INCIDENT 2026-08-29 17:42:48 trigger: php_rss=1716MB ================================================================== load: 1.67 1.53 1.63 10/679 444836 ncpu:10 mem_avail: 6895MB/13777MB (50.0%) swap_used:1481MB swapout:4/s blocked(D):0 running:9 iowait:0.0% steal:0.0% php: 12 procs / 1716MB heaviest user: madalice (10 procs, 1675MB) apache: 52 procs tcp_estab: 63 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2816 madalice 10 1696 root 250 1060 nobody 51 904 netdata 7 195 mailman 20 190 cpanellogin 1 65 dovenull 6 56 wp-toolkit 3 43 kurri 3 42 evolution 7 27 zabbix 1 23 dovecot 3 22 named 1 16 mailnull 1 8 polkitd 1 6 nscd 1 5 cpanelconnecttrack 1 4 rpc 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 10 1701 root 1 27 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4637 MB Active(file): 4360 MB Inactive(file): 853 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 571 MB CommitLimit: 10984 MB Committed_AS: 8837 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-15:24:08 7112 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2883636 9.1 Ssl 1-15:23:37 /usr/sbin/mariadbd 444774 510022 madalice 251808 81.8 R 00:07 php-fpm: pool madalice_com_au 444775 510022 madalice 186688 77.4 R 00:07 php-fpm: pool madalice_com_au 508924 1 netdata 174700 1.9 Ssl 1-15:23:06 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83639 1451906 root 174116 0.0 S 01:45:14 spamd child 444715 510022 madalice 173872 71.0 R 00:11 php-fpm: pool madalice_com_au 444717 510022 madalice 173004 68.0 R 00:11 php-fpm: pool madalice_com_au 443616 510022 madalice 171936 18.0 R 02:04 php-fpm: pool madalice_com_au 443850 510022 madalice 170556 18.2 R 01:46 php-fpm: pool madalice_com_au 444784 510022 madalice 163756 83.6 R 00:05 php-fpm: pool madalice_com_au 444713 510022 madalice 162804 71.6 R 00:11 php-fpm: pool madalice_com_au 1502904 1451906 root 161100 0.0 S 15:06:26 spamd child 444718 510022 madalice 159772 69.0 S 00:11 php-fpm: pool madalice_com_au 444714 510022 madalice 159172 71.4 S 00:11 php-fpm: pool madalice_com_au 1451906 1 root 131780 0.0 Ss 15:19:41 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509266 1 root 111436 0.0 Ss 1-15:23:03 /usr/lib/systemd/systemd-journald 133529 1353308 cpanellogin 66624 0.0 S 01:31:06 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 509236 509098 root 63348 0.0 Sl 1-15:23:03 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42580 0.1 Ss 38-15:01:29 cpsrvd (SSL) - waiting for connections 509640 508992 root 38408 0.0 Sl 1-15:23:01 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 33384 0.0 Ss 15:20:34 lfd - sleeping 510022 1 root 28320 0.0 Ss 1-15:22:59 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 25652 0.0 Ss 1-13:30:40 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 410652 506832 nobody 23968 0.0 S 08:54 /usr/sbin/httpd -k start 429228 506832 nobody 23856 0.0 S 02:58 /usr/sbin/httpd -k start 483898 1 zabbix 23556 0.2 Ssl 1-15:24:20 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 429132 506832 nobody 23536 0.0 S 03:01 /usr/sbin/httpd -k start 429237 506832 nobody 23392 0.0 S 02:58 /usr/sbin/httpd -k start 1469 1 root 22488 0.1 Ss 61-07:32:58 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 429276 506832 nobody 22260 0.0 S 02:57 /usr/sbin/httpd -k start 429131 506832 nobody 21952 0.0 S 03:01 /usr/sbin/httpd -k start 429218 506832 nobody 21888 0.0 S 02:58 /usr/sbin/httpd -k start 1463 1 root 21388 0.0 Ss 61-07:32:58 tailwatchd 429217 506832 nobody 21312 0.0 S 02:58 /usr/sbin/httpd -k start 444581 506832 nobody 20848 0.0 S 00:33 /usr/sbin/httpd -k start 429238 506832 nobody 20824 0.0 S 02:58 /usr/sbin/httpd -k start 444571 506832 nobody 20416 0.0 S 00:35 /usr/sbin/httpd -k start 444742 506832 nobody 20352 0.2 S 00:09 /usr/sbin/httpd -k start 429284 506832 nobody 20016 0.0 S 02:57 /usr/sbin/httpd -k start 444576 506832 nobody 19760 0.0 S 00:34 /usr/sbin/httpd -k start 444783 506832 nobody 19340 0.3 S 00:06 /usr/sbin/httpd -k start 429232 506832 nobody 19292 0.0 S 02:58 /usr/sbin/httpd -k start 444793 506832 nobody 19276 0.2 S 00:05 /usr/sbin/httpd -k start 444788 506832 nobody 19252 0.2 S 00:05 /usr/sbin/httpd -k start 444781 506832 nobody 19220 0.3 S 00:06 /usr/sbin/httpd -k start 444786 506832 nobody 19216 0.2 S 00:05 /usr/sbin/httpd -k start 444799 506832 nobody 19212 0.2 S 00:05 /usr/sbin/httpd -k start 444716 506832 nobody 19196 0.0 S 00:11 /usr/sbin/httpd -k start 444782 506832 nobody 19152 0.1 S 00:06 /usr/sbin/httpd -k start 444768 506832 nobody 18864 0.1 S 00:08 /usr/sbin/httpd -k start 444780 506832 nobody 18216 0.0 S 00:06 /usr/sbin/httpd -k start 444789 506832 nobody 17844 0.0 S 00:05 /usr/sbin/httpd -k start 508634 1 named 17400 0.0 Ssl 1-15:23:11 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 444787 506832 nobody 17168 0.0 S 00:05 /usr/sbin/httpd -k start 509671 508992 netdata 17068 2.1 Sl 1-15:23:01 /usr/libexec/netdata/plugins.d/apps.plugin 1 444771 506832 nobody 16860 0.1 S 00:07 /usr/sbin/httpd -k start 444791 506832 nobody 16860 0.0 S 00:05 /usr/sbin/httpd -k start 444776 506832 nobody 16812 0.1 S 00:06 /usr/sbin/httpd -k start 444777 506832 nobody 16812 0.0 S 00:06 /usr/sbin/httpd -k start 444778 506832 nobody 16812 0.0 S 00:06 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4119241 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min otterfencing/otterfencing.com.au-ssl_log 184 coscom/coscom.com.au-ssl_log 155 madalice/madalice.com.au-ssl_log 58 infinium/infinium.net.au-ssl_log 48 evolution/portal.evolutionerp.com.au-ssl_log 32 alison/alisonarts.com.au-ssl_log 21 alison/alisonarts.com.au 9 aaa/aaadownunder.com.au-ssl_log 8 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 182 4.205.62.107 156 20.52.41.200 38 52.139.37.240 35 35.231.130.18 32 203.54.180.238 29 68.155.159.216 11 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 7 118.127.40.55 3 114.119.159.70 2 205.185.124.105 2 193.70.46.29 2 160.250.130.168 2 124.184.172.190 2 114.119.140.234 2 103.138.189.56 --- top request paths across all vhosts (last 3 min) --- 32 GET /heartbeat.php 13 POST /wp-admin/admin-ajax.php 7 GET /store/hand-painted-nike-af1-pink-pastel-flower/ 6 GET /wp-login.php 4 POST /wp-login.php 4 POST /wp-cron.php 3 GET /wp-content/packed.php 3 GET /test1.php 3 GET /packed.php 3 GET /goods.php 3 GET /admin.php 3 GET /222.php 2 POST / 2 GET /x.php 2 GET /wp-l0gin.php 2 GET /wp-includes/SimplePie/Content/index.php 2 GET /wp-includes/SimplePie/about.php 2 GET /wp-includes/ID3/ 2 GET /w.php 2 GET /wp-good.php --- busiest 3 vhosts: top paths + last 10 requests --- == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 2 GET /ms-edit.php 2 GET /koiy.php 2 GET /doc.php 1 POST /wp-cron.php 1 GET /zz.php 1 GET /zaza.php 1 GET /xza.php 1 GET /xve22.php 1 GET /xp.php 1 GET /xmy.php 1 GET /xin1.php 1 GET /ws79.php -- last 10 requests -- 4.205.62.107 - - [29/Aug/2026:17:41:22 +1000] "GET /wp-tem.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [29/Aug/2026:17:41:23 +1000] "GET /time.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [29/Aug/2026:17:41:23 +1000] "GET /doc.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [29/Aug/2026:17:41:24 +1000] "GET /classsmtps.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [29/Aug/2026:17:41:24 +1000] "GET /cache-compat.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [29/Aug/2026:17:41:25 +1000] "GET /aws_keys.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [29/Aug/2026:17:41:25 +1000] "GET /umgebung.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [29/Aug/2026:17:41:26 +1000] "GET /wp-act.php HTTP/1.1" 401 36 "-" "-" 100.28.49.152 - - [29/Aug/2026:17:42:15 +1000] "GET /2018/02/02/hurlingham-park-boundary-fence/ HTTP/1.1" 200 70992 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.am 118.127.40.55 - - [29/Aug/2026:17:42:17 +1000] "POST /wp-cron.php?doing_wp_cron=1787989337.2054638862609863281250 HTTP/1.1" 200 1 "-" "WordPress/6.8.2; https://wp.otterfencing.com.au" == coscom/coscom.com.au-ssl_log == -- top paths -- 2 GET /222.php 1 GET /zoom1.php 1 GET /yanz.php 1 GET /xxx.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-themes.php 1 GET /wp-mail.php 1 GET /wp-logs.php -- last 10 requests -- 20.52.41.200 - - [29/Aug/2026:17:41:49 +1000] "GET /css/index.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [29/Aug/2026:17:41:49 +1000] "GET /wp-cron.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [29/Aug/2026:17:41:49 +1000] "GET /wp-block.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [29/Aug/2026:17:41:50 +1000] "GET /wp-includes/fonts/admin.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [29/Aug/2026:17:41:50 +1000] "GET /m.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [29/Aug/2026:17:41:50 +1000] "GET /wp-admin/css/wp-login.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [29/Aug/2026:17:41:50 +1000] "GET /222.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [29/Aug/2026:17:41:51 +1000] "GET /mini.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [29/Aug/2026:17:41:51 +1000] "GET /aa.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [29/Aug/2026:17:41:51 +1000] "GET /c.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 13 POST /wp-admin/admin-ajax.php 7 GET /store/hand-painted-nike-af1-pink-pastel-flower/ 2 GET /users/login 2 GET /user/login 2 GET /signup 2 GET /signin 2 GET /sign-in 2 GET /reset-password 2 GET /register 2 GET /login 2 GET /forgot-password 2 GET /auth/login -- last 10 requests -- 35.231.130.18 - - [29/Aug/2026:17:42:45 +1000] "GET /admin/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [29/Aug/2026:17:42:44 +1000] "GET /signup HTTP/1.1" 404 36642 "https://www.madalice.com.au/signup" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safa 35.231.130.18 - - [29/Aug/2026:17:42:44 +1000] "GET /register HTTP/1.1" 404 36639 "https://www.madalice.com.au/register" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile 35.231.130.18 - - [29/Aug/2026:17:42:45 +1000] "GET /console HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [29/Aug/2026:17:42:45 +1000] "GET /dashboard HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 114.119.159.70 - - [29/Aug/2026:17:42:45 +1000] "GET /store/hand-painted-nike-af1-pink-pastel-flower/?amp%3Brating=1&wcpr_rating=2&wcpr_page=2&wcpr_verified=1 HTTP/1.1" 301 1 "https://madalice.com.au/store/hand-painted-n 35.231.130.18 - - [29/Aug/2026:17:42:45 +1000] "GET /wp-login.php HTTP/1.1" 200 4024 "https://madalice.com.au/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safa 35.231.130.18 - - [29/Aug/2026:17:42:45 +1000] "GET /backoffice HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [29/Aug/2026:17:42:46 +1000] "GET /portal HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [29/Aug/2026:17:42:46 +1000] "GET /panel HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-29 17:40:19 L1=1.59 run=3 blk=0 avail=7458 (54.1%) swpO=0 conn=3 myRSS=2816 php=7 phpRSS=755 ap=88 tcp=41 topuser=madalice 2026-08-29 17:40:27 L1=1.50 run=3 blk=0 avail=7313 (53.1%) swpO=0 conn=3 myRSS=2816 php=8 phpRSS=993 ap=79 tcp=36 topuser=madalice 2026-08-29 17:40:29 L1=1.50 run=2 blk=0 avail=7721 (56.0%) swpO=0 conn=3 myRSS=2816 php=5 phpRSS=506 ap=78 tcp=33 topuser=madalice 2026-08-29 17:40:37 L1=1.42 run=7 blk=0 avail=7862 (57.1%) swpO=0 conn=3 myRSS=2816 php=8 phpRSS=579 ap=69 tcp=36 topuser=olympic 2026-08-29 17:40:39 L1=1.42 run=6 blk=0 avail=7734 (56.1%) swpO=0 conn=3 myRSS=2816 php=7 phpRSS=659 ap=68 tcp=33 topuser=olympic 2026-08-29 17:40:47 L1=1.88 run=3 blk=0 avail=8016 (58.2%) swpO=0 conn=3 myRSS=2816 php=5 phpRSS=374 ap=59 tcp=36 topuser=alison 2026-08-29 17:40:49 L1=1.88 run=2 blk=0 avail=8084 (58.7%) swpO=0 conn=3 myRSS=2816 php=4 phpRSS=284 ap=58 tcp=33 topuser=alison 2026-08-29 17:40:57 L1=1.59 run=1 blk=0 avail=8242 (59.8%) swpO=4 conn=3 myRSS=2816 php=3 phpRSS=193 ap=49 tcp=24 topuser=madalice 2026-08-29 17:40:59 L1=1.59 run=3 blk=0 avail=8198 (59.5%) swpO=4 conn=2 myRSS=2816 php=4 phpRSS=281 ap=48 tcp=24 topuser=madalice 2026-08-29 17:41:08 L1=1.34 run=3 blk=0 avail=8106 (58.8%) swpO=0 conn=3 myRSS=2816 php=4 phpRSS=438 ap=39 tcp=29 topuser=madalice 2026-08-29 17:41:09 L1=1.34 run=2 blk=0 avail=8224 (59.7%) swpO=1 conn=2 myRSS=2816 php=4 phpRSS=328 ap=37 tcp=30 topuser=madalice 2026-08-29 17:41:18 L1=1.21 run=4 blk=0 avail=8094 (58.8%) swpO=0 conn=4 myRSS=2816 php=6 phpRSS=576 ap=29 tcp=32 topuser=madalice 2026-08-29 17:41:19 L1=1.21 run=3 blk=0 avail=8268 (60.0%) swpO=0 conn=2 myRSS=2816 php=4 phpRSS=361 ap=27 tcp=27 topuser=madalice 2026-08-29 17:41:28 L1=1.17 run=1 blk=0 avail=8307 (60.3%) swpO=0 conn=4 myRSS=2816 php=4 phpRSS=356 ap=21 tcp=27 topuser=madalice 2026-08-29 17:41:29 L1=1.17 run=1 blk=0 avail=8321 (60.4%) swpO=0 conn=2 myRSS=2816 php=4 phpRSS=356 ap=20 tcp=25 topuser=madalice 2026-08-29 17:41:38 L1=0.99 run=1 blk=0 avail=8342 (60.5%) swpO=0 conn=4 myRSS=2816 php=4 phpRSS=356 ap=17 tcp=23 topuser=madalice 2026-08-29 17:41:39 L1=0.99 run=1 blk=0 avail=8349 (60.6%) swpO=0 conn=2 myRSS=2816 php=4 phpRSS=356 ap=17 tcp=21 topuser=madalice 2026-08-29 17:41:48 L1=0.84 run=1 blk=0 avail=8356 (60.7%) swpO=0 conn=4 myRSS=2816 php=4 phpRSS=357 ap=15 tcp=21 topuser=madalice 2026-08-29 17:41:50 L1=0.84 run=1 blk=0 avail=8356 (60.7%) swpO=0 conn=2 myRSS=2816 php=4 phpRSS=357 ap=15 tcp=20 topuser=madalice 2026-08-29 17:41:58 L1=0.71 run=2 blk=0 avail=8349 (60.6%) swpO=0 conn=4 myRSS=2816 php=4 phpRSS=356 ap=15 tcp=21 topuser=madalice 2026-08-29 17:42:00 L1=0.71 run=1 blk=0 avail=8356 (60.7%) swpO=0 conn=1 myRSS=2816 php=4 phpRSS=356 ap=15 tcp=22 topuser=madalice 2026-08-29 17:42:08 L1=0.60 run=2 blk=0 avail=8331 (60.5%) swpO=0 conn=4 myRSS=2816 php=5 phpRSS=417 ap=15 tcp=25 topuser=madalice 2026-08-29 17:42:10 L1=0.60 run=3 blk=0 avail=8208 (59.6%) swpO=0 conn=1 myRSS=2816 php=5 phpRSS=527 ap=15 tcp=25 topuser=madalice 2026-08-29 17:42:18 L1=0.65 run=3 blk=0 avail=8102 (58.8%) swpO=0 conn=3 myRSS=2816 php=5 phpRSS=590 ap=22 tcp=26 topuser=madalice 2026-08-29 17:42:20 L1=0.65 run=2 blk=0 avail=8247 (59.9%) swpO=0 conn=1 myRSS=2816 php=5 phpRSS=460 ap=20 tcp=22 topuser=madalice 2026-08-29 17:42:28 L1=0.70 run=1 blk=0 avail=8329 (60.5%) swpO=0 conn=3 myRSS=2816 php=4 phpRSS=359 ap=17 tcp=24 topuser=madalice 2026-08-29 17:42:30 L1=0.70 run=1 blk=0 avail=8328 (60.4%) swpO=0 conn=1 myRSS=2816 php=4 phpRSS=359 ap=17 tcp=24 topuser=madalice 2026-08-29 17:42:38 L1=0.75 run=11 blk=0 avail=7606 (55.2%) swpO=0 conn=3 myRSS=2816 php=9 phpRSS=1182 ap=18 tcp=28 topuser=madalice 2026-08-29 17:42:40 L1=0.75 run=7 blk=0 avail=7336 (53.3%) swpO=0 conn=1 myRSS=2816 php=9 phpRSS=1446 ap=19 tcp=33 topuser=madalice 2026-08-29 17:42:48 L1=1.67 run=9 blk=0 avail=6895 (50.0%) swpO=4 conn=9 myRSS=2816 php=12 phpRSS=1716 ap=52 tcp=63 topuser=madalice