INCIDENT 2026-08-29 22:13:05 trigger: php_rss=1629MB ================================================================== load: 4.33 2.22 1.66 1/681 1412413 ncpu:10 mem_avail: 7315MB/13777MB (53.1%) swap_used:1788MB swapout:0/s blocked(D):0 running:1 iowait:0.1% steal:0.0% php: 12 procs / 1629MB heaviest user: madalice (10 procs, 1592MB) apache: 40 procs tcp_estab: 35 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2609 madalice 10 1592 root 258 1071 nobody 39 727 netdata 7 188 mailman 20 148 cpanellogin 1 71 dovenull 6 48 lowrange 3 42 wp-toolkit 3 34 aaa 2 29 kurri 2 26 evolution 7 24 zabbix 1 21 dovecot 3 20 mailnull 2 17 named 1 15 polkitd 1 5 nscd 1 5 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1592 root 1 23 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5147 MB Active(file): 2230 MB Inactive(file): 3227 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 573 MB CommitLimit: 10984 MB Committed_AS: 8626 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-19:54:25 6388 /usr/bin/imunify-agent-proxy 1351827 root 13:04 1080 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2671952 8.5 Ssl 1-19:53:54 /usr/sbin/mariadbd 508924 1 netdata 171796 1.9 Ssl 1-19:53:23 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83639 1451906 root 169036 0.0 S 06:15:31 spamd child 1411082 510022 madalice 164408 29.0 S 01:05 php-fpm: pool madalice_com_au 1411068 510022 madalice 164272 30.1 S 01:06 php-fpm: pool madalice_com_au 1410961 510022 madalice 164232 25.3 S 01:15 php-fpm: pool madalice_com_au 1410734 510022 madalice 164180 29.6 S 01:34 php-fpm: pool madalice_com_au 1411087 510022 madalice 163752 27.2 S 01:05 php-fpm: pool madalice_com_au 1410965 510022 madalice 163504 28.7 S 01:14 php-fpm: pool madalice_com_au 1410835 510022 madalice 162652 30.0 S 01:24 php-fpm: pool madalice_com_au 1410966 510022 madalice 162524 26.7 S 01:14 php-fpm: pool madalice_com_au 1502904 1451906 root 161788 0.0 S 19:36:43 spamd child 1411131 510022 madalice 160664 30.7 S 01:04 php-fpm: pool madalice_com_au 1410705 510022 madalice 160636 31.2 S 01:35 php-fpm: pool madalice_com_au 509266 1 root 117836 0.0 Ss 1-19:53:20 /usr/lib/systemd/systemd-journald 1451906 1 root 114588 0.0 Ss 19:49:58 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1136288 1353308 cpanellogin 73316 0.0 S 01:15:33 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 509236 509098 root 58316 0.0 Sl 1-19:53:20 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 40696 0.0 Sl 1-19:53:18 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 39692 0.1 Ss 38-19:31:46 cpsrvd (SSL) - waiting for connections 1451116 1 root 31448 0.0 Ss 19:50:51 lfd - sleeping 1412383 1469 root 28912 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1412400 1469 root 28904 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 24212 0.0 Ss 1-19:53:16 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1394763 506832 nobody 22680 0.0 S 04:35 /usr/sbin/httpd -k start 1393212 506832 nobody 22540 0.0 S 07:10 /usr/sbin/httpd -k start 1395185 506832 nobody 22508 0.1 S 04:03 /usr/sbin/httpd -k start 1410918 506832 nobody 22404 0.1 S 01:19 /usr/sbin/httpd -k start 483898 1 zabbix 22328 0.2 Ssl 1-19:54:37 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1411614 506832 nobody 21856 0.1 S 00:50 /usr/sbin/httpd -k start 1410363 506832 nobody 21816 0.0 S 02:09 /usr/sbin/httpd -k start 1410912 506832 nobody 21760 0.1 S 01:19 /usr/sbin/httpd -k start 1410482 506832 nobody 21604 0.1 S 01:56 /usr/sbin/httpd -k start 1411673 506832 nobody 21572 0.1 S 00:47 /usr/sbin/httpd -k start 1411636 506832 nobody 21400 0.1 S 00:49 /usr/sbin/httpd -k start 1411671 506832 nobody 21304 0.1 S 00:47 /usr/sbin/httpd -k start 1411128 506832 nobody 21008 0.0 S 01:04 /usr/sbin/httpd -k start 1410904 506832 nobody 20956 0.1 S 01:20 /usr/sbin/httpd -k start 1411656 506832 nobody 20900 0.1 S 00:48 /usr/sbin/httpd -k start 1410905 506832 nobody 20884 0.0 S 01:20 /usr/sbin/httpd -k start 1411635 506832 nobody 20776 0.1 S 00:49 /usr/sbin/httpd -k start 1411670 506832 nobody 20760 0.1 S 00:47 /usr/sbin/httpd -k start 1411693 506832 nobody 20716 0.1 S 00:46 /usr/sbin/httpd -k start 1410916 506832 nobody 20692 0.1 S 01:19 /usr/sbin/httpd -k start 1411687 506832 nobody 20520 0.1 S 00:46 /usr/sbin/httpd -k start 1410914 506832 nobody 20504 0.0 S 01:19 /usr/sbin/httpd -k start 1469 1 root 20484 0.1 Ss 61-12:03:15 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 938582 1 wp-toolkit 20424 0.0 Ss 1-18:00:57 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1410911 506832 nobody 20304 0.1 S 01:19 /usr/sbin/httpd -k start 1463 1 root 20256 0.0 Ss 61-12:03:15 tailwatchd 1395184 506832 nobody 20048 0.0 S 04:03 /usr/sbin/httpd -k start 1412171 506832 nobody 19984 0.0 S 00:15 /usr/sbin/httpd -k start 1411699 506832 nobody 19592 0.1 S 00:46 /usr/sbin/httpd -k start 1411698 506832 nobody 19512 0.0 S 00:46 /usr/sbin/httpd -k start 1411697 506832 nobody 19504 0.0 S 00:46 /usr/sbin/httpd -k start 1412160 506832 nobody 19376 0.1 S 00:16 /usr/sbin/httpd -k start 1411685 506832 nobody 19352 0.1 S 00:46 /usr/sbin/httpd -k start 1411684 506832 nobody 19340 0.0 S 00:46 /usr/sbin/httpd -k start 1412209 506832 nobody 19300 0.1 S 00:12 /usr/sbin/httpd -k start 1411657 506832 nobody 19260 0.0 S 00:48 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4208361 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 187 vinesit/vinesit.com.au-ssl_log 135 customc/customcentral.com.au-ssl_log 101 kurri/kurrimotorinn.com.au-ssl_log 59 otter2/otterfencing.net.au 50 evolution/my.evolutionerp.com.au-ssl_log 18 evolution/portal.evolutionerp.com.au-ssl_log 18 infinium/infinium.net.au-ssl_log 3 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 194 52.139.37.240 174 34.80.46.49 101 20.48.160.90 50 195.178.110.135 18 203.54.180.238 17 202.153.211.134 9 118.127.40.55 1 52.167.144.210 1 192.250.232.93 1 168.63.79.147 1 114.119.146.16 1 114.119.140.234 1 114.119.137.101 1 114.119.131.88 1 114.119.130.40 --- top request paths across all vhosts (last 3 min) --- 25 POST / 18 GET /heartbeat.php 10 POST /index.php 7 POST /functions.php 5 GET /wp-login.php 4 POST /wp-json/Batch/v1 4 POST /wp-json/batch/v1/ 4 POST /wp-json/batch/v1 4 POST //wp-json/batch/v1 4 POST /wordpress/wp-json/batch/v1 4 POST /blog/wp-json/batch/v1 4 GET /app/ajax.php 3 GET /wp-includes/images/media/ 3 GET /wp-admin/user/index.php 3 GET /mini.php 3 GET /mah.php 3 GET /mac.php 3 GET /index.php 2 POST /support_tickets.php 2 GET /zup.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 8 POST / 2 GET /wp-login.php 2 GET /@fs/proc/self/environ 2 GET / 1 GET /wp-config.php.old 1 GET /wp-config.php.bak 1 GET /wp-config.php 1 GET /wp-admin/ 1 GET /web/.env 1 GET /@vite/env 1 GET /v2/.env 1 GET /v1/graphql -- last 10 requests -- 34.80.46.49 - - [29/Aug/2026:22:12:57 +1000] "GET /.env.prod HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 34.80.46.49 - - [29/Aug/2026:22:12:57 +1000] "GET /application.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.2498.182 Safari/537.36; compatible 34.80.46.49 - - [29/Aug/2026:22:12:57 +1000] "GET /_next/../.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 34.80.46.49 - - [29/Aug/2026:22:12:57 +1000] "GET /i.php HTTP/1.1" 404 36612 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 34.80.46.49 - - [29/Aug/2026:22:12:57 +1000] "GET /pi.php HTTP/1.1" 404 36612 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Discordbot/2.0; +https://discordapp.com) Chrom 34.80.46.49 - - [29/Aug/2026:22:12:57 +1000] "GET /gradle.properties HTTP/1.1" 404 36619 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 34.80.46.49 - - [29/Aug/2026:22:12:58 +1000] "GET /_next/static/../.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)" 34.80.46.49 - - [29/Aug/2026:22:12:58 +1000] "GET /.bash_history HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.180.66 Safari/537.36 Edg/114.0.180.6 34.80.46.49 - - [29/Aug/2026:22:12:57 +1000] "GET /.gradle/gradle.properties HTTP/1.1" 404 36623 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Bytespider; +https://zhanzhang.toutiao.com/)" 34.80.46.49 - - [29/Aug/2026:22:12:57 +1000] "GET /.env~ HTTP/1.1" 404 36614 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" == vinesit/vinesit.com.au-ssl_log == -- top paths -- 2 GET /wp-includes/images/media/ 2 GET /wp-admin/user/index.php 2 GET /mini.php 2 GET /mah.php 2 GET /files/index.php 1 GET /zwso.php 1 GET /zup.php 1 GET /z.php 1 GET /zoom1.php 1 GET /zafir1.php 1 GET /yanz.php 1 GET /xxx.php -- last 10 requests -- 52.139.37.240 - - [29/Aug/2026:22:12:47 +1000] "GET /ac.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:12:47 +1000] "GET /ctex1.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:12:46 +1000] "GET /room.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:12:47 +1000] "GET /defaults.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:12:47 +1000] "GET /domains.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:12:48 +1000] "GET /dropdown.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:12:48 +1000] "GET /files/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:12:47 +1000] "GET /disagreed.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:12:48 +1000] "GET /flower.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:12:48 +1000] "GET /kyami.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == customc/customcentral.com.au-ssl_log == -- top paths -- 2 GET /wp-conffg.php 1 GET /xr.php 1 GET /xmini4.php 1 GET /xl2023.php 1 GET /xcc.php 1 GET /wp_xiPu52Ut.php 1 GET /wp-ws68.php 1 GET /wp-validate.php 1 GET /wp-tymanage.php 1 GET /wp-theme.php 1 GET /wp-signup.php 1 GET /wp-settings.php -- last 10 requests -- 20.48.160.90 - - [29/Aug/2026:22:12:36 +1000] "GET /xr.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [29/Aug/2026:22:12:37 +1000] "GET /Q3.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [29/Aug/2026:22:12:37 +1000] "GET /Q1.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [29/Aug/2026:22:12:37 +1000] "GET /nz.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [29/Aug/2026:22:12:38 +1000] "GET /sg.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [29/Aug/2026:22:12:38 +1000] "GET /hypo.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [29/Aug/2026:22:12:39 +1000] "GET /Hd.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [29/Aug/2026:22:12:39 +1000] "GET /im.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [29/Aug/2026:22:12:40 +1000] "GET /fc.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [29/Aug/2026:22:12:40 +1000] "GET /ke.php HTTP/1.1" 404 5750 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-29 22:10:34 L1=1.45 run=2 blk=0 avail=8771 (63.7%) swpO=0 conn=3 myRSS=2601 php=3 phpRSS=170 ap=15 tcp=25 topuser=madalice 2026-08-29 22:10:43 L1=1.33 run=1 blk=0 avail=8871 (64.4%) swpO=0 conn=1 myRSS=2601 php=3 phpRSS=78 ap=15 tcp=24 topuser=evolution 2026-08-29 22:10:45 L1=1.23 run=3 blk=0 avail=8883 (64.5%) swpO=0 conn=1 myRSS=2601 php=2 phpRSS=37 ap=15 tcp=26 topuser=root 2026-08-29 22:10:53 L1=1.21 run=1 blk=0 avail=8757 (63.6%) swpO=0 conn=1 myRSS=2601 php=4 phpRSS=211 ap=15 tcp=26 topuser=madalice 2026-08-29 22:10:55 L1=1.19 run=1 blk=0 avail=8750 (63.5%) swpO=0 conn=1 myRSS=2601 php=4 phpRSS=216 ap=15 tcp=30 topuser=madalice 2026-08-29 22:11:03 L1=1.01 run=1 blk=0 avail=8723 (63.3%) swpO=0 conn=1 myRSS=2609 php=4 phpRSS=211 ap=16 tcp=35 topuser=madalice 2026-08-29 22:11:05 L1=1.01 run=1 blk=0 avail=8734 (63.4%) swpO=0 conn=1 myRSS=2609 php=3 phpRSS=170 ap=16 tcp=36 topuser=madalice 2026-08-29 22:11:13 L1=0.85 run=3 blk=0 avail=8682 (63.0%) swpO=0 conn=1 myRSS=2609 php=6 phpRSS=315 ap=17 tcp=35 topuser=madalice 2026-08-29 22:11:15 L1=0.85 run=3 blk=0 avail=8717 (63.3%) swpO=0 conn=1 myRSS=2609 php=3 phpRSS=192 ap=17 tcp=35 topuser=madalice 2026-08-29 22:11:23 L1=0.88 run=2 blk=0 avail=8255 (59.9%) swpO=0 conn=3 myRSS=2609 php=5 phpRSS=272 ap=16 tcp=31 topuser=madalice 2026-08-29 22:11:25 L1=0.88 run=2 blk=0 avail=8187 (59.4%) swpO=0 conn=1 myRSS=2609 php=3 phpRSS=192 ap=16 tcp=31 topuser=madalice 2026-08-29 22:11:34 L1=0.82 run=1 blk=0 avail=8576 (62.3%) swpO=0 conn=3 myRSS=2609 php=6 phpRSS=407 ap=16 tcp=33 topuser=madalice 2026-08-29 22:11:35 L1=0.82 run=2 blk=0 avail=8520 (61.8%) swpO=0 conn=1 myRSS=2609 php=5 phpRSS=438 ap=16 tcp=34 topuser=madalice 2026-08-29 22:11:44 L1=0.84 run=1 blk=0 avail=8450 (61.3%) swpO=0 conn=3 myRSS=2609 php=5 phpRSS=484 ap=19 tcp=59 topuser=madalice 2026-08-29 22:11:45 L1=0.84 run=4 blk=0 avail=8407 (61.0%) swpO=0 conn=1 myRSS=2609 php=5 phpRSS=484 ap=23 tcp=60 topuser=madalice 2026-08-29 22:11:54 L1=0.78 run=1 blk=0 avail=7926 (57.5%) swpO=0 conn=3 myRSS=2609 php=10 phpRSS=990 ap=41 tcp=43 topuser=madalice 2026-08-29 22:11:55 L1=0.78 run=2 blk=0 avail=7957 (57.8%) swpO=0 conn=1 myRSS=2609 php=8 phpRSS=908 ap=40 tcp=37 topuser=madalice 2026-08-29 22:12:04 L1=1.29 run=10 blk=0 avail=7264 (52.7%) swpO=0 conn=8 myRSS=2609 php=15 phpRSS=1741 ap=41 tcp=55 topuser=madalice 2026-08-29 22:12:05 L1=1.29 run=1 blk=0 avail=7353 (53.4%) swpO=0 conn=1 myRSS=2609 php=12 phpRSS=1557 ap=41 tcp=50 topuser=madalice 2026-08-29 22:12:15 L1=1.61 run=3 blk=0 avail=7316 (53.1%) swpO=0 conn=2 myRSS=2609 php=13 phpRSS=1683 ap=33 tcp=58 topuser=madalice 2026-08-29 22:12:15 L1=1.61 run=6 blk=0 avail=7325 (53.2%) swpO=0 conn=5 myRSS=2609 php=12 phpRSS=1615 ap=33 tcp=62 topuser=madalice 2026-08-29 22:12:25 L1=1.45 run=4 blk=0 avail=7160 (52.0%) swpO=0 conn=3 myRSS=2609 php=14 phpRSS=1728 ap=59 tcp=54 topuser=madalice 2026-08-29 22:12:25 L1=1.45 run=8 blk=0 avail=7154 (51.9%) swpO=0 conn=2 myRSS=2609 php=14 phpRSS=1738 ap=59 tcp=48 topuser=madalice 2026-08-29 22:12:35 L1=3.37 run=6 blk=0 avail=7252 (52.6%) swpO=0 conn=6 myRSS=2609 php=12 phpRSS=1603 ap=53 tcp=62 topuser=madalice 2026-08-29 22:12:35 L1=3.37 run=7 blk=0 avail=7232 (52.5%) swpO=0 conn=7 myRSS=2609 php=12 phpRSS=1630 ap=53 tcp=56 topuser=madalice 2026-08-29 22:12:45 L1=3.82 run=3 blk=0 avail=7309 (53.1%) swpO=0 conn=1 myRSS=2609 php=13 phpRSS=1657 ap=44 tcp=39 topuser=madalice 2026-08-29 22:12:45 L1=3.82 run=2 blk=0 avail=7263 (52.7%) swpO=0 conn=2 myRSS=2609 php=13 phpRSS=1711 ap=44 tcp=37 topuser=madalice 2026-08-29 22:12:55 L1=4.66 run=5 blk=0 avail=7113 (51.6%) swpO=0 conn=6 myRSS=2609 php=13 phpRSS=1797 ap=50 tcp=56 topuser=madalice 2026-08-29 22:12:55 L1=4.66 run=5 blk=0 avail=7141 (51.8%) swpO=0 conn=5 myRSS=2609 php=12 phpRSS=1737 ap=50 tcp=56 topuser=madalice 2026-08-29 22:13:05 L1=4.33 run=1 blk=0 avail=7315 (53.1%) swpO=0 conn=1 myRSS=2609 php=12 phpRSS=1629 ap=40 tcp=35 topuser=madalice