INCIDENT 2026-08-29 18:30:26 trigger: php_rss=1719MB ================================================================== load: 2.14 2.43 1.96 3/648 619777 ncpu:10 mem_avail: 7183MB/13777MB (52.1%) swap_used:1485MB swapout:0/s blocked(D):0 running:4 iowait:0.0% steal:0.0% php: 13 procs / 1719MB heaviest user: madalice (9 procs, 1418MB) apache: 17 procs tcp_estab: 27 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2814 madalice 9 1418 root 252 1058 nobody 16 280 corpkicks 2 242 netdata 7 199 mailman 20 190 cpanellogin 1 64 dovenull 6 56 wp-toolkit 3 43 evolution 7 27 zabbix 1 23 dovecot 3 22 mailnull 2 20 named 1 16 lowrange 1 14 candyfabcom 1 14 kurri 1 13 polkitd 1 6 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 9 1418 corpkicks 1 229 root 1 27 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4681 MB Active(file): 4398 MB Inactive(file): 861 MB Dirty: 159 MB Writeback: 0 MB SReclaimable: 579 MB CommitLimit: 10984 MB Committed_AS: 8233 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-16:11:46 7112 /usr/bin/imunify-agent-proxy 605346 root 00:25 3156 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2881700 9.0 Ssl 1-16:11:15 /usr/sbin/mariadbd 619731 604272 corpkicks 243456 57.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 508924 1 netdata 178736 1.9 Ssl 1-16:10:44 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83639 1451906 root 174408 0.0 S 02:32:52 spamd child 602483 510022 madalice 172228 11.7 R 03:07 php-fpm: pool madalice_com_au 602380 510022 madalice 163512 13.5 S 03:13 php-fpm: pool madalice_com_au 601734 510022 madalice 162848 13.8 S 04:36 php-fpm: pool madalice_com_au 1502904 1451906 root 161008 0.0 S 15:54:04 spamd child 602480 510022 madalice 160760 11.4 S 03:08 php-fpm: pool madalice_com_au 602434 510022 madalice 160600 13.4 S 03:13 php-fpm: pool madalice_com_au 602439 510022 madalice 160588 13.4 S 03:12 php-fpm: pool madalice_com_au 602443 510022 madalice 160296 13.1 S 03:12 php-fpm: pool madalice_com_au 602386 510022 madalice 158844 12.6 S 03:13 php-fpm: pool madalice_com_au 602382 510022 madalice 157920 13.1 S 03:13 php-fpm: pool madalice_com_au 1451906 1 root 131340 0.0 Ss 16:07:19 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509266 1 root 112852 0.0 Ss 1-16:10:41 /usr/lib/systemd/systemd-journald 463083 1353308 cpanellogin 65752 0.0 S 41:39 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 509236 509098 root 64472 0.0 Sl 1-16:10:41 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42268 0.1 Ss 38-15:49:07 cpsrvd (SSL) - waiting for connections 509640 508992 root 38936 0.0 Sl 1-16:10:39 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 33388 0.0 Ss 16:08:12 lfd - sleeping 510022 1 root 28324 0.0 Ss 1-16:10:37 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 25652 0.0 Ss 1-14:18:18 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 483898 1 zabbix 24448 0.2 Ssl 1-16:11:58 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1469 1 root 22488 0.1 Ss 61-08:20:36 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 604236 506832 nobody 21932 0.0 S 01:40 /usr/sbin/httpd -k start 602066 506832 nobody 21888 0.1 S 03:58 /usr/sbin/httpd -k start 1463 1 root 21388 0.0 Ss 61-08:20:36 tailwatchd 603544 506832 nobody 21164 0.0 S 02:02 /usr/sbin/httpd -k start 604115 506832 nobody 21120 0.2 S 01:56 /usr/sbin/httpd -k start 604272 506832 nobody 20860 0.0 S 01:39 /usr/sbin/httpd -k start 604235 506832 nobody 20780 0.2 S 01:40 /usr/sbin/httpd -k start 604078 506832 nobody 20736 0.6 S 02:01 /usr/sbin/httpd -k start 604271 506832 nobody 20144 0.0 S 01:39 /usr/sbin/httpd -k start 604269 506832 nobody 20020 0.0 S 01:39 /usr/sbin/httpd -k start 605274 506832 nobody 19860 0.0 S 00:30 /usr/sbin/httpd -k start 604429 506832 nobody 19776 0.0 S 01:18 /usr/sbin/httpd -k start 604434 506832 nobody 19648 0.3 S 01:16 /usr/sbin/httpd -k start 605304 506832 nobody 17896 0.0 S 00:27 /usr/sbin/httpd -k start 508634 1 named 17400 0.0 Ssl 1-16:10:49 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 509671 508992 netdata 17056 2.1 Sl 1-16:10:39 /usr/libexec/netdata/plugins.d/apps.plugin 1 938585 1 wp-toolkit 16232 0.0 Ss 1-14:18:18 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2766563 1471 root 16228 0.0 S 09:52:38 cPhulkd - dbprocessor 1471 1 root 16036 0.0 Ss 61-08:20:36 cPhulkd - processor 550242 508511 lowrange 15348 0.0 S 15:53 dovecot/imap 619671 1471 root 15108 0.0 S 00:05 cPhulkd - processor - http socket 605336 508511 corpkicks 14580 0.0 S 00:25 dovecot/imap 619670 508511 candyfabcom 14508 0.0 S 00:05 dovecot/imap 481558 1 root 14480 0.1 Ssl 1-16:13:08 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 4180059 4180015 evolution 14244 0.0 Ss 1-18:30:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 3883280 508511 kurri 13844 0.0 S 04:28:36 dovecot/imap 603509 508511 root 12944 0.0 S 02:03 dovecot/auth -w 619739 506832 nobody 12628 0.0 S 00:01 /usr/sbin/httpd -k start 506832 1 root 12536 0.0 Ss 1-16:11:14 /usr/sbin/httpd -k start 508514 508511 dovenull 12496 0.0 S 1-16:10:49 dovecot/imap-login 508865 508814 mailman 12476 0.0 S 1-16:10:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 508856 508814 mailman 12160 0.0 S 1-16:10:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 604504 508720 mailnull 11900 0.0 S 01:06 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 508518 508511 dovenull 11728 0.0 S 1-16:10:49 dovecot/imap-login 508855 508814 mailman 11516 0.0 S 1-16:10:47 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4134988 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 4134950 | corpkicks_wp_iwddf | corpkicks_wp_baolr | Query | 0 | Sending data | SELECT option_name, option_value FROM MPHOrV_options WHERE autoload IN ( 'yes', 'on', 'auto-on', 'auto' ) | +---------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 363 madalice/madalice.com.au-ssl_log 105 whiz/whizengineering.com.au-ssl_log 47 evolution/portal.evolutionerp.com.au-ssl_log 19 infinium/infinium.net.au-ssl_log 10 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 363 40.115.94.245 74 20.220.10.235 47 158.23.184.117 19 203.54.180.238 4 162.240.171.12 4 118.127.40.55 2 64.23.249.31 2 50.6.200.195 2 168.63.79.147 2 114.119.137.101 1 98.82.39.241 1 57.129.136.36 1 54.235.191.179 1 54.197.178.107 1 50.6.169.131 --- top request paths across all vhosts (last 3 min) --- 48 GET /api/getItem/LWHG2001KG 19 GET /heartbeat.php 9 GET /api/getItem/NA 4 GET /wp-login.php 4 GET /api/getItem/PWFBW3151KG 3 POST / 3 GET / 2 POST /wp-login.php 2 POST /wp-cron.php 2 GET /wp-admin/maint 2 GET /store/hand-painted-nike-af1-afl-carlton/ 2 GET /store/hand-painted-nike-af1-afl-brisbane/ 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 2 GET /api/getItem/SHSG757540-8 2 GET /api/getItem/SHSG757530-8 2 GET /api/getItem/SHSG757525-8 --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 48 GET /api/getItem/LWHG2001KG 9 GET /api/getItem/NA 4 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 2 GET /api/getItem/SHSG757540-8 2 GET /api/getItem/SHSG757530-8 2 GET /api/getItem/SHSG757525-8 2 GET /api/getItem/SHSG757520-8 -- last 10 requests -- 40.115.94.245 - - [29/Aug/2026:18:30:23 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:30:23 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:30:23 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:30:23 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:30:23 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:30:23 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:30:24 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:30:24 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:30:24 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:18:30:24 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == madalice/madalice.com.au-ssl_log == -- top paths -- 2 POST / 2 GET /store/hand-painted-nike-af1-afl-carlton/ 2 GET /store/hand-painted-nike-af1-afl-brisbane/ 2 GET / 1 GET /ztv.php 1 GET /zoz.php 1 GET /Zeiss.php 1 GET /zafir1.php 1 GET /xcre1.php 1 GET /X7T6.php 1 GET /x0x.php 1 GET /ww3.php -- last 10 requests -- 20.220.10.235 - - [29/Aug/2026:18:29:50 +1000] "GET /xcre1.php HTTP/1.1" 404 36644 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:29:51 +1000] "GET /motu.php HTTP/1.1" 404 36642 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:29:53 +1000] "GET /wefile.php HTTP/1.1" 404 36644 "-" "-" 50.6.169.131 - - [29/Aug/2026:18:29:54 +1000] "GET /wp-json/batch/v1/v1/users HTTP/1.1" 403 6221 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 118.127.40.55 - - [29/Aug/2026:18:29:55 +1000] "POST /?wordfence_syncAttackData=1787992195.5606 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://madalice.com.au" 20.220.10.235 - - [29/Aug/2026:18:29:54 +1000] "GET /EM.php HTTP/1.1" 404 36640 "-" "-" 114.119.143.104 - - [29/Aug/2026:18:29:56 +1000] "GET /store/hand-painted-af1-swoosh-rainbow/?amp%3Bwcpr_rating=2&verified=1&rating=4&wcpr_rating=1 HTTP/1.1" 404 36669 "https://madalice.com.au/store/hand-painted-af1-swoo 160.153.252.100 - - [29/Aug/2026:18:29:56 +1000] "GET /wp-json/elementor/v1/users HTTP/1.1" 404 95 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 20.220.10.235 - - [29/Aug/2026:18:29:57 +1000] "GET /ca4.php HTTP/1.1" 404 36643 "-" "-" 20.220.10.235 - - [29/Aug/2026:18:29:59 +1000] "GET /x0x.php HTTP/1.1" 404 36642 "-" "-" == whiz/whizengineering.com.au-ssl_log == -- top paths -- 2 GET /wp-admin/maint 1 GET /xda.php 1 GET /wp-signup.php 1 GET /wp-mail.php 1 GET /wp-includes/fonts/index.php 1 GET /wp-includes/blocks/search/index.php 1 GET /w.php 1 GET /wp-content/themes/index.php 1 GET /wp-content/themes/admin.php 1 GET /wp-content/themes 1 GET /wp-content/admin.php 1 GET /wp-content -- last 10 requests -- 158.23.184.117 - - [29/Aug/2026:18:28:50 +1000] "GET /7.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:28:50 +1000] "GET /black.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:28:50 +1000] "GET /wp-blog-header.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:28:50 +1000] "GET /wp-content/themes HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:28:50 +1000] "GET /2.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:28:50 +1000] "GET /index/function.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:28:51 +1000] "GET /wp-admin/maint/repair.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:28:51 +1000] "GET /wp-admin/maint HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:28:51 +1000] "GET /wp-content/themes/index.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:18:28:51 +1000] "GET /xda.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-29 18:27:56 L1=3.95 run=2 blk=0 avail=7072 (51.3%) swpO=0 conn=2 myRSS=2814 php=12 phpRSS=1691 ap=25 tcp=26 topuser=madalice 2026-08-29 18:28:04 L1=3.96 run=3 blk=0 avail=7151 (51.9%) swpO=0 conn=4 myRSS=2814 php=14 phpRSS=1724 ap=18 tcp=25 topuser=madalice 2026-08-29 18:28:06 L1=3.88 run=1 blk=0 avail=7214 (52.4%) swpO=0 conn=1 myRSS=2814 php=12 phpRSS=1603 ap=17 tcp=24 topuser=madalice 2026-08-29 18:28:14 L1=3.81 run=2 blk=0 avail=7106 (51.6%) swpO=0 conn=4 myRSS=2814 php=14 phpRSS=1772 ap=16 tcp=25 topuser=madalice 2026-08-29 18:28:16 L1=3.91 run=2 blk=0 avail=7221 (52.4%) swpO=0 conn=2 myRSS=2814 php=12 phpRSS=1600 ap=16 tcp=26 topuser=madalice 2026-08-29 18:28:24 L1=3.75 run=2 blk=0 avail=7189 (52.2%) swpO=0 conn=4 myRSS=2814 php=14 phpRSS=1681 ap=16 tcp=28 topuser=madalice 2026-08-29 18:28:26 L1=3.69 run=4 blk=0 avail=7191 (52.2%) swpO=0 conn=3 myRSS=2814 php=12 phpRSS=1607 ap=19 tcp=33 topuser=madalice 2026-08-29 18:28:35 L1=3.80 run=2 blk=0 avail=7188 (52.2%) swpO=0 conn=2 myRSS=2814 php=12 phpRSS=1604 ap=20 tcp=33 topuser=madalice 2026-08-29 18:28:36 L1=3.73 run=4 blk=0 avail=7088 (51.4%) swpO=0 conn=3 myRSS=2814 php=13 phpRSS=1729 ap=20 tcp=31 topuser=madalice 2026-08-29 18:28:45 L1=3.43 run=3 blk=0 avail=7212 (52.4%) swpO=0 conn=2 myRSS=2814 php=12 phpRSS=1613 ap=20 tcp=31 topuser=madalice 2026-08-29 18:28:46 L1=3.96 run=6 blk=0 avail=6871 (49.9%) swpO=0 conn=7 myRSS=2814 php=17 phpRSS=2080 ap=23 tcp=35 topuser=madalice 2026-08-29 18:28:55 L1=3.88 run=2 blk=0 avail=7208 (52.3%) swpO=0 conn=2 myRSS=2814 php=12 phpRSS=1622 ap=22 tcp=24 topuser=madalice 2026-08-29 18:28:56 L1=3.57 run=2 blk=0 avail=7193 (52.2%) swpO=0 conn=2 myRSS=2814 php=12 phpRSS=1648 ap=20 tcp=22 topuser=madalice 2026-08-29 18:29:05 L1=3.29 run=2 blk=0 avail=7209 (52.3%) swpO=0 conn=2 myRSS=2814 php=12 phpRSS=1658 ap=16 tcp=24 topuser=madalice 2026-08-29 18:29:07 L1=3.10 run=4 blk=0 avail=7187 (52.2%) swpO=0 conn=3 myRSS=2814 php=12 phpRSS=1683 ap=16 tcp=24 topuser=madalice 2026-08-29 18:29:15 L1=3.17 run=3 blk=0 avail=7155 (51.9%) swpO=0 conn=2 myRSS=2814 php=12 phpRSS=1695 ap=18 tcp=27 topuser=madalice 2026-08-29 18:29:17 L1=3.00 run=1 blk=0 avail=7243 (52.6%) swpO=0 conn=1 myRSS=2814 php=12 phpRSS=1605 ap=18 tcp=25 topuser=madalice 2026-08-29 18:29:25 L1=2.84 run=2 blk=0 avail=7268 (52.8%) swpO=0 conn=1 myRSS=2814 php=12 phpRSS=1604 ap=15 tcp=25 topuser=madalice 2026-08-29 18:29:27 L1=2.69 run=4 blk=0 avail=7265 (52.7%) swpO=0 conn=1 myRSS=2814 php=12 phpRSS=1603 ap=15 tcp=27 topuser=madalice 2026-08-29 18:29:35 L1=2.64 run=3 blk=0 avail=7262 (52.7%) swpO=0 conn=2 myRSS=2814 php=12 phpRSS=1610 ap=15 tcp=28 topuser=madalice 2026-08-29 18:29:37 L1=2.59 run=3 blk=0 avail=7265 (52.7%) swpO=0 conn=2 myRSS=2814 php=12 phpRSS=1604 ap=15 tcp=27 topuser=madalice 2026-08-29 18:29:46 L1=2.46 run=5 blk=0 avail=7142 (51.8%) swpO=0 conn=3 myRSS=2814 php=13 phpRSS=1760 ap=15 tcp=26 topuser=madalice 2026-08-29 18:29:47 L1=2.42 run=3 blk=0 avail=7003 (50.8%) swpO=0 conn=4 myRSS=2814 php=14 phpRSS=1940 ap=15 tcp=28 topuser=madalice 2026-08-29 18:29:56 L1=2.23 run=2 blk=0 avail=7270 (52.8%) swpO=0 conn=3 myRSS=2814 php=12 phpRSS=1611 ap=14 tcp=27 topuser=madalice 2026-08-29 18:29:57 L1=2.13 run=3 blk=0 avail=7285 (52.9%) swpO=0 conn=3 myRSS=2814 php=12 phpRSS=1609 ap=15 tcp=27 topuser=madalice 2026-08-29 18:30:06 L1=2.12 run=5 blk=0 avail=7194 (52.2%) swpO=0 conn=2 myRSS=2814 php=13 phpRSS=1682 ap=16 tcp=29 topuser=madalice 2026-08-29 18:30:07 L1=2.19 run=3 blk=0 avail=7186 (52.2%) swpO=0 conn=2 myRSS=2814 php=13 phpRSS=1682 ap=16 tcp=30 topuser=madalice 2026-08-29 18:30:16 L1=2.09 run=3 blk=0 avail=7207 (52.3%) swpO=0 conn=2 myRSS=2814 php=13 phpRSS=1680 ap=16 tcp=26 topuser=madalice 2026-08-29 18:30:17 L1=2.17 run=2 blk=0 avail=7208 (52.3%) swpO=0 conn=2 myRSS=2814 php=14 phpRSS=1715 ap=16 tcp=25 topuser=madalice 2026-08-29 18:30:26 L1=2.14 run=4 blk=0 avail=7183 (52.1%) swpO=0 conn=3 myRSS=2814 php=13 phpRSS=1719 ap=17 tcp=27 topuser=madalice