INCIDENT 2026-08-29 17:43:49 trigger: php_rss=1505MB ================================================================== load: 1.09 1.39 1.58 6/671 445693 ncpu:10 mem_avail: 7231MB/13777MB (52.5%) swap_used:1481MB swapout:0/s blocked(D):0 running:18 iowait:0.1% steal:0.0% php: 16 procs / 1505MB heaviest user: madalice (7 procs, 1091MB) apache: 35 procs tcp_estab: 56 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2816 madalice 7 1091 root 252 1060 nobody 34 660 infinium 5 198 netdata 7 196 mailman 20 190 cpanellogin 1 65 dovenull 6 56 wp-toolkit 3 43 kurri 3 42 evolution 7 27 zabbix 1 24 dovecot 3 22 named 1 16 vinesit 1 14 lowrange 1 14 corpkicks 1 14 mailnull 1 8 polkitd 1 6 --- php workers by user --- USER PROCS RSS_MB madalice 7 1091 infinium 4 167 root 1 27 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4639 MB Active(file): 4361 MB Inactive(file): 853 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 571 MB CommitLimit: 10984 MB Committed_AS: 7960 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-15:25:09 7112 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2883636 9.1 Ssl 1-15:24:38 /usr/sbin/mariadbd 508924 1 netdata 175348 1.9 Ssl 1-15:24:07 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83639 1451906 root 174116 0.0 S 01:46:15 spamd child 444784 510022 madalice 161724 9.1 S 01:06 php-fpm: pool madalice_com_au 1502904 1451906 root 161100 0.0 S 15:07:27 spamd child 444718 510022 madalice 160188 13.3 S 01:12 php-fpm: pool madalice_com_au 444774 510022 madalice 160144 11.4 S 01:08 php-fpm: pool madalice_com_au 444715 510022 madalice 159760 12.9 S 01:12 php-fpm: pool madalice_com_au 444714 510022 madalice 158764 13.7 S 01:12 php-fpm: pool madalice_com_au 444717 510022 madalice 158680 12.6 S 01:12 php-fpm: pool madalice_com_au 444775 510022 madalice 158604 11.8 S 01:08 php-fpm: pool madalice_com_au 1451906 1 root 131780 0.0 Ss 15:20:42 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509266 1 root 111436 0.0 Ss 1-15:24:04 /usr/lib/systemd/systemd-journald 133529 1353308 cpanellogin 66624 0.0 S 01:32:07 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 509236 509098 root 63348 0.0 Sl 1-15:24:04 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 445698 445590 infinium 52440 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 445703 445570 infinium 48044 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 445704 445591 infinium 46376 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 445705 445589 infinium 46100 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1353308 1 root 42580 0.1 Ss 38-15:02:30 cpsrvd (SSL) - waiting for connections 509640 508992 root 38408 0.0 Sl 1-15:24:02 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 33384 0.0 Ss 15:21:35 lfd - sleeping 510022 1 root 28320 0.0 Ss 1-15:24:00 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 25652 0.0 Ss 1-13:31:41 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 483898 1 zabbix 24612 0.2 Ssl 1-15:25:21 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 410652 506832 nobody 24036 0.0 S 09:55 /usr/sbin/httpd -k start 429132 506832 nobody 23736 0.0 S 04:02 /usr/sbin/httpd -k start 1469 1 root 22488 0.1 Ss 61-07:33:59 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 429217 506832 nobody 22336 0.0 S 03:59 /usr/sbin/httpd -k start 444801 506832 nobody 22032 0.0 S 01:06 /usr/sbin/httpd -k start 429218 506832 nobody 21888 0.0 S 03:59 /usr/sbin/httpd -k start 1463 1 root 21388 0.0 Ss 61-07:33:59 tailwatchd 444776 506832 nobody 21288 0.1 S 01:07 /usr/sbin/httpd -k start 445556 506832 nobody 21280 0.7 S 00:04 /usr/sbin/httpd -k start 445588 506832 nobody 21168 1.0 S 00:02 /usr/sbin/httpd -k start 445589 506832 nobody 21164 1.0 S 00:02 /usr/sbin/httpd -k start 444786 506832 nobody 21084 0.0 S 01:06 /usr/sbin/httpd -k start 445570 506832 nobody 21020 1.0 S 00:03 /usr/sbin/httpd -k start 445590 506832 nobody 21000 1.5 S 00:02 /usr/sbin/httpd -k start 444807 506832 nobody 20960 0.0 S 01:02 /usr/sbin/httpd -k start 444795 506832 nobody 20956 0.0 S 01:06 /usr/sbin/httpd -k start 445591 506832 nobody 20908 1.5 S 00:02 /usr/sbin/httpd -k start 444799 506832 nobody 20904 0.1 S 01:06 /usr/sbin/httpd -k start 444769 506832 nobody 20852 0.0 S 01:09 /usr/sbin/httpd -k start 429238 506832 nobody 20824 0.0 S 03:59 /usr/sbin/httpd -k start 444792 506832 nobody 20780 0.0 S 01:06 /usr/sbin/httpd -k start 444571 506832 nobody 20712 0.0 S 01:36 /usr/sbin/httpd -k start 444790 506832 nobody 20628 0.0 S 01:06 /usr/sbin/httpd -k start 444798 506832 nobody 20536 0.0 S 01:06 /usr/sbin/httpd -k start 445631 506832 nobody 19864 1.0 S 00:01 /usr/sbin/httpd -k start 445633 506832 nobody 19864 1.0 S 00:01 /usr/sbin/httpd -k start 445571 506832 nobody 19832 0.3 S 00:03 /usr/sbin/httpd -k start 445634 506832 nobody 19800 0.0 S 00:01 /usr/sbin/httpd -k start 445637 506832 nobody 19800 0.0 S 00:01 /usr/sbin/httpd -k start 445635 506832 nobody 19780 0.0 S 00:01 /usr/sbin/httpd -k start 445636 506832 nobody 19780 0.0 S 00:01 /usr/sbin/httpd -k start 445630 506832 nobody 19740 0.0 S 00:01 /usr/sbin/httpd -k start 445632 506832 nobody 19736 0.0 S 00:01 /usr/sbin/httpd -k start 444716 506832 nobody 19620 0.0 S 01:12 /usr/sbin/httpd -k start 508634 1 named 17400 0.0 Ssl 1-15:24:12 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4119360 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min infinium/infinium.net.au-ssl_log 215 coscom/coscom.com.au-ssl_log 155 madalice/madalice.com.au-ssl_log 79 otterfencing/otterfencing.com.au-ssl_log 55 evolution/portal.evolutionerp.com.au-ssl_log 32 aaa/aaadownunder.com.au-ssl_log 7 alison/alisonarts.com.au-ssl_log 6 evolution/my.evolutionerp.com.au-ssl_log 3 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 156 20.52.41.200 108 52.139.37.240 91 162.213.255.122 53 4.205.62.107 52 35.231.130.18 32 203.54.180.238 16 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 11 118.127.40.55 2 52.167.144.218 2 209.42.20.222 2 205.185.124.105 2 197.155.134.251 2 193.70.46.29 2 170.64.135.172 2 114.119.159.70 --- top request paths across all vhosts (last 3 min) --- 89 GET /wp-login.php 32 GET /heartbeat.php 20 POST /wp-login.php 19 POST /wp-admin/admin-ajax.php 7 GET /store/hand-painted-nike-af1-pink-pastel-flower/ 5 POST /wp-cron.php 3 POST / 3 GET /wp-admin/ 3 GET /test1.php 3 GET /index.php 3 GET /222.php 2 GET /zoom1.php 2 GET /xmlrpc.php 2 GET /xda.php 2 GET /wp-includes/PHPMailer/ 2 GET /wp-includes/ID3/index.php 2 GET /wp-includes/ID3/ 2 GET /wp-good.php 2 GET /wp-content/uploads/min.php 2 GET /wp-content/upgrade/index.php --- busiest 3 vhosts: top paths + last 10 requests --- == infinium/infinium.net.au-ssl_log == -- top paths -- 84 GET /wp-login.php 18 POST /wp-login.php 3 POST /wp-cron.php 2 GET /wp-content/plugins/core-plugin/include.php 2 GET /wp-admin/js/widgets/ 1 POST / 1 GET /zoom1.php 1 GET /xx.php 1 GET /xmrlpc.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws81.php -- last 10 requests -- 162.213.255.122 - - [29/Aug/2026:17:43:49 +1000] "GET /wp-login.php HTTP/1.1" 503 6560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 162.213.255.122 - - [29/Aug/2026:17:43:49 +1000] "GET /wp-login.php HTTP/1.1" 503 6560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 162.213.255.122 - - [29/Aug/2026:17:43:49 +1000] "GET /wp-login.php HTTP/1.1" 503 6560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 162.213.255.122 - - [29/Aug/2026:17:43:49 +1000] "GET /wp-login.php HTTP/1.1" 503 6560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 162.213.255.122 - - [29/Aug/2026:17:43:49 +1000] "GET /wp-login.php HTTP/1.1" 503 6560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 162.213.255.122 - - [29/Aug/2026:17:43:49 +1000] "GET /wp-login.php HTTP/1.1" 503 6560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 162.213.255.122 - - [29/Aug/2026:17:43:49 +1000] "GET /wp-login.php HTTP/1.1" 503 6560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 162.213.255.122 - - [29/Aug/2026:17:43:49 +1000] "GET /wp-login.php HTTP/1.1" 503 6560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 162.213.255.122 - - [29/Aug/2026:17:43:49 +1000] "GET /wp-login.php HTTP/1.1" 503 6560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 162.213.255.122 - - [29/Aug/2026:17:43:49 +1000] "GET /wp-login.php HTTP/1.1" 503 6560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" == coscom/coscom.com.au-ssl_log == -- top paths -- 2 GET /222.php 1 GET /zoom1.php 1 GET /yanz.php 1 GET /xxx.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-themes.php 1 GET /wp-mail.php 1 GET /wp-logs.php -- last 10 requests -- 20.52.41.200 - - [29/Aug/2026:17:41:49 +1000] "GET /css/index.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [29/Aug/2026:17:41:49 +1000] "GET /wp-cron.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [29/Aug/2026:17:41:49 +1000] "GET /wp-block.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [29/Aug/2026:17:41:50 +1000] "GET /wp-includes/fonts/admin.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [29/Aug/2026:17:41:50 +1000] "GET /m.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [29/Aug/2026:17:41:50 +1000] "GET /wp-admin/css/wp-login.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [29/Aug/2026:17:41:50 +1000] "GET /222.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [29/Aug/2026:17:41:51 +1000] "GET /mini.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [29/Aug/2026:17:41:51 +1000] "GET /aa.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.41.200 - - [29/Aug/2026:17:41:51 +1000] "GET /c.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 19 POST /wp-admin/admin-ajax.php 7 GET /store/hand-painted-nike-af1-pink-pastel-flower/ 3 GET /wp-login.php 2 GET /wp-admin/ 2 GET /users/login 2 GET /user/login 2 GET /signup 2 GET /signin 2 GET /sign-in 2 GET /secure 2 GET /reset-password 2 GET /register -- last 10 requests -- 35.231.130.18 - - [29/Aug/2026:17:42:49 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Fmadalice.com.au%2Fwp-admin%2F&reauth=1 HTTP/1.1" 200 4024 "https://madalice.com.au/wp-admin/" "Mozilla/5.0 (Linux; Android 10; K 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 - - [29/Aug/2026:17:42:52 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 77 "https://madalice.com.au/wp-admin/post.php?post=34648&action=edit" "Mozilla/5.0 (Windows NT 10.0; W 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 - - [29/Aug/2026:17:43:02 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 77 "https://madalice.com.au/wp-admin/post.php?post=34648&action=edit" "Mozilla/5.0 (Windows NT 10.0; W 114.119.146.16 - - [29/Aug/2026:17:43:12 +1000] "GET /store/hand-painted-nike-af1-pink-pastel-flower/?amp%3Brating=1&wcpr_rating=2&wcpr_page=2&wcpr_image=1 HTTP/1.1" 301 1 "https://madalice.com.au/store/hand-painted-nike 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 - - [29/Aug/2026:17:43:12 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 77 "https://madalice.com.au/wp-admin/post.php?post=34648&action=edit" "Mozilla/5.0 (Windows NT 10.0; W 198.23.209.102 - - [29/Aug/2026:17:43:16 +1000] "GET /wp-content/plugins/woo-custom-product-addons-pro/readme.txt HTTP/1.1" 200 2990 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 - - [29/Aug/2026:17:43:22 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 78 "https://madalice.com.au/wp-admin/post.php?post=34648&action=edit" "Mozilla/5.0 (Windows NT 10.0; W 118.127.40.55 - - [29/Aug/2026:17:43:23 +1000] "POST /wp-admin/admin-ajax.php?action=as_async_request_queue_runner&nonce=7f15ebcfcf HTTP/1.1" 200 1 "-" "WordPress/7.1; https://madalice.com.au" 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 - - [29/Aug/2026:17:43:32 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 77 "https://madalice.com.au/wp-admin/post.php?post=34648&action=edit" "Mozilla/5.0 (Windows NT 10.0; W 114.119.137.101 - - [29/Aug/2026:17:43:36 +1000] "GET /store/hand-painted-nike-af1-pink-pastel-flower/?amp%3Brating=1&wcpr_image=1&wcpr_rating=1&rating=4 HTTP/1.1" 301 1 "https://madalice.com.au/store/hand-painted-nike-a --- last 30 samples (run-up to this incident) --- 2026-08-29 17:41:19 L1=1.21 run=3 blk=0 avail=8268 (60.0%) swpO=0 conn=2 myRSS=2816 php=4 phpRSS=361 ap=27 tcp=27 topuser=madalice 2026-08-29 17:41:28 L1=1.17 run=1 blk=0 avail=8307 (60.3%) swpO=0 conn=4 myRSS=2816 php=4 phpRSS=356 ap=21 tcp=27 topuser=madalice 2026-08-29 17:41:29 L1=1.17 run=1 blk=0 avail=8321 (60.4%) swpO=0 conn=2 myRSS=2816 php=4 phpRSS=356 ap=20 tcp=25 topuser=madalice 2026-08-29 17:41:38 L1=0.99 run=1 blk=0 avail=8342 (60.5%) swpO=0 conn=4 myRSS=2816 php=4 phpRSS=356 ap=17 tcp=23 topuser=madalice 2026-08-29 17:41:39 L1=0.99 run=1 blk=0 avail=8349 (60.6%) swpO=0 conn=2 myRSS=2816 php=4 phpRSS=356 ap=17 tcp=21 topuser=madalice 2026-08-29 17:41:48 L1=0.84 run=1 blk=0 avail=8356 (60.7%) swpO=0 conn=4 myRSS=2816 php=4 phpRSS=357 ap=15 tcp=21 topuser=madalice 2026-08-29 17:41:50 L1=0.84 run=1 blk=0 avail=8356 (60.7%) swpO=0 conn=2 myRSS=2816 php=4 phpRSS=357 ap=15 tcp=20 topuser=madalice 2026-08-29 17:41:58 L1=0.71 run=2 blk=0 avail=8349 (60.6%) swpO=0 conn=4 myRSS=2816 php=4 phpRSS=356 ap=15 tcp=21 topuser=madalice 2026-08-29 17:42:00 L1=0.71 run=1 blk=0 avail=8356 (60.7%) swpO=0 conn=1 myRSS=2816 php=4 phpRSS=356 ap=15 tcp=22 topuser=madalice 2026-08-29 17:42:08 L1=0.60 run=2 blk=0 avail=8331 (60.5%) swpO=0 conn=4 myRSS=2816 php=5 phpRSS=417 ap=15 tcp=25 topuser=madalice 2026-08-29 17:42:10 L1=0.60 run=3 blk=0 avail=8208 (59.6%) swpO=0 conn=1 myRSS=2816 php=5 phpRSS=527 ap=15 tcp=25 topuser=madalice 2026-08-29 17:42:18 L1=0.65 run=3 blk=0 avail=8102 (58.8%) swpO=0 conn=3 myRSS=2816 php=5 phpRSS=590 ap=22 tcp=26 topuser=madalice 2026-08-29 17:42:20 L1=0.65 run=2 blk=0 avail=8247 (59.9%) swpO=0 conn=1 myRSS=2816 php=5 phpRSS=460 ap=20 tcp=22 topuser=madalice 2026-08-29 17:42:28 L1=0.70 run=1 blk=0 avail=8329 (60.5%) swpO=0 conn=3 myRSS=2816 php=4 phpRSS=359 ap=17 tcp=24 topuser=madalice 2026-08-29 17:42:30 L1=0.70 run=1 blk=0 avail=8328 (60.4%) swpO=0 conn=1 myRSS=2816 php=4 phpRSS=359 ap=17 tcp=24 topuser=madalice 2026-08-29 17:42:38 L1=0.75 run=11 blk=0 avail=7606 (55.2%) swpO=0 conn=3 myRSS=2816 php=9 phpRSS=1182 ap=18 tcp=28 topuser=madalice 2026-08-29 17:42:40 L1=0.75 run=7 blk=0 avail=7336 (53.3%) swpO=0 conn=1 myRSS=2816 php=9 phpRSS=1446 ap=19 tcp=33 topuser=madalice 2026-08-29 17:42:48 L1=1.67 run=9 blk=0 avail=6895 (50.0%) swpO=4 conn=9 myRSS=2816 php=12 phpRSS=1716 ap=52 tcp=63 topuser=madalice 2026-08-29 17:42:50 L1=1.67 run=4 blk=0 avail=6915 (50.2%) swpO=4 conn=3 myRSS=2816 php=12 phpRSS=1660 ap=56 tcp=53 topuser=madalice 2026-08-29 17:42:59 L1=1.63 run=1 blk=0 avail=7022 (51.0%) swpO=0 conn=1 myRSS=2816 php=12 phpRSS=1605 ap=47 tcp=27 topuser=madalice 2026-08-29 17:43:00 L1=1.63 run=1 blk=0 avail=7030 (51.0%) swpO=0 conn=1 myRSS=2816 php=12 phpRSS=1605 ap=46 tcp=24 topuser=madalice 2026-08-29 17:43:09 L1=1.38 run=2 blk=0 avail=7064 (51.3%) swpO=0 conn=2 myRSS=2816 php=13 phpRSS=1668 ap=37 tcp=25 topuser=madalice 2026-08-29 17:43:10 L1=1.38 run=3 blk=0 avail=6829 (49.6%) swpO=0 conn=3 myRSS=2816 php=14 phpRSS=1942 ap=36 tcp=25 topuser=madalice 2026-08-29 17:43:19 L1=1.24 run=1 blk=0 avail=7174 (52.1%) swpO=0 conn=1 myRSS=2816 php=12 phpRSS=1603 ap=27 tcp=26 topuser=madalice 2026-08-29 17:43:20 L1=1.24 run=1 blk=0 avail=7182 (52.1%) swpO=0 conn=1 myRSS=2816 php=12 phpRSS=1603 ap=26 tcp=25 topuser=madalice 2026-08-29 17:43:29 L1=1.21 run=3 blk=0 avail=7133 (51.8%) swpO=0 conn=3 myRSS=2816 php=12 phpRSS=1678 ap=22 tcp=29 topuser=madalice 2026-08-29 17:43:30 L1=1.21 run=1 blk=0 avail=7331 (53.2%) swpO=0 conn=1 myRSS=2816 php=11 phpRSS=1446 ap=22 tcp=27 topuser=madalice 2026-08-29 17:43:39 L1=1.02 run=4 blk=0 avail=7192 (52.2%) swpO=0 conn=4 myRSS=2816 php=13 phpRSS=1651 ap=21 tcp=38 topuser=madalice 2026-08-29 17:43:40 L1=1.02 run=5 blk=0 avail=7244 (52.6%) swpO=0 conn=3 myRSS=2816 php=13 phpRSS=1597 ap=21 tcp=38 topuser=madalice 2026-08-29 17:43:49 L1=1.09 run=18 blk=0 avail=7231 (52.5%) swpO=0 conn=1 myRSS=2816 php=16 phpRSS=1505 ap=35 tcp=56 topuser=madalice