INCIDENT 2026-08-29 23:30:00 trigger: php_rss=1645MB ================================================================== load: 4.37 2.20 1.50 9/676 1670939 ncpu:10 mem_avail: 7302MB/13777MB (53.0%) swap_used:1784MB swapout:0/s blocked(D):0 running:10 iowait:0.0% steal:0.0% php: 12 procs / 1645MB heaviest user: madalice (9 procs, 1522MB) apache: 32 procs tcp_estab: 48 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2616 madalice 9 1548 root 252 1074 nobody 31 566 netdata 7 199 mailman 20 147 aaa 3 119 evolution 12 82 cpanellogin 1 61 dovenull 6 48 wp-toolkit 3 34 lowrange 2 28 kurri 2 27 mailnull 3 26 zabbix 1 22 dovecot 3 20 named 1 15 infinium 1 14 polkitd 1 5 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 9 1554 aaa 1 89 evolution 2 53 root 1 23 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5301 MB Active(file): 3451 MB Inactive(file): 2133 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 571 MB CommitLimit: 10984 MB Committed_AS: 8743 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-21:11:20 6372 /usr/bin/imunify-agent-proxy 1654078 root 05:29 62428 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2679496 8.4 Ssl 1-21:10:49 /usr/sbin/mariadbd 1670043 510022 madalice 245728 46.1 R 01:06 php-fpm: pool madalice_com_au 1670039 510022 madalice 209360 45.1 R 01:06 php-fpm: pool madalice_com_au 1669968 510022 madalice 207488 46.2 R 01:14 php-fpm: pool madalice_com_au 508924 1 netdata 182372 1.9 Ssl 1-21:10:18 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83639 1451906 root 168724 0.0 S 07:32:26 spamd child 1670035 510022 madalice 162568 47.9 S 01:06 php-fpm: pool madalice_com_au 1502904 1451906 root 161432 0.0 S 20:53:38 spamd child 1670042 510022 madalice 161400 45.7 R 01:06 php-fpm: pool madalice_com_au 1670041 510022 madalice 161056 46.9 R 01:06 php-fpm: pool madalice_com_au 1670037 510022 madalice 159200 46.1 S 01:06 php-fpm: pool madalice_com_au 1670038 510022 madalice 159052 46.7 S 01:06 php-fpm: pool madalice_com_au 1670040 510022 madalice 158196 45.7 S 01:06 php-fpm: pool madalice_com_au 509266 1 root 119400 0.0 Ss 1-21:10:15 /usr/lib/systemd/systemd-journald 1451906 1 root 114528 0.0 Ss 21:06:53 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1670900 1670400 aaa 96996 66.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1668791 1353308 cpanellogin 63280 0.3 S 03:41 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 1654078 1 root 62428 0.5 Ssl 05:29 /opt/imunify360/venv/bin/python3 -m imav.run 509236 509098 root 59224 0.0 Sl 1-21:10:15 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42320 0.1 Ss 38-20:48:41 cpsrvd (SSL) - waiting for connections 509640 508992 root 41488 0.0 Sl 1-21:10:13 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 31816 0.0 Ss 21:07:46 lfd - sleeping 1469 1 root 24916 0.1 Ss 61-13:20:10 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1670972 1670060 evolution 24332 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 510022 1 root 24212 0.0 Ss 1-21:10:11 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1652949 506832 nobody 23464 0.0 S 07:16 /usr/sbin/httpd -k start 483898 1 zabbix 22848 0.2 Ssl 1-21:11:32 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1652762 506832 nobody 22696 0.0 S 07:50 /usr/sbin/httpd -k start 1668590 506832 nobody 21856 0.0 S 04:04 /usr/sbin/httpd -k start 1654213 506832 nobody 21740 0.0 S 05:19 /usr/sbin/httpd -k start 1670051 506832 nobody 21512 0.0 S 01:04 /usr/sbin/httpd -k start 1669361 506832 nobody 21416 0.0 S 02:25 /usr/sbin/httpd -k start 1670396 506832 nobody 21372 0.1 S 00:57 /usr/sbin/httpd -k start 1670047 506832 nobody 21252 0.0 S 01:05 /usr/sbin/httpd -k start 1669530 506832 nobody 20924 0.0 S 02:04 /usr/sbin/httpd -k start 1668595 506832 nobody 20588 0.1 S 04:03 /usr/sbin/httpd -k start 1463 1 root 20440 0.0 Ss 61-13:20:10 tailwatchd 938582 1 wp-toolkit 20312 0.0 Ss 1-19:17:52 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1670044 506832 nobody 20300 0.0 S 01:06 /usr/sbin/httpd -k start 1670046 506832 nobody 19828 0.0 S 01:05 /usr/sbin/httpd -k start 1670052 506832 nobody 19696 0.0 S 01:04 /usr/sbin/httpd -k start 1670053 506832 nobody 19640 0.0 S 01:04 /usr/sbin/httpd -k start 1670056 506832 nobody 19608 0.0 S 01:03 /usr/sbin/httpd -k start 1670050 506832 nobody 19532 0.0 S 01:04 /usr/sbin/httpd -k start 1670060 506832 nobody 19468 0.0 S 01:03 /usr/sbin/httpd -k start 1670711 506832 nobody 19208 0.0 S 00:22 /usr/sbin/httpd -k start 1670716 506832 nobody 18836 0.0 S 00:21 /usr/sbin/httpd -k start 1670717 506832 nobody 18836 0.0 S 00:21 /usr/sbin/httpd -k start 1670754 506832 nobody 18784 0.0 S 00:20 /usr/sbin/httpd -k start 1670712 506832 nobody 18772 0.0 S 00:22 /usr/sbin/httpd -k start 1670755 506832 nobody 18580 0.0 S 00:20 /usr/sbin/httpd -k start 1670751 506832 nobody 18508 0.0 S 00:20 /usr/sbin/httpd -k start 1670715 506832 nobody 18352 0.0 S 00:21 /usr/sbin/httpd -k start 1670802 506832 nobody 18348 0.0 S 00:17 /usr/sbin/httpd -k start 1670750 506832 nobody 18256 0.0 S 00:20 /usr/sbin/httpd -k start 1670400 506832 nobody 17084 0.2 S 00:56 /usr/sbin/httpd -k start 1651862 508511 aaa 15980 0.0 S 09:35 dovecot/imap 509671 508992 netdata 15808 2.1 Sl 1-21:10:13 /usr/libexec/netdata/plugins.d/apps.plugin 1 508634 1 named 15604 0.0 Ssl 1-21:10:23 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1670887 1471 root 15584 0.3 S 00:06 cPhulkd - dbprocessor --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4228866 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 223 aaa/aaadownunder.com.au-ssl_log 115 alison/alisonarts.com.au-ssl_log 77 kamcool/kamcool.com.au-ssl_log 57 evolution/portal.evolutionerp.com.au-ssl_log 14 infinium/infinium.net.au-ssl_log 6 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 214 185.161.210.61 130 52.139.37.240 128 149.118.59.225 14 203.54.180.238 5 118.127.40.55 3 114.119.137.101 2 194.116.184.179 2 114.119.143.104 2 103.190.47.42 1 91.92.243.239 1 74.7.244.47 1 74.7.243.247 1 72.167.132.114 1 52.206.37.239 1 2a03:2880:f802:11:: --- top request paths across all vhosts (last 3 min) --- 212 POST /index.php 53 GET /wp-login.php 51 GET /wp-admin/index.php 29 POST /wp-login.php 14 GET /heartbeat.php 3 POST /wp-cron.php 2 POST / 2 GET /zup.php 2 GET /z.php 2 GET /zafir1.php 2 GET /xxx.php 2 GET /xmrlpc.php 2 GET /ws49.php 2 GET /wp-wordfence-waf.php 2 GET /wp-update.php 2 GET /wp-info.php 2 GET /wp-includes/Text/Diff/Engine/ 2 GET /wp-includes/interactivity-api/index.php 2 GET /wp-includes/images/media/ 2 GET /wp-header-json.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 212 POST /index.php 2 GET /index.php 1 POST / 1 GET /tag/custom-footwear-australia/ 1 GET /store/hand-painted-nike-af1-roosters/ 1 GET /store/graffiti-airmax-90-custom-shoes/ 1 GET /store/gift-card-physical/ 1 GET /store/gift-card-2/ 1 GET /store/gift-card/ 1 GET /robots.txt 1 GET / -- last 10 requests -- 185.161.210.61 - - [29/Aug/2026:23:29:55 +1000] "POST /index.php?rest_route=/elementor-one/v1/themes HTTP/1.1" 400 95 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0" 185.161.210.61 - - [29/Aug/2026:23:29:55 +1000] "POST /index.php?rest_route=/elementor-one/v1/connect/disconnect HTTP/1.1" 401 86 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0" 185.161.210.61 - - [29/Aug/2026:23:29:56 +1000] "POST /index.php?rest_route=/elementor-one/v1/top-bar/feedback HTTP/1.1" 400 118 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0" 185.161.210.61 - - [29/Aug/2026:23:29:56 +1000] "POST /index.php?rest_route=/wordfence/v1/scan/issue HTTP/1.1" 401 96 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0" 185.161.210.61 - - [29/Aug/2026:23:29:56 +1000] "POST /index.php?rest_route=/elementor-one/v1/connect/authorize HTTP/1.1" 401 86 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0" 185.161.210.61 - - [29/Aug/2026:23:29:56 +1000] "POST /index.php?rest_route=/elementor-one/v1/connect/switch-domain HTTP/1.1" 401 86 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131 185.161.210.61 - - [29/Aug/2026:23:29:57 +1000] "POST /index.php?rest_route=/elementor-one/v1/connect/deactivate HTTP/1.1" 401 86 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0" 185.161.210.61 - - [29/Aug/2026:23:29:57 +1000] "POST /index.php?rest_route=/wordfence/v1/scan HTTP/1.1" 401 96 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0" 185.161.210.61 - - [29/Aug/2026:23:29:57 +1000] "POST /index.php?rest_route=/elementor-one/v1/top-bar/feedback HTTP/1.1" 400 118 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0" 185.161.210.61 - - [29/Aug/2026:23:29:58 +1000] "POST /index.php?rest_route=/elementor-one/v1/themes HTTP/1.1" 400 95 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 51 GET /wp-login.php 51 GET /wp-admin/index.php 26 POST /wp-login.php 2 POST /wp-cron.php -- last 10 requests -- 118.127.40.55 - - [29/Aug/2026:23:29:51 +1000] "POST /wp-cron.php?doing_wp_cron=1788010191.4709110260009765625000 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://aaadownunder.com.au" 149.118.59.225 - - [29/Aug/2026:23:29:50 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko 149.118.59.225 - - [29/Aug/2026:23:29:52 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Faaadownunder.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 6930 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 149.118.59.225 - - [29/Aug/2026:23:29:53 +1000] "POST /wp-login.php HTTP/1.1" 200 7295 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64; rv:92.0) Gecko/20100101 Firefox/92.0" 149.118.59.225 - - [29/Aug/2026:23:29:54 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ 149.118.59.225 - - [29/Aug/2026:23:29:55 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Faaadownunder.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 6930 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 149.118.59.225 - - [29/Aug/2026:23:29:55 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ 149.118.59.225 - - [29/Aug/2026:23:29:56 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Faaadownunder.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 6930 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 149.118.59.225 - - [29/Aug/2026:23:29:57 +1000] "POST /wp-login.php HTTP/1.1" 200 7296 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94 149.118.59.225 - - [29/Aug/2026:23:29:58 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515 == alison/alisonarts.com.au-ssl_log == -- top paths -- 1 POST /wp-login.php 1 POST / 1 GET /zup.php 1 GET /z.php 1 GET /zafir1.php 1 GET /xxx.php 1 GET /xmrlpc.php 1 GET /ww2.php 1 GET /ws49.php 1 GET /wp-wordfence-waf.php 1 GET /wp-update.php 1 GET /wp-info.php -- last 10 requests -- 52.139.37.240 - - [29/Aug/2026:23:29:26 +1000] "GET /wp-index.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:23:29:27 +1000] "GET /ww2.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:23:29:27 +1000] "GET /7logs.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:23:29:27 +1000] "GET /ac.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:23:29:27 +1000] "GET /ctex1.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:23:29:27 +1000] "GET /defaults.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:23:29:28 +1000] "GET /domains.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:23:29:28 +1000] "GET /dropdown.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:23:29:28 +1000] "GET /files/index.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:23:29:28 +1000] "GET /flower.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-29 23:27:31 L1=1.78 run=3 blk=0 avail=8743 (63.5%) swpO=0 conn=5 myRSS=2616 php=4 phpRSS=225 ap=15 tcp=30 topuser=aaa 2026-08-29 23:27:39 L1=1.71 run=3 blk=0 avail=8683 (63.0%) swpO=0 conn=3 myRSS=2616 php=4 phpRSS=252 ap=18 tcp=32 topuser=madalice 2026-08-29 23:27:41 L1=1.66 run=3 blk=0 avail=8480 (61.6%) swpO=0 conn=5 myRSS=2616 php=7 phpRSS=537 ap=18 tcp=34 topuser=infinium 2026-08-29 23:27:49 L1=1.60 run=3 blk=0 avail=8573 (62.2%) swpO=0 conn=3 myRSS=2616 php=5 phpRSS=393 ap=17 tcp=32 topuser=madalice 2026-08-29 23:27:51 L1=1.56 run=2 blk=0 avail=8679 (63.0%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=258 ap=17 tcp=28 topuser=madalice 2026-08-29 23:27:59 L1=1.51 run=2 blk=0 avail=8752 (63.5%) swpO=0 conn=3 myRSS=2616 php=4 phpRSS=168 ap=18 tcp=36 topuser=madalice 2026-08-29 23:28:01 L1=1.55 run=1 blk=0 avail=8733 (63.4%) swpO=0 conn=2 myRSS=2616 php=3 phpRSS=168 ap=18 tcp=32 topuser=madalice 2026-08-29 23:28:09 L1=1.59 run=2 blk=0 avail=8716 (63.3%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=228 ap=16 tcp=29 topuser=madalice 2026-08-29 23:28:11 L1=1.46 run=3 blk=0 avail=8576 (62.3%) swpO=0 conn=2 myRSS=2616 php=5 phpRSS=398 ap=16 tcp=28 topuser=corpkicks 2026-08-29 23:28:19 L1=1.42 run=3 blk=0 avail=8725 (63.3%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=227 ap=15 tcp=31 topuser=madalice 2026-08-29 23:28:21 L1=1.39 run=3 blk=0 avail=8843 (64.2%) swpO=0 conn=2 myRSS=2616 php=3 phpRSS=85 ap=15 tcp=28 topuser=aaa 2026-08-29 23:28:29 L1=1.44 run=2 blk=0 avail=8728 (63.4%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=229 ap=14 tcp=33 topuser=madalice 2026-08-29 23:28:32 L1=1.40 run=3 blk=0 avail=8634 (62.7%) swpO=0 conn=2 myRSS=2616 php=5 phpRSS=300 ap=15 tcp=31 topuser=madalice 2026-08-29 23:28:39 L1=1.37 run=2 blk=0 avail=8672 (62.9%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=237 ap=15 tcp=30 topuser=madalice 2026-08-29 23:28:42 L1=1.42 run=2 blk=1 avail=8680 (63.0%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=227 ap=15 tcp=28 topuser=madalice 2026-08-29 23:28:49 L1=1.39 run=2 blk=0 avail=8649 (62.8%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=259 ap=15 tcp=32 topuser=madalice 2026-08-29 23:28:52 L1=1.27 run=3 blk=0 avail=8659 (62.9%) swpO=0 conn=2 myRSS=2616 php=3 phpRSS=172 ap=15 tcp=29 topuser=madalice 2026-08-29 23:28:59 L1=1.33 run=9 blk=0 avail=7277 (52.8%) swpO=0 conn=9 myRSS=2616 php=12 phpRSS=1694 ap=30 tcp=47 topuser=madalice 2026-08-29 23:29:02 L1=2.03 run=12 blk=0 avail=7234 (52.5%) swpO=0 conn=9 myRSS=2616 php=13 phpRSS=1717 ap=31 tcp=44 topuser=madalice 2026-08-29 23:29:10 L1=2.56 run=13 blk=0 avail=7146 (51.9%) swpO=0 conn=10 myRSS=2616 php=13 phpRSS=1822 ap=34 tcp=44 topuser=madalice 2026-08-29 23:29:12 L1=2.56 run=6 blk=0 avail=7394 (53.7%) swpO=0 conn=6 myRSS=2616 php=12 phpRSS=1530 ap=34 tcp=44 topuser=madalice 2026-08-29 23:29:20 L1=2.70 run=5 blk=0 avail=7398 (53.7%) swpO=0 conn=4 myRSS=2616 php=13 phpRSS=1575 ap=33 tcp=40 topuser=madalice 2026-08-29 23:29:22 L1=2.70 run=4 blk=0 avail=7423 (53.9%) swpO=0 conn=3 myRSS=2616 php=12 phpRSS=1524 ap=31 tcp=40 topuser=madalice 2026-08-29 23:29:30 L1=2.73 run=1 blk=0 avail=7520 (54.6%) swpO=0 conn=4 myRSS=2616 php=11 phpRSS=1423 ap=27 tcp=35 topuser=madalice 2026-08-29 23:29:32 L1=2.73 run=3 blk=0 avail=7527 (54.6%) swpO=0 conn=3 myRSS=2616 php=12 phpRSS=1462 ap=25 tcp=35 topuser=madalice 2026-08-29 23:29:40 L1=2.87 run=9 blk=0 avail=7277 (52.8%) swpO=0 conn=8 myRSS=2616 php=12 phpRSS=1701 ap=31 tcp=48 topuser=madalice 2026-08-29 23:29:42 L1=2.87 run=9 blk=0 avail=7199 (52.3%) swpO=0 conn=9 myRSS=2616 php=13 phpRSS=1741 ap=39 tcp=50 topuser=madalice 2026-08-29 23:29:50 L1=3.79 run=11 blk=0 avail=7174 (52.1%) swpO=0 conn=8 myRSS=2616 php=12 phpRSS=1767 ap=36 tcp=45 topuser=madalice 2026-08-29 23:29:52 L1=3.79 run=8 blk=0 avail=7305 (53.0%) swpO=0 conn=7 myRSS=2616 php=12 phpRSS=1645 ap=34 tcp=47 topuser=madalice 2026-08-29 23:30:00 L1=4.37 run=10 blk=0 avail=7302 (53.0%) swpO=0 conn=7 myRSS=2616 php=12 phpRSS=1645 ap=32 tcp=48 topuser=madalice