INCIDENT 2026-08-29 18:27:24 trigger: php_rss=1822MB ================================================================== load: 3.79 2.30 1.79 15/683 602570 ncpu:10 mem_avail: 6832MB/13777MB (49.6%) swap_used:1485MB swapout:0/s blocked(D):0 running:21 iowait:0.0% steal:0.0% php: 14 procs / 1822MB heaviest user: madalice (10 procs, 1701MB) apache: 47 procs tcp_estab: 60 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2814 madalice 10 1664 root 250 1148 nobody 46 809 netdata 7 198 mailman 20 190 evolution 9 106 cpanellogin 1 64 dovenull 6 56 wp-toolkit 3 43 zabbix 1 23 dovecot 3 22 mailnull 2 19 named 1 16 lowrange 1 14 kurri 1 13 polkitd 1 6 nscd 1 5 cpanelconnecttrack 1 4 rpc 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1674 evolution 3 93 root 1 27 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4677 MB Active(file): 4384 MB Inactive(file): 868 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 578 MB CommitLimit: 10984 MB Committed_AS: 9125 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-16:08:43 7112 /usr/bin/imunify-agent-proxy 585675 root 04:45 55656 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2881680 9.0 Ssl 1-16:08:12 /usr/sbin/mariadbd 602483 510022 madalice 227448 90.2 R 00:04 php-fpm: pool madalice_com_au 602380 510022 madalice 198828 81.2 R 00:10 php-fpm: pool madalice_com_au 586007 510022 madalice 186084 17.6 R 04:17 php-fpm: pool madalice_com_au 508924 1 netdata 177752 1.9 Ssl 1-16:07:41 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83639 1451906 root 174436 0.0 S 02:29:49 spamd child 602386 510022 madalice 165784 69.8 R 00:10 php-fpm: pool madalice_com_au 602480 510022 madalice 164008 81.4 R 00:05 php-fpm: pool madalice_com_au 601734 510022 madalice 163384 21.5 R 01:33 php-fpm: pool madalice_com_au 602382 510022 madalice 163004 69.3 R 00:10 php-fpm: pool madalice_com_au 602434 510022 madalice 161176 74.2 R 00:10 php-fpm: pool madalice_com_au 1502904 1451906 root 161036 0.0 S 15:51:01 spamd child 602439 510022 madalice 159516 77.1 R 00:09 php-fpm: pool madalice_com_au 602443 510022 madalice 159508 69.6 S 00:09 php-fpm: pool madalice_com_au 1451906 1 root 131392 0.0 Ss 16:04:16 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509266 1 root 112852 0.0 Ss 1-16:07:38 /usr/lib/systemd/systemd-journald 463083 1353308 cpanellogin 65752 0.0 S 38:36 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 509236 509098 root 64472 0.0 Sl 1-16:07:38 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 585675 1 root 55656 0.5 Ssl 04:45 /opt/imunify360/venv/bin/python3 -m imav.run 1353308 1 root 42268 0.1 Ss 38-15:46:04 cpsrvd (SSL) - waiting for connections 602520 602509 evolution 40576 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 602518 602505 evolution 40528 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509640 508992 root 38936 0.0 Sl 1-16:07:36 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 33388 0.0 Ss 16:05:09 lfd - sleeping 602533 1469 root 29128 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 602519 1469 root 29120 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 28324 0.0 Ss 1-16:07:34 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 25652 0.0 Ss 1-14:15:15 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 483898 1 zabbix 23652 0.2 Ssl 1-16:08:55 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 587071 506832 nobody 23080 0.1 S 02:29 /usr/sbin/httpd -k start 1469 1 root 22488 0.1 Ss 61-08:17:33 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 586708 506832 nobody 22212 0.0 S 03:04 /usr/sbin/httpd -k start 601464 506832 nobody 22028 0.0 S 01:52 /usr/sbin/httpd -k start 602067 506832 nobody 21548 0.0 S 00:55 /usr/sbin/httpd -k start 1463 1 root 21388 0.0 Ss 61-08:17:33 tailwatchd 587061 506832 nobody 21172 0.0 S 02:29 /usr/sbin/httpd -k start 587047 506832 nobody 21148 0.0 S 02:30 /usr/sbin/httpd -k start 584795 506832 nobody 20804 0.0 S 06:00 /usr/sbin/httpd -k start 587045 506832 nobody 20772 0.0 S 02:30 /usr/sbin/httpd -k start 602450 506832 nobody 20440 0.3 S 00:08 /usr/sbin/httpd -k start 602449 506832 nobody 20436 0.3 S 00:08 /usr/sbin/httpd -k start 602060 506832 nobody 20400 0.0 S 00:56 /usr/sbin/httpd -k start 602448 506832 nobody 20324 0.3 S 00:08 /usr/sbin/httpd -k start 587074 506832 nobody 19920 0.0 S 02:29 /usr/sbin/httpd -k start 587066 506832 nobody 19908 0.0 S 02:29 /usr/sbin/httpd -k start 586022 506832 nobody 19580 0.1 S 04:13 /usr/sbin/httpd -k start 602066 506832 nobody 19436 0.0 S 00:55 /usr/sbin/httpd -k start 602458 506832 nobody 19280 0.1 S 00:07 /usr/sbin/httpd -k start 602491 506832 nobody 19280 0.3 S 00:03 /usr/sbin/httpd -k start 602498 506832 nobody 19276 0.5 S 00:02 /usr/sbin/httpd -k start 602499 506832 nobody 19276 0.5 S 00:02 /usr/sbin/httpd -k start 602490 506832 nobody 19248 0.3 S 00:03 /usr/sbin/httpd -k start 602276 506832 nobody 19244 0.0 S 00:27 /usr/sbin/httpd -k start 602451 506832 nobody 19188 0.2 S 00:08 /usr/sbin/httpd -k start 602497 506832 nobody 19188 0.5 S 00:02 /usr/sbin/httpd -k start 602437 506832 nobody 19160 0.2 S 00:09 /usr/sbin/httpd -k start 602459 506832 nobody 18188 0.0 S 00:07 /usr/sbin/httpd -k start 602438 506832 nobody 17840 0.0 S 00:09 /usr/sbin/httpd -k start 508634 1 named 17400 0.0 Ssl 1-16:07:46 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 602463 506832 nobody 17244 0.0 S 00:07 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4133382 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 4133380 | madalice_wp | madalice_wp | Query | 0 | Sending data | SELECT option_name, option_value FROM AMuqf6qZ_options WHERE autoload IN ( 'yes', 'on', 'auto-on', 'auto' ) | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min alison/alisonarts.com.au-ssl_log 106 customkidscom/customkids.com.au-ssl_log 96 madalice/madalice.com.au-ssl_log 64 cosgrovecreative/cosgrovecreative.com.au-ssl_log 57 speedlin/speedlinefencing.com.au 49 speedlin/speedlinefencing.com.au-ssl_log 49 whiz/whizengineering.com.au-ssl_log 39 coscom/coscom.com.au 30 evolution/portal.evolutionerp.com.au-ssl_log 20 otterfencing/otterfencing.com.au 10 customc/customcentral.com.au-ssl_log 5 evolution/evolutionerp.com.au-ssl_log 5 infinium/infinium.net.au-ssl_log 4 evolution/my.evolutionerp.com.au-ssl_log 3 olympic/olympicfencing.com.au-ssl_log 3 (total vhosts taking traffic: 20) --- top client IPs across all vhosts (last 3 min) --- 115 20.220.10.235 98 20.48.250.41 96 20.151.129.194 95 52.139.37.240 30 68.155.159.216 29 35.231.130.18 20 203.54.180.238 9 4.205.62.107 7 118.127.40.55 5 143.95.209.25 3 212.227.154.251 3 192.185.176.183 3 168.63.79.147 2 91.92.243.248 2 67.205.0.102 --- top request paths across all vhosts (last 3 min) --- 20 GET /heartbeat.php 7 GET /wp-login.php 6 POST /wp-cron.php 5 POST /wp-login.php 3 GET /wp-blog.php 3 GET /wp-act.php 3 GET /store/hand-painted-nike-af1-afl-essendon/ 3 GET /num.php 3 GET /new.php 3 GET /images/index.php 3 GET /grsiuk.php 3 GET /file.php 3 GET /click.php 3 GET /403.php 3 GET /155.php 3 GET / 2 GET /zu.php 2 GET /yyy.php 2 GET /xs.php 2 GET /xmlrpc.php --- busiest 3 vhosts: top paths + last 10 requests --- == alison/alisonarts.com.au-ssl_log == -- top paths -- 1 GET /ztv.php 1 GET /zoz.php 1 GET /Zeiss.php 1 GET /zafir1.php 1 GET /yyy.php 1 GET /xcre1.php 1 GET /X7T6.php 1 GET /x23.php 1 GET /x0x.php 1 GET /ww3.php 1 GET /ww2.php 1 GET /wsz.php -- last 10 requests -- 20.220.10.235 - - [29/Aug/2026:18:26:03 +1000] "GET /mh.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:26:04 +1000] "GET /f2r4.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:26:04 +1000] "GET /sadis.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:26:05 +1000] "GET /xcre1.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:26:05 +1000] "GET /motu.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:26:06 +1000] "GET /wefile.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:26:07 +1000] "GET /EM.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:26:07 +1000] "GET /ca4.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:26:08 +1000] "GET /x0x.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:26:08 +1000] "GET /fesa.php HTTP/1.1" 401 36 "-" "-" == customkidscom/customkids.com.au-ssl_log == -- top paths -- 2 GET /wp-content/themes/index.php 1 GET /zoo1.php 1 GET /xnm-apc.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp-temp.php 1 GET /wp.php 1 GET /wp-manager.php 1 GET /wp-mails.php 1 GET /wp-includes/Text/Diff/Engine/about.php 1 GET /wp-includes/Requests/ 1 GET /wp-includes/l10n/ -- last 10 requests -- 20.151.129.194 - - [29/Aug/2026:18:25:38 +1000] "GET /wp-admin/maint/index.php HTTP/1.1" 404 5750 "-" "-" 20.151.129.194 - - [29/Aug/2026:18:25:38 +1000] "GET /wp-includes/blocks/post-comments-form/ HTTP/1.1" 404 5750 "-" "-" 20.151.129.194 - - [29/Aug/2026:18:25:39 +1000] "GET /qazwsx.php HTTP/1.1" 404 5750 "-" "-" 20.151.129.194 - - [29/Aug/2026:18:25:39 +1000] "GET /elp.php?p= HTTP/1.1" 404 5750 "-" "-" 20.151.129.194 - - [29/Aug/2026:18:25:39 +1000] "GET /wp-content/uploads/ HTTP/1.1" 404 5750 "-" "-" 20.151.129.194 - - [29/Aug/2026:18:25:40 +1000] "GET /dorps.php HTTP/1.1" 404 5750 "-" "-" 20.151.129.194 - - [29/Aug/2026:18:25:40 +1000] "GET /cagor.php HTTP/1.1" 404 5750 "-" "-" 20.151.129.194 - - [29/Aug/2026:18:25:41 +1000] "GET /billzgs.php HTTP/1.1" 404 5750 "-" "-" 20.151.129.194 - - [29/Aug/2026:18:25:41 +1000] "GET /BDKR28_u7cn8y3b.php HTTP/1.1" 404 5750 "-" "-" 20.151.129.194 - - [29/Aug/2026:18:25:42 +1000] "GET /dftwg.php HTTP/1.1" 404 5750 "-" "-" == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET /store/hand-painted-nike-af1-afl-essendon/ 2 GET /users/login 2 GET /user/login 2 GET /signup 2 GET /signin 2 GET /sign-in 2 GET /secure 2 GET /register 2 GET /login 2 GET /forgot-password 2 GET /auth/login 2 GET /auth -- last 10 requests -- 35.231.130.18 - - [29/Aug/2026:18:27:20 +1000] "GET /signin HTTP/1.1" 404 36641 "https://www.madalice.com.au/signin" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safa 20.220.10.235 - - [29/Aug/2026:18:27:21 +1000] "GET /inject.php HTTP/1.1" 404 36642 "-" "-" 35.231.130.18 - - [29/Aug/2026:18:27:21 +1000] "GET /sign-in HTTP/1.1" 404 36641 "https://www.madalice.com.au/sign-in" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Sa 35.231.130.18 - - [29/Aug/2026:18:27:21 +1000] "GET /auth/login HTTP/1.1" 404 36645 "https://www.madalice.com.au/auth/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mob 35.231.130.18 - - [29/Aug/2026:18:27:21 +1000] "GET /forgot-password HTTP/1.1" 404 36644 "https://www.madalice.com.au/forgot-password" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149 35.231.130.18 - - [29/Aug/2026:18:27:21 +1000] "GET /login HTTP/1.1" 302 1 "https://www.madalice.com.au/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537 35.231.130.18 - - [29/Aug/2026:18:27:21 +1000] "GET /signup HTTP/1.1" 404 36641 "https://www.madalice.com.au/signup" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safa 35.231.130.18 - - [29/Aug/2026:18:27:22 +1000] "GET /reset-password HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [29/Aug/2026:18:27:21 +1000] "GET /auth HTTP/1.1" 404 36639 "https://www.madalice.com.au/auth" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/5 35.231.130.18 - - [29/Aug/2026:18:27:22 +1000] "GET /users/login HTTP/1.1" 404 36645 "https://www.madalice.com.au/users/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 M --- last 30 samples (run-up to this incident) --- 2026-08-29 18:25:03 L1=2.14 run=7 blk=0 avail=7804 (56.6%) swpO=0 conn=3 myRSS=2814 php=6 phpRSS=668 ap=46 tcp=37 topuser=madalice 2026-08-29 18:25:03 L1=2.14 run=7 blk=0 avail=7827 (56.8%) swpO=0 conn=1 myRSS=2814 php=6 phpRSS=679 ap=46 tcp=37 topuser=madalice 2026-08-29 18:25:13 L1=2.51 run=6 blk=0 avail=8017 (58.2%) swpO=0 conn=5 myRSS=2814 php=7 phpRSS=601 ap=36 tcp=33 topuser=madalice 2026-08-29 18:25:13 L1=2.51 run=8 blk=0 avail=7999 (58.1%) swpO=0 conn=1 myRSS=2814 php=7 phpRSS=617 ap=36 tcp=33 topuser=madalice 2026-08-29 18:25:23 L1=2.34 run=2 blk=0 avail=8231 (59.7%) swpO=0 conn=5 myRSS=2814 php=5 phpRSS=394 ap=26 tcp=27 topuser=madalice 2026-08-29 18:25:23 L1=2.34 run=4 blk=0 avail=8221 (59.7%) swpO=0 conn=1 myRSS=2814 php=5 phpRSS=401 ap=26 tcp=29 topuser=madalice 2026-08-29 18:25:33 L1=2.21 run=2 blk=0 avail=8259 (59.9%) swpO=0 conn=5 myRSS=2814 php=4 phpRSS=358 ap=23 tcp=26 topuser=madalice 2026-08-29 18:25:33 L1=2.21 run=6 blk=0 avail=8253 (59.9%) swpO=0 conn=1 myRSS=2814 php=4 phpRSS=358 ap=23 tcp=26 topuser=madalice 2026-08-29 18:25:43 L1=2.10 run=3 blk=0 avail=8058 (58.5%) swpO=0 conn=5 myRSS=2814 php=6 phpRSS=604 ap=22 tcp=30 topuser=madalice 2026-08-29 18:25:43 L1=2.10 run=3 blk=0 avail=8054 (58.5%) swpO=0 conn=1 myRSS=2814 php=6 phpRSS=604 ap=22 tcp=30 topuser=madalice 2026-08-29 18:25:53 L1=2.02 run=4 blk=0 avail=8070 (58.6%) swpO=0 conn=5 myRSS=2814 php=5 phpRSS=587 ap=20 tcp=28 topuser=madalice 2026-08-29 18:25:53 L1=2.02 run=3 blk=0 avail=8063 (58.5%) swpO=0 conn=1 myRSS=2814 php=5 phpRSS=596 ap=20 tcp=28 topuser=madalice 2026-08-29 18:26:03 L1=1.79 run=3 blk=0 avail=8153 (59.2%) swpO=1 conn=5 myRSS=2814 php=5 phpRSS=525 ap=19 tcp=24 topuser=madalice 2026-08-29 18:26:03 L1=1.79 run=5 blk=0 avail=8144 (59.1%) swpO=1 conn=1 myRSS=2814 php=5 phpRSS=532 ap=19 tcp=24 topuser=madalice 2026-08-29 18:26:13 L1=1.59 run=2 blk=0 avail=8220 (59.7%) swpO=0 conn=2 myRSS=2814 php=5 phpRSS=460 ap=19 tcp=22 topuser=madalice 2026-08-29 18:26:13 L1=1.59 run=3 blk=0 avail=8215 (59.6%) swpO=0 conn=1 myRSS=2814 php=5 phpRSS=463 ap=19 tcp=22 topuser=madalice 2026-08-29 18:26:23 L1=1.74 run=3 blk=0 avail=8255 (59.9%) swpO=0 conn=2 myRSS=2814 php=5 phpRSS=439 ap=17 tcp=24 topuser=madalice 2026-08-29 18:26:23 L1=1.74 run=6 blk=0 avail=8252 (59.9%) swpO=0 conn=1 myRSS=2814 php=5 phpRSS=440 ap=17 tcp=24 topuser=madalice 2026-08-29 18:26:33 L1=1.86 run=4 blk=0 avail=8143 (59.1%) swpO=0 conn=2 myRSS=2814 php=7 phpRSS=588 ap=20 tcp=24 topuser=madalice 2026-08-29 18:26:33 L1=1.86 run=7 blk=0 avail=8126 (59.0%) swpO=0 conn=4 myRSS=2814 php=7 phpRSS=602 ap=20 tcp=24 topuser=madalice 2026-08-29 18:26:43 L1=1.97 run=3 blk=0 avail=8251 (59.9%) swpO=0 conn=2 myRSS=2814 php=6 phpRSS=476 ap=16 tcp=25 topuser=madalice 2026-08-29 18:26:43 L1=1.97 run=2 blk=0 avail=8247 (59.9%) swpO=0 conn=4 myRSS=2814 php=6 phpRSS=479 ap=16 tcp=25 topuser=madalice 2026-08-29 18:26:53 L1=2.12 run=3 blk=0 avail=8268 (60.0%) swpO=0 conn=2 myRSS=2814 php=7 phpRSS=494 ap=16 tcp=25 topuser=madalice 2026-08-29 18:26:53 L1=2.12 run=3 blk=0 avail=8251 (59.9%) swpO=0 conn=4 myRSS=2814 php=7 phpRSS=504 ap=16 tcp=25 topuser=madalice 2026-08-29 18:27:03 L1=1.95 run=2 blk=0 avail=8291 (60.2%) swpO=0 conn=2 myRSS=2814 php=5 phpRSS=399 ap=17 tcp=26 topuser=madalice 2026-08-29 18:27:03 L1=1.95 run=3 blk=0 avail=8290 (60.2%) swpO=0 conn=4 myRSS=2814 php=5 phpRSS=399 ap=17 tcp=27 topuser=madalice 2026-08-29 18:27:13 L1=2.20 run=11 blk=0 avail=8167 (59.3%) swpO=0 conn=4 myRSS=2814 php=9 phpRSS=597 ap=18 tcp=35 topuser=madalice 2026-08-29 18:27:13 L1=2.20 run=10 blk=0 avail=8182 (59.4%) swpO=0 conn=8 myRSS=2814 php=9 phpRSS=579 ap=18 tcp=35 topuser=madalice 2026-08-29 18:27:24 L1=3.79 run=21 blk=0 avail=6832 (49.6%) swpO=0 conn=12 myRSS=2814 php=14 phpRSS=1822 ap=47 tcp=60 topuser=madalice 2026-08-29 18:27:24 L1=3.79 run=15 blk=0 avail=6822 (49.5%) swpO=0 conn=11 myRSS=2814 php=14 phpRSS=1846 ap=47 tcp=60 topuser=madalice