk=0 avail=8153 (59.2%) swpO=2 conn=3 myRSS=2652 php=7 phpRSS=616 ap=43 tcp=64 topuser=madalice 2026-08-29 14:09:23 L1=1.17 run=2 blk=0 avail=8249 (59.9%) swpO=0 conn=2 myRSS=2652 php=5 phpRSS=506 ap=37 tcp=30 topuser=madalice 2026-08-29 14:09:24 L1=1.17 run=1 blk=0 avail=8252 (59.9%) swpO=0 conn=3 myRSS=2652 php=6 phpRSS=541 ap=36 tcp=33 topuser=madalice 2026-08-29 14:09:33 L1=1.14 run=4 blk=0 avail=8202 (59.5%) swpO=0 conn=2 myRSS=2652 php=6 phpRSS=654 ap=27 tcp=36 topuser=madalice 2026-08-29 14:09:34 L1=1.14 run=2 blk=0 avail=8210 (59.6%) swpO=0 conn=3 myRSS=2652 php=7 phpRSS=694 ap=26 tcp=38 topuser=madalice 2026-08-29 14:09:43 L1=1.12 run=2 blk=0 avail=8300 (60.2%) swpO=0 conn=2 myRSS=2652 php=6 phpRSS=598 ap=22 tcp=42 topuser=madalice 2026-08-29 14:09:44 L1=1.12 run=1 blk=0 avail=8334 (60.5%) swpO=0 conn=3 myRSS=2652 php=6 phpRSS=551 ap=24 tcp=49 topuser=madalice 2026-08-29 14:09:53 L1=1.56 run=4 blk=0 avail=7386 (53.6%) swpO=0 conn=2 myRSS=2652 php=13 phpRSS=1470 ap=51 tcp=38 topuser=madalice 2026-08-29 14:09:55 L1=1.56 run=1 blk=0 avail=7729 (56.1%) swpO=0 conn=1 myRSS=2652 php=10 phpRSS=1034 ap=50 tcp=28 topuser=madalice 2026-08-29 14:10:03 L1=1.40 run=3 blk=0 avail=7747 (56.2%) swpO=0 conn=2 myRSS=2652 php=10 phpRSS=1078 ap=41 tcp=26 topuser=madalice 2026-08-29 14:10:05 L1=1.40 run=3 blk=0 avail=7610 (55.2%) swpO=0 conn=1 myRSS=2652 php=11 phpRSS=1252 ap=40 tcp=29 topuser=madalice 2026-08-29 14:10:13 L1=1.41 run=1 blk=0 avail=7847 (57.0%) swpO=0 conn=1 myRSS=2652 php=9 phpRSS=1011 ap=33 tcp=50 topuser=madalice 2026-08-29 14:10:15 L1=1.41 run=2 blk=0 avail=7728 (56.1%) swpO=0 conn=1 myRSS=2652 php=12 phpRSS=1204 ap=35 tcp=55 topuser=madalice 2026-08-29 14:10:23 L1=1.67 run=3 blk=0 avail=7758 (56.3%) swpO=0 conn=1 myRSS=2652 php=10 phpRSS=1088 ap=41 tcp=32 topuser=madalice 2026-08-29 14:10:25 L1=1.67 run=3 blk=0 avail=7800 (56.6%) swpO=3 conn=1 myRSS=2652 php=9 phpRSS=1014 ap=40 tcp=35 topuser=madalice 2026-08-29 14:10:33 L1=1.64 run=5 blk=0 avail=7834 (56.9%) swpO=3 conn=1 myRSS=2652 php=12 phpRSS=1139 ap=31 tcp=35 topuser=madalice 2026-08-29 14:10:35 L1=1.64 run=2 blk=0 avail=7890 (57.3%) swpO=0 conn=1 myRSS=2652 php=8 phpRSS=988 ap=30 tcp=32 topuser=madalice 2026-08-29 14:10:43 L1=1.61 run=2 blk=0 avail=7563 (54.9%) swpO=0 conn=1 myRSS=2652 php=12 phpRSS=1391 ap=28 tcp=44 topuser=madalice 2026-08-29 14:10:45 L1=1.61 run=1 blk=0 avail=7577 (55.0%) swpO=0 conn=1 myRSS=2652 php=11 phpRSS=1350 ap=28 tcp=42 topuser=madalice 2026-08-29 14:10:53 L1=1.44 run=2 blk=0 avail=7551 (54.8%) swpO=0 conn=1 myRSS=2652 php=13 phpRSS=1488 ap=22 tcp=32 topuser=madalice 2026-08-29 14:10:55 L1=1.44 run=2 blk=0 avail=7621 (55.3%) swpO=0 conn=1 myRSS=2652 php=12 phpRSS=1400 ap=21 tcp=35 topuser=madalice 2026-08-29 14:11:03 L1=1.54 run=1 blk=0 avail=7518 (54.6%) swpO=0 conn=1 myRSS=2652 php=12 phpRSS=1465 ap=23 tcp=41 topuser=madalice 2026-08-29 14:11:05 L1=1.54 run=4 blk=0 avail=7285 (52.9%) swpO=0 conn=4 myRSS=2652 php=14 phpRSS=1750 ap=25 tcp=41 topuser=madalice