INCIDENT 2026-08-29 23:39:53 trigger: php_rss=1786MB ================================================================== load: 2.79 1.92 1.65 14/692 1706589 ncpu:10 mem_avail: 7133MB/13777MB (51.8%) swap_used:1784MB swapout:0/s blocked(D):0 running:14 iowait:0.0% steal:0.0% php: 14 procs / 1786MB heaviest user: madalice (10 procs, 1636MB) apache: 50 procs tcp_estab: 68 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2616 madalice 10 1581 root 252 1048 nobody 49 868 netdata 7 197 mailman 20 147 evolution 13 121 aaa 2 93 cpanellogin 1 62 dovenull 6 48 wp-toolkit 3 34 lowrange 2 28 kurri 2 27 zabbix 1 22 dovecot 3 20 mailnull 2 17 named 1 15 infinium 1 14 polkitd 1 5 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1584 evolution 3 94 aaa 1 81 root 1 23 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5323 MB Active(file): 3487 MB Inactive(file): 2128 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 571 MB CommitLimit: 10984 MB Committed_AS: 9244 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-21:21:13 6648 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2679508 8.4 Ssl 1-21:20:42 /usr/sbin/mariadbd 508924 1 netdata 181020 1.9 Ssl 1-21:20:11 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83639 1451906 root 169480 0.0 S 07:42:19 spamd child 1705603 510022 madalice 167332 23.4 R 00:58 php-fpm: pool madalice_com_au 1706267 510022 madalice 167272 54.4 R 00:16 php-fpm: pool madalice_com_au 1706480 510022 madalice 167212 72.0 R 00:06 php-fpm: pool madalice_com_au 1706318 510022 madalice 163892 47.9 R 00:13 php-fpm: pool madalice_com_au 1706317 510022 madalice 163752 57.6 R 00:13 php-fpm: pool madalice_com_au 1706482 510022 madalice 163596 65.0 R 00:06 php-fpm: pool madalice_com_au 1706328 510022 madalice 163120 54.0 R 00:13 php-fpm: pool madalice_com_au 1706479 510022 madalice 162692 63.1 R 00:06 php-fpm: pool madalice_com_au 1502904 1451906 root 162420 0.0 S 21:03:31 spamd child 1706316 510022 madalice 159752 63.3 S 00:13 php-fpm: pool madalice_com_au 1706481 510022 madalice 157596 78.5 R 00:06 php-fpm: pool madalice_com_au 509266 1 root 119664 0.0 Ss 1-21:20:08 /usr/lib/systemd/systemd-journald 1451906 1 root 114528 0.0 Ss 21:16:46 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1706556 1704877 aaa 90952 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1668791 1353308 cpanellogin 63872 0.1 S 13:34 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 509236 509098 root 59252 0.0 Sl 1-21:20:08 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42376 0.1 Ss 38-20:58:34 cpsrvd (SSL) - waiting for connections 1706587 1706408 evolution 41936 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509640 508992 root 41488 0.0 Sl 1-21:20:06 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1706558 1706532 evolution 40660 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1451116 1 root 31820 0.0 Ss 21:17:39 lfd - sleeping 1706598 1469 root 30184 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1469 1 root 24924 0.1 Ss 61-13:30:03 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 24212 0.0 Ss 1-21:20:04 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1686675 506832 nobody 23412 0.0 S 08:42 /usr/sbin/httpd -k start 483898 1 zabbix 22600 0.2 Ssl 1-21:21:25 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1688831 506832 nobody 22468 0.0 S 05:33 /usr/sbin/httpd -k start 1705254 506832 nobody 21732 0.0 S 01:45 /usr/sbin/httpd -k start 1705611 506832 nobody 21440 0.0 S 00:57 /usr/sbin/httpd -k start 1704861 506832 nobody 20996 0.0 S 02:37 /usr/sbin/httpd -k start 1704859 506832 nobody 20988 0.0 S 02:38 /usr/sbin/httpd -k start 1704877 506832 nobody 20672 0.1 S 02:35 /usr/sbin/httpd -k start 1463 1 root 20440 0.0 Ss 61-13:30:03 tailwatchd 1706342 506832 nobody 20360 0.2 S 00:12 /usr/sbin/httpd -k start 1706343 506832 nobody 20336 0.2 S 00:12 /usr/sbin/httpd -k start 938582 1 wp-toolkit 20312 0.0 Ss 1-19:27:45 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1704697 506832 nobody 19956 0.0 S 02:56 /usr/sbin/httpd -k start 1704883 506832 nobody 19588 0.0 S 02:35 /usr/sbin/httpd -k start 1703783 506832 nobody 19388 0.0 S 04:21 /usr/sbin/httpd -k start 1706405 506832 nobody 19376 0.2 S 00:10 /usr/sbin/httpd -k start 1705624 506832 nobody 19356 0.1 S 00:56 /usr/sbin/httpd -k start 1706532 506832 nobody 19336 0.3 S 00:03 /usr/sbin/httpd -k start 1705623 506832 nobody 19264 0.0 S 00:56 /usr/sbin/httpd -k start 1706514 506832 nobody 19244 0.2 S 00:04 /usr/sbin/httpd -k start 1706498 506832 nobody 19240 0.2 S 00:05 /usr/sbin/httpd -k start 1706244 506832 nobody 19216 0.1 S 00:18 /usr/sbin/httpd -k start 1706497 506832 nobody 19176 0.2 S 00:05 /usr/sbin/httpd -k start 1706512 506832 nobody 19176 0.2 S 00:04 /usr/sbin/httpd -k start 1706513 506832 nobody 19176 0.2 S 00:04 /usr/sbin/httpd -k start 1706410 506832 nobody 19116 0.2 S 00:10 /usr/sbin/httpd -k start 1706515 506832 nobody 19116 0.2 S 00:04 /usr/sbin/httpd -k start 1706243 506832 nobody 18984 0.0 S 00:18 /usr/sbin/httpd -k start 1705251 506832 nobody 18636 0.0 S 01:46 /usr/sbin/httpd -k start 1705397 506832 nobody 18520 0.0 S 01:25 /usr/sbin/httpd -k start 1705604 506832 nobody 18500 0.1 S 00:58 /usr/sbin/httpd -k start 1706205 506832 nobody 18108 0.0 S 00:19 /usr/sbin/httpd -k start 1706359 506832 nobody 17868 0.0 S 00:11 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4232844 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min aaa/aaadownunder.com.au-ssl_log 187 otterfencing/otterfencing.com.au-ssl_log 172 alison/testing.alisonarts.com.au-ssl_log 165 whiz/whizengineering.com.au 137 alison/testing.alisonarts.com.au 117 coscom/coscom.com.au-ssl_log 58 madalice/madalice.com.au-ssl_log 43 kamcool/kamcool.com.au-ssl_log 40 tubesupplies/tubesupplies.com.au-ssl_log 35 evolution/portal.evolutionerp.com.au-ssl_log 22 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 244 68.155.159.216 176 149.118.59.225 173 20.203.141.11 137 52.139.44.162 134 52.139.37.240 33 185.177.72.53 31 35.231.96.126 22 203.54.180.238 5 34.176.192.156 4 118.127.40.55 2 91.92.243.234 2 114.119.159.70 2 114.119.143.104 1 66.249.68.67 1 66.249.68.66 --- top request paths across all vhosts (last 3 min) --- 74 GET /wp-admin/index.php 72 GET /wp-login.php 37 POST /wp-login.php 34 GET /heartbeat.php 7 GET /store/design-your-own-sliders/ 6 GET /goods.php 5 GET /radio.php 5 GET /file.php 5 GET /dropdown.php 5 GET /classwithtostring.php 5 GET /1.php 4 POST /wp-cron.php 4 GET /ws.php 4 GET /wp-includes/customize/index.php 4 GET /wp-content/plugins/index.php 4 GET /wp-content/plugins/hellopress/wp_filemanager.php 4 GET /wp-content/cong.php 4 GET /wp-content/admin.php 4 GET /this_is_a_new_hello_world.php 4 GET /simple.php --- busiest 3 vhosts: top paths + last 10 requests --- == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 71 GET /wp-admin/index.php 70 GET /wp-login.php 37 POST /wp-login.php 2 POST /wp-cron.php -- last 10 requests -- 149.118.59.225 - - [29/Aug/2026:23:39:34 +1000] "POST /wp-login.php HTTP/1.1" 200 7301 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Ch 149.118.59.225 - - [29/Aug/2026:23:39:35 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) 149.118.59.225 - - [29/Aug/2026:23:39:36 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Faaadownunder.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 6930 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 149.118.59.225 - - [29/Aug/2026:23:39:37 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) 149.118.59.225 - - [29/Aug/2026:23:39:37 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Faaadownunder.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 6930 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 149.118.59.225 - - [29/Aug/2026:23:39:38 +1000] "POST /wp-login.php HTTP/1.1" 200 7291 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) 149.118.59.225 - - [29/Aug/2026:23:39:39 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko 45.148.10.64 - - [29/Aug/2026:23:39:40 +1000] "-" 408 - "-" "-" 149.118.59.225 - - [29/Aug/2026:23:39:40 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Faaadownunder.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 6930 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 149.118.59.225 - - [29/Aug/2026:23:39:41 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 2 GET /222.php 1 GET /zoom1.php 1 GET /yanz.php 1 GET /xxx.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-themes.php 1 GET /wp-mail.php 1 GET /wp-logs.php -- last 10 requests -- 20.203.141.11 - - [29/Aug/2026:23:39:42 +1000] "GET /php.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [29/Aug/2026:23:39:42 +1000] "GET /init.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [29/Aug/2026:23:39:42 +1000] "GET /wp-includes/js/codemirror/about.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/53 20.203.141.11 - - [29/Aug/2026:23:39:42 +1000] "GET /wp-admin/css/colors/blue/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [29/Aug/2026:23:39:43 +1000] "GET /wp-includes/Requests/library/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [29/Aug/2026:23:39:43 +1000] "GET /wp-content/admin.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [29/Aug/2026:23:39:43 +1000] "GET /wp-configs.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [29/Aug/2026:23:39:44 +1000] "GET /wp-includes/index.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [29/Aug/2026:23:39:44 +1000] "GET /wp-admin/a.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.203.141.11 - - [29/Aug/2026:23:39:44 +1000] "GET /wp-includes/sitemaps/providers/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 == alison/testing.alisonarts.com.au-ssl_log == -- top paths -- 2 GET /wp-includes/customize/index.php 2 GET /wp-content/admin.php 2 GET /wp-admin.php 2 GET /file.php 2 GET /dropdown.php 2 GET /classwithtostring.php 2 GET /about.php 1 GET /zwso.php 1 GET /zoom1.php 1 GET /y.php 1 GET /yanz.php 1 GET /xmlrpc.php -- last 10 requests -- 68.155.159.216 - - [29/Aug/2026:23:39:35 +1000] "GET /wp-admin/index.php HTTP/1.1" 404 - "-" "-" 68.155.159.216 - - [29/Aug/2026:23:39:35 +1000] "GET /wp-content/themes/index.php HTTP/1.1" 404 - "-" "-" 68.155.159.216 - - [29/Aug/2026:23:39:36 +1000] "GET /about.php HTTP/1.1" 404 - "-" "-" 68.155.159.216 - - [29/Aug/2026:23:39:36 +1000] "GET /wp-includes/autoload_classmap.php HTTP/1.1" 404 - "-" "-" 68.155.159.216 - - [29/Aug/2026:23:39:37 +1000] "GET /themes.php HTTP/1.1" 404 - "-" "-" 68.155.159.216 - - [29/Aug/2026:23:39:37 +1000] "GET /wp-mail.php HTTP/1.1" 404 - "-" "-" 68.155.159.216 - - [29/Aug/2026:23:39:37 +1000] "GET /cgi-bin/index.php HTTP/1.1" 404 - "-" "-" 68.155.159.216 - - [29/Aug/2026:23:39:38 +1000] "GET /wp-content/plugins/admin.php HTTP/1.1" 404 - "-" "-" 68.155.159.216 - - [29/Aug/2026:23:39:38 +1000] "GET /wp-includes/content.php HTTP/1.1" 404 - "-" "-" 68.155.159.216 - - [29/Aug/2026:23:39:39 +1000] "GET /wp-admin/css/index.php HTTP/1.1" 404 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-29 23:37:24 L1=1.66 run=3 blk=0 avail=8539 (62.0%) swpO=0 conn=4 myRSS=2616 php=4 phpRSS=252 ap=42 tcp=37 topuser=madalice 2026-08-29 23:37:33 L1=1.60 run=2 blk=0 avail=8610 (62.5%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=243 ap=34 tcp=36 topuser=madalice 2026-08-29 23:37:34 L1=1.56 run=2 blk=0 avail=8607 (62.5%) swpO=0 conn=4 myRSS=2616 php=4 phpRSS=252 ap=32 tcp=37 topuser=madalice 2026-08-29 23:37:43 L1=1.43 run=2 blk=0 avail=8655 (62.8%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=259 ap=24 tcp=27 topuser=madalice 2026-08-29 23:37:44 L1=1.40 run=3 blk=0 avail=8669 (62.9%) swpO=0 conn=4 myRSS=2616 php=4 phpRSS=257 ap=22 tcp=30 topuser=madalice 2026-08-29 23:37:53 L1=1.44 run=1 blk=0 avail=8771 (63.7%) swpO=0 conn=2 myRSS=2616 php=3 phpRSS=169 ap=16 tcp=27 topuser=madalice 2026-08-29 23:37:55 L1=1.57 run=1 blk=0 avail=8769 (63.7%) swpO=0 conn=1 myRSS=2616 php=3 phpRSS=169 ap=15 tcp=31 topuser=madalice 2026-08-29 23:38:03 L1=1.52 run=1 blk=0 avail=8766 (63.6%) swpO=0 conn=2 myRSS=2616 php=3 phpRSS=169 ap=15 tcp=29 topuser=madalice 2026-08-29 23:38:05 L1=1.48 run=3 blk=0 avail=8692 (63.1%) swpO=0 conn=1 myRSS=2616 php=3 phpRSS=247 ap=15 tcp=32 topuser=madalice 2026-08-29 23:38:13 L1=1.44 run=1 blk=0 avail=8728 (63.3%) swpO=0 conn=1 myRSS=2616 php=3 phpRSS=191 ap=18 tcp=32 topuser=madalice 2026-08-29 23:38:15 L1=1.41 run=2 blk=0 avail=8716 (63.3%) swpO=0 conn=1 myRSS=2616 php=4 phpRSS=235 ap=18 tcp=34 topuser=madalice 2026-08-29 23:38:23 L1=1.45 run=1 blk=0 avail=8739 (63.4%) swpO=0 conn=1 myRSS=2616 php=3 phpRSS=191 ap=17 tcp=29 topuser=madalice 2026-08-29 23:38:25 L1=1.42 run=1 blk=0 avail=8738 (63.4%) swpO=0 conn=1 myRSS=2616 php=4 phpRSS=203 ap=16 tcp=33 topuser=madalice 2026-08-29 23:38:33 L1=1.38 run=4 blk=0 avail=8585 (62.3%) swpO=0 conn=1 myRSS=2616 php=6 phpRSS=426 ap=17 tcp=33 topuser=madalice 2026-08-29 23:38:35 L1=1.35 run=2 blk=0 avail=8604 (62.5%) swpO=0 conn=1 myRSS=2616 php=5 phpRSS=374 ap=17 tcp=34 topuser=madalice 2026-08-29 23:38:43 L1=1.33 run=2 blk=0 avail=8613 (62.5%) swpO=0 conn=1 myRSS=2616 php=5 phpRSS=379 ap=16 tcp=28 topuser=madalice 2026-08-29 23:38:45 L1=1.30 run=3 blk=0 avail=8613 (62.5%) swpO=0 conn=1 myRSS=2616 php=5 phpRSS=380 ap=15 tcp=30 topuser=madalice 2026-08-29 23:38:53 L1=1.43 run=1 blk=0 avail=8770 (63.7%) swpO=0 conn=1 myRSS=2616 php=3 phpRSS=169 ap=15 tcp=29 topuser=madalice 2026-08-29 23:38:55 L1=1.40 run=3 blk=0 avail=8843 (64.2%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=140 ap=15 tcp=37 topuser=tubesupplies 2026-08-29 23:39:03 L1=1.53 run=7 blk=0 avail=8451 (61.3%) swpO=0 conn=1 myRSS=2616 php=5 phpRSS=334 ap=21 tcp=38 topuser=tubesupplies 2026-08-29 23:39:05 L1=1.49 run=2 blk=0 avail=8687 (63.1%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=244 ap=20 tcp=40 topuser=madalice 2026-08-29 23:39:13 L1=1.61 run=2 blk=0 avail=8704 (63.2%) swpO=0 conn=1 myRSS=2616 php=4 phpRSS=232 ap=20 tcp=36 topuser=madalice 2026-08-29 23:39:15 L1=1.64 run=2 blk=0 avail=8687 (63.1%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=249 ap=20 tcp=36 topuser=madalice 2026-08-29 23:39:23 L1=1.67 run=2 blk=0 avail=8686 (63.1%) swpO=0 conn=1 myRSS=2616 php=4 phpRSS=246 ap=20 tcp=36 topuser=madalice 2026-08-29 23:39:25 L1=1.86 run=3 blk=0 avail=8561 (62.1%) swpO=0 conn=2 myRSS=2616 php=5 phpRSS=371 ap=20 tcp=38 topuser=madalice 2026-08-29 23:39:33 L1=1.87 run=3 blk=0 avail=8650 (62.8%) swpO=0 conn=1 myRSS=2616 php=5 phpRSS=318 ap=20 tcp=34 topuser=madalice 2026-08-29 23:39:35 L1=1.88 run=4 blk=0 avail=8614 (62.5%) swpO=0 conn=2 myRSS=2616 php=4 phpRSS=316 ap=21 tcp=40 topuser=madalice 2026-08-29 23:39:43 L1=1.81 run=10 blk=0 avail=7900 (57.3%) swpO=0 conn=1 myRSS=2616 php=10 phpRSS=1113 ap=30 tcp=48 topuser=madalice 2026-08-29 23:39:45 L1=1.90 run=4 blk=0 avail=7873 (57.1%) swpO=0 conn=2 myRSS=2616 php=9 phpRSS=1035 ap=38 tcp=47 topuser=madalice 2026-08-29 23:39:53 L1=2.79 run=14 blk=0 avail=7133 (51.8%) swpO=0 conn=11 myRSS=2616 php=14 phpRSS=1786 ap=50 tcp=68 topuser=madalice