INCIDENT 2026-08-30 02:40:09 trigger: php_rss=1621MB ================================================================== load: 1.73 1.08 0.92 7/721 2336450 ncpu:10 mem_avail: 7244MB/13777MB (52.6%) swap_used:1828MB swapout:34/s blocked(D):0 running:8 iowait:0.7% steal:0.0% php: 12 procs / 1621MB heaviest user: madalice (10 procs, 1584MB) apache: 70 procs tcp_estab: 52 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2694 madalice 10 1610 nobody 69 1141 root 264 1091 netdata 7 197 mailman 20 127 cpanellogin 1 62 evolution 13 50 dovenull 6 45 wp-toolkit 3 32 lowrange 2 29 kurri 2 26 zabbix 1 21 dovecot 3 19 named 1 15 infinium 1 14 corpkicks 1 14 candyfabcom 1 14 polkitd 1 5 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1612 root 1 22 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5790 MB Active(file): 4245 MB Inactive(file): 1938 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 684 MB CommitLimit: 10984 MB Committed_AS: 9067 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-00:21:29 4236 /usr/bin/imunify-agent-proxy 2329776 root 00:07 3080 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2759672 8.1 Ssl 2-00:20:58 /usr/sbin/mariadbd 2329653 510022 madalice 196800 47.6 R 00:14 php-fpm: pool madalice_com_au 2329657 510022 madalice 183856 38.5 R 00:14 php-fpm: pool madalice_com_au 508924 1 netdata 177088 1.9 Ssl 2-00:20:27 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 176132 0.4 Ss 17:04 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2329659 510022 madalice 174656 41.8 R 00:13 php-fpm: pool madalice_com_au 2328310 2277352 root 170076 0.0 S 01:58 spamd child 2328311 2277352 root 168540 0.0 S 01:58 spamd child 2329654 510022 madalice 163752 37.6 R 00:14 php-fpm: pool madalice_com_au 2329592 510022 madalice 160436 33.4 R 00:27 php-fpm: pool madalice_com_au 2329655 510022 madalice 159436 42.4 R 00:14 php-fpm: pool madalice_com_au 2334053 510022 madalice 159136 86.0 S 00:03 php-fpm: pool madalice_com_au 2334055 510022 madalice 159064 86.6 S 00:03 php-fpm: pool madalice_com_au 2334057 510022 madalice 159040 87.0 R 00:03 php-fpm: pool madalice_com_au 2334056 510022 madalice 159024 87.3 R 00:03 php-fpm: pool madalice_com_au 509266 1 root 127432 0.0 Ss 2-00:20:24 /usr/lib/systemd/systemd-journald 2293638 1353308 cpanellogin 63488 0.2 S 12:25 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 509236 509098 root 55536 0.0 Sl 2-00:20:24 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 43204 0.0 Sl 2-00:20:22 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 41068 0.1 Ss 38-23:58:50 cpsrvd (SSL) - waiting for connections 2275833 1 root 37216 0.0 Ss 17:54 lfd - sleeping 2326939 506832 nobody 23572 0.0 S 04:29 /usr/sbin/httpd -k start 510022 1 root 23544 0.0 Ss 2-00:20:20 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1469 1 root 23356 0.1 Ss 61-16:30:19 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2327703 506832 nobody 22820 0.0 S 03:01 /usr/sbin/httpd -k start 2295025 506832 nobody 22328 0.1 S 10:23 /usr/sbin/httpd -k start 483898 1 zabbix 21584 0.2 Ssl 2-00:21:41 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2293006 506832 nobody 21496 0.0 S 13:52 /usr/sbin/httpd -k start 2327786 506832 nobody 21336 0.0 S 02:51 /usr/sbin/httpd -k start 1463 1 root 20188 0.0 Ss 61-16:30:19 tailwatchd 2329747 506832 nobody 19912 0.1 S 00:09 /usr/sbin/httpd -k start 2276321 506832 nobody 19836 0.0 S 17:39 /usr/sbin/httpd -k start 2327788 506832 nobody 19648 0.0 S 02:51 /usr/sbin/httpd -k start 2328619 506832 nobody 19600 0.0 S 01:21 /usr/sbin/httpd -k start 2327785 506832 nobody 19488 0.0 S 02:51 /usr/sbin/httpd -k start 2329662 506832 nobody 19084 0.0 S 00:12 /usr/sbin/httpd -k start 2329688 506832 nobody 19076 0.2 S 00:10 /usr/sbin/httpd -k start 2329660 506832 nobody 19044 0.1 S 00:13 /usr/sbin/httpd -k start 2329674 506832 nobody 19024 0.1 S 00:10 /usr/sbin/httpd -k start 2329746 506832 nobody 18984 0.1 S 00:09 /usr/sbin/httpd -k start 2329754 506832 nobody 18980 0.1 S 00:09 /usr/sbin/httpd -k start 2329663 506832 nobody 18976 0.0 S 00:12 /usr/sbin/httpd -k start 2329661 506832 nobody 18952 0.0 S 00:13 /usr/sbin/httpd -k start 2329676 506832 nobody 18948 0.2 S 00:10 /usr/sbin/httpd -k start 2329656 506832 nobody 18824 0.1 S 00:14 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18780 0.0 Ss 1-22:28:01 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2329751 506832 nobody 17484 0.0 S 00:09 /usr/sbin/httpd -k start 2329752 506832 nobody 17420 0.0 S 00:09 /usr/sbin/httpd -k start 2329669 506832 nobody 17208 0.0 S 00:11 /usr/sbin/httpd -k start 2329667 506832 nobody 17184 0.0 S 00:11 /usr/sbin/httpd -k start 2329672 506832 nobody 17180 0.0 S 00:11 /usr/sbin/httpd -k start 2329664 506832 nobody 17168 0.0 S 00:12 /usr/sbin/httpd -k start 2328896 506832 nobody 17104 0.0 S 00:57 /usr/sbin/httpd -k start 2329666 506832 nobody 17036 0.0 S 00:11 /usr/sbin/httpd -k start 2329682 506832 nobody 16548 0.0 S 00:10 /usr/sbin/httpd -k start 2329687 506832 nobody 16548 0.0 S 00:10 /usr/sbin/httpd -k start 2329739 506832 nobody 16548 0.0 S 00:09 /usr/sbin/httpd -k start 2329668 506832 nobody 16544 0.0 S 00:11 /usr/sbin/httpd -k start 2329689 506832 nobody 16520 0.0 S 00:10 /usr/sbin/httpd -k start 2329763 506832 nobody 16520 0.0 S 00:09 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4291505 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/apps.evolutionerp.com.au 127 evolution/apps.evolutionerp.com.au-ssl_log 127 madalice/madalice.com.au-ssl_log 66 bigdeals/bigdeals.com.au-ssl_log 36 evolution/portal.evolutionerp.com.au-ssl_log 14 infinium/infinium.net.au-ssl_log 8 customc/customcentral.com.au 6 customc/customcentral.com.au-ssl_log 6 aaa/aaadownunder.com.au-ssl_log 4 corpkicks/corporatekicks.com.au-ssl_log 2 alison/alisonarts.com.au-ssl_log 1 evolution/pdev.evolutionerp.com.au-ssl_log 1 speedlin/speedlinefencing.com.au-ssl_log 1 (total vhosts taking traffic: 13) --- top client IPs across all vhosts (last 3 min) --- 254 20.48.179.39 42 20.104.104.62 36 52.139.37.240 17 35.231.130.18 14 203.54.180.238 12 91.92.40.30 4 118.127.40.55 2 50.6.169.131 2 198.154.94.36 2 192.250.232.93 2 114.119.143.14 1 40.77.167.74 1 34.23.224.28 1 34.196.51.17 1 209.141.37.250 --- top request paths across all vhosts (last 3 min) --- 14 GET /heartbeat.php 9 GET /wp-login.php 4 POST /wp-cron.php 4 GET /wp-conffg.php 4 GET /classwithtostring.php 4 GET /about.php 3 GET /wp-signup.php 3 GET /wp-mail.php 3 GET /wp-cron.php 3 GET /simple.php 3 GET /goods.php 3 GET /alfanew.php 3 GET / 2 POST /wp-login.php 2 GET /zi.php 2 GET /yj.php 2 GET /xr.php 2 GET /xmini4.php 2 GET /xl2023.php 2 GET /xcc.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/apps.evolutionerp.com.au == -- top paths -- 2 GET /wp-conffg.php 1 GET /zi.php 1 GET /yj.php 1 GET /xr.php 1 GET /xmini4.php 1 GET /xl2023.php 1 GET /xcc.php 1 GET /wp_xiPu52Ut.php 1 GET /wp-ws68.php 1 GET /wp-validate.php 1 GET /wp-tymanage.php 1 GET /wp-theme.php -- last 10 requests -- 20.48.179.39 - - [30/Aug/2026:02:39:08 +1000] "GET /doo.php HTTP/1.1" 301 288 "-" "-" 20.48.179.39 - - [30/Aug/2026:02:39:08 +1000] "GET /adminer-4.6.6.php HTTP/1.1" 301 298 "-" "-" 20.48.179.39 - - [30/Aug/2026:02:39:09 +1000] "GET /gelap1.php HTTP/1.1" 301 291 "-" "-" 20.48.179.39 - - [30/Aug/2026:02:39:09 +1000] "GET /rsjlrria.php HTTP/1.1" 301 293 "-" "-" 20.48.179.39 - - [30/Aug/2026:02:39:10 +1000] "GET /AxAo.php HTTP/1.1" 301 289 "-" "-" 20.48.179.39 - - [30/Aug/2026:02:39:10 +1000] "GET /class17.php HTTP/1.1" 301 292 "-" "-" 20.48.179.39 - - [30/Aug/2026:02:39:11 +1000] "GET /okxoby.php HTTP/1.1" 301 291 "-" "-" 20.48.179.39 - - [30/Aug/2026:02:39:11 +1000] "GET /esuutzzx.php HTTP/1.1" 301 293 "-" "-" 20.48.179.39 - - [30/Aug/2026:02:39:11 +1000] "GET /replace.php HTTP/1.1" 301 292 "-" "-" 20.48.179.39 - - [30/Aug/2026:02:39:12 +1000] "GET /gulu.php HTTP/1.1" 301 289 "-" "-" == evolution/apps.evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /wp-conffg.php 1 GET /zi.php 1 GET /yj.php 1 GET /xr.php 1 GET /xmini4.php 1 GET /xl2023.php 1 GET /xcc.php 1 GET /wp_xiPu52Ut.php 1 GET /wp-ws68.php 1 GET /wp-validate.php 1 GET /wp-tymanage.php 1 GET /wp-theme.php -- last 10 requests -- 20.48.179.39 - - [30/Aug/2026:02:39:08 +1000] "GET /doo.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [30/Aug/2026:02:39:09 +1000] "GET /adminer-4.6.6.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [30/Aug/2026:02:39:09 +1000] "GET /gelap1.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [30/Aug/2026:02:39:10 +1000] "GET /rsjlrria.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [30/Aug/2026:02:39:10 +1000] "GET /AxAo.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [30/Aug/2026:02:39:10 +1000] "GET /class17.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [30/Aug/2026:02:39:11 +1000] "GET /okxoby.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [30/Aug/2026:02:39:11 +1000] "GET /esuutzzx.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [30/Aug/2026:02:39:12 +1000] "GET /replace.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [30/Aug/2026:02:39:12 +1000] "GET /gulu.php HTTP/1.1" 404 - "-" "-" == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET / 2 GET /login 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /ws.php 1 GET /wp.php 1 GET /wp-includes/ID3/ 1 GET /wp-content/uploads/index.php 1 GET /wp-content/uploads/ 1 GET /wp-content/themes/admin.php 1 GET /wp-content.php -- last 10 requests -- 35.231.130.18 - - [30/Aug/2026:02:40:05 +1000] "GET /users/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [30/Aug/2026:02:40:05 +1000] "GET /signin HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [30/Aug/2026:02:40:05 +1000] "GET /user/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [30/Aug/2026:02:40:05 +1000] "GET /register HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [30/Aug/2026:02:40:05 +1000] "GET /forgot-password HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [30/Aug/2026:02:40:05 +1000] "GET /account/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [30/Aug/2026:02:40:05 +1000] "GET /auth/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [30/Aug/2026:02:40:05 +1000] "GET /reset-password HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [30/Aug/2026:02:40:06 +1000] "GET /sign-in HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.130.18 - - [30/Aug/2026:02:40:07 +1000] "GET /login HTTP/1.1" 302 1 "https://www.madalice.com.au/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537 --- last 30 samples (run-up to this incident) --- 2026-08-30 02:37:48 L1=1.77 run=2 blk=0 avail=8231 (59.7%) swpO=0 conn=1 myRSS=2696 php=9 phpRSS=1128 ap=18 tcp=29 topuser=madalice 2026-08-30 02:37:48 L1=1.77 run=2 blk=0 avail=8229 (59.7%) swpO=0 conn=2 myRSS=2696 php=9 phpRSS=1134 ap=17 tcp=29 topuser=madalice 2026-08-30 02:37:58 L1=1.57 run=2 blk=0 avail=8245 (59.8%) swpO=0 conn=1 myRSS=2696 php=9 phpRSS=1130 ap=15 tcp=29 topuser=madalice 2026-08-30 02:37:58 L1=1.57 run=3 blk=0 avail=8204 (59.6%) swpO=0 conn=2 myRSS=2696 php=9 phpRSS=1171 ap=15 tcp=29 topuser=madalice 2026-08-30 02:38:08 L1=1.56 run=2 blk=0 avail=8012 (58.2%) swpO=0 conn=2 myRSS=2696 php=9 phpRSS=1147 ap=15 tcp=30 topuser=madalice 2026-08-30 02:38:08 L1=1.56 run=2 blk=0 avail=7955 (57.7%) swpO=0 conn=2 myRSS=2696 php=9 phpRSS=1206 ap=15 tcp=30 topuser=madalice 2026-08-30 02:38:18 L1=1.40 run=1 blk=0 avail=8048 (58.4%) swpO=0 conn=2 myRSS=2696 php=9 phpRSS=1124 ap=15 tcp=28 topuser=madalice 2026-08-30 02:38:19 L1=1.40 run=1 blk=0 avail=8046 (58.4%) swpO=0 conn=2 myRSS=2696 php=9 phpRSS=1124 ap=15 tcp=28 topuser=madalice 2026-08-30 02:38:28 L1=1.35 run=2 blk=0 avail=8042 (58.4%) swpO=0 conn=2 myRSS=2696 php=9 phpRSS=1127 ap=15 tcp=32 topuser=madalice 2026-08-30 02:38:29 L1=1.35 run=2 blk=0 avail=8036 (58.3%) swpO=0 conn=2 myRSS=2696 php=9 phpRSS=1134 ap=15 tcp=31 topuser=madalice 2026-08-30 02:38:38 L1=1.22 run=1 blk=0 avail=8191 (59.5%) swpO=0 conn=2 myRSS=2696 php=8 phpRSS=968 ap=15 tcp=31 topuser=madalice 2026-08-30 02:38:39 L1=1.22 run=1 blk=0 avail=8189 (59.4%) swpO=0 conn=2 myRSS=2696 php=8 phpRSS=968 ap=15 tcp=32 topuser=madalice 2026-08-30 02:38:48 L1=1.11 run=1 blk=0 avail=8176 (59.3%) swpO=0 conn=2 myRSS=2696 php=8 phpRSS=968 ap=17 tcp=28 topuser=madalice 2026-08-30 02:38:49 L1=1.11 run=1 blk=0 avail=8176 (59.3%) swpO=0 conn=1 myRSS=2696 php=8 phpRSS=968 ap=17 tcp=28 topuser=madalice 2026-08-30 02:38:58 L1=0.94 run=1 blk=0 avail=8573 (62.2%) swpO=0 conn=2 myRSS=2696 php=5 phpRSS=502 ap=17 tcp=29 topuser=madalice 2026-08-30 02:38:59 L1=0.94 run=1 blk=0 avail=8573 (62.2%) swpO=0 conn=1 myRSS=2696 php=5 phpRSS=502 ap=17 tcp=29 topuser=madalice 2026-08-30 02:39:08 L1=0.80 run=2 blk=0 avail=8377 (60.8%) swpO=0 conn=2 myRSS=2696 php=6 phpRSS=738 ap=16 tcp=29 topuser=madalice 2026-08-30 02:39:09 L1=0.80 run=2 blk=0 avail=8307 (60.3%) swpO=0 conn=1 myRSS=2696 php=7 phpRSS=838 ap=16 tcp=32 topuser=madalice 2026-08-30 02:39:18 L1=0.75 run=1 blk=0 avail=8822 (64.0%) swpO=0 conn=2 myRSS=2696 php=3 phpRSS=191 ap=17 tcp=30 topuser=madalice 2026-08-30 02:39:19 L1=0.75 run=1 blk=0 avail=8822 (64.0%) swpO=0 conn=1 myRSS=2696 php=3 phpRSS=191 ap=17 tcp=30 topuser=madalice 2026-08-30 02:39:28 L1=0.63 run=1 blk=0 avail=8855 (64.3%) swpO=0 conn=2 myRSS=2696 php=3 phpRSS=191 ap=16 tcp=27 topuser=madalice 2026-08-30 02:39:29 L1=0.63 run=4 blk=0 avail=8855 (64.3%) swpO=0 conn=1 myRSS=2696 php=3 phpRSS=191 ap=16 tcp=25 topuser=madalice 2026-08-30 02:39:39 L1=0.53 run=2 blk=0 avail=8998 (65.3%) swpO=0 conn=2 myRSS=2696 php=2 phpRSS=36 ap=15 tcp=25 topuser=root 2026-08-30 02:39:39 L1=0.53 run=1 blk=0 avail=8998 (65.3%) swpO=0 conn=1 myRSS=2696 php=2 phpRSS=36 ap=15 tcp=25 topuser=root 2026-08-30 02:39:49 L1=0.45 run=1 blk=0 avail=8898 (64.6%) swpO=0 conn=2 myRSS=2696 php=3 phpRSS=158 ap=15 tcp=24 topuser=madalice 2026-08-30 02:39:49 L1=0.45 run=1 blk=0 avail=8898 (64.6%) swpO=0 conn=1 myRSS=2696 php=3 phpRSS=158 ap=15 tcp=24 topuser=madalice 2026-08-30 02:39:59 L1=0.62 run=2 blk=0 avail=8006 (58.1%) swpO=0 conn=2 myRSS=2696 php=8 phpRSS=949 ap=46 tcp=63 topuser=madalice 2026-08-30 02:39:59 L1=0.62 run=4 blk=0 avail=7974 (57.9%) swpO=0 conn=1 myRSS=2696 php=8 phpRSS=981 ap=46 tcp=64 topuser=madalice 2026-08-30 02:40:09 L1=1.73 run=8 blk=0 avail=7244 (52.6%) swpO=34 conn=5 myRSS=2694 php=12 phpRSS=1621 ap=70 tcp=52 topuser=madalice 2026-08-30 02:40:09 L1=1.73 run=13 blk=1 avail=7115 (51.6%) swpO=34 conn=11 myRSS=2694 php=12 phpRSS=1763 ap=70 tcp=58 topuser=madalice