INCIDENT 2026-08-29 23:46:37 trigger: php_rss=2047MB ================================================================== load: 3.94 2.95 2.22 14/776 1741611 ncpu:10 mem_avail: 6245MB/13777MB (45.3%) swap_used:1784MB swapout:0/s blocked(D):0 running:17 iowait:0.0% steal:0.0% php: 13 procs / 2047MB heaviest user: madalice (10 procs, 1919MB) apache: 137 procs tcp_estab: 63 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2616 nobody 136 2312 madalice 10 1707 root 249 1019 netdata 7 199 mailman 20 147 cpanellogin 1 62 dovenull 6 48 evolution 11 47 lowrange 3 44 wp-toolkit 3 34 mailnull 3 27 kurri 2 27 zabbix 1 21 dovecot 3 20 named 1 15 infinium 1 14 candyfabcom 1 14 aaa 1 14 polkitd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1716 root 1 23 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5292 MB Active(file): 3491 MB Inactive(file): 2133 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 573 MB CommitLimit: 10984 MB Committed_AS: 10521 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-21:27:57 6648 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2679540 8.4 Ssl 1-21:27:26 /usr/sbin/mariadbd 1741448 510022 madalice 251932 54.2 R 00:13 php-fpm: pool madalice_com_au 1741447 510022 madalice 224280 44.7 R 00:13 php-fpm: pool madalice_com_au 508924 1 netdata 181692 1.9 Ssl 1-21:26:55 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1741556 510022 madalice 171360 79.2 R 00:04 php-fpm: pool madalice_com_au 83639 1451906 root 169480 0.0 S 07:49:03 spamd child 1737325 510022 madalice 166044 18.3 R 01:27 php-fpm: pool madalice_com_au 1741453 510022 madalice 164764 40.4 R 00:13 php-fpm: pool madalice_com_au 1741560 510022 madalice 162436 70.2 R 00:04 php-fpm: pool madalice_com_au 1502904 1451906 root 162420 0.0 S 21:10:15 spamd child 1741458 510022 madalice 161984 42.4 R 00:12 php-fpm: pool madalice_com_au 1741456 510022 madalice 159460 46.3 R 00:13 php-fpm: pool madalice_com_au 1741454 510022 madalice 159452 44.7 S 00:13 php-fpm: pool madalice_com_au 1741561 510022 madalice 159076 66.0 R 00:04 php-fpm: pool madalice_com_au 509266 1 root 119924 0.0 Ss 1-21:26:52 /usr/lib/systemd/systemd-journald 1451906 1 root 114528 0.0 Ss 21:23:30 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1668791 1353308 cpanellogin 64008 0.1 S 20:18 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 509236 509098 root 59252 0.0 Sl 1-21:26:52 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42376 0.1 Ss 38-21:05:18 cpsrvd (SSL) - waiting for connections 509640 508992 root 41752 0.0 Sl 1-21:26:50 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 31824 0.0 Ss 21:24:23 lfd - sleeping 1469 1 root 24924 0.1 Ss 61-13:36:47 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 24212 0.0 Ss 1-21:26:48 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1721156 506832 nobody 23664 0.1 S 05:58 /usr/sbin/httpd -k start 1721298 506832 nobody 23016 0.1 S 05:52 /usr/sbin/httpd -k start 1721230 506832 nobody 22528 0.0 S 05:53 /usr/sbin/httpd -k start 483898 1 zabbix 22172 0.2 Ssl 1-21:28:09 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1724334 506832 nobody 22044 0.3 S 03:47 /usr/sbin/httpd -k start 1706533 506832 nobody 21640 0.2 S 06:47 /usr/sbin/httpd -k start 1725036 506832 nobody 21620 0.0 S 02:30 /usr/sbin/httpd -k start 1721293 506832 nobody 21404 0.1 S 05:52 /usr/sbin/httpd -k start 1727745 506832 nobody 21208 0.0 S 01:33 /usr/sbin/httpd -k start 1732358 506832 nobody 21084 0.3 S 01:30 /usr/sbin/httpd -k start 1721309 506832 nobody 20976 0.1 S 05:52 /usr/sbin/httpd -k start 1741285 506832 nobody 20636 0.2 S 00:18 /usr/sbin/httpd -k start 1721198 506832 nobody 20552 0.2 S 05:54 /usr/sbin/httpd -k start 1463 1 root 20440 0.0 Ss 61-13:36:47 tailwatchd 938582 1 wp-toolkit 20312 0.0 Ss 1-19:34:29 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1725037 506832 nobody 20116 0.2 S 02:30 /usr/sbin/httpd -k start 1721176 506832 nobody 19960 0.0 S 05:55 /usr/sbin/httpd -k start 1741282 506832 nobody 19896 0.0 S 00:18 /usr/sbin/httpd -k start 1741316 506832 nobody 19492 0.0 S 00:16 /usr/sbin/httpd -k start 1741310 506832 nobody 19468 0.0 S 00:16 /usr/sbin/httpd -k start 1741291 506832 nobody 19460 0.0 S 00:17 /usr/sbin/httpd -k start 1741294 506832 nobody 19456 0.1 S 00:17 /usr/sbin/httpd -k start 1741307 506832 nobody 19452 0.1 S 00:16 /usr/sbin/httpd -k start 1741314 506832 nobody 19452 0.0 S 00:16 /usr/sbin/httpd -k start 1741292 506832 nobody 19360 0.0 S 00:17 /usr/sbin/httpd -k start 1741315 506832 nobody 19336 0.1 S 00:16 /usr/sbin/httpd -k start 1725483 506832 nobody 19328 0.6 S 01:40 /usr/sbin/httpd -k start 1741312 506832 nobody 19328 0.0 S 00:16 /usr/sbin/httpd -k start 1741293 506832 nobody 19324 0.1 S 00:17 /usr/sbin/httpd -k start 1741309 506832 nobody 19324 0.0 S 00:16 /usr/sbin/httpd -k start 1741313 506832 nobody 19324 0.0 S 00:16 /usr/sbin/httpd -k start 1741318 506832 nobody 19324 0.0 S 00:16 /usr/sbin/httpd -k start 1741420 506832 nobody 19224 0.0 S 00:13 /usr/sbin/httpd -k start 1741419 506832 nobody 19164 0.0 S 00:13 /usr/sbin/httpd -k start 1741154 506832 nobody 19040 0.0 S 00:22 /usr/sbin/httpd -k start 1721175 506832 nobody 18964 0.1 S 05:55 /usr/sbin/httpd -k start 1741410 506832 nobody 18928 0.0 S 00:13 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4237017 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 4237006 | madalice_wp | madalice_wp | Query | 0 | Preparing | SELECT option_name, option_value FROM AMuqf6qZ_options WHERE option_name IN ('_transient_wc_block_product_filter_attribute_default_attribute','_transient_timeout_wc_block_product_filter_attribute_default_attribute') | +---------+-------------+-------------+---------+------+----------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 1075 aaa/aaadownunder.com.au-ssl_log 447 aaa/aaadownunder.com.au 262 coscom/coscom.com.au-ssl_log 261 customc/customcentral.com.au-ssl_log 139 tubesupplies/tubesupplies.com.au-ssl_log 109 madalice/madalice.com.au-ssl_log 51 whiz/whizengineering.com.au-ssl_log 39 customc/customcentral.com.au 22 evolution/portal.evolutionerp.com.au-ssl_log 22 evolution/support.evolutionerp.com.au-ssl_log 12 alison/alisonarts.com.au-ssl_log 1 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 1075 40.115.94.245 548 52.139.44.162 261 34.163.2.223 158 149.118.59.225 99 52.139.37.240 85 68.155.159.216 80 185.177.72.53 39 20.63.81.20 29 35.231.130.18 22 203.54.180.238 11 118.127.40.55 3 57.129.136.36 3 49.185.205.144 2 91.92.243.249 2 209.42.18.204 --- top request paths across all vhosts (last 3 min) --- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 69 GET /wp-login.php 63 GET /wp-admin/index.php 34 POST /wp-login.php 22 GET /heartbeat.php 10 POST /wp-cron.php 9 GET /api/getItem/NA 8 GET /wp-content/themes/index.php 8 GET /admin.php 6 POST / 6 GET /store/design-your-own-send-in/ 6 GET /av.php 6 GET /1.php 5 GET /wp-content/plugins/hellopress/wp_filemanager.php 5 GET /wp-content/admin.php 5 GET /wp-blog.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 9 GET /api/getItem/NA 4 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 -- last 10 requests -- 40.115.94.245 - - [29/Aug/2026:23:46:15 +1000] "GET /api/getItem/RGW90 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:23:46:15 +1000] "GET /api/getItem/RGW100 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:23:46:16 +1000] "GET /api/getItem/RGW120 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:23:46:16 +1000] "GET /api/getItem/RGW160 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:23:46:16 +1000] "GET /api/getItem/RGW117T HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:23:46:16 +1000] "GET /api/getItem/RGW80 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:23:46:16 +1000] "GET /api/getItem/GP150x200x8 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:23:46:16 +1000] "GET /api/getItem/K125MSGB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:23:46:16 +1000] "GET /api/getItem/253-40SP HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:23:46:16 +1000] "GET /api/getItem/300558 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 66 GET /wp-login.php 63 GET /wp-admin/index.php 31 POST /wp-login.php 6 GET /admin.php 4 GET /wp-content/themes/index.php 4 GET /av.php 2 POST /wp-cron.php 2 GET /zoo1.php 2 GET /yj09.php 2 GET /xnm-apc.php 2 GET /xiugai.php 2 GET /xamp.php -- last 10 requests -- 149.118.59.225 - - [29/Aug/2026:23:46:20 +1000] "POST /wp-login.php HTTP/1.1" 200 7339 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0" 149.118.59.225 - - [29/Aug/2026:23:46:21 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/605.1.15 (KHTML, like Gecko) Vers 149.118.59.225 - - [29/Aug/2026:23:46:22 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Faaadownunder.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 6930 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 149.118.59.225 - - [29/Aug/2026:23:46:24 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/605.1.15 (KHTML, like Gecko) Vers 149.118.59.225 - - [29/Aug/2026:23:46:25 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Faaadownunder.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 6930 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 149.118.59.225 - - [29/Aug/2026:23:46:26 +1000] "POST /wp-login.php HTTP/1.1" 200 7339 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0.2" 149.118.59.225 - - [29/Aug/2026:23:46:27 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/605.1.15 (KHTML, like Gecko) Vers 149.118.59.225 - - [29/Aug/2026:23:46:28 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Faaadownunder.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 6930 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 149.118.59.225 - - [29/Aug/2026:23:46:29 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 - "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/605.1.15 (KHTML, like Gecko) Vers 149.118.59.225 - - [29/Aug/2026:23:46:30 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Faaadownunder.com.au%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 6930 "https://aaadownunder.com.au/wp-login.php" "Mozilla/5.0 == aaa/aaadownunder.com.au == -- top paths -- 4 GET /wp-content/themes/index.php 2 GET /zoo1.php 2 GET /yj09.php 2 GET /xnm-apc.php 2 GET /xiugai.php 2 GET /xamp.php 2 GET /wp-temp.php 2 GET /wp.php 2 GET /wp-mails.php 2 GET //wp-includes/Requests/ 2 GET //wp-includes/js/jquery/ 2 GET /wp-includes/ID3/about.php -- last 10 requests -- 52.139.44.162 - - [29/Aug/2026:23:45:49 +1000] "GET //elp.php?p= HTTP/1.1" 301 291 "-" "-" 52.139.44.162 - - [29/Aug/2026:23:45:49 +1000] "GET /av.php HTTP/1.1" 301 287 "-" "-" 52.139.44.162 - - [29/Aug/2026:23:45:49 +1000] "GET /wp-content/uploads/ HTTP/1.1" 301 300 "-" "-" 52.139.44.162 - - [29/Aug/2026:23:45:49 +1000] "GET /wp-content/themes/index.php HTTP/1.1" 301 308 "-" "-" 52.139.44.162 - - [29/Aug/2026:23:45:50 +1000] "GET /dorps.php HTTP/1.1" 301 290 "-" "-" 52.139.44.162 - - [29/Aug/2026:23:45:50 +1000] "GET /wp-blog.php HTTP/1.1" 301 292 "-" "-" 52.139.44.162 - - [29/Aug/2026:23:45:50 +1000] "GET /cagor.php HTTP/1.1" 301 290 "-" "-" 52.139.44.162 - - [29/Aug/2026:23:45:50 +1000] "GET //wp-includes/js/jquery/ HTTP/1.1" 301 303 "-" "-" 52.139.44.162 - - [29/Aug/2026:23:45:50 +1000] "GET /billzgs.php HTTP/1.1" 301 292 "-" "-" 52.139.44.162 - - [29/Aug/2026:23:45:51 +1000] "GET //cgi-bin/index.php HTTP/1.1" 301 298 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-29 23:44:16 L1=3.18 run=3 blk=0 avail=8391 (60.9%) swpO=0 conn=3 myRSS=2616 php=6 phpRSS=550 ap=23 tcp=39 topuser=madalice 2026-08-29 23:44:16 L1=3.18 run=2 blk=0 avail=8523 (61.9%) swpO=0 conn=4 myRSS=2616 php=4 phpRSS=357 ap=23 tcp=41 topuser=madalice 2026-08-29 23:44:26 L1=3.15 run=4 blk=0 avail=8466 (61.4%) swpO=0 conn=3 myRSS=2616 php=6 phpRSS=463 ap=22 tcp=47 topuser=madalice 2026-08-29 23:44:27 L1=3.15 run=5 blk=0 avail=8310 (60.3%) swpO=0 conn=4 myRSS=2616 php=6 phpRSS=619 ap=22 tcp=47 topuser=madalice 2026-08-29 23:44:36 L1=3.37 run=6 blk=0 avail=8274 (60.1%) swpO=0 conn=3 myRSS=2616 php=6 phpRSS=657 ap=24 tcp=39 topuser=madalice 2026-08-29 23:44:37 L1=3.37 run=5 blk=0 avail=8369 (60.7%) swpO=0 conn=4 myRSS=2616 php=7 phpRSS=591 ap=24 tcp=37 topuser=madalice 2026-08-29 23:44:46 L1=3.23 run=4 blk=0 avail=8439 (61.3%) swpO=0 conn=3 myRSS=2616 php=7 phpRSS=544 ap=21 tcp=37 topuser=madalice 2026-08-29 23:44:47 L1=3.23 run=4 blk=0 avail=8345 (60.6%) swpO=0 conn=4 myRSS=2616 php=6 phpRSS=604 ap=21 tcp=37 topuser=madalice 2026-08-29 23:44:56 L1=2.89 run=3 blk=0 avail=8309 (60.3%) swpO=0 conn=3 myRSS=2616 php=8 phpRSS=681 ap=22 tcp=45 topuser=madalice 2026-08-29 23:44:57 L1=2.89 run=3 blk=0 avail=8346 (60.6%) swpO=0 conn=3 myRSS=2616 php=6 phpRSS=594 ap=22 tcp=41 topuser=madalice 2026-08-29 23:45:06 L1=2.92 run=7 blk=0 avail=8489 (61.6%) swpO=0 conn=3 myRSS=2616 php=7 phpRSS=477 ap=24 tcp=44 topuser=customc 2026-08-29 23:45:07 L1=2.92 run=4 blk=0 avail=8570 (62.2%) swpO=0 conn=3 myRSS=2616 php=5 phpRSS=332 ap=24 tcp=45 topuser=customc 2026-08-29 23:45:16 L1=3.08 run=5 blk=0 avail=8395 (60.9%) swpO=0 conn=5 myRSS=2616 php=8 phpRSS=579 ap=27 tcp=44 topuser=customc 2026-08-29 23:45:17 L1=3.08 run=4 blk=0 avail=8512 (61.8%) swpO=0 conn=3 myRSS=2616 php=6 phpRSS=411 ap=27 tcp=43 topuser=customc 2026-08-29 23:45:26 L1=3.22 run=4 blk=0 avail=8518 (61.8%) swpO=0 conn=5 myRSS=2616 php=6 phpRSS=386 ap=27 tcp=44 topuser=madalice 2026-08-29 23:45:27 L1=3.22 run=8 blk=0 avail=8335 (60.5%) swpO=0 conn=3 myRSS=2616 php=8 phpRSS=649 ap=27 tcp=45 topuser=customc 2026-08-29 23:45:36 L1=3.18 run=4 blk=0 avail=8451 (61.3%) swpO=0 conn=5 myRSS=2616 php=7 phpRSS=501 ap=27 tcp=41 topuser=madalice 2026-08-29 23:45:37 L1=3.18 run=6 blk=0 avail=8464 (61.4%) swpO=0 conn=3 myRSS=2616 php=4 phpRSS=245 ap=27 tcp=41 topuser=madalice 2026-08-29 23:45:46 L1=2.77 run=4 blk=0 avail=8590 (62.4%) swpO=0 conn=5 myRSS=2616 php=4 phpRSS=277 ap=24 tcp=41 topuser=madalice 2026-08-29 23:45:47 L1=2.77 run=5 blk=0 avail=8500 (61.7%) swpO=0 conn=3 myRSS=2616 php=7 phpRSS=473 ap=24 tcp=41 topuser=madalice 2026-08-29 23:45:56 L1=2.89 run=6 blk=0 avail=8560 (62.1%) swpO=0 conn=5 myRSS=2616 php=7 phpRSS=407 ap=23 tcp=38 topuser=madalice 2026-08-29 23:45:57 L1=2.89 run=8 blk=0 avail=8402 (61.0%) swpO=0 conn=5 myRSS=2616 php=7 phpRSS=572 ap=23 tcp=37 topuser=madalice 2026-08-29 23:46:07 L1=2.98 run=4 blk=0 avail=8456 (61.4%) swpO=0 conn=5 myRSS=2616 php=6 phpRSS=488 ap=23 tcp=38 topuser=madalice 2026-08-29 23:46:07 L1=2.98 run=5 blk=0 avail=8537 (62.0%) swpO=0 conn=5 myRSS=2616 php=4 phpRSS=337 ap=23 tcp=37 topuser=madalice 2026-08-29 23:46:17 L1=2.91 run=5 blk=0 avail=8608 (62.5%) swpO=0 conn=3 myRSS=2616 php=6 phpRSS=354 ap=21 tcp=41 topuser=madalice 2026-08-29 23:46:17 L1=2.91 run=5 blk=0 avail=8455 (61.4%) swpO=0 conn=5 myRSS=2616 php=6 phpRSS=505 ap=22 tcp=40 topuser=customc 2026-08-29 23:46:27 L1=3.17 run=7 blk=0 avail=7131 (51.8%) swpO=0 conn=3 myRSS=2616 php=10 phpRSS=1043 ap=147 tcp=126 topuser=madalice 2026-08-29 23:46:27 L1=3.17 run=13 blk=0 avail=6884 (50.0%) swpO=0 conn=5 myRSS=2616 php=11 phpRSS=1346 ap=146 tcp=124 topuser=madalice 2026-08-29 23:46:37 L1=3.94 run=17 blk=0 avail=6245 (45.3%) swpO=0 conn=10 myRSS=2616 php=13 phpRSS=2047 ap=137 tcp=63 topuser=madalice 2026-08-29 23:46:37 L1=3.94 run=18 blk=0 avail=6406 (46.5%) swpO=0 conn=12 myRSS=2616 php=14 phpRSS=1866 ap=136 tcp=67 topuser=madalice