INCIDENT 2026-08-29 18:17:19 trigger: php_rss=1565MB ================================================================== load: 1.52 1.33 1.28 8/655 566931 ncpu:10 mem_avail: 7255MB/13777MB (52.7%) swap_used:1484MB swapout:0/s blocked(D):0 running:9 iowait:0.0% steal:0.0% php: 12 procs / 1565MB heaviest user: madalice (7 procs, 1064MB) apache: 29 procs tcp_estab: 42 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2814 root 249 1029 madalice 7 957 nobody 28 475 netdata 7 199 evolution 8 198 mailman 20 190 otterfencing 1 172 alison 1 129 cpanellogin 1 62 dovenull 6 56 wp-toolkit 3 43 kurri 2 28 zabbix 1 22 dovecot 3 22 mailnull 2 19 named 1 16 lowrange 1 14 polkitd 1 6 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 7 957 evolution 2 185 otterfencing 1 172 alison 1 130 root 1 27 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4832 MB Active(file): 4386 MB Inactive(file): 869 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 576 MB CommitLimit: 10984 MB Committed_AS: 8059 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-15:58:39 7112 /usr/bin/imunify-agent-proxy 497928 root 17:19 1332 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2882184 9.0 Ssl 1-15:58:08 /usr/sbin/mariadbd 508924 1 netdata 178600 1.9 Ssl 1-15:57:37 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 566886 566822 evolution 175344 25.3 S 00:03 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 83639 1451906 root 174448 0.0 S 02:19:45 spamd child 549916 510022 madalice 166576 8.6 R 03:16 php-fpm: pool madalice_com_au 496630 510022 madalice 164448 9.6 S 19:26 php-fpm: pool madalice_com_au 1502904 1451906 root 161056 0.0 S 15:40:57 spamd child 566898 549529 alison 140332 102 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 566895 510022 madalice 136472 65.0 S 00:02 php-fpm: pool madalice_com_au 1451906 1 root 131480 0.0 Ss 15:54:12 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 566889 510022 madalice 129784 48.3 R 00:03 php-fpm: pool madalice_com_au 566890 510022 madalice 129784 46.6 R 00:03 php-fpm: pool madalice_com_au 566892 510022 madalice 127532 61.5 R 00:02 php-fpm: pool madalice_com_au 566894 510022 madalice 127424 63.0 S 00:02 php-fpm: pool madalice_com_au 509266 1 root 112588 0.0 Ss 1-15:57:34 /usr/lib/systemd/systemd-journald 509236 509098 root 64472 0.0 Sl 1-15:57:34 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 463083 1353308 cpanellogin 64164 0.0 S 28:32 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 1353308 1 root 42268 0.1 Ss 38-15:36:00 cpsrvd (SSL) - waiting for connections 509640 508992 root 38936 0.0 Sl 1-15:57:32 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 33384 0.0 Ss 15:55:05 lfd - sleeping 510022 1 root 28324 0.0 Ss 1-15:57:30 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 25652 0.0 Ss 1-14:05:11 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 530718 506832 nobody 23696 0.0 S 10:30 /usr/sbin/httpd -k start 483898 1 zabbix 23188 0.2 Ssl 1-15:58:51 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 549084 506832 nobody 22784 0.0 S 04:04 /usr/sbin/httpd -k start 1469 1 root 22488 0.1 Ss 61-08:07:29 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 555412 506832 nobody 22108 0.2 S 02:14 /usr/sbin/httpd -k start 565757 506832 nobody 22008 0.0 S 01:30 /usr/sbin/httpd -k start 550061 506832 nobody 21536 0.4 S 03:03 /usr/sbin/httpd -k start 1463 1 root 21388 0.0 Ss 61-08:07:29 tailwatchd 549529 506832 nobody 21120 0.0 S 03:41 /usr/sbin/httpd -k start 565805 506832 nobody 19900 0.0 S 01:29 /usr/sbin/httpd -k start 549230 506832 nobody 19584 0.3 S 03:55 /usr/sbin/httpd -k start 566530 506832 nobody 19388 0.1 S 00:46 /usr/sbin/httpd -k start 566891 506832 nobody 19276 0.5 S 00:02 /usr/sbin/httpd -k start 566821 506832 nobody 19148 0.2 S 00:10 /usr/sbin/httpd -k start 566671 506832 nobody 18864 0.0 S 00:25 /usr/sbin/httpd -k start 566527 506832 nobody 18264 0.0 S 00:47 /usr/sbin/httpd -k start 566682 506832 nobody 18160 0.0 S 00:24 /usr/sbin/httpd -k start 566684 506832 nobody 18152 0.0 S 00:24 /usr/sbin/httpd -k start 566685 506832 nobody 18116 0.0 S 00:24 /usr/sbin/httpd -k start 566659 506832 nobody 17840 0.0 S 00:26 /usr/sbin/httpd -k start 508634 1 named 17400 0.0 Ssl 1-15:57:42 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 566819 506832 nobody 17344 0.0 S 00:11 /usr/sbin/httpd -k start 566822 506832 nobody 17224 0.0 S 00:10 /usr/sbin/httpd -k start 566683 506832 nobody 17172 0.0 S 00:24 /usr/sbin/httpd -k start 509671 508992 netdata 17060 2.1 Sl 1-15:57:32 /usr/libexec/netdata/plugins.d/apps.plugin 1 566899 506832 nobody 16812 0.0 S 00:00 /usr/sbin/httpd -k start 566897 506832 nobody 16752 0.0 S 00:01 /usr/sbin/httpd -k start 566896 506832 nobody 16688 0.0 S 00:01 /usr/sbin/httpd -k start 938585 1 wp-toolkit 16232 0.0 Ss 1-14:05:11 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2766563 1471 root 16228 0.0 S 09:39:31 cPhulkd - dbprocessor 1471 1 root 16036 0.0 Ss 61-08:07:29 cPhulkd - processor 444454 508511 kurri 15584 0.0 S 35:20 dovecot/imap 550242 508511 lowrange 14748 0.0 S 02:46 dovecot/imap 481558 1 root 14480 0.1 Ssl 1-16:00:01 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 4180059 4180015 evolution 14244 0.0 Ss 1-18:17:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 3883280 508511 kurri 13844 0.0 S 04:15:29 dovecot/imap 566900 506832 nobody 12628 0.0 S 00:00 /usr/sbin/httpd -k start 566901 506832 nobody 12628 0.0 S 00:00 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4132134 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 1073 bigdeals/bigdeals.com.au 203 speedlin/speedlinefencing.com.au-ssl_log 117 olympic/olympicfencing.com.au-ssl_log 68 alison/alisonarts.com.au-ssl_log 46 madalice/madalice.com.au-ssl_log 26 evolution/portal.evolutionerp.com.au-ssl_log 24 evolution/my.evolutionerp.com.au-ssl_log 12 infinium/infinium.net.au-ssl_log 10 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 1073 40.115.94.245 203 20.220.10.235 117 20.104.18.15 67 52.139.37.240 45 158.23.184.117 24 203.54.180.238 13 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 9 1.144.107.82 6 118.127.40.55 3 4.205.62.107 2 47.128.32.38 2 40.77.167.154 2 170.64.135.172 2 114.119.143.104 1 91.92.243.239 --- top request paths across all vhosts (last 3 min) --- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 101 GET /cgi-sys/suspendedpage.cgi 24 GET /heartbeat.php 15 POST /wp-admin/admin-ajax.php 9 GET /api/getItem/NA 4 GET /index.php 4 GET /api/getItem/PWFBW3151KG 3 POST /wp-cron.php 3 GET /store/hand-painted-nike-af1-afl-north-melbourne/ 3 GET /new.php 3 GET /goods.php 3 GET /autodiscover/autodiscover.xml 3 GET / 2 POST /wp-login.php 2 POST /functions.php 2 POST /app/ajax.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 9 GET /api/getItem/NA 4 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 -- last 10 requests -- 40.115.94.245 - - [29/Aug/2026:18:16:13 +1000] "GET /api/getItem/RGW90 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:16:13 +1000] "GET /api/getItem/RGW100 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:16:13 +1000] "GET /api/getItem/RGW120 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:16:13 +1000] "GET /api/getItem/RGW160 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:16:14 +1000] "GET /api/getItem/RGW117T HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:16:14 +1000] "GET /api/getItem/RGW80 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:16:14 +1000] "GET /api/getItem/GP150x200x8 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:16:14 +1000] "GET /api/getItem/K125MSGB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:16:14 +1000] "GET /api/getItem/253-40SP HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:16:14 +1000] "GET /api/getItem/300558 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == bigdeals/bigdeals.com.au == -- top paths -- 101 GET /cgi-sys/suspendedpage.cgi 1 GET /ztv.php 1 GET /zoz.php 1 GET /Zeiss.php 1 GET /zafir1.php 1 GET /yyy.php 1 GET /xcre1.php 1 GET /X7T6.php 1 GET /x23.php 1 GET /ww3.php 1 GET /ww2.php 1 GET /wsz.php -- last 10 requests -- 20.220.10.235 - - [29/Aug/2026:18:16:07 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:16:08 +1000] "GET /mh.php HTTP/1.1" 302 250 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:16:08 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:16:08 +1000] "GET /f2r4.php HTTP/1.1" 302 250 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:16:08 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:16:08 +1000] "GET /sadis.php HTTP/1.1" 302 250 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:16:09 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:16:09 +1000] "GET /xcre1.php HTTP/1.1" 302 250 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:16:09 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:16:10 +1000] "GET /motu.php HTTP/1.1" 302 250 "-" "-" == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 2 GET /goods.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /x.php 1 GET /xmini4.php 1 GET /ws85.php 1 GET /ws55.php 1 GET /wp-trackback.php 1 GET /wp-safe.php 1 GET /wp.php 1 GET /wp-includes/index.php -- last 10 requests -- 20.104.18.15 - - [29/Aug/2026:18:15:49 +1000] "GET /wp-admin/js/wp-load.php HTTP/1.1" 404 5749 "-" "-" 20.104.18.15 - - [29/Aug/2026:18:15:50 +1000] "GET /robot.php HTTP/1.1" 404 5749 "-" "-" 20.104.18.15 - - [29/Aug/2026:18:15:50 +1000] "GET /revo.php HTTP/1.1" 404 5749 "-" "-" 20.104.18.15 - - [29/Aug/2026:18:15:51 +1000] "GET /birrs.php HTTP/1.1" 404 5749 "-" "-" 20.104.18.15 - - [29/Aug/2026:18:15:51 +1000] "GET /sss.php?p= HTTP/1.1" 404 5749 "-" "-" 20.104.18.15 - - [29/Aug/2026:18:15:51 +1000] "GET /wp-content/themes/gaukingo/ HTTP/1.1" 404 5749 "-" "-" 20.104.18.15 - - [29/Aug/2026:18:15:52 +1000] "GET /wp-includes/ID3/moon.php HTTP/1.1" 404 5749 "-" "-" 20.104.18.15 - - [29/Aug/2026:18:15:52 +1000] "GET /xmini4.php HTTP/1.1" 404 5749 "-" "-" 20.104.18.15 - - [29/Aug/2026:18:15:53 +1000] "GET /gulu.php HTTP/1.1" 404 5749 "-" "-" 20.104.18.15 - - [29/Aug/2026:18:15:53 +1000] "GET /replace.php HTTP/1.1" 404 5749 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-29 18:14:49 L1=1.18 run=2 blk=0 avail=8159 (59.2%) swpO=0 conn=2 myRSS=2814 php=5 phpRSS=520 ap=20 tcp=32 topuser=madalice 2026-08-29 18:14:58 L1=1.00 run=3 blk=0 avail=8085 (58.7%) swpO=0 conn=3 myRSS=2814 php=6 phpRSS=628 ap=19 tcp=29 topuser=madalice 2026-08-29 18:14:59 L1=1.00 run=3 blk=0 avail=7992 (58.0%) swpO=0 conn=2 myRSS=2814 php=8 phpRSS=785 ap=19 tcp=32 topuser=madalice 2026-08-29 18:15:09 L1=1.68 run=3 blk=0 avail=8044 (58.4%) swpO=3 conn=3 myRSS=2814 php=8 phpRSS=670 ap=25 tcp=35 topuser=madalice 2026-08-29 18:15:09 L1=1.68 run=3 blk=0 avail=7994 (58.0%) swpO=3 conn=3 myRSS=2814 php=8 phpRSS=752 ap=25 tcp=35 topuser=madalice 2026-08-29 18:15:19 L1=1.95 run=2 blk=0 avail=8103 (58.8%) swpO=0 conn=3 myRSS=2814 php=7 phpRSS=590 ap=22 tcp=36 topuser=madalice 2026-08-29 18:15:19 L1=1.95 run=3 blk=0 avail=8069 (58.6%) swpO=0 conn=3 myRSS=2814 php=9 phpRSS=709 ap=22 tcp=36 topuser=madalice 2026-08-29 18:15:29 L1=1.72 run=5 blk=0 avail=8063 (58.5%) swpO=0 conn=3 myRSS=2814 php=7 phpRSS=687 ap=21 tcp=33 topuser=madalice 2026-08-29 18:15:29 L1=1.72 run=3 blk=0 avail=8051 (58.4%) swpO=0 conn=3 myRSS=2814 php=7 phpRSS=698 ap=21 tcp=33 topuser=madalice 2026-08-29 18:15:39 L1=1.85 run=4 blk=0 avail=8139 (59.1%) swpO=0 conn=3 myRSS=2814 php=7 phpRSS=623 ap=20 tcp=30 topuser=madalice 2026-08-29 18:15:39 L1=1.85 run=4 blk=0 avail=8082 (58.7%) swpO=0 conn=3 myRSS=2814 php=6 phpRSS=634 ap=20 tcp=30 topuser=madalice 2026-08-29 18:15:49 L1=1.88 run=4 blk=0 avail=7873 (57.1%) swpO=0 conn=3 myRSS=2814 php=9 phpRSS=920 ap=20 tcp=37 topuser=madalice 2026-08-29 18:15:49 L1=1.88 run=6 blk=0 avail=7890 (57.3%) swpO=0 conn=3 myRSS=2814 php=8 phpRSS=889 ap=21 tcp=34 topuser=madalice 2026-08-29 18:15:59 L1=1.81 run=3 blk=0 avail=8130 (59.0%) swpO=0 conn=3 myRSS=2814 php=7 phpRSS=621 ap=21 tcp=29 topuser=madalice 2026-08-29 18:15:59 L1=1.81 run=3 blk=0 avail=8085 (58.7%) swpO=0 conn=3 myRSS=2814 php=6 phpRSS=638 ap=21 tcp=26 topuser=madalice 2026-08-29 18:16:09 L1=1.84 run=3 blk=0 avail=8190 (59.4%) swpO=0 conn=3 myRSS=2814 php=6 phpRSS=550 ap=18 tcp=30 topuser=madalice 2026-08-29 18:16:09 L1=1.84 run=3 blk=0 avail=8149 (59.1%) swpO=0 conn=2 myRSS=2814 php=7 phpRSS=621 ap=18 tcp=28 topuser=madalice 2026-08-29 18:16:19 L1=1.87 run=2 blk=0 avail=8117 (58.9%) swpO=0 conn=3 myRSS=2814 php=6 phpRSS=632 ap=17 tcp=25 topuser=madalice 2026-08-29 18:16:19 L1=1.87 run=1 blk=0 avail=8198 (59.5%) swpO=0 conn=2 myRSS=2814 php=5 phpRSS=520 ap=17 tcp=21 topuser=madalice 2026-08-29 18:16:29 L1=1.66 run=2 blk=0 avail=8217 (59.6%) swpO=0 conn=2 myRSS=2814 php=5 phpRSS=523 ap=14 tcp=28 topuser=madalice 2026-08-29 18:16:30 L1=1.66 run=2 blk=0 avail=8162 (59.2%) swpO=0 conn=2 myRSS=2814 php=5 phpRSS=580 ap=14 tcp=25 topuser=madalice 2026-08-29 18:16:39 L1=1.48 run=1 blk=0 avail=8180 (59.4%) swpO=0 conn=2 myRSS=2814 php=5 phpRSS=520 ap=21 tcp=26 topuser=madalice 2026-08-29 18:16:40 L1=1.48 run=2 blk=0 avail=8183 (59.4%) swpO=0 conn=2 myRSS=2814 php=5 phpRSS=522 ap=20 tcp=24 topuser=madalice 2026-08-29 18:16:49 L1=1.41 run=2 blk=0 avail=8150 (59.2%) swpO=1 conn=2 myRSS=2814 php=6 phpRSS=620 ap=15 tcp=28 topuser=madalice 2026-08-29 18:16:50 L1=1.41 run=5 blk=0 avail=8097 (58.8%) swpO=1 conn=2 myRSS=2814 php=6 phpRSS=666 ap=15 tcp=26 topuser=madalice 2026-08-29 18:16:59 L1=1.43 run=2 blk=0 avail=7908 (57.4%) swpO=0 conn=2 myRSS=2814 php=7 phpRSS=840 ap=22 tcp=35 topuser=madalice 2026-08-29 18:17:00 L1=1.43 run=2 blk=0 avail=7858 (57.0%) swpO=0 conn=2 myRSS=2814 php=7 phpRSS=887 ap=22 tcp=32 topuser=madalice 2026-08-29 18:17:09 L1=1.43 run=3 blk=0 avail=8043 (58.4%) swpO=0 conn=2 myRSS=2814 php=6 phpRSS=579 ap=23 tcp=34 topuser=madalice 2026-08-29 18:17:10 L1=1.43 run=3 blk=0 avail=8049 (58.4%) swpO=0 conn=3 myRSS=2814 php=7 phpRSS=695 ap=23 tcp=33 topuser=madalice 2026-08-29 18:17:19 L1=1.52 run=9 blk=0 avail=7255 (52.7%) swpO=0 conn=7 myRSS=2814 php=12 phpRSS=1565 ap=29 tcp=42 topuser=madalice