INCIDENT 2026-08-30 02:19:34 trigger: php_rss=1856MB ================================================================== load: 2.05 1.01 0.78 8/677 2260108 ncpu:10 mem_avail: 7039MB/13777MB (51.1%) swap_used:1834MB swapout:182/s blocked(D):0 running:6 iowait:0.1% steal:0.0% php: 13 procs / 1856MB heaviest user: madalice (10 procs, 1779MB) apache: 32 procs tcp_estab: 60 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2755 madalice 10 1808 root 255 1033 nobody 31 563 netdata 7 191 mailman 20 142 evolution 12 86 cpanellogin 1 66 dovenull 6 49 wp-toolkit 3 34 lowrange 2 29 candyfabcom 2 28 kurri 2 26 zabbix 1 21 dovecot 3 20 named 1 15 infinium 1 14 mailnull 1 6 polkitd 1 5 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1814 evolution 2 53 root 1 23 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5913 MB Active(file): 4042 MB Inactive(file): 2262 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 666 MB CommitLimit: 10984 MB Committed_AS: 8755 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-00:00:53 4516 /usr/bin/imunify-agent-proxy 2191947 root 19:33 1240 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2821660 8.1 Ssl 2-00:00:22 /usr/sbin/mariadbd 2259960 510022 madalice 252604 53.0 R 00:18 php-fpm: pool madalice_com_au 2260053 510022 madalice 213208 86.7 R 00:04 php-fpm: pool madalice_com_au 2259973 510022 madalice 209972 63.0 S 00:11 php-fpm: pool madalice_com_au 508924 1 netdata 174272 1.9 Ssl 1-23:59:51 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83639 1451906 root 169216 0.0 S 10:21:59 spamd child 2260054 510022 madalice 163148 72.5 R 00:04 php-fpm: pool madalice_com_au 1502904 1451906 root 161392 0.0 S 23:43:11 spamd child 2259979 510022 madalice 159480 54.2 S 00:11 php-fpm: pool madalice_com_au 2259977 510022 madalice 159464 55.0 R 00:11 php-fpm: pool madalice_com_au 2259975 510022 madalice 159088 54.5 R 00:11 php-fpm: pool madalice_com_au 2260051 510022 madalice 159084 67.2 R 00:04 php-fpm: pool madalice_com_au 2260052 510022 madalice 159072 64.2 S 00:04 php-fpm: pool madalice_com_au 2259974 510022 madalice 159012 56.2 S 00:11 php-fpm: pool madalice_com_au 509266 1 root 127944 0.0 Ss 1-23:59:48 /usr/lib/systemd/systemd-journald 1451906 1 root 113388 0.0 Ss 23:56:26 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1878774 1353308 cpanellogin 67852 0.0 S 01:49:43 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 509236 509098 root 55340 0.0 Sl 1-23:59:48 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 43328 0.0 Sl 1-23:59:46 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42556 0.1 Ss 38-23:38:14 cpsrvd (SSL) - waiting for connections 2260063 2260062 evolution 40888 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1777392 1 root 37176 0.0 Ss 02:19:31 lfd - sleeping 2242341 506832 nobody 26328 0.1 S 05:33 /usr/sbin/httpd -k start 1469 1 root 25164 0.1 Ss 61-16:09:43 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 24196 0.0 Ss 1-23:59:44 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 2226667 506832 nobody 23824 0.0 S 09:33 /usr/sbin/httpd -k start 2226867 506832 nobody 23632 0.1 S 09:31 /usr/sbin/httpd -k start 2226886 506832 nobody 23168 0.0 S 09:31 /usr/sbin/httpd -k start 2226268 506832 nobody 22784 0.1 S 09:58 /usr/sbin/httpd -k start 2258633 506832 nobody 22140 0.0 S 02:30 /usr/sbin/httpd -k start 2242101 506832 nobody 21940 0.1 S 05:58 /usr/sbin/httpd -k start 483898 1 zabbix 21824 0.2 Ssl 2-00:01:05 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2241554 506832 nobody 21264 0.0 S 06:55 /usr/sbin/httpd -k start 2259217 506832 nobody 21092 0.0 S 01:25 /usr/sbin/httpd -k start 2259248 506832 nobody 20880 0.0 S 01:22 /usr/sbin/httpd -k start 1463 1 root 20512 0.0 Ss 61-16:09:43 tailwatchd 2259904 506832 nobody 20356 0.1 S 00:24 /usr/sbin/httpd -k start 2259978 506832 nobody 20324 0.1 S 00:11 /usr/sbin/httpd -k start 2260029 506832 nobody 20200 0.2 S 00:10 /usr/sbin/httpd -k start 938582 1 wp-toolkit 20184 0.0 Ss 1-22:07:25 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2260055 506832 nobody 19224 0.2 S 00:04 /usr/sbin/httpd -k start 2260028 506832 nobody 19136 0.2 S 00:10 /usr/sbin/httpd -k start 2260039 506832 nobody 19116 0.2 S 00:08 /usr/sbin/httpd -k start 2260030 506832 nobody 19096 0.2 S 00:09 /usr/sbin/httpd -k start 2259903 506832 nobody 19064 0.0 S 00:24 /usr/sbin/httpd -k start 2259236 506832 nobody 18608 0.0 S 01:23 /usr/sbin/httpd -k start 2121394 1471 root 16804 0.0 S 41:34 cPhulkd - dbprocessor 2260041 506832 nobody 16624 0.0 S 00:08 /usr/sbin/httpd -k start 2260043 506832 nobody 16624 0.0 S 00:08 /usr/sbin/httpd -k start 2260046 506832 nobody 16624 0.0 S 00:08 /usr/sbin/httpd -k start 2260040 506832 nobody 16608 0.0 S 00:08 /usr/sbin/httpd -k start 2260042 506832 nobody 16608 0.0 S 00:08 /usr/sbin/httpd -k start 2260044 506832 nobody 16608 0.0 S 00:08 /usr/sbin/httpd -k start 2260045 506832 nobody 16608 0.0 S 00:08 /usr/sbin/httpd -k start 2260129 506832 nobody 16608 0.0 S 00:00 /usr/sbin/httpd -k start 2260130 506832 nobody 16608 0.0 S 00:00 /usr/sbin/httpd -k start 2260135 506832 nobody 16608 0.0 S 00:00 /usr/sbin/httpd -k start 2260062 506832 nobody 16600 0.0 S 00:01 /usr/sbin/httpd -k start 2260061 506832 nobody 16564 0.0 S 00:01 /usr/sbin/httpd -k start 2260060 506832 nobody 16548 0.0 S 00:02 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4287529 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min tubesupplies/tubesupplies.com.au-ssl_log 238 coscom/coscom.com.au-ssl_log 195 cosgrovecreative/cosgrovecreative.com.au-ssl_log 184 madalice/madalice.com.au-ssl_log 105 corpkicks/corporatekicks.com.au-ssl_log 69 evolution/portal.evolutionerp.com.au-ssl_log 22 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 343 34.156.104.43 230 34.155.143.199 109 52.139.37.240 67 20.48.250.41 25 35.231.130.18 21 203.54.180.238 3 118.127.40.55 3 114.119.140.234 2 162.0.232.111 1 54.80.185.200 1 44.213.202.136 1 44.209.35.147 1 34.196.51.17 1 18.232.36.1 1 158.23.184.117 --- top request paths across all vhosts (last 3 min) --- 21 GET /heartbeat.php 3 POST /wp-cron.php 3 GET /www/phpinfo.php 3 GET /wp-admin/phpinfo.php 3 GET /worker/.env 3 GET /webroot/index.php/_environment 3 GET /webmail/phpinfo.php 3 GET /vue/.env 3 GET /vite/.env 3 GET /user-panel/.env 3 GET /uploads/.env 3 GET /uat/phpinfo.php 3 GET /uat/.env 3 GET /travis/.env 3 GET /transactional/.env 3 GET /tools/.env 3 GET /tmp/phpinfo.php 3 GET /tmp/.env 3 GET /test/phpinfo.php 3 GET /test.php --- busiest 3 vhosts: top paths + last 10 requests --- == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 2 POST /wp-cron.php 2 GET /wp-content/plugins/elementor/assets/js/packages/editor-canvas/ 1 POST /wp-login.php 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp-login.php 1 GET /wp/.env 1 GET /wp-content/plugins/elementor-pro/modules/mega-menu/widgets/ 1 GET /wp-content/plugins/elementor/core/settings/manager.php 1 GET /wp-admin/phpinfo.php -- last 10 requests -- 34.155.143.199 - - [30/Aug/2026:02:18:54 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.155.143.199 - - [30/Aug/2026:02:18:54 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.155.143.199 - - [30/Aug/2026:02:18:54 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.155.143.199 - - [30/Aug/2026:02:18:55 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.155.143.199 - - [30/Aug/2026:02:18:55 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.155.143.199 - - [30/Aug/2026:02:18:55 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.155.143.199 - - [30/Aug/2026:02:18:55 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.155.143.199 - - [30/Aug/2026:02:18:56 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.155.143.199 - - [30/Aug/2026:02:18:56 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.155.143.199 - - [30/Aug/2026:02:18:56 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == coscom/coscom.com.au-ssl_log == -- top paths -- 1 GET /xmrlpc.php 1 GET /www/phpinfo.php 1 GET /wso112233.php 1 GET /wp-signup.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-cron.php 1 GET /wp-content/plugins/google-seo-rank/module.php 1 GET /wp-conflg.php 1 GET /wp-comments-post.php 1 GET /wp-admin/phpinfo.php -- last 10 requests -- 34.156.104.43 - - [30/Aug/2026:02:17:39 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.156.104.43 - - [30/Aug/2026:02:17:39 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.156.104.43 - - [30/Aug/2026:02:17:40 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.156.104.43 - - [30/Aug/2026:02:17:40 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.156.104.43 - - [30/Aug/2026:02:17:40 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.156.104.43 - - [30/Aug/2026:02:17:40 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.156.104.43 - - [30/Aug/2026:02:17:41 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.156.104.43 - - [30/Aug/2026:02:17:41 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.156.104.43 - - [30/Aug/2026:02:17:41 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.156.104.43 - - [30/Aug/2026:02:17:41 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /vue/.env 1 GET /vite/.env 1 GET /vendor/.env 1 GET /v3/.env 1 GET /v2/.env -- last 10 requests -- 34.156.104.43 - - [30/Aug/2026:02:17:47 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.156.104.43 - - [30/Aug/2026:02:17:47 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.156.104.43 - - [30/Aug/2026:02:17:48 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.156.104.43 - - [30/Aug/2026:02:17:48 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.156.104.43 - - [30/Aug/2026:02:17:48 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.156.104.43 - - [30/Aug/2026:02:17:48 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.156.104.43 - - [30/Aug/2026:02:17:49 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.156.104.43 - - [30/Aug/2026:02:17:49 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.156.104.43 - - [30/Aug/2026:02:17:49 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.156.104.43 - - [30/Aug/2026:02:17:49 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-30 02:17:13 L1=0.82 run=1 blk=0 avail=8712 (63.2%) swpO=0 conn=1 myRSS=2761 php=2 phpRSS=37 ap=16 tcp=30 topuser=root 2026-08-30 02:17:13 L1=0.82 run=2 blk=0 avail=8712 (63.2%) swpO=0 conn=3 myRSS=2761 php=2 phpRSS=37 ap=16 tcp=30 topuser=root 2026-08-30 02:17:23 L1=0.77 run=1 blk=0 avail=8613 (62.5%) swpO=1 conn=1 myRSS=2761 php=3 phpRSS=170 ap=16 tcp=29 topuser=madalice 2026-08-30 02:17:23 L1=0.77 run=5 blk=0 avail=8611 (62.5%) swpO=1 conn=3 myRSS=2761 php=3 phpRSS=170 ap=16 tcp=29 topuser=madalice 2026-08-30 02:17:33 L1=0.65 run=2 blk=0 avail=8581 (62.3%) swpO=0 conn=1 myRSS=2761 php=4 phpRSS=226 ap=16 tcp=29 topuser=madalice 2026-08-30 02:17:33 L1=0.65 run=4 blk=0 avail=8574 (62.2%) swpO=0 conn=3 myRSS=2761 php=4 phpRSS=232 ap=16 tcp=29 topuser=madalice 2026-08-30 02:17:43 L1=0.63 run=2 blk=0 avail=8566 (62.2%) swpO=0 conn=1 myRSS=2761 php=3 phpRSS=192 ap=16 tcp=29 topuser=madalice 2026-08-30 02:17:43 L1=0.63 run=3 blk=0 avail=8568 (62.2%) swpO=0 conn=3 myRSS=2761 php=3 phpRSS=192 ap=16 tcp=32 topuser=madalice 2026-08-30 02:17:53 L1=0.61 run=2 blk=0 avail=8573 (62.2%) swpO=0 conn=1 myRSS=2761 php=4 phpRSS=216 ap=16 tcp=31 topuser=madalice 2026-08-30 02:17:53 L1=0.61 run=4 blk=0 avail=8566 (62.2%) swpO=0 conn=3 myRSS=2761 php=4 phpRSS=232 ap=16 tcp=31 topuser=madalice 2026-08-30 02:18:03 L1=0.52 run=5 blk=0 avail=8530 (61.9%) swpO=1 conn=1 myRSS=2761 php=5 phpRSS=320 ap=15 tcp=29 topuser=madalice 2026-08-30 02:18:03 L1=0.52 run=6 blk=0 avail=8519 (61.8%) swpO=1 conn=4 myRSS=2761 php=5 phpRSS=327 ap=15 tcp=29 topuser=madalice 2026-08-30 02:18:13 L1=0.67 run=2 blk=0 avail=8514 (61.8%) swpO=0 conn=1 myRSS=2761 php=5 phpRSS=304 ap=19 tcp=35 topuser=madalice 2026-08-30 02:18:13 L1=0.67 run=2 blk=0 avail=8512 (61.8%) swpO=0 conn=4 myRSS=2761 php=5 phpRSS=308 ap=19 tcp=36 topuser=madalice 2026-08-30 02:18:23 L1=0.94 run=1 blk=0 avail=8556 (62.1%) swpO=0 conn=1 myRSS=2761 php=4 phpRSS=233 ap=19 tcp=32 topuser=madalice 2026-08-30 02:18:23 L1=0.94 run=1 blk=0 avail=8554 (62.1%) swpO=0 conn=4 myRSS=2761 php=4 phpRSS=233 ap=19 tcp=33 topuser=madalice 2026-08-30 02:18:33 L1=0.95 run=2 blk=0 avail=8548 (62.0%) swpO=0 conn=1 myRSS=2761 php=6 phpRSS=311 ap=18 tcp=32 topuser=madalice 2026-08-30 02:18:33 L1=0.95 run=5 blk=0 avail=8533 (61.9%) swpO=0 conn=4 myRSS=2761 php=6 phpRSS=322 ap=18 tcp=32 topuser=madalice 2026-08-30 02:18:43 L1=0.96 run=2 blk=0 avail=8533 (61.9%) swpO=0 conn=3 myRSS=2761 php=6 phpRSS=312 ap=17 tcp=33 topuser=madalice 2026-08-30 02:18:43 L1=0.96 run=3 blk=0 avail=8533 (61.9%) swpO=0 conn=4 myRSS=2761 php=6 phpRSS=312 ap=17 tcp=33 topuser=madalice 2026-08-30 02:18:53 L1=0.89 run=2 blk=0 avail=8550 (62.1%) swpO=0 conn=3 myRSS=2761 php=5 phpRSS=275 ap=16 tcp=32 topuser=madalice 2026-08-30 02:18:53 L1=0.89 run=3 blk=0 avail=8549 (62.1%) swpO=0 conn=4 myRSS=2761 php=5 phpRSS=275 ap=16 tcp=32 topuser=madalice 2026-08-30 02:19:03 L1=1.31 run=1 blk=0 avail=8567 (62.2%) swpO=1 conn=3 myRSS=2761 php=5 phpRSS=273 ap=16 tcp=27 topuser=madalice 2026-08-30 02:19:03 L1=1.31 run=2 blk=0 avail=8565 (62.2%) swpO=1 conn=3 myRSS=2761 php=5 phpRSS=273 ap=16 tcp=27 topuser=madalice 2026-08-30 02:19:14 L1=1.11 run=1 blk=0 avail=8696 (63.1%) swpO=1 conn=3 myRSS=2761 php=4 phpRSS=116 ap=17 tcp=26 topuser=evolution 2026-08-30 02:19:14 L1=1.11 run=2 blk=0 avail=8696 (63.1%) swpO=1 conn=3 myRSS=2761 php=4 phpRSS=116 ap=17 tcp=26 topuser=evolution 2026-08-30 02:19:24 L1=1.01 run=5 blk=0 avail=7797 (56.6%) swpO=0 conn=3 myRSS=2761 php=11 phpRSS=1157 ap=17 tcp=35 topuser=madalice 2026-08-30 02:19:24 L1=1.01 run=7 blk=0 avail=7783 (56.5%) swpO=0 conn=3 myRSS=2761 php=11 phpRSS=1169 ap=17 tcp=35 topuser=madalice 2026-08-30 02:19:34 L1=2.05 run=6 blk=0 avail=7039 (51.1%) swpO=182 conn=7 myRSS=2755 php=13 phpRSS=1856 ap=32 tcp=60 topuser=madalice 2026-08-30 02:19:34 L1=2.05 run=8 blk=0 avail=7012 (50.9%) swpO=182 conn=6 myRSS=2755 php=13 phpRSS=1880 ap=32 tcp=60 topuser=madalice