INCIDENT 2026-08-29 18:29:25 trigger: php_rss=1604MB ================================================================== load: 2.84 2.61 1.98 1/643 604541 ncpu:10 mem_avail: 7268MB/13777MB (52.8%) swap_used:1485MB swapout:0/s blocked(D):0 running:2 iowait:0.0% steal:0.0% php: 12 procs / 1604MB heaviest user: madalice (10 procs, 1563MB) apache: 15 procs tcp_estab: 25 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2814 madalice 10 1563 root 247 1038 nobody 14 241 netdata 7 199 mailman 20 190 cpanellogin 1 64 dovenull 6 56 mailnull 5 53 wp-toolkit 3 43 evolution 7 27 zabbix 1 22 dovecot 3 22 named 1 16 lowrange 1 14 kurri 1 13 polkitd 1 6 nscd 1 5 cpanelconnecttrack 1 4 rpc 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1563 root 1 27 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4664 MB Active(file): 4380 MB Inactive(file): 865 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 579 MB CommitLimit: 10984 MB Committed_AS: 7987 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-16:10:45 7112 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2881692 9.0 Ssl 1-16:10:14 /usr/sbin/mariadbd 508924 1 netdata 178428 1.9 Ssl 1-16:09:43 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83639 1451906 root 174432 0.0 S 02:31:51 spamd child 586007 510022 madalice 162516 15.5 S 06:19 php-fpm: pool madalice_com_au 602380 510022 madalice 162024 17.2 S 02:12 php-fpm: pool madalice_com_au 601734 510022 madalice 161056 15.7 S 03:35 php-fpm: pool madalice_com_au 1502904 1451906 root 161032 0.0 S 15:53:03 spamd child 602439 510022 madalice 160596 16.5 S 02:11 php-fpm: pool madalice_com_au 602480 510022 madalice 160176 15.1 S 02:07 php-fpm: pool madalice_com_au 602434 510022 madalice 159624 17.1 S 02:12 php-fpm: pool madalice_com_au 602483 510022 madalice 159072 14.1 S 02:06 php-fpm: pool madalice_com_au 602386 510022 madalice 158912 16.0 S 02:12 php-fpm: pool madalice_com_au 602443 510022 madalice 158768 15.8 S 02:11 php-fpm: pool madalice_com_au 602382 510022 madalice 157880 16.6 S 02:12 php-fpm: pool madalice_com_au 1451906 1 root 131364 0.0 Ss 16:06:18 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509266 1 root 112852 0.0 Ss 1-16:09:40 /usr/lib/systemd/systemd-journald 463083 1353308 cpanellogin 65752 0.0 S 40:38 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 509236 509098 root 64472 0.0 Sl 1-16:09:40 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42268 0.1 Ss 38-15:48:06 cpsrvd (SSL) - waiting for connections 509640 508992 root 38936 0.0 Sl 1-16:09:38 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 33388 0.0 Ss 16:07:11 lfd - sleeping 510022 1 root 28324 0.0 Ss 1-16:09:36 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 25652 0.0 Ss 1-14:17:17 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 483898 1 zabbix 23244 0.2 Ssl 1-16:10:57 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 586708 506832 nobody 22664 0.0 S 05:06 /usr/sbin/httpd -k start 1469 1 root 22488 0.1 Ss 61-08:19:35 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 602066 506832 nobody 21632 0.0 S 02:57 /usr/sbin/httpd -k start 1463 1 root 21388 0.0 Ss 61-08:19:35 tailwatchd 603544 506832 nobody 20536 0.1 S 01:01 /usr/sbin/httpd -k start 604236 506832 nobody 20492 0.0 S 00:39 /usr/sbin/httpd -k start 604078 506832 nobody 20292 0.8 S 01:00 /usr/sbin/httpd -k start 604272 506832 nobody 20176 0.0 S 00:38 /usr/sbin/httpd -k start 604271 506832 nobody 19600 0.0 S 00:38 /usr/sbin/httpd -k start 604269 506832 nobody 19372 0.0 S 00:38 /usr/sbin/httpd -k start 604115 506832 nobody 18988 0.0 S 00:55 /usr/sbin/httpd -k start 604235 506832 nobody 18480 0.0 S 00:39 /usr/sbin/httpd -k start 604429 506832 nobody 18124 0.0 S 00:17 /usr/sbin/httpd -k start 604434 506832 nobody 17776 0.0 S 00:15 /usr/sbin/httpd -k start 508634 1 named 17400 0.0 Ssl 1-16:09:48 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 509671 508992 netdata 17056 2.1 Sl 1-16:09:38 /usr/libexec/netdata/plugins.d/apps.plugin 1 938585 1 wp-toolkit 16232 0.0 Ss 1-14:17:17 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2766563 1471 root 16228 0.0 S 09:51:37 cPhulkd - dbprocessor 1471 1 root 16036 0.0 Ss 61-08:19:35 cPhulkd - processor 550242 508511 lowrange 15348 0.0 S 14:52 dovecot/imap 481558 1 root 14480 0.1 Ssl 1-16:12:07 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 604571 1471 root 14420 0.0 S 00:00 cPhulkd - processor - http socket 4180059 4180015 evolution 14244 0.0 Ss 1-18:29:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 3883280 508511 kurri 13844 0.0 S 04:27:35 dovecot/imap 603509 508511 root 12944 0.0 S 01:02 dovecot/auth -w 506832 1 root 12536 0.0 Ss 1-16:10:13 /usr/sbin/httpd -k start 508514 508511 dovenull 12496 0.0 S 1-16:09:48 dovecot/imap-login 508865 508814 mailman 12484 0.0 S 1-16:09:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 508856 508814 mailman 12160 0.0 S 1-16:09:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 604504 508720 mailnull 11900 0.0 S 00:05 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 508518 508511 dovenull 11728 0.0 S 1-16:09:48 dovecot/imap-login 604501 508720 mailnull 11680 0.0 S 00:08 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 604503 508720 mailnull 11676 0.0 S 00:07 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 508855 508814 mailman 11516 0.0 S 1-16:09:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 508866 508814 mailman 11420 0.0 S 1-16:09:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 508864 508814 mailman 11248 0.0 S 1-16:09:46 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4133652 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 174 whiz/whizengineering.com.au-ssl_log 118 evolution/portal.evolutionerp.com.au-ssl_log 19 infinium/infinium.net.au-ssl_log 14 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 81 20.220.10.235 70 52.139.37.240 53 35.231.130.18 47 158.23.184.117 19 203.54.180.238 4 162.240.171.12 4 118.127.40.55 3 168.63.79.147 3 103.239.138.71 2 64.23.249.31 2 50.6.200.195 2 43.135.153.177 2 212.227.154.251 2 114.119.143.14 2 114.119.140.234 --- top request paths across all vhosts (last 3 min) --- 19 GET /heartbeat.php 9 GET /wp-login.php 5 GET / 3 POST /wp-login.php 3 GET /store/hand-painted-nike-af1-afl-essendon/ 2 POST /wp-cron.php 2 POST / 2 GET /xda.php 2 GET /wp-json/wp/v2/users/me 2 GET /wp-admin/maint 2 GET /wp-admin/ 2 GET /users/login 2 GET /user/login 2 GET /txets.php 2 GET /.trash7206/index.php 2 GET /store/hand-painted-nike-af1-afl-carlton/ 2 GET /storage/index.php 2 GET /signup 2 GET /signin 2 GET /sign-in --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET /wp-login.php 3 GET /store/hand-painted-nike-af1-afl-essendon/ 3 GET / 2 GET /wp-admin/ 2 GET /users/login 2 GET /user/login 2 GET /store/hand-painted-nike-af1-afl-carlton/ 2 GET /signup 2 GET /signin 2 GET /sign-in 2 GET /secure 2 GET /reset-password -- last 10 requests -- 20.220.10.235 - - [29/Aug/2026:18:29:07 +1000] "GET /bge.php HTTP/1.1" 404 36643 "-" "-" 114.119.137.101 - - [29/Aug/2026:18:29:08 +1000] "GET /store/hand-painted-nike-af1-afl-brisbane/?rating=2&wcpr_rating=1&wcpr_image=1 HTTP/1.1" 404 36659 "https://madalice.com.au/store/hand-painted-nike-af1-afl-brisbane/? 20.220.10.235 - - [29/Aug/2026:18:29:09 +1000] "GET /wp-ana.php HTTP/1.1" 404 36641 "-" "-" 15.235.140.103 - - [29/Aug/2026:18:29:10 +1000] "GET /wp-json/wc/pos/users HTTP/1.1" 404 95 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 20.220.10.235 - - [29/Aug/2026:18:29:10 +1000] "GET /secret.php HTTP/1.1" 404 36644 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:29:12 +1000] "GET /pro.php HTTP/1.1" 404 36640 "-" "-" 43.157.58.134 - - [29/Aug/2026:18:29:13 +1000] "GET /wp-json/wc/pos/v1/users HTTP/1.1" 404 95 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 20.220.10.235 - - [29/Aug/2026:18:29:14 +1000] "GET /999.php HTTP/1.1" 404 36644 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:29:15 +1000] "GET /sef.php HTTP/1.1" 404 36642 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:29:17 +1000] "GET /admin123.php HTTP/1.1" 404 36643 "-" "-" == whiz/whizengineering.com.au-ssl_log == -- top paths -- 2 GET /xda.php 2 GET /wp-admin/maint 2 GET /txets.php 2 GET /.trash7206/index.php 2 GET /storage/index.php 2 GET /Ov-Simple1.php 2 GET /new.php 2 GET /lock360.php 2 GET /7.php 2 GET /403.php 2 GET / 1 GET /zoom1.php -- last 10 requests -- 158.23.184.117 - - [29/Aug/2026:18:28:50 +1000] "GET /7.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:28:50 +1000] "GET /black.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:28:50 +1000] "GET /wp-blog-header.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:28:50 +1000] "GET /wp-content/themes HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:28:50 +1000] "GET /2.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:28:50 +1000] "GET /index/function.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:28:51 +1000] "GET /wp-admin/maint/repair.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:28:51 +1000] "GET /wp-admin/maint HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:28:51 +1000] "GET /wp-content/themes/index.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:28:51 +1000] "GET /xda.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 19 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [29/Aug/2026:18:27:43 +1000] "GET /heartbeat.php?sentAt=1787992064&bytes=106,146,152,0&_=1787918088342 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [29/Aug/2026:18:27:53 +1000] "GET /heartbeat.php?sentAt=1787992074&bytes=106,146,152,10&_=1787897049858 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [29/Aug/2026:18:27:53 +1000] "GET /heartbeat.php?sentAt=1787992074&bytes=106,146,152,10&_=1787918088343 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [29/Aug/2026:18:28:03 +1000] "GET /heartbeat.php?sentAt=1787992084&bytes=106,146,152,20&_=1787897049859 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [29/Aug/2026:18:28:03 +1000] "GET /heartbeat.php?sentAt=1787992084&bytes=106,146,152,20&_=1787918088344 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [29/Aug/2026:18:28:13 +1000] "GET /heartbeat.php?sentAt=1787992094&bytes=106,146,152,30&_=1787897049860 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [29/Aug/2026:18:28:13 +1000] "GET /heartbeat.php?sentAt=1787992094&bytes=106,146,152,30&_=1787918088345 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [29/Aug/2026:18:28:23 +1000] "GET /heartbeat.php?sentAt=1787992104&bytes=106,146,152,40&_=1787897049861 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [29/Aug/2026:18:28:23 +1000] "GET /heartbeat.php?sentAt=1787992104&bytes=106,146,152,40&_=1787918088346 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [29/Aug/2026:18:28:33 +1000] "GET /heartbeat.php?sentAt=1787992114&bytes=106,146,152,50&_=1787897049862 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-08-29 18:26:53 L1=2.12 run=3 blk=0 avail=8251 (59.9%) swpO=0 conn=4 myRSS=2814 php=7 phpRSS=504 ap=16 tcp=25 topuser=madalice 2026-08-29 18:27:03 L1=1.95 run=2 blk=0 avail=8291 (60.2%) swpO=0 conn=2 myRSS=2814 php=5 phpRSS=399 ap=17 tcp=26 topuser=madalice 2026-08-29 18:27:03 L1=1.95 run=3 blk=0 avail=8290 (60.2%) swpO=0 conn=4 myRSS=2814 php=5 phpRSS=399 ap=17 tcp=27 topuser=madalice 2026-08-29 18:27:13 L1=2.20 run=11 blk=0 avail=8167 (59.3%) swpO=0 conn=4 myRSS=2814 php=9 phpRSS=597 ap=18 tcp=35 topuser=madalice 2026-08-29 18:27:13 L1=2.20 run=10 blk=0 avail=8182 (59.4%) swpO=0 conn=8 myRSS=2814 php=9 phpRSS=579 ap=18 tcp=35 topuser=madalice 2026-08-29 18:27:24 L1=3.79 run=21 blk=0 avail=6832 (49.6%) swpO=0 conn=12 myRSS=2814 php=14 phpRSS=1822 ap=47 tcp=60 topuser=madalice 2026-08-29 18:27:24 L1=3.79 run=15 blk=0 avail=6822 (49.5%) swpO=0 conn=11 myRSS=2814 php=14 phpRSS=1846 ap=47 tcp=60 topuser=madalice 2026-08-29 18:27:34 L1=4.77 run=2 blk=0 avail=6968 (50.6%) swpO=0 conn=3 myRSS=2814 php=14 phpRSS=1683 ap=48 tcp=31 topuser=madalice 2026-08-29 18:27:36 L1=4.55 run=2 blk=0 avail=7002 (50.8%) swpO=0 conn=2 myRSS=2814 php=12 phpRSS=1611 ap=46 tcp=28 topuser=madalice 2026-08-29 18:27:44 L1=4.42 run=2 blk=0 avail=7043 (51.1%) swpO=0 conn=4 myRSS=2814 php=14 phpRSS=1687 ap=38 tcp=25 topuser=madalice 2026-08-29 18:27:46 L1=4.31 run=4 blk=0 avail=7002 (50.8%) swpO=0 conn=3 myRSS=2814 php=12 phpRSS=1699 ap=35 tcp=25 topuser=madalice 2026-08-29 18:27:54 L1=4.12 run=2 blk=0 avail=7106 (51.6%) swpO=0 conn=4 myRSS=2814 php=14 phpRSS=1689 ap=28 tcp=25 topuser=madalice 2026-08-29 18:27:56 L1=3.95 run=2 blk=0 avail=7072 (51.3%) swpO=0 conn=2 myRSS=2814 php=12 phpRSS=1691 ap=25 tcp=26 topuser=madalice 2026-08-29 18:28:04 L1=3.96 run=3 blk=0 avail=7151 (51.9%) swpO=0 conn=4 myRSS=2814 php=14 phpRSS=1724 ap=18 tcp=25 topuser=madalice 2026-08-29 18:28:06 L1=3.88 run=1 blk=0 avail=7214 (52.4%) swpO=0 conn=1 myRSS=2814 php=12 phpRSS=1603 ap=17 tcp=24 topuser=madalice 2026-08-29 18:28:14 L1=3.81 run=2 blk=0 avail=7106 (51.6%) swpO=0 conn=4 myRSS=2814 php=14 phpRSS=1772 ap=16 tcp=25 topuser=madalice 2026-08-29 18:28:16 L1=3.91 run=2 blk=0 avail=7221 (52.4%) swpO=0 conn=2 myRSS=2814 php=12 phpRSS=1600 ap=16 tcp=26 topuser=madalice 2026-08-29 18:28:24 L1=3.75 run=2 blk=0 avail=7189 (52.2%) swpO=0 conn=4 myRSS=2814 php=14 phpRSS=1681 ap=16 tcp=28 topuser=madalice 2026-08-29 18:28:26 L1=3.69 run=4 blk=0 avail=7191 (52.2%) swpO=0 conn=3 myRSS=2814 php=12 phpRSS=1607 ap=19 tcp=33 topuser=madalice 2026-08-29 18:28:35 L1=3.80 run=2 blk=0 avail=7188 (52.2%) swpO=0 conn=2 myRSS=2814 php=12 phpRSS=1604 ap=20 tcp=33 topuser=madalice 2026-08-29 18:28:36 L1=3.73 run=4 blk=0 avail=7088 (51.4%) swpO=0 conn=3 myRSS=2814 php=13 phpRSS=1729 ap=20 tcp=31 topuser=madalice 2026-08-29 18:28:45 L1=3.43 run=3 blk=0 avail=7212 (52.4%) swpO=0 conn=2 myRSS=2814 php=12 phpRSS=1613 ap=20 tcp=31 topuser=madalice 2026-08-29 18:28:46 L1=3.96 run=6 blk=0 avail=6871 (49.9%) swpO=0 conn=7 myRSS=2814 php=17 phpRSS=2080 ap=23 tcp=35 topuser=madalice 2026-08-29 18:28:55 L1=3.88 run=2 blk=0 avail=7208 (52.3%) swpO=0 conn=2 myRSS=2814 php=12 phpRSS=1622 ap=22 tcp=24 topuser=madalice 2026-08-29 18:28:56 L1=3.57 run=2 blk=0 avail=7193 (52.2%) swpO=0 conn=2 myRSS=2814 php=12 phpRSS=1648 ap=20 tcp=22 topuser=madalice 2026-08-29 18:29:05 L1=3.29 run=2 blk=0 avail=7209 (52.3%) swpO=0 conn=2 myRSS=2814 php=12 phpRSS=1658 ap=16 tcp=24 topuser=madalice 2026-08-29 18:29:07 L1=3.10 run=4 blk=0 avail=7187 (52.2%) swpO=0 conn=3 myRSS=2814 php=12 phpRSS=1683 ap=16 tcp=24 topuser=madalice 2026-08-29 18:29:15 L1=3.17 run=3 blk=0 avail=7155 (51.9%) swpO=0 conn=2 myRSS=2814 php=12 phpRSS=1695 ap=18 tcp=27 topuser=madalice 2026-08-29 18:29:17 L1=3.00 run=1 blk=0 avail=7243 (52.6%) swpO=0 conn=1 myRSS=2814 php=12 phpRSS=1605 ap=18 tcp=25 topuser=madalice 2026-08-29 18:29:25 L1=2.84 run=2 blk=0 avail=7268 (52.8%) swpO=0 conn=1 myRSS=2814 php=12 phpRSS=1604 ap=15 tcp=25 topuser=madalice