INCIDENT 2026-08-29 18:18:20 trigger: php_rss=1940MB ================================================================== load: 2.83 1.74 1.42 4/670 567865 ncpu:10 mem_avail: 6850MB/13777MB (49.7%) swap_used:1484MB swapout:0/s blocked(D):0 running:4 iowait:0.0% steal:0.0% php: 15 procs / 1940MB heaviest user: madalice (10 procs, 1550MB) apache: 40 procs tcp_estab: 29 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2814 madalice 10 1550 root 250 1029 nobody 39 666 netdata 7 199 evolution 8 198 mailman 20 190 otterfencing 1 106 alison 2 93 cpanellogin 1 62 dovenull 6 56 wp-toolkit 3 43 zabbix 1 23 dovecot 3 22 mailnull 2 19 named 1 16 lowrange 1 14 kurri 1 13 polkitd 1 6 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1550 evolution 2 185 alison 2 113 otterfencing 1 106 root 1 27 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4747 MB Active(file): 4385 MB Inactive(file): 869 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 576 MB CommitLimit: 10984 MB Committed_AS: 8895 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-15:59:40 7112 /usr/bin/imunify-agent-proxy 497928 root 18:20 1332 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2882092 9.0 Ssl 1-15:59:09 /usr/sbin/mariadbd 508924 1 netdata 178680 1.9 Ssl 1-15:58:38 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 566886 566822 evolution 175344 1.1 S 01:04 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 83639 1451906 root 174448 0.0 S 02:20:46 spamd child 1502904 1451906 root 161056 0.0 S 15:41:58 spamd child 566890 510022 madalice 160088 14.2 S 01:04 php-fpm: pool madalice_com_au 566894 510022 madalice 159804 14.6 S 01:03 php-fpm: pool madalice_com_au 567417 510022 madalice 159768 15.2 S 00:31 php-fpm: pool madalice_com_au 567418 510022 madalice 159516 15.6 S 00:31 php-fpm: pool madalice_com_au 566892 510022 madalice 159092 14.2 S 01:03 php-fpm: pool madalice_com_au 566895 510022 madalice 158320 13.9 S 01:03 php-fpm: pool madalice_com_au 567410 510022 madalice 158024 17.3 S 00:32 php-fpm: pool madalice_com_au 567419 510022 madalice 157916 13.7 S 00:31 php-fpm: pool madalice_com_au 567421 510022 madalice 157608 14.2 S 00:31 php-fpm: pool madalice_com_au 567420 510022 madalice 157564 14.1 S 00:31 php-fpm: pool madalice_com_au 1451906 1 root 131456 0.0 Ss 15:55:13 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 567833 566530 otterfencing 113168 79.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509266 1 root 112588 0.0 Ss 1-15:58:35 /usr/lib/systemd/systemd-journald 567834 567211 alison 88328 47.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509236 509098 root 64472 0.0 Sl 1-15:58:35 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 463083 1353308 cpanellogin 64164 0.0 S 29:33 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 567864 566819 alison 56104 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353308 1 root 42268 0.1 Ss 38-15:37:01 cpsrvd (SSL) - waiting for connections 509640 508992 root 38936 0.0 Sl 1-15:58:33 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 33384 0.0 Ss 15:56:06 lfd - sleeping 510022 1 root 28324 0.0 Ss 1-15:58:31 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 25652 0.0 Ss 1-14:06:12 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 483898 1 zabbix 23784 0.2 Ssl 1-15:59:52 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1469 1 root 22488 0.1 Ss 61-08:08:30 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1463 1 root 21388 0.0 Ss 61-08:08:30 tailwatchd 549529 506832 nobody 21156 0.1 S 04:42 /usr/sbin/httpd -k start 566900 506832 nobody 21028 0.0 S 01:01 /usr/sbin/httpd -k start 565805 506832 nobody 20864 0.0 S 02:30 /usr/sbin/httpd -k start 567193 506832 nobody 20780 0.1 S 01:00 /usr/sbin/httpd -k start 567201 506832 nobody 20748 0.0 S 00:59 /usr/sbin/httpd -k start 567204 506832 nobody 20632 0.0 S 00:59 /usr/sbin/httpd -k start 566819 506832 nobody 20588 0.0 S 01:12 /usr/sbin/httpd -k start 567205 506832 nobody 19960 0.0 S 00:59 /usr/sbin/httpd -k start 566659 506832 nobody 19740 0.0 S 01:27 /usr/sbin/httpd -k start 567207 506832 nobody 19544 0.0 S 00:59 /usr/sbin/httpd -k start 567525 506832 nobody 19532 0.0 S 00:25 /usr/sbin/httpd -k start 567528 506832 nobody 19528 0.0 S 00:25 /usr/sbin/httpd -k start 566530 506832 nobody 19404 0.1 S 01:47 /usr/sbin/httpd -k start 567508 506832 nobody 19212 0.0 S 00:27 /usr/sbin/httpd -k start 567696 506832 nobody 19212 0.0 S 00:13 /usr/sbin/httpd -k start 567695 506832 nobody 19056 0.1 S 00:13 /usr/sbin/httpd -k start 567213 506832 nobody 18772 0.0 S 00:59 /usr/sbin/httpd -k start 567698 506832 nobody 18740 0.0 S 00:13 /usr/sbin/httpd -k start 567202 506832 nobody 18736 0.0 S 00:59 /usr/sbin/httpd -k start 567211 506832 nobody 18588 0.0 S 00:59 /usr/sbin/httpd -k start 567699 506832 nobody 18572 0.0 S 00:13 /usr/sbin/httpd -k start 567514 506832 nobody 18176 0.0 S 00:26 /usr/sbin/httpd -k start 567527 506832 nobody 17896 0.0 S 00:25 /usr/sbin/httpd -k start 567526 506832 nobody 17828 0.0 S 00:25 /usr/sbin/httpd -k start 567492 506832 nobody 17760 0.0 S 00:29 /usr/sbin/httpd -k start 567673 506832 nobody 17480 0.0 S 00:15 /usr/sbin/httpd -k start 508634 1 named 17400 0.0 Ssl 1-15:58:43 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 566901 506832 nobody 17400 0.1 S 01:01 /usr/sbin/httpd -k start 567194 506832 nobody 17384 0.1 S 01:00 /usr/sbin/httpd -k start 567694 506832 nobody 17248 0.0 S 00:13 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4132324 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 205 alison/alisonarts.com.au-ssl_log 112 otterfencing/otterfencing.com.au-ssl_log 66 coscom/coscom.com.au-ssl_log 60 madalice/madalice.com.au-ssl_log 60 bigdeals/bigdeals.com.au 46 otterfencing/otterfencing.com.au 41 evolution/portal.evolutionerp.com.au-ssl_log 24 olympic/olympicfencing.com.au-ssl_log 8 evolution/my.evolutionerp.com.au-ssl_log 1 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 205 40.115.94.245 112 158.23.184.117 68 52.139.37.240 66 158.23.147.79 46 20.220.10.235 38 4.205.62.107 34 3.84.14.142 24 203.54.180.238 7 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 4 118.127.40.55 2 47.128.32.38 2 17.166.21.101 2 162.241.144.20 2 114.119.143.104 2 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 120 GET /api/getItem/LWFBW2001KG 24 GET /heartbeat.php 23 GET /cgi-sys/suspendedpage.cgi 8 POST /wp-admin/admin-ajax.php 6 GET /store/hand-painted-nike-af1-afl-north-melbourne/ 5 GET / 3 POST /wp-cron.php 3 POST / 3 GET /wp-content/admin.php 3 GET /wp-admin.php 3 GET /file.php 2 GET /xmlrpc.php 2 GET /xda.php 2 GET /wp-login.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /wp-admin/maint 2 GET /wp-admin/about.php 2 GET /users/login 2 GET /user/login 2 GET /txets.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 120 GET /api/getItem/LWFBW2001KG 2 GET /api/getItem/GEB12-DL 1 GET /api/getItem/SPHDG15040 1 GET /api/getItem/S6 1 GET /api/getItem/S5 1 GET /api/getItem/S4 1 GET /api/getItem/S3 1 GET /api/getItem/S2 1 GET /api/getItem/S1 1 GET /api/getItem/RGW90 1 GET /api/getItem/RGW80 1 GET /api/getItem/RGW160 -- last 10 requests -- 40.115.94.245 - - [29/Aug/2026:18:16:13 +1000] "GET /api/getItem/RGW90 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:16:13 +1000] "GET /api/getItem/RGW100 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:16:13 +1000] "GET /api/getItem/RGW120 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:16:13 +1000] "GET /api/getItem/RGW160 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:16:14 +1000] "GET /api/getItem/RGW117T HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:16:14 +1000] "GET /api/getItem/RGW80 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:16:14 +1000] "GET /api/getItem/GP150x200x8 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:16:14 +1000] "GET /api/getItem/K125MSGB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:16:14 +1000] "GET /api/getItem/253-40SP HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:16:14 +1000] "GET /api/getItem/300558 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == alison/alisonarts.com.au-ssl_log == -- top paths -- 2 GET /wp-admin/maint 2 GET /new.php 2 GET / 1 GET /xmr.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /wp-trackback.php 1 GET /wp-themes.php 1 GET /wp-signup.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-includes/themes/uploads/config.php -- last 10 requests -- 158.23.184.117 - - [29/Aug/2026:18:18:06 +1000] "GET /admin/alfa-rex.php HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:18:07 +1000] "GET /wp-content/export.php HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:18:09 +1000] "GET /new.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:18:09 +1000] "GET /wp-content/plugins/revslider/admin.php HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safar 158.23.184.117 - - [29/Aug/2026:18:18:10 +1000] "GET /wp-content/images/uploads/admin.php HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/5 158.23.184.117 - - [29/Aug/2026:18:18:12 +1000] "GET /tools.php HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:18:13 +1000] "GET /wp-content/uploads/my.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:18:13 +1000] "GET /wp-includes/themes/uploads/config.php HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari 158.23.184.117 - - [29/Aug/2026:18:18:15 +1000] "GET /av.php HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:18:16 +1000] "GET /wp-includes/blocks/button HTTP/1.1" 301 300 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 2 GET /dropdown.php 1 GET /xmlrpc.php 1 GET /ws.php 1 GET /wp-login.php 1 GET /wp-includes/Text/index.php 1 GET /wp-includes/Text/about.php 1 GET /wp-includes/rest-api/about.php 1 GET /wp-includes/Requests/network.php 1 GET /wp-includes/Requests/about.php 1 GET /wp-includes/js/jcrop/Jcrop.php 1 GET /wp-includes/IXR/index.php 1 GET /wp-includes/images/wp-login.php -- last 10 requests -- 158.23.147.79 - - [29/Aug/2026:18:18:11 +1000] "GET /wp-includes/Requests/about.php HTTP/1.1" 404 5749 "-" "-" 158.23.147.79 - - [29/Aug/2026:18:18:12 +1000] "GET /wp-admin/includes/index.php HTTP/1.1" 404 5749 "-" "-" 158.23.147.79 - - [29/Aug/2026:18:18:12 +1000] "GET /wp-login.php HTTP/1.1" 404 5749 "-" "-" 158.23.147.79 - - [29/Aug/2026:18:18:12 +1000] "GET /wp-includes/js/jcrop/Jcrop.php HTTP/1.1" 404 5749 "-" "-" 158.23.147.79 - - [29/Aug/2026:18:18:13 +1000] "GET /wp-admin/images/about.php HTTP/1.1" 404 5749 "-" "-" 158.23.147.79 - - [29/Aug/2026:18:18:13 +1000] "GET /wp-includes/ID3/index.php HTTP/1.1" 404 5749 "-" "-" 158.23.147.79 - - [29/Aug/2026:18:18:14 +1000] "GET /wp-admin.php HTTP/1.1" 404 5749 "-" "-" 158.23.147.79 - - [29/Aug/2026:18:18:14 +1000] "GET /wp-includes/assets/index.php HTTP/1.1" 404 5749 "-" "-" 158.23.147.79 - - [29/Aug/2026:18:18:14 +1000] "GET /lock.php HTTP/1.1" 404 5749 "-" "-" 158.23.147.79 - - [29/Aug/2026:18:18:15 +1000] "GET /index/function.php HTTP/1.1" 404 5749 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-29 18:15:59 L1=1.81 run=3 blk=0 avail=8130 (59.0%) swpO=0 conn=3 myRSS=2814 php=7 phpRSS=621 ap=21 tcp=29 topuser=madalice 2026-08-29 18:15:59 L1=1.81 run=3 blk=0 avail=8085 (58.7%) swpO=0 conn=3 myRSS=2814 php=6 phpRSS=638 ap=21 tcp=26 topuser=madalice 2026-08-29 18:16:09 L1=1.84 run=3 blk=0 avail=8190 (59.4%) swpO=0 conn=3 myRSS=2814 php=6 phpRSS=550 ap=18 tcp=30 topuser=madalice 2026-08-29 18:16:09 L1=1.84 run=3 blk=0 avail=8149 (59.1%) swpO=0 conn=2 myRSS=2814 php=7 phpRSS=621 ap=18 tcp=28 topuser=madalice 2026-08-29 18:16:19 L1=1.87 run=2 blk=0 avail=8117 (58.9%) swpO=0 conn=3 myRSS=2814 php=6 phpRSS=632 ap=17 tcp=25 topuser=madalice 2026-08-29 18:16:19 L1=1.87 run=1 blk=0 avail=8198 (59.5%) swpO=0 conn=2 myRSS=2814 php=5 phpRSS=520 ap=17 tcp=21 topuser=madalice 2026-08-29 18:16:29 L1=1.66 run=2 blk=0 avail=8217 (59.6%) swpO=0 conn=2 myRSS=2814 php=5 phpRSS=523 ap=14 tcp=28 topuser=madalice 2026-08-29 18:16:30 L1=1.66 run=2 blk=0 avail=8162 (59.2%) swpO=0 conn=2 myRSS=2814 php=5 phpRSS=580 ap=14 tcp=25 topuser=madalice 2026-08-29 18:16:39 L1=1.48 run=1 blk=0 avail=8180 (59.4%) swpO=0 conn=2 myRSS=2814 php=5 phpRSS=520 ap=21 tcp=26 topuser=madalice 2026-08-29 18:16:40 L1=1.48 run=2 blk=0 avail=8183 (59.4%) swpO=0 conn=2 myRSS=2814 php=5 phpRSS=522 ap=20 tcp=24 topuser=madalice 2026-08-29 18:16:49 L1=1.41 run=2 blk=0 avail=8150 (59.2%) swpO=1 conn=2 myRSS=2814 php=6 phpRSS=620 ap=15 tcp=28 topuser=madalice 2026-08-29 18:16:50 L1=1.41 run=5 blk=0 avail=8097 (58.8%) swpO=1 conn=2 myRSS=2814 php=6 phpRSS=666 ap=15 tcp=26 topuser=madalice 2026-08-29 18:16:59 L1=1.43 run=2 blk=0 avail=7908 (57.4%) swpO=0 conn=2 myRSS=2814 php=7 phpRSS=840 ap=22 tcp=35 topuser=madalice 2026-08-29 18:17:00 L1=1.43 run=2 blk=0 avail=7858 (57.0%) swpO=0 conn=2 myRSS=2814 php=7 phpRSS=887 ap=22 tcp=32 topuser=madalice 2026-08-29 18:17:09 L1=1.43 run=3 blk=0 avail=8043 (58.4%) swpO=0 conn=2 myRSS=2814 php=6 phpRSS=579 ap=23 tcp=34 topuser=madalice 2026-08-29 18:17:10 L1=1.43 run=3 blk=0 avail=8049 (58.4%) swpO=0 conn=3 myRSS=2814 php=7 phpRSS=695 ap=23 tcp=33 topuser=madalice 2026-08-29 18:17:19 L1=1.52 run=9 blk=0 avail=7255 (52.7%) swpO=0 conn=7 myRSS=2814 php=12 phpRSS=1565 ap=29 tcp=42 topuser=madalice 2026-08-29 18:17:20 L1=1.52 run=7 blk=0 avail=7467 (54.2%) swpO=0 conn=3 myRSS=2814 php=10 phpRSS=1297 ap=29 tcp=50 topuser=madalice 2026-08-29 18:17:30 L1=2.04 run=3 blk=0 avail=7113 (51.6%) swpO=0 conn=4 myRSS=2814 php=12 phpRSS=1546 ap=50 tcp=32 topuser=madalice 2026-08-29 18:17:30 L1=2.04 run=3 blk=0 avail=7079 (51.4%) swpO=0 conn=4 myRSS=2814 php=12 phpRSS=1579 ap=50 tcp=31 topuser=madalice 2026-08-29 18:17:40 L1=1.96 run=3 blk=0 avail=7204 (52.3%) swpO=0 conn=4 myRSS=2814 php=12 phpRSS=1526 ap=40 tcp=30 topuser=madalice 2026-08-29 18:17:40 L1=1.96 run=3 blk=0 avail=7269 (52.8%) swpO=0 conn=4 myRSS=2814 php=11 phpRSS=1413 ap=40 tcp=31 topuser=madalice 2026-08-29 18:17:50 L1=1.89 run=11 blk=0 avail=7074 (51.3%) swpO=0 conn=10 myRSS=2814 php=14 phpRSS=1747 ap=30 tcp=43 topuser=madalice 2026-08-29 18:17:50 L1=1.89 run=12 blk=0 avail=6841 (49.7%) swpO=0 conn=11 myRSS=2814 php=15 phpRSS=2008 ap=30 tcp=43 topuser=madalice 2026-08-29 18:18:00 L1=2.74 run=4 blk=0 avail=6817 (49.5%) swpO=3 conn=5 myRSS=2814 php=15 phpRSS=1971 ap=39 tcp=42 topuser=madalice 2026-08-29 18:18:00 L1=2.74 run=4 blk=0 avail=6741 (48.9%) swpO=3 conn=5 myRSS=2814 php=15 phpRSS=2053 ap=39 tcp=40 topuser=madalice 2026-08-29 18:18:10 L1=2.63 run=6 blk=0 avail=6555 (47.6%) swpO=0 conn=6 myRSS=2814 php=17 phpRSS=2227 ap=50 tcp=39 topuser=madalice 2026-08-29 18:18:10 L1=2.63 run=4 blk=0 avail=6599 (47.9%) swpO=0 conn=5 myRSS=2814 php=16 phpRSS=2147 ap=50 tcp=39 topuser=madalice 2026-08-29 18:18:20 L1=2.83 run=4 blk=0 avail=6850 (49.7%) swpO=0 conn=4 myRSS=2814 php=15 phpRSS=1940 ap=40 tcp=29 topuser=madalice 2026-08-29 18:18:20 L1=2.83 run=8 blk=0 avail=6784 (49.2%) swpO=0 conn=5 myRSS=2814 php=16 phpRSS=2049 ap=39 tcp=28 topuser=madalice