INCIDENT 2026-08-29 22:12:04 trigger: php_rss=1741MB ================================================================== load: 1.29 1.35 1.36 6/701 1411177 ncpu:10 mem_avail: 7264MB/13777MB (52.7%) swap_used:1812MB swapout:0/s blocked(D):0 running:10 iowait:1.0% steal:0.0% php: 15 procs / 1741MB heaviest user: madalice (10 procs, 1549MB) apache: 41 procs tcp_estab: 55 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2609 madalice 10 1559 root 256 1004 nobody 40 706 netdata 7 189 mailman 20 148 vinesit 14 118 evolution 9 104 cpanellogin 1 71 dovenull 6 48 lowrange 3 42 wp-toolkit 3 34 kurri 2 27 zabbix 1 21 dovecot 3 20 named 1 15 aaa 1 14 mailnull 1 6 polkitd 1 5 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1564 evolution 3 93 vinesit 1 78 root 1 23 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5166 MB Active(file): 2220 MB Inactive(file): 3221 MB Dirty: 173 MB Writeback: 0 MB SReclaimable: 573 MB CommitLimit: 10984 MB Committed_AS: 9057 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-19:53:23 6388 /usr/bin/imunify-agent-proxy 1351827 root 12:02 1080 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2671824 8.5 Ssl 1-19:52:53 /usr/sbin/mariadbd 1410734 510022 madalice 189608 31.0 R 00:33 php-fpm: pool madalice_com_au 1411068 510022 madalice 180152 73.0 R 00:05 php-fpm: pool madalice_com_au 1410835 510022 madalice 177868 37.6 R 00:23 php-fpm: pool madalice_com_au 1410705 510022 madalice 176676 33.8 R 00:34 php-fpm: pool madalice_com_au 508924 1 netdata 172580 1.9 Ssl 1-19:52:22 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83639 1451906 root 169040 0.0 S 06:14:30 spamd child 1502904 1451906 root 161788 0.0 S 19:35:42 spamd child 1410965 510022 madalice 160200 33.9 S 00:13 php-fpm: pool madalice_com_au 1410966 510022 madalice 160172 32.7 S 00:13 php-fpm: pool madalice_com_au 1410961 510022 madalice 160124 31.0 S 00:14 php-fpm: pool madalice_com_au 1411082 510022 madalice 160012 73.7 S 00:04 php-fpm: pool madalice_com_au 1411087 510022 madalice 137408 41.7 S 00:04 php-fpm: pool madalice_com_au 1411131 510022 madalice 136832 49.3 S 00:03 php-fpm: pool madalice_com_au 509266 1 root 117460 0.0 Ss 1-19:52:19 /usr/lib/systemd/systemd-journald 1451906 1 root 114588 0.0 Ss 19:48:57 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1411146 1395185 vinesit 88260 49.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1136288 1353308 cpanellogin 73264 0.0 S 01:14:32 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 509236 509098 root 58316 0.0 Sl 1-19:52:19 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1411144 1410914 evolution 41152 4.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1411147 1410864 evolution 41056 4.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509640 508992 root 40696 0.0 Sl 1-19:52:17 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 39692 0.1 Ss 38-19:30:45 cpsrvd (SSL) - waiting for connections 1451116 1 root 31436 0.0 Ss 19:49:50 lfd - sleeping 510022 1 root 24212 0.0 Ss 1-19:52:15 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1395185 506832 nobody 22452 0.0 S 03:02 /usr/sbin/httpd -k start 1393212 506832 nobody 22288 0.0 S 06:09 /usr/sbin/httpd -k start 1394744 506832 nobody 21936 0.1 S 03:35 /usr/sbin/httpd -k start 1394763 506832 nobody 21876 0.0 S 03:34 /usr/sbin/httpd -k start 483898 1 zabbix 21688 0.2 Ssl 1-19:53:36 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1410482 506832 nobody 21604 0.1 S 00:55 /usr/sbin/httpd -k start 1394680 506832 nobody 20800 0.0 S 03:41 /usr/sbin/httpd -k start 1469 1 root 20484 0.1 Ss 61-12:02:14 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1410866 506832 nobody 20480 0.2 S 00:20 /usr/sbin/httpd -k start 1411027 1377857 vinesit 20480 0.6 SN 00:08 cpanellogd - http logs for vinesit 938582 1 wp-toolkit 20424 0.0 Ss 1-17:59:56 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1410913 506832 nobody 20408 0.1 S 00:18 /usr/sbin/httpd -k start 1410904 506832 nobody 20320 0.1 S 00:19 /usr/sbin/httpd -k start 1410911 506832 nobody 20304 0.2 S 00:18 /usr/sbin/httpd -k start 1463 1 root 20256 0.0 Ss 61-12:02:14 tailwatchd 1395184 506832 nobody 20048 0.0 S 03:02 /usr/sbin/httpd -k start 1410363 506832 nobody 19788 0.0 S 01:08 /usr/sbin/httpd -k start 1410912 506832 nobody 19616 0.1 S 00:18 /usr/sbin/httpd -k start 1410836 506832 nobody 19576 0.0 S 00:22 /usr/sbin/httpd -k start 1410910 506832 nobody 19460 0.1 S 00:18 /usr/sbin/httpd -k start 1410907 506832 nobody 19440 0.1 S 00:19 /usr/sbin/httpd -k start 1410924 506832 nobody 19404 0.0 S 00:18 /usr/sbin/httpd -k start 1410905 506832 nobody 19336 0.1 S 00:19 /usr/sbin/httpd -k start 1411128 506832 nobody 19260 0.6 S 00:03 /usr/sbin/httpd -k start 1410906 506832 nobody 19220 0.1 S 00:19 /usr/sbin/httpd -k start 1410900 506832 nobody 19192 0.1 S 00:19 /usr/sbin/httpd -k start 1411084 506832 nobody 19192 0.2 S 00:04 /usr/sbin/httpd -k start 1411129 506832 nobody 19192 0.6 S 00:03 /usr/sbin/httpd -k start 1410903 506832 nobody 19168 0.1 S 00:19 /usr/sbin/httpd -k start 1410925 506832 nobody 19148 0.0 S 00:18 /usr/sbin/httpd -k start 1410902 506832 nobody 19140 0.1 S 00:19 /usr/sbin/httpd -k start 1377857 508116 root 19052 0.4 SN 08:32 cpanellogd - waiting for child to process logs for vinesit 1410922 506832 nobody 19008 0.0 S 00:18 /usr/sbin/httpd -k start 1410918 506832 nobody 18992 0.1 S 00:18 /usr/sbin/httpd -k start 1410914 506832 nobody 17884 0.0 S 00:18 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4208019 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 60 evolution/portal.evolutionerp.com.au-ssl_log 18 evolution/my.evolutionerp.com.au-ssl_log 17 customc/customcentral.com.au-ssl_log 13 infinium/infinium.net.au-ssl_log 13 aaa/aaadownunder.com.au-ssl_log 4 alison/alisonarts.com.au-ssl_log 1 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 55 34.80.46.49 18 203.54.180.238 15 202.153.211.134 13 20.48.160.90 6 118.127.40.55 4 168.63.79.147 2 52.167.144.210 2 103.77.162.29 2 103.239.138.71 1 91.92.243.239 1 52.7.33.248 1 198.235.24.139 1 192.250.232.93 1 114.119.146.16 1 114.119.143.104 --- top request paths across all vhosts (last 3 min) --- 18 GET /heartbeat.php 6 GET /wp-login.php 5 POST /functions.php 5 GET /index.php 5 GET /app/ajax.php 4 POST /wp-cron.php 3 POST /wp-login.php 3 GET / 2 POST / 1 POST /support_tickets.php 1 POST /app/ajax/selectTicketFilter.php 1 GET /wp-json/wp/v2/users/me 1 GET /wp-includes/blocks/query-title/footer.php 1 GET /wp-content/themes/wp-pridmag/init.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-content/plugins/ccx/index.php 1 GET /wp-admin/css/colors/coffee/index.php 1 GET /this_is_a_new_hello_world.php 1 GET /store/splatteraf1/ 1 GET /store/posty-af1/ --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 2 GET / 1 GET /store/splatteraf1/ 1 GET /store/posty-af1/ 1 GET /store/pink-dust-custom-af1-shoes/ 1 GET /store/peep-af1/ 1 GET /store/nike-af1-bluedog/ 1 GET /@fs/var/www/html/wp-config.php 1 GET /@fs/var/www/html/.env 1 GET /@fs/var/www/html/.aws/credentials 1 GET /@fs/var/www/.env 1 GET /@fs/var/www/.aws/credentials 1 GET /@fs/var/run/secrets/kubernetes.io/serviceaccount/token -- last 10 requests -- 114.119.146.16 - - [29/Aug/2026:22:11:55 +1000] "GET /store/nike-af1-bluedog/?amprating=2&wcpr_verified=1&rating=3&wcpr_rating=2 HTTP/1.1" 404 36663 "https://madalice.com.au/store/nike-af1-bluedog/?amprating=2&wcpr_verif 34.80.46.49 - - [29/Aug/2026:22:12:00 +1000] "GET /@fs/root/.ssh/id_ed25519?raw?? HTTP/1.1" 403 13 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko; compatible; GrokBot/1. 34.80.46.49 - - [29/Aug/2026:22:12:00 +1000] "GET /@fs/var/www/html/wp-config.php?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 34.80.46.49 - - [29/Aug/2026:22:12:00 +1000] "GET /@fs/root/.ssh/id_rsa?raw?? HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; WhatsApp/10.0.2.1" 34.80.46.49 - - [29/Aug/2026:22:12:00 +1000] "GET /@fs/home/ec2-user/.aws/config?raw?? HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:143.15) Gecko/20100101 Firefox/143.15; compatible; GPTBot/1.2; 34.80.46.49 - - [29/Aug/2026:22:12:00 +1000] "GET /@fs/proc/self/cmdline?raw?? HTTP/1.1" 404 36642 "-" "Mozilla/5.0 (compatible; Claude-SearchBot/1.0; +https://www.anthropic.com/claude-searchbot)" 34.80.46.49 - - [29/Aug/2026:22:12:00 +1000] "GET /@fs/root/.oci/config?raw?? HTTP/1.1" 404 36630 "-" "Mozilla/5.0 (compatible; Applebot/0.1; +http://www.apple.com/go/applebot)" 34.80.46.49 - - [29/Aug/2026:22:12:00 +1000] "GET /@fs/etc/nginx/nginx.conf?raw?? HTTP/1.1" 404 36631 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:121.7) Gecko/20100101 Firefox/121.7; compatible; WhatsApp/10.0.2 34.80.46.49 - - [29/Aug/2026:22:12:00 +1000] "GET /@fs/etc/apache2/apache2.conf?raw?? HTTP/1.1" 404 36644 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko; compatible; fac 34.80.46.49 - - [29/Aug/2026:22:12:00 +1000] "GET /@fs/var/run/secrets/kubernetes.io/serviceaccount/token?raw?? HTTP/1.1" 404 36661 "-" "Mozilla/5.0 (compatible; Claude-User/1.0; +https://www.anthropic.com/claude-user)" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 18 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [29/Aug/2026:22:10:43 +1000] "GET /heartbeat.php?sentAt=1788005444&bytes=106,146,204,68&_=1787897051195 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [29/Aug/2026:22:10:43 +1000] "GET /heartbeat.php?sentAt=1788005444&bytes=106,146,204,68&_=1787918089680 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [29/Aug/2026:22:10:53 +1000] "GET /heartbeat.php?sentAt=1788005454&bytes=106,146,204,78&_=1787897051196 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [29/Aug/2026:22:10:53 +1000] "GET /heartbeat.php?sentAt=1788005454&bytes=106,146,204,78&_=1787918089681 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [29/Aug/2026:22:11:03 +1000] "GET /heartbeat.php?sentAt=1788005464&bytes=106,146,204,88&_=1787897051197 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [29/Aug/2026:22:11:03 +1000] "GET /heartbeat.php?sentAt=1788005464&bytes=106,146,204,88&_=1787918089682 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [29/Aug/2026:22:11:13 +1000] "GET /heartbeat.php?sentAt=1788005474&bytes=106,146,204,98&_=1787897051198 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [29/Aug/2026:22:11:13 +1000] "GET /heartbeat.php?sentAt=1788005474&bytes=106,146,204,98&_=1787918089683 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [29/Aug/2026:22:11:23 +1000] "GET /heartbeat.php?sentAt=1788005484&bytes=106,146,204,108&_=1787897051199 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [29/Aug/2026:22:11:23 +1000] "GET /heartbeat.php?sentAt=1788005484&bytes=106,146,204,108&_=1787918089684 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 5 POST /functions.php 5 GET /index.php 5 GET /app/ajax.php 1 POST /support_tickets.php 1 POST /app/ajax/selectTicketFilter.php -- last 10 requests -- 202.153.211.134 - - [29/Aug/2026:22:10:57 +1000] "GET /index.php?page=support_companyedit&id=73 HTTP/1.1" 200 14406 "https://my.evolutionerp.com.au/index.php?page=support_companies" "Mozilla/5.0 (Windows NT 10.0; Win64; 202.153.211.134 - - [29/Aug/2026:22:10:57 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=support_tickets" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 202.153.211.134 - - [29/Aug/2026:22:10:58 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dsupport_companyedit%26id%3D73&call=getUserSetting&caller=ajaxSubmitLocal&seq=12906977640 HTTP/1.1" 200 107 "https://my.evolutio 202.153.211.134 - - [29/Aug/2026:22:11:00 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=support_companyedit&id=73" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 202.153.211.134 - - [29/Aug/2026:22:11:04 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=support_ticketedit&id=1003" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 202.153.211.134 - - [29/Aug/2026:22:11:07 +1000] "POST /support_tickets.php HTTP/1.1" 302 95 "https://my.evolutionerp.com.au/index.php?page=support_tickets" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ( 202.153.211.134 - - [29/Aug/2026:22:11:07 +1000] "GET /index.php?page=support_ticketedit&id=1348 HTTP/1.1" 200 49973 "https://my.evolutionerp.com.au/index.php?page=support_tickets" "Mozilla/5.0 (Windows NT 10.0; Win64; x 202.153.211.134 - - [29/Aug/2026:22:11:08 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=14313829654 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/ind 202.153.211.134 - - [29/Aug/2026:22:11:08 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=15079994163 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/inde 202.153.211.134 - - [29/Aug/2026:22:11:08 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dsupport_ticketedit%26id%3D1348&call=getUserSetting&caller=ajaxSubmitLocal&seq=19555780089 HTTP/1.1" 200 119 " --- last 30 samples (run-up to this incident) --- 2026-08-29 22:09:34 L1=1.72 run=3 blk=0 avail=8676 (63.0%) swpO=3 conn=3 myRSS=2601 php=5 phpRSS=272 ap=19 tcp=33 topuser=madalice 2026-08-29 22:09:43 L1=1.66 run=2 blk=0 avail=8663 (62.9%) swpO=0 conn=1 myRSS=2601 php=4 phpRSS=277 ap=19 tcp=29 topuser=madalice 2026-08-29 22:09:44 L1=1.53 run=3 blk=1 avail=8688 (63.1%) swpO=0 conn=3 myRSS=2601 php=5 phpRSS=277 ap=19 tcp=31 topuser=madalice 2026-08-29 22:09:53 L1=1.40 run=4 blk=0 avail=8719 (63.3%) swpO=0 conn=1 myRSS=2601 php=3 phpRSS=195 ap=18 tcp=26 topuser=madalice 2026-08-29 22:09:54 L1=1.37 run=1 blk=0 avail=8721 (63.3%) swpO=0 conn=3 myRSS=2601 php=4 phpRSS=231 ap=17 tcp=27 topuser=madalice 2026-08-29 22:10:03 L1=1.26 run=2 blk=0 avail=8735 (63.4%) swpO=0 conn=1 myRSS=2601 php=3 phpRSS=191 ap=17 tcp=23 topuser=madalice 2026-08-29 22:10:04 L1=1.40 run=3 blk=0 avail=8718 (63.3%) swpO=0 conn=3 myRSS=2601 php=4 phpRSS=233 ap=16 tcp=25 topuser=madalice 2026-08-29 22:10:13 L1=1.53 run=2 blk=0 avail=8738 (63.4%) swpO=0 conn=1 myRSS=2601 php=3 phpRSS=191 ap=16 tcp=24 topuser=madalice 2026-08-29 22:10:14 L1=1.57 run=3 blk=0 avail=8603 (62.4%) swpO=0 conn=3 myRSS=2601 php=6 phpRSS=416 ap=16 tcp=27 topuser=alison 2026-08-29 22:10:23 L1=1.68 run=3 blk=0 avail=8605 (62.5%) swpO=0 conn=1 myRSS=2601 php=3 phpRSS=170 ap=16 tcp=24 topuser=madalice 2026-08-29 22:10:24 L1=1.63 run=2 blk=0 avail=8747 (63.5%) swpO=0 conn=3 myRSS=2601 php=4 phpRSS=203 ap=15 tcp=24 topuser=madalice 2026-08-29 22:10:33 L1=1.58 run=3 blk=0 avail=8763 (63.6%) swpO=0 conn=1 myRSS=2601 php=4 phpRSS=210 ap=15 tcp=24 topuser=madalice 2026-08-29 22:10:34 L1=1.45 run=2 blk=0 avail=8771 (63.7%) swpO=0 conn=3 myRSS=2601 php=3 phpRSS=170 ap=15 tcp=25 topuser=madalice 2026-08-29 22:10:43 L1=1.33 run=1 blk=0 avail=8871 (64.4%) swpO=0 conn=1 myRSS=2601 php=3 phpRSS=78 ap=15 tcp=24 topuser=evolution 2026-08-29 22:10:45 L1=1.23 run=3 blk=0 avail=8883 (64.5%) swpO=0 conn=1 myRSS=2601 php=2 phpRSS=37 ap=15 tcp=26 topuser=root 2026-08-29 22:10:53 L1=1.21 run=1 blk=0 avail=8757 (63.6%) swpO=0 conn=1 myRSS=2601 php=4 phpRSS=211 ap=15 tcp=26 topuser=madalice 2026-08-29 22:10:55 L1=1.19 run=1 blk=0 avail=8750 (63.5%) swpO=0 conn=1 myRSS=2601 php=4 phpRSS=216 ap=15 tcp=30 topuser=madalice 2026-08-29 22:11:03 L1=1.01 run=1 blk=0 avail=8723 (63.3%) swpO=0 conn=1 myRSS=2609 php=4 phpRSS=211 ap=16 tcp=35 topuser=madalice 2026-08-29 22:11:05 L1=1.01 run=1 blk=0 avail=8734 (63.4%) swpO=0 conn=1 myRSS=2609 php=3 phpRSS=170 ap=16 tcp=36 topuser=madalice 2026-08-29 22:11:13 L1=0.85 run=3 blk=0 avail=8682 (63.0%) swpO=0 conn=1 myRSS=2609 php=6 phpRSS=315 ap=17 tcp=35 topuser=madalice 2026-08-29 22:11:15 L1=0.85 run=3 blk=0 avail=8717 (63.3%) swpO=0 conn=1 myRSS=2609 php=3 phpRSS=192 ap=17 tcp=35 topuser=madalice 2026-08-29 22:11:23 L1=0.88 run=2 blk=0 avail=8255 (59.9%) swpO=0 conn=3 myRSS=2609 php=5 phpRSS=272 ap=16 tcp=31 topuser=madalice 2026-08-29 22:11:25 L1=0.88 run=2 blk=0 avail=8187 (59.4%) swpO=0 conn=1 myRSS=2609 php=3 phpRSS=192 ap=16 tcp=31 topuser=madalice 2026-08-29 22:11:34 L1=0.82 run=1 blk=0 avail=8576 (62.3%) swpO=0 conn=3 myRSS=2609 php=6 phpRSS=407 ap=16 tcp=33 topuser=madalice 2026-08-29 22:11:35 L1=0.82 run=2 blk=0 avail=8520 (61.8%) swpO=0 conn=1 myRSS=2609 php=5 phpRSS=438 ap=16 tcp=34 topuser=madalice 2026-08-29 22:11:44 L1=0.84 run=1 blk=0 avail=8450 (61.3%) swpO=0 conn=3 myRSS=2609 php=5 phpRSS=484 ap=19 tcp=59 topuser=madalice 2026-08-29 22:11:45 L1=0.84 run=4 blk=0 avail=8407 (61.0%) swpO=0 conn=1 myRSS=2609 php=5 phpRSS=484 ap=23 tcp=60 topuser=madalice 2026-08-29 22:11:54 L1=0.78 run=1 blk=0 avail=7926 (57.5%) swpO=0 conn=3 myRSS=2609 php=10 phpRSS=990 ap=41 tcp=43 topuser=madalice 2026-08-29 22:11:55 L1=0.78 run=2 blk=0 avail=7957 (57.8%) swpO=0 conn=1 myRSS=2609 php=8 phpRSS=908 ap=40 tcp=37 topuser=madalice 2026-08-29 22:12:04 L1=1.29 run=10 blk=0 avail=7264 (52.7%) swpO=0 conn=8 myRSS=2609 php=15 phpRSS=1741 ap=41 tcp=55 topuser=madalice