INCIDENT 2026-08-29 22:37:43 trigger: php_rss=1797MB ================================================================== load: 2.79 1.37 1.33 9/684 1499341 ncpu:10 mem_avail: 7065MB/13777MB (51.3%) swap_used:1783MB swapout:0/s blocked(D):0 running:13 iowait:0.0% steal:0.0% php: 12 procs / 1797MB heaviest user: madalice (10 procs, 1760MB) apache: 50 procs tcp_estab: 66 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2615 madalice 10 1631 root 248 1010 nobody 49 836 netdata 7 193 mailman 20 148 cpanellogin 1 71 dovenull 6 48 evolution 11 47 wp-toolkit 3 34 aaa 2 30 lowrange 2 28 kurri 2 27 zabbix 1 22 dovecot 3 20 named 1 15 infinium 1 14 candyfabcom 1 14 mailnull 1 6 polkitd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1634 root 1 23 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6051 MB Active(file): 3292 MB Inactive(file): 3119 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 576 MB CommitLimit: 10984 MB Committed_AS: 8752 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-20:19:03 6388 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2678548 8.5 Ssl 1-20:18:32 /usr/sbin/mariadbd 1499279 510022 madalice 227952 76.1 R 00:06 php-fpm: pool madalice_com_au 508924 1 netdata 176288 1.9 Ssl 1-20:18:01 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83639 1451906 root 169020 0.0 S 06:40:09 spamd child 1499196 510022 madalice 166832 58.9 R 00:13 php-fpm: pool madalice_com_au 1499203 510022 madalice 164632 58.6 R 00:12 php-fpm: pool madalice_com_au 1499257 510022 madalice 164536 56.1 R 00:10 php-fpm: pool madalice_com_au 1499200 510022 madalice 163600 54.4 R 00:13 php-fpm: pool madalice_com_au 1502904 1451906 root 161788 0.0 S 20:01:21 spamd child 1499199 510022 madalice 161284 59.9 R 00:13 php-fpm: pool madalice_com_au 1499197 510022 madalice 161276 54.0 R 00:13 php-fpm: pool madalice_com_au 1499202 510022 madalice 160536 61.1 S 00:12 php-fpm: pool madalice_com_au 1499198 510022 madalice 159688 58.2 S 00:13 php-fpm: pool madalice_com_au 1499280 510022 madalice 159588 65.6 S 00:06 php-fpm: pool madalice_com_au 509266 1 root 118356 0.0 Ss 1-20:17:58 /usr/lib/systemd/systemd-journald 1451906 1 root 114588 0.0 Ss 20:14:36 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1136288 1353308 cpanellogin 73684 0.0 S 01:40:11 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 509236 509098 root 59596 0.0 Sl 1-20:17:58 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 40960 0.0 Sl 1-20:17:56 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 40120 0.1 Ss 38-19:56:24 cpsrvd (SSL) - waiting for connections 1451116 1 root 31808 0.0 Ss 20:15:29 lfd - sleeping 510022 1 root 24208 0.0 Ss 1-20:17:54 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 22820 0.2 Ssl 1-20:19:15 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1498083 506832 nobody 21484 0.0 S 02:19 /usr/sbin/httpd -k start 1498017 506832 nobody 21388 0.0 S 02:21 /usr/sbin/httpd -k start 1498127 506832 nobody 21380 0.0 S 02:18 /usr/sbin/httpd -k start 1483427 506832 nobody 21016 0.0 S 03:38 /usr/sbin/httpd -k start 1498070 506832 nobody 21016 0.0 S 02:20 /usr/sbin/httpd -k start 1498044 506832 nobody 20836 0.0 S 02:20 /usr/sbin/httpd -k start 1498050 506832 nobody 20800 0.0 S 02:20 /usr/sbin/httpd -k start 1498137 506832 nobody 20688 0.0 S 02:18 /usr/sbin/httpd -k start 1498113 506832 nobody 20612 0.0 S 02:18 /usr/sbin/httpd -k start 1498089 506832 nobody 20592 0.0 S 02:19 /usr/sbin/httpd -k start 1497976 506832 nobody 20564 0.0 S 02:22 /usr/sbin/httpd -k start 1498138 506832 nobody 20528 0.0 S 02:18 /usr/sbin/httpd -k start 1469 1 root 20484 0.1 Ss 61-12:27:53 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 938582 1 wp-toolkit 20424 0.0 Ss 1-18:25:35 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1463 1 root 20272 0.0 Ss 61-12:27:53 tailwatchd 1499284 506832 nobody 19856 0.0 S 00:04 /usr/sbin/httpd -k start 1498090 506832 nobody 19740 0.0 S 02:19 /usr/sbin/httpd -k start 1498085 506832 nobody 19576 0.0 S 02:19 /usr/sbin/httpd -k start 1499206 506832 nobody 19516 0.2 S 00:11 /usr/sbin/httpd -k start 1499261 506832 nobody 19368 0.1 S 00:10 /usr/sbin/httpd -k start 1498060 506832 nobody 18800 0.0 S 02:20 /usr/sbin/httpd -k start 1498013 506832 nobody 18376 0.0 S 02:21 /usr/sbin/httpd -k start 1498061 506832 nobody 18260 0.0 S 02:20 /usr/sbin/httpd -k start 1499260 506832 nobody 17776 0.1 S 00:10 /usr/sbin/httpd -k start 1499265 506832 nobody 17680 0.0 S 00:09 /usr/sbin/httpd -k start 1499293 506832 nobody 17532 0.0 S 00:02 /usr/sbin/httpd -k start 1499296 506832 nobody 17152 0.5 S 00:02 /usr/sbin/httpd -k start 1499305 506832 nobody 16792 0.0 S 00:01 /usr/sbin/httpd -k start 1464700 1471 root 16768 0.0 S 11:17 cPhulkd - dbprocessor 1499267 506832 nobody 16760 0.0 S 00:09 /usr/sbin/httpd -k start 1499275 506832 nobody 16760 0.0 S 00:08 /usr/sbin/httpd -k start 1499277 506832 nobody 16760 0.0 S 00:08 /usr/sbin/httpd -k start 1499294 506832 nobody 16760 0.0 S 00:02 /usr/sbin/httpd -k start 1499268 506832 nobody 16732 0.0 S 00:09 /usr/sbin/httpd -k start 1499271 506832 nobody 16712 0.0 S 00:08 /usr/sbin/httpd -k start 1499272 506832 nobody 16712 0.0 S 00:08 /usr/sbin/httpd -k start 1499273 506832 nobody 16712 0.0 S 00:08 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4216026 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min candyfabcom/candyfab.com.au-ssl_log 60 olytis/tis.com.au-ssl_log 57 madalice/madalice.com.au-ssl_log 46 lowrange/lowrange.com.au-ssl_log 39 evolution/forms.evolutionerp.com.au 35 evolution/portal.evolutionerp.com.au-ssl_log 24 coscom/coscom.com.au-ssl_log 15 corpkicks/corporatekicks.com.au-ssl_log 6 aaa/aaadownunder.com.au-ssl_log 5 evolution/evolutionerp.com.au-ssl_log 3 infinium/infinium.net.au-ssl_log 2 (total vhosts taking traffic: 11) --- top client IPs across all vhosts (last 3 min) --- 96 158.23.184.117 60 52.139.37.240 35 20.104.18.15 32 35.231.130.18 24 203.54.180.238 15 20.52.41.200 6 118.127.40.55 3 2a09:bac2:189:3464::538:2b 2 52.167.144.189 2 3.71.7.238 2 114.119.141.112 2 114.119.140.234 2 114.119.131.88 1 95.27.40.72 1 69.16.218.67 --- top request paths across all vhosts (last 3 min) --- 24 GET /heartbeat.php 6 POST /wp-cron.php 6 GET / 5 GET /wp-login.php 2 GET /wp-trackback.php 2 GET /wp-content/admin.php 2 GET /users/login 2 GET /user/login 2 GET /store/custom-afl-geelong-cats-kids/ 2 GET /signup 2 GET /signin 2 GET /sign-in 2 GET /secure 2 GET /register 2 GET /new.php 2 GET /mini.php 2 GET /login 2 GET /forgot-password 2 GET /file.php 2 GET /auth/login --- busiest 3 vhosts: top paths + last 10 requests --- == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 1 GET /zwso.php 1 GET /zoom1.php 1 GET /yanz.php 1 GET /wp-sigunq.php 1 GET /wp-includes/rest-api/ 1 GET /wp-includes/PHPMailer/ 1 GET /wp-includes/images/media/ 1 GET /wp-includes/images/crystal/ 1 GET /wp-includes/customize/index.php 1 GET /wp-content/themes/alera/alpha.php 1 GET /wp-content/file.php 1 GET /wp-content/admin.php -- last 10 requests -- 52.139.37.240 - - [29/Aug/2026:22:36:11 +1000] "GET /about.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:36:11 +1000] "GET /sid3.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:36:11 +1000] "GET /blog.php7 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:36:12 +1000] "GET /GOD.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:36:12 +1000] "GET /alumni_reg.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:36:12 +1000] "GET /depotcv.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:36:12 +1000] "GET /admin.php7 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:36:12 +1000] "GET /ini.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:36:13 +1000] "GET /nf.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:36:13 +1000] "GET /room.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == olytis/tis.com.au-ssl_log == -- top paths -- 1 GET /xmr.php 1 GET /xmlrpc.php 1 GET /wp-trackback.php 1 GET /wp.php 1 GET /wp-includes/themes/uploads/config.php 1 GET /wp-includes/theme-compat 1 GET /wp-includes/Text.php 1 GET /wp-includes/Text/Diff/ 1 GET /wp-includes/Test.php 1 GET /wp-includes/style-engine/wp-conflg.php 1 GET /wp-includes/Requests/Exception/file.php 1 GET /wp-includes/pomo.php -- last 10 requests -- 158.23.184.117 - - [29/Aug/2026:22:37:09 +1000] "GET /wp-content/export.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:22:37:09 +1000] "GET /new.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:22:37:09 +1000] "GET /wp-content/plugins/revslider/admin.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safar 158.23.184.117 - - [29/Aug/2026:22:37:09 +1000] "GET /wp-content/images/uploads/admin.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/5 158.23.184.117 - - [29/Aug/2026:22:37:10 +1000] "GET /tools.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:22:37:10 +1000] "GET /wp-content/uploads/my.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:22:37:10 +1000] "GET /wp-includes/themes/uploads/config.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari 158.23.184.117 - - [29/Aug/2026:22:37:10 +1000] "GET /av.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:22:37:10 +1000] "GET /wp-includes/blocks/button HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:22:37:10 +1000] "GET /wp-includes/ID3/file.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 2 GET /users/login 2 GET /user/login 2 GET /store/custom-afl-geelong-cats-kids/ 2 GET /signup 2 GET /signin 2 GET /sign-in 2 GET /secure 2 GET /register 2 GET /login 2 GET /forgot-password 2 GET /auth/login 2 GET /auth -- last 10 requests -- 35.231.130.18 - - [29/Aug/2026:22:37:39 +1000] "GET /forgot-password HTTP/1.1" 404 36642 "https://www.madalice.com.au/forgot-password" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149 35.231.130.18 - - [29/Aug/2026:22:37:39 +1000] "GET /register HTTP/1.1" 404 36638 "https://www.madalice.com.au/register" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile 35.231.130.18 - - [29/Aug/2026:22:37:39 +1000] "GET /signup HTTP/1.1" 404 36641 "https://www.madalice.com.au/signup" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safa 35.231.130.18 - - [29/Aug/2026:22:37:40 +1000] "GET /user/login HTTP/1.1" 404 36645 "https://www.madalice.com.au/user/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mob 35.231.130.18 - - [29/Aug/2026:22:37:40 +1000] "GET /users/login HTTP/1.1" 404 36646 "https://www.madalice.com.au/users/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 M 35.231.130.18 - - [29/Aug/2026:22:37:41 +1000] "GET /admin HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [29/Aug/2026:22:37:41 +1000] "GET /wp-login.php HTTP/1.1" 200 4024 "https://madalice.com.au/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safa 35.231.130.18 - - [29/Aug/2026:22:37:40 +1000] "GET /reset-password HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [29/Aug/2026:22:37:41 +1000] "GET /dashboard HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [29/Aug/2026:22:37:41 +1000] "GET /console HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-29 22:35:22 L1=0.60 run=1 blk=0 avail=8504 (61.7%) swpO=0 conn=2 myRSS=2615 php=4 phpRSS=323 ap=32 tcp=140 topuser=madalice 2026-08-29 22:35:22 L1=0.60 run=2 blk=0 avail=8406 (61.0%) swpO=0 conn=1 myRSS=2615 php=4 phpRSS=323 ap=48 tcp=139 topuser=madalice 2026-08-29 22:35:32 L1=0.67 run=2 blk=0 avail=7630 (55.4%) swpO=0 conn=2 myRSS=2615 php=4 phpRSS=422 ap=139 tcp=29 topuser=madalice 2026-08-29 22:35:32 L1=0.67 run=2 blk=0 avail=7617 (55.3%) swpO=0 conn=2 myRSS=2615 php=4 phpRSS=439 ap=138 tcp=29 topuser=madalice 2026-08-29 22:35:42 L1=0.65 run=1 blk=0 avail=7768 (56.4%) swpO=0 conn=2 myRSS=2615 php=4 phpRSS=346 ap=129 tcp=30 topuser=madalice 2026-08-29 22:35:43 L1=0.65 run=1 blk=0 avail=7772 (56.4%) swpO=0 conn=2 myRSS=2615 php=4 phpRSS=346 ap=128 tcp=31 topuser=madalice 2026-08-29 22:35:52 L1=0.78 run=2 blk=0 avail=7826 (56.8%) swpO=0 conn=2 myRSS=2615 php=4 phpRSS=353 ap=119 tcp=33 topuser=madalice 2026-08-29 22:35:53 L1=0.78 run=3 blk=0 avail=7809 (56.7%) swpO=0 conn=2 myRSS=2615 php=5 phpRSS=420 ap=118 tcp=33 topuser=madalice 2026-08-29 22:36:02 L1=0.74 run=3 blk=0 avail=8023 (58.2%) swpO=0 conn=2 myRSS=2615 php=3 phpRSS=192 ap=108 tcp=32 topuser=madalice 2026-08-29 22:36:03 L1=0.74 run=6 blk=0 avail=7994 (58.0%) swpO=0 conn=2 myRSS=2615 php=4 phpRSS=262 ap=108 tcp=32 topuser=madalice 2026-08-29 22:36:12 L1=0.77 run=2 blk=0 avail=7989 (58.0%) swpO=0 conn=2 myRSS=2615 php=4 phpRSS=325 ap=98 tcp=30 topuser=madalice 2026-08-29 22:36:13 L1=0.77 run=3 blk=0 avail=7990 (58.0%) swpO=0 conn=2 myRSS=2615 php=4 phpRSS=325 ap=98 tcp=33 topuser=madalice 2026-08-29 22:36:23 L1=0.65 run=1 blk=0 avail=8070 (58.6%) swpO=0 conn=2 myRSS=2615 php=4 phpRSS=325 ap=88 tcp=30 topuser=madalice 2026-08-29 22:36:23 L1=0.65 run=1 blk=0 avail=8069 (58.6%) swpO=0 conn=2 myRSS=2615 php=4 phpRSS=325 ap=88 tcp=31 topuser=madalice 2026-08-29 22:36:33 L1=0.63 run=1 blk=0 avail=8152 (59.2%) swpO=0 conn=2 myRSS=2615 php=4 phpRSS=347 ap=78 tcp=28 topuser=madalice 2026-08-29 22:36:33 L1=0.63 run=1 blk=0 avail=8152 (59.2%) swpO=0 conn=1 myRSS=2615 php=4 phpRSS=347 ap=78 tcp=27 topuser=madalice 2026-08-29 22:36:43 L1=0.53 run=1 blk=0 avail=8220 (59.7%) swpO=0 conn=2 myRSS=2615 php=4 phpRSS=348 ap=68 tcp=27 topuser=madalice 2026-08-29 22:36:43 L1=0.53 run=2 blk=0 avail=8218 (59.7%) swpO=0 conn=1 myRSS=2615 php=4 phpRSS=348 ap=68 tcp=28 topuser=madalice 2026-08-29 22:36:53 L1=0.68 run=2 blk=0 avail=8314 (60.3%) swpO=0 conn=1 myRSS=2615 php=4 phpRSS=348 ap=58 tcp=26 topuser=madalice 2026-08-29 22:36:53 L1=0.68 run=1 blk=0 avail=8314 (60.3%) swpO=0 conn=1 myRSS=2615 php=4 phpRSS=348 ap=58 tcp=26 topuser=madalice 2026-08-29 22:37:03 L1=0.88 run=1 blk=0 avail=8382 (60.8%) swpO=0 conn=1 myRSS=2615 php=4 phpRSS=348 ap=48 tcp=31 topuser=madalice 2026-08-29 22:37:03 L1=0.88 run=1 blk=0 avail=8383 (60.8%) swpO=0 conn=1 myRSS=2615 php=4 phpRSS=348 ap=48 tcp=31 topuser=madalice 2026-08-29 22:37:13 L1=1.06 run=2 blk=0 avail=8581 (62.3%) swpO=0 conn=1 myRSS=2615 php=4 phpRSS=233 ap=38 tcp=31 topuser=madalice 2026-08-29 22:37:13 L1=1.06 run=2 blk=0 avail=8558 (62.1%) swpO=0 conn=1 myRSS=2615 php=4 phpRSS=253 ap=38 tcp=32 topuser=madalice 2026-08-29 22:37:23 L1=1.28 run=1 blk=0 avail=8657 (62.8%) swpO=0 conn=1 myRSS=2615 php=3 phpRSS=191 ap=28 tcp=26 topuser=madalice 2026-08-29 22:37:23 L1=1.28 run=1 blk=0 avail=8659 (62.9%) swpO=0 conn=1 myRSS=2615 php=3 phpRSS=191 ap=28 tcp=26 topuser=madalice 2026-08-29 22:37:33 L1=1.47 run=8 blk=0 avail=7765 (56.4%) swpO=0 conn=1 myRSS=2615 php=11 phpRSS=1340 ap=21 tcp=42 topuser=madalice 2026-08-29 22:37:33 L1=1.47 run=16 blk=0 avail=7613 (55.3%) swpO=0 conn=9 myRSS=2615 php=10 phpRSS=1417 ap=21 tcp=44 topuser=madalice 2026-08-29 22:37:43 L1=2.79 run=13 blk=0 avail=7065 (51.3%) swpO=0 conn=8 myRSS=2615 php=12 phpRSS=1797 ap=50 tcp=66 topuser=madalice 2026-08-29 22:37:43 L1=2.79 run=12 blk=0 avail=7187 (52.2%) swpO=0 conn=7 myRSS=2615 php=12 phpRSS=1692 ap=50 tcp=75 topuser=madalice