INCIDENT 2026-08-29 18:19:21 trigger: php_rss=1832MB ================================================================== load: 2.54 1.91 1.51 3/657 568767 ncpu:10 mem_avail: 6951MB/13777MB (50.5%) swap_used:1484MB swapout:2/s blocked(D):0 running:4 iowait:0.0% steal:0.0% php: 14 procs / 1832MB heaviest user: madalice (10 procs, 1566MB) apache: 23 procs tcp_estab: 32 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2814 madalice 10 1566 root 251 1083 nobody 22 394 netdata 7 199 evolution 8 198 mailman 20 190 cpanellogin 1 62 dovenull 6 56 otterfencing 1 54 wp-toolkit 3 43 mailnull 4 39 zabbix 1 23 dovecot 3 22 named 1 16 lowrange 1 14 candyfabcom 1 14 kurri 1 13 polkitd 1 6 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1566 evolution 2 185 otterfencing 1 56 root 1 27 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4680 MB Active(file): 4383 MB Inactive(file): 870 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 577 MB CommitLimit: 10984 MB Committed_AS: 8477 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-16:00:40 7112 /usr/bin/imunify-agent-proxy 497928 root 19:20 1332 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2882040 9.0 Ssl 1-16:00:09 /usr/sbin/mariadbd 508924 1 netdata 178764 1.9 Ssl 1-15:59:38 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 568585 567696 evolution 175264 5.6 S 00:13 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 83639 1451906 root 174448 0.0 S 02:21:46 spamd child 567421 510022 madalice 162488 8.3 S 01:31 php-fpm: pool madalice_com_au 567419 510022 madalice 161568 9.6 S 01:31 php-fpm: pool madalice_com_au 1502904 1451906 root 161056 0.0 S 15:42:58 spamd child 566892 510022 madalice 161052 10.0 S 02:03 php-fpm: pool madalice_com_au 567420 510022 madalice 160448 9.8 S 01:31 php-fpm: pool madalice_com_au 567418 510022 madalice 160332 9.0 S 01:31 php-fpm: pool madalice_com_au 567417 510022 madalice 160224 8.7 S 01:31 php-fpm: pool madalice_com_au 566894 510022 madalice 160180 10.2 S 02:03 php-fpm: pool madalice_com_au 566895 510022 madalice 159712 9.8 S 02:03 php-fpm: pool madalice_com_au 567410 510022 madalice 159320 9.5 S 01:32 php-fpm: pool madalice_com_au 566890 510022 madalice 158612 9.9 S 02:04 php-fpm: pool madalice_com_au 1451906 1 root 131428 0.0 Ss 15:56:13 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509266 1 root 112588 0.0 Ss 1-15:59:35 /usr/lib/systemd/systemd-journald 509236 509098 root 64472 0.0 Sl 1-15:59:35 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 463083 1353308 cpanellogin 64164 0.0 S 30:33 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 568732 567682 otterfencing 62860 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 42268 0.1 Ss 38-15:38:01 cpsrvd (SSL) - waiting for connections 509640 508992 root 38936 0.0 Sl 1-15:59:33 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 33384 0.0 Ss 15:57:06 lfd - sleeping 568730 1469 root 28820 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 568810 1469 root 28820 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 28324 0.0 Ss 1-15:59:31 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 25652 0.0 Ss 1-14:07:12 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 483898 1 zabbix 23652 0.2 Ssl 1-16:00:52 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 565805 506832 nobody 23244 0.1 S 03:30 /usr/sbin/httpd -k start 1469 1 root 22488 0.1 Ss 61-08:09:30 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 549529 506832 nobody 21884 0.1 S 05:42 /usr/sbin/httpd -k start 1463 1 root 21388 0.0 Ss 61-08:09:30 tailwatchd 566822 506832 nobody 21272 0.0 S 02:11 /usr/sbin/httpd -k start 567696 506832 nobody 20996 0.0 S 01:13 /usr/sbin/httpd -k start 567528 506832 nobody 20868 0.1 S 01:25 /usr/sbin/httpd -k start 567207 506832 nobody 20788 0.0 S 01:59 /usr/sbin/httpd -k start 567682 506832 nobody 20572 0.0 S 01:14 /usr/sbin/httpd -k start 567211 506832 nobody 20260 0.0 S 01:59 /usr/sbin/httpd -k start 566530 506832 nobody 20248 0.0 S 02:47 /usr/sbin/httpd -k start 567683 506832 nobody 19856 0.0 S 01:14 /usr/sbin/httpd -k start 567662 506832 nobody 19532 0.0 S 01:16 /usr/sbin/httpd -k start 567684 506832 nobody 19420 0.0 S 01:14 /usr/sbin/httpd -k start 567695 506832 nobody 19184 0.1 S 01:13 /usr/sbin/httpd -k start 566901 506832 nobody 19000 0.0 S 02:01 /usr/sbin/httpd -k start 567694 506832 nobody 18980 0.0 S 01:13 /usr/sbin/httpd -k start 568588 506832 nobody 18192 0.0 S 00:13 /usr/sbin/httpd -k start 568602 506832 nobody 17840 0.0 S 00:11 /usr/sbin/httpd -k start 568604 506832 nobody 17712 0.0 S 00:11 /usr/sbin/httpd -k start 568594 506832 nobody 17644 0.0 S 00:12 /usr/sbin/httpd -k start 508634 1 named 17400 0.0 Ssl 1-15:59:43 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 568601 506832 nobody 17200 0.0 S 00:11 /usr/sbin/httpd -k start 509671 508992 netdata 17056 2.1 Sl 1-15:59:33 /usr/libexec/netdata/plugins.d/apps.plugin 1 938585 1 wp-toolkit 16232 0.0 Ss 1-14:07:12 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2766563 1471 root 16228 0.0 S 09:41:32 cPhulkd - dbprocessor 1471 1 root 16036 0.0 Ss 61-08:09:30 cPhulkd - processor 568572 1471 root 15076 0.0 S 00:15 cPhulkd - processor - http socket 550242 508511 lowrange 14748 0.0 S 04:47 dovecot/imap 481558 1 root 14480 0.1 Ssl 1-16:02:02 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 568685 508511 candyfabcom 14348 0.0 S 00:07 dovecot/imap 4180059 4180015 evolution 14244 0.0 Ss 1-18:19:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4132467 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min otterfencing/otterfencing.com.au-ssl_log 148 coscom/coscom.com.au-ssl_log 140 madalice/madalice.com.au-ssl_log 73 alison/alisonarts.com.au-ssl_log 72 otterfencing/otterfencing.com.au 31 evolution/portal.evolutionerp.com.au-ssl_log 24 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 139 52.139.37.240 122 158.23.147.79 72 158.23.184.117 34 3.84.14.142 30 4.205.62.107 26 20.48.251.3 24 203.54.180.238 2 50.6.169.131 2 209.42.20.222 2 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 2 190.6.176.90 2 17.166.21.101 2 162.241.144.20 2 162.144.20.85 2 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 24 GET /heartbeat.php 6 GET / 5 GET /store/hand-painted-nike-af1-afl-north-melbourne/ 3 GET /xmlrpc.php 3 GET /wp-includes/customize/index.php 3 GET /wp-content/admin.php 3 GET /wp-admin/user/index.php 3 GET /wp-admin.php 3 GET /mah.php 3 GET /file.php 3 GET /about.php 2 POST /wp-admin/admin-ajax.php 2 POST / 2 GET /zwso.php 2 GET /zoom1.php 2 GET /yanz.php 2 GET /xda.php 2 GET /wsws.php 2 GET /wp-sigunq.php 2 GET /wp-login.php --- busiest 3 vhosts: top paths + last 10 requests --- == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /this_is_a_new_hello_world.php 2 GET /dropdown.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /wzy.php 1 GET /wsws.php 1 GET /ws.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-l0gin.php 1 GET /wp-includes/widgets/index.php -- last 10 requests -- 20.48.251.3 - - [29/Aug/2026:18:19:11 +1000] "GET /lala.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [29/Aug/2026:18:19:12 +1000] "GET /public/bnn_.php.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [29/Aug/2026:18:19:12 +1000] "GET /wsws.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [29/Aug/2026:18:19:13 +1000] "GET /localconf.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [29/Aug/2026:18:19:13 +1000] "GET /bengi.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [29/Aug/2026:18:19:14 +1000] "GET /i.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [29/Aug/2026:18:19:14 +1000] "GET /guk.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [29/Aug/2026:18:19:15 +1000] "GET /config_dev.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [29/Aug/2026:18:19:15 +1000] "GET /aws_credentials.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [29/Aug/2026:18:19:15 +1000] "GET /aws-credentials.php HTTP/1.1" 401 36 "-" "-" == coscom/coscom.com.au-ssl_log == -- top paths -- 2 GET /zwso.php 2 GET /zoom1.php 2 GET /yanz.php 2 GET /wp-sigunq.php 2 GET /wp-includes/rest-api/ 2 GET /wp-includes/PHPMailer/ 2 GET /wp-includes/images/media/ 2 GET /wp-includes/images/crystal/ 2 GET /wp-includes/customize/index.php 2 GET /wp-content/themes/alera/alpha.php 2 GET /wp-content/file.php 2 GET /wp-content/admin.php -- last 10 requests -- 52.139.37.240 - - [29/Aug/2026:18:18:45 +1000] "GET /blog.php7 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:18:18:45 +1000] "GET /GOD.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:18:18:45 +1000] "GET /alumni_reg.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:18:18:45 +1000] "GET /depotcv.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:18:18:45 +1000] "GET /admin.php7 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:18:18:46 +1000] "GET /ini.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:18:18:46 +1000] "GET /nf.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:18:18:46 +1000] "GET /room.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:18:18:46 +1000] "GET /disagreed.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:18:18:46 +1000] "GET /kyami.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 5 GET /store/hand-painted-nike-af1-afl-north-melbourne/ 4 GET / 2 POST /wp-admin/admin-ajax.php 2 POST / 2 GET /users/login 2 GET /user/login 2 GET /signin 2 GET /sign-in 2 GET /secure 2 GET /reset-password 2 GET /register 2 GET /readme.html -- last 10 requests -- 160.153.252.100 - - [29/Aug/2026:18:18:42 +1000] "GET /author-sitemap.xml HTTP/1.1" 404 35716 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 162.144.20.85 - - [29/Aug/2026:18:18:50 +1000] "POST /xmlrpc.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 2a03:2880:f802:15:: - - [29/Aug/2026:18:18:50 +1000] "GET /product-tag/mix-and-match-socks/ HTTP/1.1" 200 35780 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safar 162.144.20.85 - - [29/Aug/2026:18:18:52 +1000] "GET /xmlrpc.php HTTP/1.1" 404 36636 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 108.167.132.58 - - [29/Aug/2026:18:18:55 +1000] "GET /wp-json/ultimate-member/v1/users HTTP/1.1" 404 95 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 114.119.143.14 - - [29/Aug/2026:18:18:56 +1000] "GET /store/hand-painted-nike-af1-afl-north-melbourne/?amp%3Bwcpr_page=2&wcpr_image=1&rating=4&wcpr_rating=2 HTTP/1.1" 404 36680 "https://madalice.com.au/store/hand-painted 103.239.138.71 - - [29/Aug/2026:18:18:59 +1000] "GET /wp-json/buddypress/v1/members HTTP/1.1" 404 95 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 20.237.250.71 - - [29/Aug/2026:18:19:03 +1000] "GET /wp-json/ HTTP/1.1" 200 52045 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 103.133.216.219 - - [29/Aug/2026:18:19:04 +1000] "GET /wp-json/learnpress/v1/users HTTP/1.1" 404 95 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 - - [29/Aug/2026:18:19:05 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 77 "https://madalice.com.au/wp-admin/post.php?post=34648&action=edit" "Mozilla/5.0 (Windows NT 10.0; W --- last 30 samples (run-up to this incident) --- 2026-08-29 18:16:59 L1=1.43 run=2 blk=0 avail=7908 (57.4%) swpO=0 conn=2 myRSS=2814 php=7 phpRSS=840 ap=22 tcp=35 topuser=madalice 2026-08-29 18:17:00 L1=1.43 run=2 blk=0 avail=7858 (57.0%) swpO=0 conn=2 myRSS=2814 php=7 phpRSS=887 ap=22 tcp=32 topuser=madalice 2026-08-29 18:17:09 L1=1.43 run=3 blk=0 avail=8043 (58.4%) swpO=0 conn=2 myRSS=2814 php=6 phpRSS=579 ap=23 tcp=34 topuser=madalice 2026-08-29 18:17:10 L1=1.43 run=3 blk=0 avail=8049 (58.4%) swpO=0 conn=3 myRSS=2814 php=7 phpRSS=695 ap=23 tcp=33 topuser=madalice 2026-08-29 18:17:19 L1=1.52 run=9 blk=0 avail=7255 (52.7%) swpO=0 conn=7 myRSS=2814 php=12 phpRSS=1565 ap=29 tcp=42 topuser=madalice 2026-08-29 18:17:20 L1=1.52 run=7 blk=0 avail=7467 (54.2%) swpO=0 conn=3 myRSS=2814 php=10 phpRSS=1297 ap=29 tcp=50 topuser=madalice 2026-08-29 18:17:30 L1=2.04 run=3 blk=0 avail=7113 (51.6%) swpO=0 conn=4 myRSS=2814 php=12 phpRSS=1546 ap=50 tcp=32 topuser=madalice 2026-08-29 18:17:30 L1=2.04 run=3 blk=0 avail=7079 (51.4%) swpO=0 conn=4 myRSS=2814 php=12 phpRSS=1579 ap=50 tcp=31 topuser=madalice 2026-08-29 18:17:40 L1=1.96 run=3 blk=0 avail=7204 (52.3%) swpO=0 conn=4 myRSS=2814 php=12 phpRSS=1526 ap=40 tcp=30 topuser=madalice 2026-08-29 18:17:40 L1=1.96 run=3 blk=0 avail=7269 (52.8%) swpO=0 conn=4 myRSS=2814 php=11 phpRSS=1413 ap=40 tcp=31 topuser=madalice 2026-08-29 18:17:50 L1=1.89 run=11 blk=0 avail=7074 (51.3%) swpO=0 conn=10 myRSS=2814 php=14 phpRSS=1747 ap=30 tcp=43 topuser=madalice 2026-08-29 18:17:50 L1=1.89 run=12 blk=0 avail=6841 (49.7%) swpO=0 conn=11 myRSS=2814 php=15 phpRSS=2008 ap=30 tcp=43 topuser=madalice 2026-08-29 18:18:00 L1=2.74 run=4 blk=0 avail=6817 (49.5%) swpO=3 conn=5 myRSS=2814 php=15 phpRSS=1971 ap=39 tcp=42 topuser=madalice 2026-08-29 18:18:00 L1=2.74 run=4 blk=0 avail=6741 (48.9%) swpO=3 conn=5 myRSS=2814 php=15 phpRSS=2053 ap=39 tcp=40 topuser=madalice 2026-08-29 18:18:10 L1=2.63 run=6 blk=0 avail=6555 (47.6%) swpO=0 conn=6 myRSS=2814 php=17 phpRSS=2227 ap=50 tcp=39 topuser=madalice 2026-08-29 18:18:10 L1=2.63 run=4 blk=0 avail=6599 (47.9%) swpO=0 conn=5 myRSS=2814 php=16 phpRSS=2147 ap=50 tcp=39 topuser=madalice 2026-08-29 18:18:20 L1=2.83 run=4 blk=0 avail=6850 (49.7%) swpO=0 conn=4 myRSS=2814 php=15 phpRSS=1940 ap=40 tcp=29 topuser=madalice 2026-08-29 18:18:20 L1=2.83 run=8 blk=0 avail=6784 (49.2%) swpO=0 conn=5 myRSS=2814 php=16 phpRSS=2049 ap=39 tcp=28 topuser=madalice 2026-08-29 18:18:30 L1=3.02 run=4 blk=0 avail=7104 (51.6%) swpO=0 conn=4 myRSS=2814 php=13 phpRSS=1710 ap=29 tcp=27 topuser=madalice 2026-08-29 18:18:30 L1=3.02 run=5 blk=0 avail=7093 (51.5%) swpO=0 conn=4 myRSS=2814 php=13 phpRSS=1721 ap=29 tcp=27 topuser=madalice 2026-08-29 18:18:40 L1=3.08 run=3 blk=0 avail=7160 (52.0%) swpO=0 conn=2 myRSS=2814 php=13 phpRSS=1681 ap=24 tcp=29 topuser=madalice 2026-08-29 18:18:40 L1=3.08 run=2 blk=0 avail=7153 (51.9%) swpO=0 conn=2 myRSS=2814 php=13 phpRSS=1685 ap=24 tcp=29 topuser=madalice 2026-08-29 18:18:50 L1=2.91 run=4 blk=0 avail=7170 (52.0%) swpO=0 conn=3 myRSS=2814 php=13 phpRSS=1669 ap=23 tcp=32 topuser=madalice 2026-08-29 18:18:51 L1=2.91 run=4 blk=0 avail=7159 (52.0%) swpO=0 conn=4 myRSS=2814 php=13 phpRSS=1686 ap=23 tcp=32 topuser=madalice 2026-08-29 18:19:01 L1=3.15 run=2 blk=0 avail=7005 (50.8%) swpO=0 conn=3 myRSS=2814 php=14 phpRSS=1870 ap=22 tcp=29 topuser=madalice 2026-08-29 18:19:01 L1=3.06 run=2 blk=0 avail=7001 (50.8%) swpO=0 conn=3 myRSS=2814 php=14 phpRSS=1874 ap=22 tcp=29 topuser=madalice 2026-08-29 18:19:11 L1=2.82 run=4 blk=0 avail=6775 (49.2%) swpO=0 conn=5 myRSS=2814 php=15 phpRSS=2098 ap=27 tcp=35 topuser=madalice 2026-08-29 18:19:11 L1=2.82 run=3 blk=0 avail=6765 (49.1%) swpO=0 conn=5 myRSS=2814 php=15 phpRSS=2111 ap=27 tcp=35 topuser=madalice 2026-08-29 18:19:21 L1=2.54 run=4 blk=0 avail=6951 (50.5%) swpO=2 conn=2 myRSS=2814 php=14 phpRSS=1832 ap=23 tcp=32 topuser=madalice 2026-08-29 18:19:21 L1=2.54 run=4 blk=0 avail=7028 (51.0%) swpO=2 conn=3 myRSS=2814 php=14 phpRSS=1837 ap=23 tcp=32 topuser=madalice