INCIDENT 2026-08-30 00:29:42 trigger: php_rss=1594MB ================================================================== load: 2.15 1.48 1.55 1/679 1878541 ncpu:10 mem_avail: 7401MB/13777MB (53.7%) swap_used:1819MB swapout:0/s blocked(D):0 running:1 iowait:0.0% steal:0.0% php: 12 procs / 1594MB heaviest user: madalice (10 procs, 1557MB) apache: 43 procs tcp_estab: 42 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2596 madalice 10 1557 root 245 973 nobody 42 714 netdata 7 199 mailman 20 143 infinium 5 73 dovenull 6 49 evolution 11 47 mailnull 5 44 wp-toolkit 3 33 lowrange 2 29 kurri 2 27 zabbix 1 21 dovecot 3 20 named 1 15 candyfabcom 1 14 aaa 1 14 polkitd 1 5 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1557 root 1 23 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5694 MB Active(file): 3426 MB Inactive(file): 2583 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 563 MB CommitLimit: 10984 MB Committed_AS: 8469 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-22:11:01 6600 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2659104 8.3 Ssl 1-22:10:30 /usr/sbin/mariadbd 508924 1 netdata 182364 1.9 Ssl 1-22:09:59 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83639 1451906 root 169556 0.0 S 08:32:07 spamd child 1502904 1451906 root 161412 0.0 S 21:53:19 spamd child 1878163 510022 madalice 160572 19.6 S 00:42 php-fpm: pool madalice_com_au 1878160 510022 madalice 159852 19.6 S 00:42 php-fpm: pool madalice_com_au 1878161 510022 madalice 159688 19.4 S 00:42 php-fpm: pool madalice_com_au 1878159 510022 madalice 159684 19.9 S 00:42 php-fpm: pool madalice_com_au 1878436 510022 madalice 159664 29.9 S 00:13 php-fpm: pool madalice_com_au 1878435 510022 madalice 159620 38.0 S 00:13 php-fpm: pool madalice_com_au 1878504 510022 madalice 159596 31.3 S 00:08 php-fpm: pool madalice_com_au 1878437 510022 madalice 159168 30.0 S 00:13 php-fpm: pool madalice_com_au 1878503 510022 madalice 159016 33.8 S 00:08 php-fpm: pool madalice_com_au 1878501 510022 madalice 158388 31.2 S 00:08 php-fpm: pool madalice_com_au 509266 1 root 119296 0.0 Ss 1-22:09:56 /usr/lib/systemd/systemd-journald 1451906 1 root 113568 0.0 Ss 22:06:34 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509236 509098 root 55580 0.0 Sl 1-22:09:56 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 42268 0.0 Sl 1-22:09:54 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1777392 1 root 37296 0.0 Ss 29:39 lfd - sleeping 1469 1 root 25284 0.1 Ss 61-14:19:51 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 24200 0.0 Ss 1-22:09:52 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1877117 506832 nobody 22464 0.0 S 01:58 /usr/sbin/httpd -k start 483898 1 zabbix 22404 0.2 Ssl 1-22:11:13 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1877110 506832 nobody 21308 0.0 S 01:59 /usr/sbin/httpd -k start 1877124 506832 nobody 20948 0.0 S 01:58 /usr/sbin/httpd -k start 1463 1 root 20420 0.0 Ss 61-14:19:51 tailwatchd 1878194 506832 nobody 20252 0.1 S 00:40 /usr/sbin/httpd -k start 1877141 506832 nobody 19832 0.0 S 01:57 /usr/sbin/httpd -k start 938582 1 wp-toolkit 19536 0.0 Ss 1-20:17:33 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1877126 506832 nobody 19484 0.0 S 01:58 /usr/sbin/httpd -k start 1877149 506832 nobody 19448 0.0 S 01:57 /usr/sbin/httpd -k start 1878282 506832 nobody 19416 0.0 S 00:36 /usr/sbin/httpd -k start 1878295 506832 nobody 19416 0.0 S 00:36 /usr/sbin/httpd -k start 1878280 506832 nobody 19396 0.0 S 00:36 /usr/sbin/httpd -k start 1878279 506832 nobody 19388 0.0 S 00:36 /usr/sbin/httpd -k start 1878262 506832 nobody 19368 0.0 S 00:37 /usr/sbin/httpd -k start 1878271 506832 nobody 19336 0.0 S 00:37 /usr/sbin/httpd -k start 1878283 506832 nobody 19328 0.0 S 00:36 /usr/sbin/httpd -k start 1878285 506832 nobody 19328 0.0 S 00:36 /usr/sbin/httpd -k start 1878297 506832 nobody 19120 0.0 S 00:36 /usr/sbin/httpd -k start 1878293 506832 nobody 19088 0.0 S 00:36 /usr/sbin/httpd -k start 1878294 506832 nobody 19088 0.0 S 00:36 /usr/sbin/httpd -k start 1878154 506832 nobody 19048 0.0 S 00:45 /usr/sbin/httpd -k start 1878244 506832 nobody 18016 0.0 S 00:39 /usr/sbin/httpd -k start 1878299 506832 nobody 17840 0.0 S 00:36 /usr/sbin/httpd -k start 1878243 506832 nobody 17804 0.0 S 00:39 /usr/sbin/httpd -k start 1878300 506832 nobody 17688 0.0 S 00:36 /usr/sbin/httpd -k start 1878273 506832 nobody 17604 0.0 S 00:37 /usr/sbin/httpd -k start 1878253 506832 nobody 17428 0.0 S 00:38 /usr/sbin/httpd -k start 1878254 506832 nobody 17416 0.0 S 00:38 /usr/sbin/httpd -k start 1878278 506832 nobody 17392 0.0 S 00:36 /usr/sbin/httpd -k start 1878275 506832 nobody 17380 0.0 S 00:37 /usr/sbin/httpd -k start 1878266 506832 nobody 17372 0.0 S 00:37 /usr/sbin/httpd -k start 1878270 506832 nobody 17304 0.0 S 00:37 /usr/sbin/httpd -k start 1878256 506832 nobody 17244 0.0 S 00:38 /usr/sbin/httpd -k start 1878265 506832 nobody 17244 0.0 S 00:37 /usr/sbin/httpd -k start 1878269 506832 nobody 17240 0.0 S 00:37 /usr/sbin/httpd -k start 1878268 506832 nobody 17208 0.0 S 00:37 /usr/sbin/httpd -k start 1878257 506832 nobody 17176 0.0 S 00:38 /usr/sbin/httpd -k start 1878263 506832 nobody 17172 0.0 S 00:37 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4257407 | root | NULL | Query | 0 | Optimizing | SELECT VARIABLE_VALUE FROM information_schema.GLOBAL_STATUS WHERE VARIABLE_NAME='Threads_running' | | 4257406 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min bigdeals/bigdeals.com.au-ssl_log 258 madalice/madalice.com.au-ssl_log 121 evolution/portal.evolutionerp.com.au-ssl_log 22 alison/alisonarts.com.au-ssl_log 6 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 258 34.130.67.92 53 35.231.130.18 34 18.142.162.7 26 52.139.37.240 22 203.54.180.238 3 114.119.143.14 2 217.113.194.170 2 217.113.194.165 1 217.113.194.163 1 199.45.154.76 1 118.127.40.55 1 114.119.146.16 1 114.119.143.104 1 114.119.140.234 1 114.119.137.101 --- top request paths across all vhosts (last 3 min) --- 22 GET /heartbeat.php 7 GET /store/customwarriors-kids/ 4 GET /wp-login.php 4 GET /users/login 4 GET /user/login 4 GET /signup 4 GET /signin 4 GET /sign-in 4 GET /secure 4 GET /register 4 GET /login 4 GET /forgot-password 4 GET /auth/login 4 GET /auth 4 GET /account/login 3 POST /cgi-sys/suspendedpage.cgi 3 GET /reset-password 3 GET /portal 3 GET /dashboard 3 GET /console --- busiest 3 vhosts: top paths + last 10 requests --- == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 3 POST /cgi-sys/suspendedpage.cgi 1 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php -- last 10 requests -- 34.130.67.92 - - [30/Aug/2026:00:27:58 +1000] "GET /beta/phpinfo.php HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.130.67.92 - - [30/Aug/2026:00:27:58 +1000] "GET /uat/phpinfo.php HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.130.67.92 - - [30/Aug/2026:00:27:58 +1000] "GET /qa/phpinfo.php HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.130.67.92 - - [30/Aug/2026:00:27:58 +1000] "GET /preview/phpinfo.php HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.130.67.92 - - [30/Aug/2026:00:27:58 +1000] "GET /www/phpinfo.php HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.130.67.92 - - [30/Aug/2026:00:27:59 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.130.67.92 - - [30/Aug/2026:00:27:59 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.130.67.92 - - [30/Aug/2026:00:27:59 +1000] "GET /site/phpinfo.php HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.130.67.92 - - [30/Aug/2026:00:27:59 +1000] "GET /docs/phpinfo.php HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.130.67.92 - - [30/Aug/2026:00:27:59 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 302 250 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 7 GET /store/customwarriors-kids/ 4 GET /wp-login.php 4 GET /users/login 4 GET /user/login 4 GET /signup 4 GET /signin 4 GET /sign-in 4 GET /secure 4 GET /register 4 GET /login 4 GET /forgot-password 4 GET /auth/login -- last 10 requests -- 18.142.162.7 - - [30/Aug/2026:00:29:33 +1000] "GET /users/login HTTP/1.1" 404 36618 "https://www.madalice.com.au/users/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mo 18.142.162.7 - - [30/Aug/2026:00:29:33 +1000] "GET /register HTTP/1.1" 404 36612 "https://www.madalice.com.au/register" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile S 18.142.162.7 - - [30/Aug/2026:00:29:33 +1000] "GET /login HTTP/1.1" 302 1 "https://www.madalice.com.au/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537. 18.142.162.7 - - [30/Aug/2026:00:29:33 +1000] "GET /user/login HTTP/1.1" 404 36616 "https://www.madalice.com.au/user/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobi 18.142.162.7 - - [30/Aug/2026:00:29:35 +1000] "GET /backoffice HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 18.142.162.7 - - [30/Aug/2026:00:29:36 +1000] "GET /admin HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 18.142.162.7 - - [30/Aug/2026:00:29:36 +1000] "GET /dashboard HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 18.142.162.7 - - [30/Aug/2026:00:29:36 +1000] "GET /console HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 18.142.162.7 - - [30/Aug/2026:00:29:36 +1000] "GET /admin/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 18.142.162.7 - - [30/Aug/2026:00:29:36 +1000] "GET /portal HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 22 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [30/Aug/2026:00:28:03 +1000] "GET /heartbeat.php?sentAt=1788013684&bytes=106,146,236,116&_=1787897052019 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:00:28:03 +1000] "GET /heartbeat.php?sentAt=1788013684&bytes=106,146,236,116&_=1787918090504 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:00:28:13 +1000] "GET /heartbeat.php?sentAt=1788013694&bytes=106,146,236,126&_=1787897052020 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:00:28:13 +1000] "GET /heartbeat.php?sentAt=1788013694&bytes=106,146,236,126&_=1787918090505 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:00:28:23 +1000] "GET /heartbeat.php?sentAt=1788013704&bytes=106,146,236,136&_=1787897052021 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:00:28:23 +1000] "GET /heartbeat.php?sentAt=1788013704&bytes=106,146,236,136&_=1787918090506 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:00:28:33 +1000] "GET /heartbeat.php?sentAt=1788013714&bytes=106,146,236,146&_=1787897052022 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:00:28:33 +1000] "GET /heartbeat.php?sentAt=1788013714&bytes=106,146,236,146&_=1787918090507 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:00:28:43 +1000] "GET /heartbeat.php?sentAt=1788013724&bytes=106,146,236,156&_=1787897052023 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:00:28:43 +1000] "GET /heartbeat.php?sentAt=1788013724&bytes=106,146,236,156&_=1787918090508 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 --- last 30 samples (run-up to this incident) --- 2026-08-30 00:27:20 L1=1.05 run=3 blk=0 avail=8481 (61.6%) swpO=0 conn=5 myRSS=2596 php=4 phpRSS=378 ap=20 tcp=40 topuser=madalice 2026-08-30 00:27:21 L1=1.12 run=2 blk=0 avail=8493 (61.6%) swpO=0 conn=1 myRSS=2596 php=4 phpRSS=364 ap=20 tcp=42 topuser=madalice 2026-08-30 00:27:30 L1=1.25 run=2 blk=0 avail=8327 (60.4%) swpO=0 conn=5 myRSS=2596 php=5 phpRSS=537 ap=22 tcp=40 topuser=madalice 2026-08-30 00:27:31 L1=1.25 run=1 blk=0 avail=8354 (60.6%) swpO=0 conn=1 myRSS=2596 php=5 phpRSS=505 ap=22 tcp=39 topuser=madalice 2026-08-30 00:27:40 L1=1.43 run=2 blk=0 avail=7920 (57.5%) swpO=0 conn=5 myRSS=2596 php=9 phpRSS=1015 ap=23 tcp=61 topuser=madalice 2026-08-30 00:27:41 L1=1.43 run=2 blk=0 avail=7920 (57.5%) swpO=0 conn=1 myRSS=2596 php=9 phpRSS=1017 ap=23 tcp=63 topuser=madalice 2026-08-30 00:27:50 L1=2.65 run=12 blk=0 avail=6568 (47.7%) swpO=0 conn=9 myRSS=2596 php=12 phpRSS=2102 ap=78 tcp=58 topuser=madalice 2026-08-30 00:27:51 L1=2.65 run=11 blk=0 avail=6844 (49.7%) swpO=0 conn=5 myRSS=2596 php=12 phpRSS=1780 ap=78 tcp=59 topuser=madalice 2026-08-30 00:28:01 L1=2.54 run=2 blk=0 avail=6959 (50.5%) swpO=0 conn=2 myRSS=2596 php=13 phpRSS=1746 ap=68 tcp=37 topuser=madalice 2026-08-30 00:28:01 L1=2.54 run=2 blk=0 avail=6955 (50.5%) swpO=0 conn=3 myRSS=2596 php=13 phpRSS=1756 ap=68 tcp=38 topuser=madalice 2026-08-30 00:28:11 L1=2.22 run=2 blk=0 avail=7184 (52.1%) swpO=0 conn=2 myRSS=2596 php=12 phpRSS=1607 ap=58 tcp=38 topuser=madalice 2026-08-30 00:28:11 L1=2.22 run=2 blk=0 avail=7182 (52.1%) swpO=0 conn=2 myRSS=2596 php=12 phpRSS=1608 ap=57 tcp=37 topuser=madalice 2026-08-30 00:28:21 L1=1.96 run=1 blk=0 avail=7533 (54.7%) swpO=0 conn=2 myRSS=2596 php=10 phpRSS=1287 ap=48 tcp=35 topuser=madalice 2026-08-30 00:28:21 L1=1.96 run=1 blk=0 avail=7540 (54.7%) swpO=0 conn=2 myRSS=2596 php=10 phpRSS=1287 ap=47 tcp=35 topuser=madalice 2026-08-30 00:28:31 L1=1.66 run=4 blk=0 avail=7530 (54.7%) swpO=0 conn=2 myRSS=2596 php=11 phpRSS=1402 ap=38 tcp=32 topuser=madalice 2026-08-30 00:28:31 L1=1.66 run=2 blk=0 avail=7527 (54.6%) swpO=0 conn=2 myRSS=2596 php=11 phpRSS=1411 ap=37 tcp=32 topuser=madalice 2026-08-30 00:28:41 L1=1.55 run=1 blk=0 avail=8237 (59.8%) swpO=0 conn=2 myRSS=2596 php=6 phpRSS=664 ap=27 tcp=32 topuser=madalice 2026-08-30 00:28:41 L1=1.55 run=1 blk=0 avail=8241 (59.8%) swpO=0 conn=2 myRSS=2596 php=6 phpRSS=664 ap=27 tcp=31 topuser=madalice 2026-08-30 00:28:51 L1=1.31 run=1 blk=0 avail=8317 (60.4%) swpO=0 conn=2 myRSS=2596 php=6 phpRSS=664 ap=17 tcp=30 topuser=madalice 2026-08-30 00:28:51 L1=1.31 run=1 blk=0 avail=8317 (60.4%) swpO=0 conn=2 myRSS=2596 php=6 phpRSS=664 ap=17 tcp=30 topuser=madalice 2026-08-30 00:29:01 L1=1.67 run=3 blk=0 avail=8126 (59.0%) swpO=0 conn=2 myRSS=2596 php=8 phpRSS=888 ap=18 tcp=37 topuser=madalice 2026-08-30 00:29:01 L1=1.67 run=2 blk=0 avail=8112 (58.9%) swpO=0 conn=2 myRSS=2596 php=8 phpRSS=901 ap=18 tcp=37 topuser=madalice 2026-08-30 00:29:11 L1=1.64 run=1 blk=0 avail=7683 (55.8%) swpO=2 conn=2 myRSS=2596 php=8 phpRSS=973 ap=73 tcp=43 topuser=madalice 2026-08-30 00:29:11 L1=1.64 run=1 blk=0 avail=7682 (55.8%) swpO=2 conn=1 myRSS=2596 php=8 phpRSS=973 ap=73 tcp=43 topuser=madalice 2026-08-30 00:29:21 L1=1.46 run=1 blk=0 avail=7811 (56.7%) swpO=0 conn=2 myRSS=2596 php=8 phpRSS=973 ap=63 tcp=31 topuser=madalice 2026-08-30 00:29:22 L1=1.46 run=2 blk=0 avail=7811 (56.7%) swpO=0 conn=1 myRSS=2596 php=8 phpRSS=973 ap=63 tcp=31 topuser=madalice 2026-08-30 00:29:31 L1=2.02 run=1 blk=0 avail=7803 (56.6%) swpO=0 conn=1 myRSS=2596 php=9 phpRSS=1066 ap=53 tcp=45 topuser=madalice 2026-08-30 00:29:32 L1=2.02 run=3 blk=0 avail=7799 (56.6%) swpO=0 conn=1 myRSS=2596 php=10 phpRSS=1103 ap=53 tcp=46 topuser=madalice 2026-08-30 00:29:42 L1=2.15 run=1 blk=0 avail=7401 (53.7%) swpO=0 conn=1 myRSS=2596 php=12 phpRSS=1594 ap=43 tcp=42 topuser=madalice 2026-08-30 00:29:42 L1=2.15 run=2 blk=0 avail=7400 (53.7%) swpO=0 conn=2 myRSS=2596 php=12 phpRSS=1594 ap=43 tcp=41 topuser=madalice