INCIDENT 2026-08-29 14:59:07 trigger: php_rss=1559MB ================================================================== load: 0.59 0.77 1.03 2/656 4073264 ncpu:10 mem_avail: 7317MB/13777MB (53.1%) swap_used:1487MB swapout:0/s blocked(D):0 running:2 iowait:0.0% steal:0.0% php: 12 procs / 1559MB heaviest user: madalice (10 procs, 1517MB) apache: 23 procs tcp_estab: 25 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2736 madalice 10 1520 root 250 1058 nobody 22 387 netdata 7 202 mailman 20 190 cpanellogin 1 64 dovenull 6 54 wp-toolkit 3 43 lowrange 2 28 evolution 7 27 zabbix 1 24 dovecot 3 22 named 1 16 vinesit 1 14 infinium 1 14 corpkicks 1 14 kurri 1 13 candyfabcom 1 13 mailnull 1 8 --- php workers by user --- USER PROCS RSS_MB madalice 10 1520 root 1 27 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4253 MB Active(file): 4122 MB Inactive(file): 679 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 536 MB CommitLimit: 10984 MB Committed_AS: 8053 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-12:40:27 7112 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2802296 9.5 Ssl 1-12:39:56 /usr/sbin/mariadbd 4072810 510022 madalice 251536 10.1 S 00:45 php-fpm: pool madalice_com_au 1502903 1451906 root 192752 0.0 S 12:22:45 spamd child 508924 1 netdata 182012 2.0 Ssl 1-12:39:25 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 4072562 510022 madalice 160892 13.6 S 01:06 php-fpm: pool madalice_com_au 4072560 510022 madalice 160844 13.5 S 01:06 php-fpm: pool madalice_com_au 4072807 510022 madalice 160316 10.7 S 00:46 php-fpm: pool madalice_com_au 1502904 1451906 root 160168 0.0 S 12:22:45 spamd child 4072809 510022 madalice 159928 10.8 S 00:45 php-fpm: pool madalice_com_au 4072561 510022 madalice 159816 11.6 S 01:06 php-fpm: pool madalice_com_au 1451906 1 root 131596 0.0 Ss 12:36:00 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4073174 510022 madalice 127432 13.8 S 00:09 php-fpm: pool madalice_com_au 4073173 510022 madalice 127416 15.0 S 00:09 php-fpm: pool madalice_com_au 4073171 510022 madalice 125388 14.8 S 00:09 php-fpm: pool madalice_com_au 4073172 510022 madalice 125328 13.5 S 00:09 php-fpm: pool madalice_com_au 509266 1 root 102532 0.0 Ss 1-12:39:22 /usr/lib/systemd/systemd-journald 3899599 1353308 cpanellogin 65796 0.0 S 53:43 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 509236 509098 root 64260 0.0 Sl 1-12:39:22 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42324 0.1 Ss 38-12:17:48 cpsrvd (SSL) - waiting for connections 509640 508992 root 36824 0.0 Sl 1-12:39:20 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 33336 0.0 Ss 12:36:53 lfd - sleeping 510022 1 root 28324 0.0 Ss 1-12:39:18 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 25652 0.0 Ss 1-10:46:59 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 483898 1 zabbix 25360 0.2 Ssl 1-12:40:39 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 4054025 506832 nobody 23840 0.0 S 08:41 /usr/sbin/httpd -k start 4071072 506832 nobody 22892 0.0 S 02:53 /usr/sbin/httpd -k start 4062137 506832 nobody 22844 0.0 S 04:02 /usr/sbin/httpd -k start 4055869 506832 nobody 22824 0.1 S 05:16 /usr/sbin/httpd -k start 1469 1 root 22388 0.1 Ss 61-04:49:17 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4071081 506832 nobody 22324 0.0 S 02:53 /usr/sbin/httpd -k start 4067269 506832 nobody 22164 0.1 S 03:59 /usr/sbin/httpd -k start 4071008 506832 nobody 21912 0.0 S 02:55 /usr/sbin/httpd -k start 4071801 506832 nobody 21868 0.0 S 01:58 /usr/sbin/httpd -k start 1463 1 root 21388 0.0 Ss 61-04:49:17 tailwatchd 4071083 506832 nobody 21044 0.1 S 02:53 /usr/sbin/httpd -k start 4072875 506832 nobody 20280 0.0 S 00:40 /usr/sbin/httpd -k start 4072874 506832 nobody 20084 0.0 S 00:40 /usr/sbin/httpd -k start 4072828 506832 nobody 20036 0.0 S 00:42 /usr/sbin/httpd -k start 4072832 506832 nobody 20036 0.0 S 00:41 /usr/sbin/httpd -k start 4072835 506832 nobody 18464 0.0 S 00:41 /usr/sbin/httpd -k start 4072871 506832 nobody 18344 0.0 S 00:40 /usr/sbin/httpd -k start 4072872 506832 nobody 18184 0.0 S 00:40 /usr/sbin/httpd -k start 4072838 506832 nobody 17472 0.0 S 00:41 /usr/sbin/httpd -k start 508634 1 named 17308 0.0 Ssl 1-12:39:30 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 509671 508992 netdata 17032 2.1 Sl 1-12:39:20 /usr/libexec/netdata/plugins.d/apps.plugin 1 4073201 506832 nobody 16812 0.0 S 00:07 /usr/sbin/httpd -k start 4073198 506832 nobody 16364 0.0 S 00:08 /usr/sbin/httpd -k start 938585 1 wp-toolkit 16232 0.0 Ss 1-10:46:59 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2766563 1471 root 16228 0.0 S 06:21:19 cPhulkd - dbprocessor 4073096 1471 root 16076 0.0 S 00:13 cPhulkd - processor - http socket 1471 1 root 16036 0.0 Ss 61-04:49:17 cPhulkd - processor 4055159 508511 lowrange 14640 0.0 S 06:24 dovecot/imap 4020979 508511 infinium 14612 0.0 S 16:26 dovecot/imap 4073233 508511 vinesit 14604 0.0 S 00:04 dovecot/imap 4072581 508511 lowrange 14568 0.0 S 01:04 dovecot/imap 4073199 508511 corpkicks 14568 0.0 S 00:07 dovecot/imap 481558 1 root 14480 0.1 Ssl 1-12:41:49 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 4180059 4180015 evolution 14244 0.0 Ss 1-14:59:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 3883280 508511 kurri 13844 0.0 S 57:17 dovecot/imap 4073023 508511 candyfabcom 13352 0.0 S 00:14 dovecot/quota-status -p postfix --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4062023 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min lowrange/lowrange.com.au-ssl_log 159 olytis/tis.com.au-ssl_log 135 bigdeals/bigdeals.com.au-ssl_log 62 olympic/olympicfencing.com.au-ssl_log 57 evolution/portal.evolutionerp.com.au-ssl_log 22 madalice/madalice.com.au-ssl_log 22 evolution/evolutionerp.com.au-ssl_log 15 infinium/infinium.net.au-ssl_log 13 alison/alisonarts.com.au-ssl_log 3 aaa/aaadownunder.com.au-ssl_log 1 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 159 20.100.175.163 135 20.63.81.20 62 20.220.10.235 57 158.23.184.117 22 203.54.180.238 15 91.215.85.88 14 3.144.206.117 2 66.96.183.227 2 51.68.111.202 2 50.6.137.53 2 192.250.232.93 2 160.250.130.168 2 160.153.252.100 2 118.127.40.55 2 114.119.159.70 --- top request paths across all vhosts (last 3 min) --- 22 GET /heartbeat.php 7 GET /wp-login.php 5 GET /store/lover-custom-nike-dunks/ 5 GET / 4 POST /wp-login.php 3 GET /wp-json/wp/v2/users/me 3 GET /wp-admin/css/colors/modern/ 2 POST /wp-cron.php 2 GET /xmlrpc.php 2 GET /wp-trackback.php 2 GET /wp-mail.php 2 GET /wp-includes/Text/Diff/ 2 GET /wp-includes/ID3/ 2 GET /wp-cron.php 2 GET /wp-conffg.php 2 GET /wp-admin/maint/ 2 GET /wp-admin/includes/ 2 GET /wp-admin/css/colors/sunrise/ 2 GET /wp-admin/css/colors/ocean/ 2 GET /wp-admin/css/colors/midnight/ --- busiest 3 vhosts: top paths + last 10 requests --- == lowrange/lowrange.com.au-ssl_log == -- top paths -- 2 GET /222.php 1 GET /zoom1.php 1 GET /yanz.php 1 GET /xxx.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-themes.php 1 GET /wp-mail.php 1 GET /wp-logs.php -- last 10 requests -- 20.100.175.163 - - [29/Aug/2026:14:58:05 +1000] "GET /m.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:14:58:06 +1000] "GET /wp-admin/css/wp-login.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:14:58:06 +1000] "GET /222.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:14:58:06 +1000] "GET /mini.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:14:58:06 +1000] "GET /aa.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:14:58:07 +1000] "GET /c.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:14:58:07 +1000] "GET /f.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:14:58:07 +1000] "GET /av.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:14:58:08 +1000] "GET /file.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:14:58:08 +1000] "GET /wp-includes/customize/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 == olytis/tis.com.au-ssl_log == -- top paths -- 2 GET /wp-conffg.php 1 GET /zi.php 1 GET /yj.php 1 GET /xr.php 1 GET /xmini4.php 1 GET /xl2023.php 1 GET /xcc.php 1 GET /wp_xiPu52Ut.php 1 GET /wp-ws68.php 1 GET /wp-validate.php 1 GET /wp-tymanage.php 1 GET /wp-theme.php -- last 10 requests -- 20.63.81.20 - - [29/Aug/2026:14:58:18 +1000] "GET /gulu.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [29/Aug/2026:14:58:18 +1000] "GET /gtghklk.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [29/Aug/2026:14:58:19 +1000] "GET /comand.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [29/Aug/2026:14:58:19 +1000] "GET /wp_motu_myk3v.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [29/Aug/2026:14:58:20 +1000] "GET /wp_motu_ypdat.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [29/Aug/2026:14:58:20 +1000] "GET /edit.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [29/Aug/2026:14:58:21 +1000] "GET /tqkdqbbv.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [29/Aug/2026:14:58:21 +1000] "GET /kjyehoxl.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [29/Aug/2026:14:58:21 +1000] "GET /llyuxaqd.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [29/Aug/2026:14:58:22 +1000] "GET /nbwxolou.php HTTP/1.1" 401 36 "-" "-" == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 1 GET /ztv.php 1 GET /zoz.php 1 GET /Zeiss.php 1 GET /zafir1.php 1 GET /X7T6.php 1 GET /x23.php 1 GET /ww3.php 1 GET /ww2.php 1 GET /wsz.php 1 GET /ws66.php 1 GET /wp-wlx.php 1 GET /wp-gzone.php -- last 10 requests -- 20.220.10.235 - - [29/Aug/2026:14:57:23 +1000] "GET /str.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:14:57:23 +1000] "GET /mega.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:14:57:23 +1000] "GET /ww3.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:14:57:24 +1000] "GET /sko.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:14:57:24 +1000] "GET /zoz.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:14:57:25 +1000] "GET /mmm.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:14:57:25 +1000] "GET /advanced.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:14:57:26 +1000] "GET /blox.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:14:57:26 +1000] "GET /kcs.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:14:57:26 +1000] "GET /wsz.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-29 14:56:38 L1=0.93 run=1 blk=0 avail=8456 (61.4%) swpO=0 conn=3 myRSS=2734 php=3 phpRSS=199 ap=26 tcp=28 topuser=madalice 2026-08-29 14:56:47 L1=0.86 run=3 blk=0 avail=8522 (61.9%) swpO=0 conn=3 myRSS=2736 php=3 phpRSS=199 ap=18 tcp=27 topuser=madalice 2026-08-29 14:56:48 L1=0.87 run=2 blk=0 avail=8329 (60.5%) swpO=0 conn=3 myRSS=2736 php=4 phpRSS=420 ap=18 tcp=30 topuser=corpkicks 2026-08-29 14:56:57 L1=0.80 run=3 blk=0 avail=8544 (62.0%) swpO=0 conn=3 myRSS=2736 php=3 phpRSS=173 ap=18 tcp=26 topuser=madalice 2026-08-29 14:56:58 L1=0.74 run=1 blk=0 avail=8544 (62.0%) swpO=0 conn=3 myRSS=2736 php=3 phpRSS=173 ap=18 tcp=26 topuser=madalice 2026-08-29 14:57:07 L1=0.68 run=2 blk=0 avail=8508 (61.8%) swpO=0 conn=3 myRSS=2736 php=4 phpRSS=254 ap=17 tcp=25 topuser=madalice 2026-08-29 14:57:08 L1=0.79 run=4 blk=0 avail=8317 (60.4%) swpO=0 conn=2 myRSS=2736 php=4 phpRSS=443 ap=17 tcp=26 topuser=corpkicks 2026-08-29 14:57:17 L1=0.80 run=2 blk=0 avail=8606 (62.5%) swpO=0 conn=3 myRSS=2736 php=3 phpRSS=124 ap=18 tcp=25 topuser=alison 2026-08-29 14:57:18 L1=0.82 run=3 blk=0 avail=8601 (62.4%) swpO=0 conn=2 myRSS=2736 php=3 phpRSS=121 ap=18 tcp=25 topuser=madalice 2026-08-29 14:57:27 L1=0.83 run=3 blk=0 avail=8354 (60.6%) swpO=0 conn=3 myRSS=2736 php=5 phpRSS=409 ap=19 tcp=30 topuser=infinium 2026-08-29 14:57:28 L1=0.93 run=2 blk=0 avail=8537 (62.0%) swpO=0 conn=2 myRSS=2736 php=4 phpRSS=200 ap=19 tcp=29 topuser=madalice 2026-08-29 14:57:37 L1=0.85 run=1 blk=0 avail=8538 (62.0%) swpO=0 conn=3 myRSS=2736 php=3 phpRSS=173 ap=20 tcp=32 topuser=madalice 2026-08-29 14:57:38 L1=0.79 run=1 blk=0 avail=8534 (61.9%) swpO=0 conn=2 myRSS=2736 php=3 phpRSS=173 ap=20 tcp=28 topuser=madalice 2026-08-29 14:57:47 L1=0.72 run=5 blk=0 avail=8466 (61.4%) swpO=0 conn=3 myRSS=2736 php=4 phpRSS=297 ap=19 tcp=26 topuser=madalice 2026-08-29 14:57:48 L1=0.66 run=1 blk=0 avail=8553 (62.1%) swpO=0 conn=2 myRSS=2736 php=3 phpRSS=173 ap=19 tcp=27 topuser=madalice 2026-08-29 14:57:57 L1=0.61 run=1 blk=0 avail=8547 (62.0%) swpO=0 conn=3 myRSS=2736 php=3 phpRSS=173 ap=19 tcp=27 topuser=madalice 2026-08-29 14:57:58 L1=0.64 run=2 blk=0 avail=8548 (62.0%) swpO=0 conn=2 myRSS=2736 php=3 phpRSS=173 ap=19 tcp=28 topuser=madalice 2026-08-29 14:58:07 L1=0.67 run=2 blk=0 avail=8137 (59.1%) swpO=0 conn=3 myRSS=2736 php=6 phpRSS=646 ap=18 tcp=29 topuser=madalice 2026-08-29 14:58:09 L1=0.70 run=1 blk=0 avail=8046 (58.4%) swpO=0 conn=2 myRSS=2736 php=7 phpRSS=764 ap=18 tcp=29 topuser=madalice 2026-08-29 14:58:17 L1=0.88 run=2 blk=0 avail=8066 (58.6%) swpO=0 conn=3 myRSS=2736 php=7 phpRSS=744 ap=18 tcp=26 topuser=madalice 2026-08-29 14:58:19 L1=0.81 run=1 blk=0 avail=8123 (59.0%) swpO=0 conn=2 myRSS=2736 php=6 phpRSS=661 ap=18 tcp=25 topuser=madalice 2026-08-29 14:58:27 L1=0.83 run=1 blk=0 avail=7628 (55.4%) swpO=0 conn=1 myRSS=2736 php=9 phpRSS=1131 ap=32 tcp=38 topuser=madalice 2026-08-29 14:58:29 L1=0.76 run=2 blk=0 avail=7528 (54.6%) swpO=0 conn=2 myRSS=2736 php=9 phpRSS=1134 ap=48 tcp=43 topuser=madalice 2026-08-29 14:58:37 L1=0.78 run=2 blk=0 avail=7519 (54.6%) swpO=0 conn=1 myRSS=2736 php=9 phpRSS=1165 ap=43 tcp=24 topuser=madalice 2026-08-29 14:58:39 L1=0.80 run=3 blk=0 avail=7429 (53.9%) swpO=0 conn=2 myRSS=2736 php=11 phpRSS=1327 ap=41 tcp=26 topuser=madalice 2026-08-29 14:58:47 L1=0.73 run=1 blk=0 avail=7616 (55.3%) swpO=0 conn=1 myRSS=2736 php=8 phpRSS=975 ap=33 tcp=22 topuser=madalice 2026-08-29 14:58:49 L1=0.75 run=2 blk=0 avail=7741 (56.2%) swpO=0 conn=2 myRSS=2736 php=8 phpRSS=1001 ap=31 tcp=23 topuser=madalice 2026-08-29 14:58:57 L1=0.69 run=1 blk=0 avail=7820 (56.8%) swpO=0 conn=1 myRSS=2736 php=8 phpRSS=976 ap=23 tcp=25 topuser=madalice 2026-08-29 14:58:59 L1=0.64 run=13 blk=0 avail=7566 (54.9%) swpO=0 conn=2 myRSS=2736 php=12 phpRSS=1358 ap=21 tcp=36 topuser=madalice 2026-08-29 14:59:07 L1=0.59 run=2 blk=0 avail=7317 (53.1%) swpO=0 conn=2 myRSS=2736 php=12 phpRSS=1559 ap=23 tcp=25 topuser=madalice