INCIDENT 2026-08-29 22:21:38 trigger: php_rss=1687MB ================================================================== load: 3.12 1.76 1.60 5/695 1446669 ncpu:10 mem_avail: 7151MB/13777MB (51.9%) swap_used:1786MB swapout:0/s blocked(D):0 running:5 iowait:0.0% steal:0.0% php: 12 procs / 1687MB heaviest user: madalice (10 procs, 1650MB) apache: 57 procs tcp_estab: 67 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2609 madalice 10 1672 root 252 1004 nobody 56 996 netdata 7 191 mailman 20 148 cpanellogin 1 71 dovenull 6 48 evolution 11 47 mailnull 4 39 wp-toolkit 3 34 aaa 2 30 kurri 2 27 zabbix 1 21 dovecot 3 20 named 1 15 lowrange 1 13 polkitd 1 5 nscd 1 5 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1681 root 1 23 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5615 MB Active(file): 2501 MB Inactive(file): 3458 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 575 MB CommitLimit: 10984 MB Committed_AS: 8968 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-20:02:58 6388 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2672040 8.5 Ssl 1-20:02:27 /usr/sbin/mariadbd 1446634 510022 madalice 234096 74.6 R 00:05 php-fpm: pool madalice_com_au 1445880 510022 madalice 193988 31.3 R 01:15 php-fpm: pool madalice_com_au 1446514 510022 madalice 191156 46.2 R 00:15 php-fpm: pool madalice_com_au 508924 1 netdata 174600 1.9 Ssl 1-20:01:56 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83639 1451906 root 169036 0.0 S 06:24:04 spamd child 1446218 510022 madalice 168464 35.1 R 00:44 php-fpm: pool madalice_com_au 1502904 1451906 root 161788 0.0 S 19:45:16 spamd child 1446517 510022 madalice 160312 44.2 S 00:15 php-fpm: pool madalice_com_au 1446406 510022 madalice 159992 40.2 S 00:28 php-fpm: pool madalice_com_au 1446532 510022 madalice 159820 41.5 S 00:13 php-fpm: pool madalice_com_au 1446511 510022 madalice 159688 51.9 S 00:16 php-fpm: pool madalice_com_au 1446633 510022 madalice 159628 69.1 S 00:06 php-fpm: pool madalice_com_au 1440686 510022 madalice 159460 27.1 S 01:30 php-fpm: pool madalice_com_au 509266 1 root 117836 0.0 Ss 1-20:01:53 /usr/lib/systemd/systemd-journald 1451906 1 root 114588 0.0 Ss 19:58:31 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1136288 1353308 cpanellogin 73468 0.0 S 01:24:06 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 509236 509098 root 58316 0.0 Sl 1-20:01:53 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 40696 0.0 Sl 1-20:01:51 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 39692 0.1 Ss 38-19:40:19 cpsrvd (SSL) - waiting for connections 1451116 1 root 31708 0.0 Ss 19:59:24 lfd - sleeping 510022 1 root 24212 0.0 Ss 1-20:01:49 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1431757 506832 nobody 23592 0.0 S 01:42 /usr/sbin/httpd -k start 1430083 506832 nobody 23360 0.0 S 04:25 /usr/sbin/httpd -k start 1411697 506832 nobody 22432 0.0 S 09:19 /usr/sbin/httpd -k start 483898 1 zabbix 22056 0.2 Ssl 1-20:03:10 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1445969 506832 nobody 21940 0.2 S 01:08 /usr/sbin/httpd -k start 1445956 506832 nobody 21756 0.2 S 01:09 /usr/sbin/httpd -k start 1445874 506832 nobody 21576 0.0 S 01:15 /usr/sbin/httpd -k start 1445971 506832 nobody 21432 0.2 S 01:08 /usr/sbin/httpd -k start 1431691 506832 nobody 20944 0.0 S 01:54 /usr/sbin/httpd -k start 1469 1 root 20484 0.1 Ss 61-12:11:48 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 938582 1 wp-toolkit 20424 0.0 Ss 1-18:09:30 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1446184 506832 nobody 20412 0.0 S 00:49 /usr/sbin/httpd -k start 1446176 506832 nobody 20296 0.0 S 00:50 /usr/sbin/httpd -k start 1463 1 root 20272 0.0 Ss 61-12:11:48 tailwatchd 1446194 506832 nobody 20088 0.0 S 00:48 /usr/sbin/httpd -k start 1445953 506832 nobody 19800 0.0 S 01:09 /usr/sbin/httpd -k start 1440433 506832 nobody 19780 0.1 S 01:30 /usr/sbin/httpd -k start 1446190 506832 nobody 19604 0.0 S 00:48 /usr/sbin/httpd -k start 1446542 506832 nobody 19580 0.0 S 00:11 /usr/sbin/httpd -k start 1446604 506832 nobody 19516 0.2 S 00:10 /usr/sbin/httpd -k start 1446545 506832 nobody 19488 0.1 S 00:11 /usr/sbin/httpd -k start 1446074 506832 nobody 19484 0.0 S 00:59 /usr/sbin/httpd -k start 1446544 506832 nobody 19484 0.1 S 00:11 /usr/sbin/httpd -k start 1446606 506832 nobody 19460 0.1 S 00:10 /usr/sbin/httpd -k start 1446537 506832 nobody 19432 0.0 S 00:12 /usr/sbin/httpd -k start 1446620 506832 nobody 19412 0.2 S 00:09 /usr/sbin/httpd -k start 1446608 506832 nobody 19392 0.2 S 00:10 /usr/sbin/httpd -k start 1446605 506832 nobody 19384 0.1 S 00:10 /usr/sbin/httpd -k start 1446182 506832 nobody 19324 0.0 S 00:49 /usr/sbin/httpd -k start 1445891 506832 nobody 19308 0.0 S 01:11 /usr/sbin/httpd -k start 1445801 506832 nobody 19292 0.0 S 01:20 /usr/sbin/httpd -k start 1446189 506832 nobody 19292 0.0 S 00:48 /usr/sbin/httpd -k start 1446624 506832 nobody 19204 0.3 S 00:09 /usr/sbin/httpd -k start 1446601 506832 nobody 19184 0.1 S 00:10 /usr/sbin/httpd -k start 1446603 506832 nobody 19128 0.2 S 00:10 /usr/sbin/httpd -k start 1446536 506832 nobody 19120 0.0 S 00:12 /usr/sbin/httpd -k start 1446628 506832 nobody 19120 0.1 S 00:09 /usr/sbin/httpd -k start 1446177 506832 nobody 19112 0.0 S 00:50 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4211893 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 4211890 | madalice_wp | madalice_wp | Query | 0 | Preparing | SELECT *, CASE WHEN `type` = 3 THEN 0 WHEN `type` = 4 THEN 1 WHEN `type` = 7 THEN 2 WHEN `type` = 6 THEN 3 WHEN `type` = 5 THEN 4 WHEN `type` = 9 THEN 5 WHEN `type` = 8 THEN 6 WHEN `type` = 2 THEN 7 WHEN `type` = 1 THEN 8 ELSE 9999 END AS `typeSort`, CASE WHEN `type` = 3 THEN `parameters` WHEN `ty | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/portal.evolutionerp.com.au-ssl_log 282 bigdeals/bigdeals.com.au-ssl_log 130 infinium/infinium.net.au-ssl_log 72 madalice/madalice.com.au-ssl_log 66 corpkicks/corporatekicks.com.au-ssl_log 4 alison/alisonarts.com.au-ssl_log 3 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 251 34.22.208.61 124 20.104.18.15 68 52.139.37.240 33 2403:5810:8010:0:cee4:1bb5:1492:eee3 31 203.54.180.238 24 35.231.130.18 5 45.148.10.140 5 118.127.40.55 2 17.166.233.9 1 91.92.243.239 1 74.7.230.12 1 47.128.17.152 1 34.196.51.17 1 207.46.13.78 1 168.63.79.147 --- top request paths across all vhosts (last 3 min) --- 31 GET /heartbeat.php 12 GET / 4 POST /wp-cron.php 4 POST / 3 GET /userlogin.php 3 GET /store/hand-painted-nike-af1-wildroses/ 3 GET /login 2 POST /wp-login.php 2 GET /users/login 2 GET /user/login 2 GET /store/hand-painted-nike-af1-titans/ 2 GET /store/cartoon-drippy-pink-nike-court-vision/ 2 GET /store/butterfly-air-force-1-with-crystal-swoosh/ 2 GET /signup 2 GET /sign-in 2 GET /secure 2 GET /mac.php 2 GET /goods.php 2 GET /@fs/proc/self/environ 2 GET /forgot-password --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 31 GET /heartbeat.php 3 GET /userlogin.php 3 GET / 2 GET /@fs/proc/self/environ 1 GET /.zsh_history 1 GET /wp-config.php.old 1 GET /wp-config.php.bak 1 GET /wp-config.php 1 GET /web/.env 1 GET /web.config 1 GET /@vite/env 1 GET /values.yaml -- last 10 requests -- 203.54.180.238 - - [29/Aug/2026:22:20:43 +1000] "GET /heartbeat.php?sentAt=1788006044&bytes=106,146,206,156&_=1787918089740 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [29/Aug/2026:22:20:53 +1000] "GET /heartbeat.php?sentAt=1788006054&bytes=106,146,206,166&_=1787897051256 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [29/Aug/2026:22:20:53 +1000] "GET /heartbeat.php?sentAt=1788006054&bytes=106,146,206,166&_=1787918089741 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [29/Aug/2026:22:21:03 +1000] "GET /heartbeat.php?sentAt=1788006064&bytes=106,146,206,176&_=1787897051257 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [29/Aug/2026:22:21:03 +1000] "GET /heartbeat.php?sentAt=1788006064&bytes=106,146,206,176&_=1787918089742 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [29/Aug/2026:22:21:13 +1000] "GET /heartbeat.php?sentAt=1788006074&bytes=106,146,206,186&_=1787897051258 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [29/Aug/2026:22:21:13 +1000] "GET /heartbeat.php?sentAt=1788006074&bytes=106,146,206,186&_=1787918089743 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [29/Aug/2026:22:21:23 +1000] "GET /heartbeat.php?sentAt=1788006084&bytes=106,146,206,196&_=1787897051259 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [29/Aug/2026:22:21:23 +1000] "GET /heartbeat.php?sentAt=1788006084&bytes=106,146,206,196&_=1787918089744 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [29/Aug/2026:22:21:33 +1000] "GET /heartbeat.php?sentAt=1788006094&bytes=106,146,206,206&_=1787897051260 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 2 GET /goods.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /x.php 1 GET /wsd.php 1 GET /ws85.php 1 GET /ws55.php 1 GET /wp-trackback.php 1 GET /wp-safe.php 1 GET /wp.php 1 GET /wp-includes/index.php -- last 10 requests -- 20.104.18.15 - - [29/Aug/2026:22:21:18 +1000] "GET /sushi.php HTTP/1.1" 401 36 "-" "-" 45.148.10.140 - - [29/Aug/2026:22:21:18 +1000] "GET /.env.production.local HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 20.104.18.15 - - [29/Aug/2026:22:21:18 +1000] "GET /manga.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [29/Aug/2026:22:21:19 +1000] "GET /asdfghj.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [29/Aug/2026:22:21:19 +1000] "GET /dragonshell.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [29/Aug/2026:22:21:20 +1000] "GET /wp-safe.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [29/Aug/2026:22:21:20 +1000] "GET /gjewuagf.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [29/Aug/2026:22:21:21 +1000] "GET /tnglzqmv.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [29/Aug/2026:22:21:21 +1000] "GET /wefile.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [29/Aug/2026:22:21:22 +1000] "GET /blog.php HTTP/1.1" 401 36 "-" "-" == infinium/infinium.net.au-ssl_log == -- top paths -- 2 POST /wp-cron.php 1 POST /wp-login.php 1 GET /zup.php 1 GET /z.php 1 GET /zafir1.php 1 GET /xxx.php 1 GET /xmrlpc.php 1 GET /ww2.php 1 GET /ws49.php 1 GET /wp-wordfence-waf.php 1 GET /wp-update.php 1 GET /wp-json/wp/v2/users/me -- last 10 requests -- 52.139.37.240 - - [29/Aug/2026:22:19:14 +1000] "GET /wp-admin/images/admin.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:19:14 +1000] "GET /wp-content/themes/seotheme/mar.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537 52.139.37.240 - - [29/Aug/2026:22:19:14 +1000] "GET /wp-includes/Text/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:19:14 +1000] "GET /wp-includes/rest-api/fields/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:19:15 +1000] "GET /wp-index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:19:15 +1000] "GET /ww2.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:19:15 +1000] "GET /7logs.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:19:15 +1000] "GET /ac.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:19:15 +1000] "GET /ctex1.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 162.214.184.71 - - [29/Aug/2026:22:19:15 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 401 82 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-29 22:19:17 L1=0.90 run=2 blk=0 avail=8766 (63.6%) swpO=0 conn=2 myRSS=2609 php=3 phpRSS=128 ap=17 tcp=33 topuser=aaa 2026-08-29 22:19:17 L1=0.90 run=2 blk=0 avail=8743 (63.5%) swpO=0 conn=1 myRSS=2609 php=4 phpRSS=182 ap=17 tcp=35 topuser=aaa 2026-08-29 22:19:27 L1=0.83 run=1 blk=0 avail=8716 (63.3%) swpO=0 conn=1 myRSS=2609 php=3 phpRSS=168 ap=19 tcp=27 topuser=madalice 2026-08-29 22:19:27 L1=0.83 run=2 blk=0 avail=8715 (63.3%) swpO=0 conn=1 myRSS=2609 php=3 phpRSS=168 ap=19 tcp=28 topuser=madalice 2026-08-29 22:19:37 L1=0.70 run=2 blk=0 avail=8636 (62.7%) swpO=0 conn=1 myRSS=2609 php=4 phpRSS=257 ap=22 tcp=29 topuser=madalice 2026-08-29 22:19:37 L1=0.70 run=2 blk=0 avail=8622 (62.6%) swpO=0 conn=1 myRSS=2609 php=4 phpRSS=271 ap=22 tcp=29 topuser=madalice 2026-08-29 22:19:47 L1=0.59 run=2 blk=0 avail=8671 (62.9%) swpO=0 conn=1 myRSS=2609 php=3 phpRSS=192 ap=22 tcp=30 topuser=madalice 2026-08-29 22:19:47 L1=0.59 run=1 blk=0 avail=8670 (62.9%) swpO=0 conn=1 myRSS=2609 php=3 phpRSS=192 ap=22 tcp=30 topuser=madalice 2026-08-29 22:19:57 L1=0.50 run=3 blk=0 avail=8428 (61.2%) swpO=0 conn=1 myRSS=2609 php=5 phpRSS=492 ap=24 tcp=30 topuser=corpkicks 2026-08-29 22:19:58 L1=0.50 run=3 blk=0 avail=8389 (60.9%) swpO=0 conn=1 myRSS=2609 php=5 phpRSS=536 ap=24 tcp=30 topuser=corpkicks 2026-08-29 22:20:07 L1=0.58 run=2 blk=0 avail=8792 (63.8%) swpO=0 conn=1 myRSS=2609 php=2 phpRSS=37 ap=23 tcp=57 topuser=root 2026-08-29 22:20:08 L1=0.58 run=2 blk=0 avail=8792 (63.8%) swpO=0 conn=1 myRSS=2609 php=2 phpRSS=37 ap=23 tcp=55 topuser=root 2026-08-29 22:20:17 L1=0.71 run=1 blk=0 avail=8681 (63.0%) swpO=0 conn=1 myRSS=2609 php=3 phpRSS=170 ap=21 tcp=64 topuser=madalice 2026-08-29 22:20:18 L1=0.71 run=1 blk=0 avail=8680 (63.0%) swpO=0 conn=1 myRSS=2609 php=3 phpRSS=170 ap=21 tcp=64 topuser=madalice 2026-08-29 22:20:28 L1=0.76 run=2 blk=0 avail=8559 (62.1%) swpO=0 conn=2 myRSS=2609 php=4 phpRSS=326 ap=22 tcp=80 topuser=madalice 2026-08-29 22:20:28 L1=0.76 run=2 blk=1 avail=8554 (62.1%) swpO=0 conn=1 myRSS=2609 php=4 phpRSS=328 ap=22 tcp=80 topuser=madalice 2026-08-29 22:20:38 L1=0.71 run=2 blk=0 avail=8429 (61.2%) swpO=0 conn=2 myRSS=2609 php=4 phpRSS=348 ap=45 tcp=38 topuser=madalice 2026-08-29 22:20:38 L1=0.71 run=1 blk=0 avail=8430 (61.2%) swpO=0 conn=1 myRSS=2609 php=4 phpRSS=348 ap=45 tcp=40 topuser=madalice 2026-08-29 22:20:48 L1=0.60 run=4 blk=0 avail=8455 (61.4%) swpO=0 conn=2 myRSS=2609 php=4 phpRSS=357 ap=38 tcp=64 topuser=madalice 2026-08-29 22:20:48 L1=0.60 run=3 blk=0 avail=8449 (61.3%) swpO=0 conn=3 myRSS=2609 php=4 phpRSS=362 ap=38 tcp=65 topuser=madalice 2026-08-29 22:20:58 L1=0.59 run=3 blk=0 avail=8255 (59.9%) swpO=0 conn=2 myRSS=2609 php=5 phpRSS=483 ap=52 tcp=67 topuser=madalice 2026-08-29 22:20:58 L1=0.59 run=2 blk=0 avail=8250 (59.9%) swpO=0 conn=3 myRSS=2609 php=5 phpRSS=485 ap=52 tcp=65 topuser=madalice 2026-08-29 22:21:08 L1=0.65 run=3 blk=0 avail=8073 (58.6%) swpO=0 conn=2 myRSS=2609 php=6 phpRSS=757 ap=43 tcp=58 topuser=madalice 2026-08-29 22:21:08 L1=0.65 run=3 blk=0 avail=8026 (58.3%) swpO=0 conn=3 myRSS=2609 php=6 phpRSS=803 ap=43 tcp=57 topuser=madalice 2026-08-29 22:21:18 L1=0.70 run=2 blk=0 avail=8122 (59.0%) swpO=0 conn=2 myRSS=2609 php=6 phpRSS=730 ap=36 tcp=49 topuser=madalice 2026-08-29 22:21:18 L1=0.70 run=2 blk=0 avail=8103 (58.8%) swpO=0 conn=3 myRSS=2609 php=6 phpRSS=749 ap=36 tcp=49 topuser=madalice 2026-08-29 22:21:28 L1=1.46 run=2 blk=0 avail=7623 (55.3%) swpO=0 conn=2 myRSS=2609 php=10 phpRSS=1272 ap=40 tcp=74 topuser=madalice 2026-08-29 22:21:28 L1=1.46 run=2 blk=0 avail=7606 (55.2%) swpO=0 conn=3 myRSS=2609 php=10 phpRSS=1291 ap=40 tcp=74 topuser=madalice 2026-08-29 22:21:38 L1=3.12 run=5 blk=0 avail=7151 (51.9%) swpO=0 conn=5 myRSS=2609 php=12 phpRSS=1687 ap=57 tcp=67 topuser=madalice 2026-08-29 22:21:38 L1=3.12 run=8 blk=0 avail=7155 (51.9%) swpO=0 conn=4 myRSS=2609 php=12 phpRSS=1683 ap=57 tcp=67 topuser=madalice