INCIDENT 2026-08-30 03:04:07 trigger: php_rss=1594MB ================================================================== load: 1.23 0.87 0.87 8/655 2415957 ncpu:10 mem_avail: 7544MB/13777MB (54.8%) swap_used:1826MB swapout:0/s blocked(D):0 running:10 iowait:0.0% steal:0.0% php: 9 procs / 1594MB heaviest user: madalice (7 procs, 1558MB) apache: 14 procs tcp_estab: 33 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2705 madalice 7 1507 root 259 1092 nobody 13 212 netdata 7 197 mailman 20 127 cpanellogin 1 62 dovenull 6 45 evolution 11 44 wp-toolkit 3 32 lowrange 2 29 kurri 2 26 zabbix 1 21 dovecot 3 19 named 1 15 mailnull 2 15 infinium 1 14 polkitd 1 5 nscd 1 4 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 7 1518 root 1 22 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5849 MB Active(file): 4415 MB Inactive(file): 1831 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 683 MB CommitLimit: 10984 MB Committed_AS: 7900 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-00:45:27 4236 /usr/bin/imunify-agent-proxy 2363150 root 17:06 1264 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))'; /usr/libexec/report-command-error /opt/imunify360/venv/share/imunify360/scripts/imunify-check-pkg-integr 2398426 root 04:05 3136 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2770500 8.0 Ssl 2-00:44:56 /usr/sbin/mariadbd 2415923 510022 madalice 249868 130 R 00:01 php-fpm: pool madalice_com_au 2415924 510022 madalice 249724 132 S 00:01 php-fpm: pool madalice_com_au 2415921 510022 madalice 249464 127 R 00:01 php-fpm: pool madalice_com_au 2415922 510022 madalice 248940 132 R 00:01 php-fpm: pool madalice_com_au 2415925 510022 madalice 248936 130 R 00:01 php-fpm: pool madalice_com_au 2415926 510022 madalice 206508 100 R 00:01 php-fpm: pool madalice_com_au 2328310 2277352 root 181180 0.0 S 25:56 spamd child 508924 1 netdata 177220 1.9 Ssl 2-00:44:25 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175908 0.1 Ss 41:02 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328311 2277352 root 168480 0.0 S 25:56 spamd child 2415919 510022 madalice 135924 138 S 00:01 php-fpm: pool madalice_com_au 509266 1 root 127664 0.0 Ss 2-00:44:22 /usr/lib/systemd/systemd-journald 2293638 1353308 cpanellogin 63988 0.1 S 36:23 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 509236 509098 root 55564 0.0 Sl 2-00:44:22 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 43204 0.0 Sl 2-00:44:20 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 41496 0.1 Ss 39-00:22:48 cpsrvd (SSL) - waiting for connections 2275833 1 root 36832 0.0 Ss 41:52 lfd - sleeping 1469 1 root 23800 0.1 Ss 61-16:54:17 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23532 0.0 Ss 2-00:44:18 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 22152 0.2 Ssl 2-00:45:39 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2414762 506832 nobody 20920 0.0 S 02:10 /usr/sbin/httpd -k start 2414714 506832 nobody 20808 0.0 S 02:13 /usr/sbin/httpd -k start 1463 1 root 20300 0.0 Ss 61-16:54:17 tailwatchd 2415408 506832 nobody 20184 0.0 S 01:01 /usr/sbin/httpd -k start 2413893 506832 nobody 19936 0.1 S 02:56 /usr/sbin/httpd -k start 2414761 506832 nobody 19640 0.0 S 02:10 /usr/sbin/httpd -k start 2414795 506832 nobody 19504 0.1 S 02:09 /usr/sbin/httpd -k start 2414722 506832 nobody 19412 0.0 S 02:12 /usr/sbin/httpd -k start 2415717 506832 nobody 19172 0.0 S 00:32 /usr/sbin/httpd -k start 2413862 506832 nobody 18976 0.0 S 02:58 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18780 0.0 Ss 1-22:51:59 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2415462 506832 nobody 18780 0.0 S 00:57 /usr/sbin/httpd -k start 2327413 1471 root 16276 0.0 S 27:48 cPhulkd - dbprocessor 509671 508992 netdata 15956 2.1 Sl 2-00:44:20 /usr/libexec/netdata/plugins.d/apps.plugin 1 508634 1 named 15720 0.0 Ssl 2-00:44:30 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1471 1 root 15164 0.0 Ss 61-16:54:17 cPhulkd - processor 1482727 508511 lowrange 15096 0.0 S 04:31:32 dovecot/imap 2413393 1471 root 15060 0.0 S 03:12 cPhulkd - processor - http socket 1876631 508511 infinium 14972 0.0 S 02:37:35 dovecot/imap 1742095 508511 lowrange 14652 0.0 S 03:17:14 dovecot/imap 2415928 508511 kurri 14532 0.0 S 00:00 dovecot/imap 4180059 4180015 evolution 13580 0.0 Ss 2-03:04:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 3883280 508511 kurri 12668 0.0 S 13:02:17 dovecot/imap 2415927 506832 nobody 12368 0.0 S 00:00 /usr/sbin/httpd -k start 938585 1 wp-toolkit 11888 0.0 Ss 1-22:51:59 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 508518 508511 dovenull 10564 0.0 S 2-00:44:30 dovecot/imap-login 506832 1 root 10424 0.0 Ss 2-00:44:55 /usr/sbin/httpd -k start 508514 508511 dovenull 10280 0.0 S 2-00:44:30 dovecot/imap-login 481558 1 root 9784 0.1 Ssl 2-00:46:49 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 2415718 938444 wp-toolkit 9528 0.0 R 00:31 sw-engine-fpm: pool wordpress-toolkit 2415568 508720 mailnull 9520 0.0 S 00:48 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 508529 508511 dovecot 9424 0.0 S 2-00:44:30 dovecot/auth 508865 508814 mailman 9304 0.0 S 2-00:44:28 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 454473 1 root 9180 0.0 Ss 2-00:50:30 queueprocd - waiting up to 60s to process a task 508856 508814 mailman 8904 0.0 S 2-00:44:28 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 1428929 483760 root 8796 0.0 Ss 04:48:24 sshd: evolution [priv] 1428521 483760 root 8696 0.0 Ss 04:48:30 sshd: evolution [priv] 508516 508511 dovenull 8332 0.0 S 2-00:44:30 dovecot/pop3-login 508867 508814 mailman 8088 0.0 S 2-00:44:28 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4298388 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 4298380 | madalice_wp | madalice_wp | Query | 0 | init | SELECT * FROM AMuqf6qZ_posts WHERE ID = 21060 LIMIT 1 | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min coscom/coscom.com.au-ssl_log 166 evolution/portal.evolutionerp.com.au-ssl_log 21 madalice/madalice.com.au-ssl_log 8 tubesupplies/tubesupplies.com.au-ssl_log 5 evolution/my.evolutionerp.com.au-ssl_log 4 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 166 158.158.54.35 21 203.54.180.238 2 91.92.243.248 2 192.42.116.113 2 157.55.39.11 2 114.119.146.16 2 114.119.143.104 2 114.119.137.101 1 52.167.144.211 1 40.77.167.241 1 20.197.61.180 1 137.131.47.87 1 103.133.216.219 --- top request paths across all vhosts (last 3 min) --- 21 GET /heartbeat.php 4 GET /store/custom-melbourne-storm-shoes-design2/ 4 GET /index.php 3 GET / 2 POST /wp-login.php 2 GET /222.php 1 POST / 1 GET /zoom1.php 1 GET /yanz.php 1 GET /xxx.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-themes.php 1 GET /wp-mail.php 1 GET /wp-logs.php 1 GET /wp-login.php 1 GET /wp-load.php --- busiest 3 vhosts: top paths + last 10 requests --- == coscom/coscom.com.au-ssl_log == -- top paths -- 2 GET /222.php 1 GET /zoom1.php 1 GET /yanz.php 1 GET /xxx.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-themes.php 1 GET /wp-mail.php 1 GET /wp-logs.php -- last 10 requests -- 158.158.54.35 - - [30/Aug/2026:03:02:53 +1000] "GET /av.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [30/Aug/2026:03:02:53 +1000] "GET /file.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [30/Aug/2026:03:02:53 +1000] "GET /wp-includes/customize/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 158.158.54.35 - - [30/Aug/2026:03:02:54 +1000] "GET /gmo.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [30/Aug/2026:03:02:54 +1000] "GET /classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [30/Aug/2026:03:02:54 +1000] "GET /404.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [30/Aug/2026:03:02:54 +1000] "GET /php.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [30/Aug/2026:03:02:55 +1000] "GET /init.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [30/Aug/2026:03:02:55 +1000] "GET /wp-includes/js/codemirror/about.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/53 158.158.54.35 - - [30/Aug/2026:03:02:55 +1000] "GET /wp-admin/css/colors/blue/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 21 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [30/Aug/2026:03:02:53 +1000] "GET /heartbeat.php?sentAt=1788022974&bytes=106,147,16,190&_=1787918091433 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:03:03:03 +1000] "GET /heartbeat.php?sentAt=1788022984&bytes=106,147,16,200&_=1787897052949 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:03:03:03 +1000] "GET /heartbeat.php?sentAt=1788022984&bytes=106,147,16,200&_=1787918091434 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:03:03:13 +1000] "GET /heartbeat.php?sentAt=1788022994&bytes=106,147,16,210&_=1787897052950 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:03:03:13 +1000] "GET /heartbeat.php?sentAt=1788022994&bytes=106,147,16,210&_=1787918091435 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:03:03:23 +1000] "GET /heartbeat.php?sentAt=1788023004&bytes=106,147,16,220&_=1787897052951 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:03:03:23 +1000] "GET /heartbeat.php?sentAt=1788023004&bytes=106,147,16,220&_=1787918091436 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:03:03:33 +1000] "GET /heartbeat.php?sentAt=1788023014&bytes=106,147,16,230&_=1787897052952 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:03:03:33 +1000] "GET /heartbeat.php?sentAt=1788023014&bytes=106,147,16,230&_=1787918091437 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:03:03:43 +1000] "GET /heartbeat.php?sentAt=1788023024&bytes=106,147,16,240&_=1787897052953 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" == madalice/madalice.com.au-ssl_log == -- top paths -- 4 GET /store/custom-melbourne-storm-shoes-design2/ 1 GET /store/custom-sydney-roosters-kids/ 1 GET /store/custom-shapeshifter/ 1 GET /product-tag/tmnt 1 GET / -- last 10 requests -- 114.119.146.16 - - [30/Aug/2026:03:02:14 +1000] "GET /store/custom-sydney-roosters-kids/?amp%3Bwcpr_rating=3&wcpr_image=1&verified=1&wcpr_rating=4 HTTP/1.1" 404 36670 "https://madalice.com.au/store/custom-sydney-roosters 20.197.61.180 - - [30/Aug/2026:03:02:16 +1000] "GET / HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 114.119.143.104 - - [30/Aug/2026:03:02:28 +1000] "GET /store/custom-shapeshifter/?wcpr_rating=1&rating=4&wcpr_verified=1&wcpr_page=2 HTTP/1.1" 404 36725 "https://madalice.com.au/store/custom-shapeshifter/?wcpr_rating=1&r 137.131.47.87 - - [30/Aug/2026:03:02:32 +1000] "GET /product-tag/tmnt HTTP/1.1" 301 1 "-" "Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" 114.119.143.104 - - [30/Aug/2026:03:02:52 +1000] "GET /store/custom-melbourne-storm-shoes-design2/?wcpr_verified=1&rating=5&wcpr_rating=2&wcpr_image=1 HTTP/1.1" 404 36671 "https://madalice.com.au/store/custom-melbourne-s 114.119.137.101 - - [30/Aug/2026:03:03:16 +1000] "GET /store/custom-melbourne-storm-shoes-design2/?wcpr_verified=1&rating=1&wcpr_page=4 HTTP/1.1" 404 36734 "https://madalice.com.au/store/custom-melbourne-storm-shoes-desi 114.119.146.16 - - [30/Aug/2026:03:03:42 +1000] "GET /store/custom-melbourne-storm-shoes-design2/?verified=1&rating=2&image=1&wcpr_page=4 HTTP/1.1" 404 36670 "https://madalice.com.au/store/custom-melbourne-storm-shoes-de 114.119.137.101 - - [30/Aug/2026:03:04:05 +1000] "GET /store/custom-melbourne-storm-shoes-design2/?rating=5&wcpr_page=2&wcpr_rating=1&wcpr_verified=1 HTTP/1.1" 404 36669 "https://madalice.com.au/store/custom-melbourne-st --- last 30 samples (run-up to this incident) --- 2026-08-30 03:01:36 L1=1.45 run=2 blk=0 avail=8728 (63.3%) swpO=0 conn=1 myRSS=2705 php=4 phpRSS=217 ap=21 tcp=35 topuser=madalice 2026-08-30 03:01:46 L1=1.33 run=2 blk=0 avail=8760 (63.6%) swpO=0 conn=1 myRSS=2705 php=3 phpRSS=169 ap=19 tcp=32 topuser=madalice 2026-08-30 03:01:46 L1=1.22 run=1 blk=0 avail=8768 (63.6%) swpO=0 conn=1 myRSS=2705 php=3 phpRSS=169 ap=19 tcp=31 topuser=madalice 2026-08-30 03:01:56 L1=1.13 run=1 blk=0 avail=8684 (63.0%) swpO=0 conn=3 myRSS=2705 php=5 phpRSS=270 ap=26 tcp=58 topuser=madalice 2026-08-30 03:01:56 L1=1.12 run=1 blk=0 avail=8655 (62.8%) swpO=0 conn=1 myRSS=2705 php=3 phpRSS=191 ap=34 tcp=58 topuser=madalice 2026-08-30 03:02:06 L1=1.02 run=2 blk=0 avail=8564 (62.2%) swpO=0 conn=3 myRSS=2705 php=4 phpRSS=259 ap=43 tcp=37 topuser=madalice 2026-08-30 03:02:06 L1=1.02 run=2 blk=0 avail=8491 (61.6%) swpO=0 conn=1 myRSS=2705 php=4 phpRSS=341 ap=42 tcp=38 topuser=evolution 2026-08-30 03:02:16 L1=0.87 run=1 blk=0 avail=8700 (63.1%) swpO=2 conn=3 myRSS=2704 php=3 phpRSS=169 ap=32 tcp=28 topuser=madalice 2026-08-30 03:02:17 L1=0.87 run=2 blk=0 avail=8707 (63.2%) swpO=2 conn=2 myRSS=2704 php=3 phpRSS=169 ap=32 tcp=28 topuser=madalice 2026-08-30 03:02:26 L1=1.03 run=1 blk=0 avail=8752 (63.5%) swpO=0 conn=3 myRSS=2704 php=3 phpRSS=191 ap=22 tcp=28 topuser=madalice 2026-08-30 03:02:27 L1=1.03 run=1 blk=0 avail=8751 (63.5%) swpO=0 conn=2 myRSS=2704 php=3 phpRSS=191 ap=22 tcp=28 topuser=madalice 2026-08-30 03:02:36 L1=0.87 run=1 blk=0 avail=8784 (63.8%) swpO=0 conn=3 myRSS=2704 php=3 phpRSS=193 ap=17 tcp=27 topuser=madalice 2026-08-30 03:02:37 L1=0.87 run=1 blk=0 avail=8781 (63.7%) swpO=0 conn=2 myRSS=2704 php=3 phpRSS=193 ap=17 tcp=27 topuser=madalice 2026-08-30 03:02:46 L1=0.81 run=1 blk=0 avail=8789 (63.8%) swpO=0 conn=3 myRSS=2704 php=3 phpRSS=193 ap=16 tcp=27 topuser=madalice 2026-08-30 03:02:47 L1=0.81 run=2 blk=0 avail=8788 (63.8%) swpO=0 conn=2 myRSS=2704 php=3 phpRSS=193 ap=16 tcp=28 topuser=madalice 2026-08-30 03:02:56 L1=0.77 run=1 blk=0 avail=8792 (63.8%) swpO=0 conn=1 myRSS=2704 php=3 phpRSS=194 ap=16 tcp=28 topuser=madalice 2026-08-30 03:02:57 L1=0.77 run=1 blk=0 avail=8792 (63.8%) swpO=0 conn=2 myRSS=2704 php=3 phpRSS=194 ap=16 tcp=30 topuser=madalice 2026-08-30 03:03:06 L1=0.65 run=1 blk=0 avail=8792 (63.8%) swpO=0 conn=1 myRSS=2704 php=3 phpRSS=194 ap=16 tcp=29 topuser=madalice 2026-08-30 03:03:07 L1=0.65 run=1 blk=0 avail=8791 (63.8%) swpO=0 conn=2 myRSS=2704 php=3 phpRSS=194 ap=16 tcp=30 topuser=madalice 2026-08-30 03:03:16 L1=0.62 run=1 blk=0 avail=8932 (64.8%) swpO=0 conn=1 myRSS=2705 php=2 phpRSS=36 ap=15 tcp=27 topuser=root 2026-08-30 03:03:17 L1=0.62 run=2 blk=0 avail=8866 (64.4%) swpO=0 conn=2 myRSS=2705 php=3 phpRSS=119 ap=15 tcp=28 topuser=madalice 2026-08-30 03:03:26 L1=0.53 run=1 blk=0 avail=8824 (64.1%) swpO=0 conn=1 myRSS=2705 php=3 phpRSS=169 ap=14 tcp=28 topuser=madalice 2026-08-30 03:03:27 L1=0.53 run=2 blk=0 avail=8823 (64.0%) swpO=0 conn=2 myRSS=2705 php=3 phpRSS=169 ap=14 tcp=28 topuser=madalice 2026-08-30 03:03:36 L1=0.45 run=1 blk=0 avail=8818 (64.0%) swpO=0 conn=1 myRSS=2705 php=3 phpRSS=169 ap=15 tcp=32 topuser=madalice 2026-08-30 03:03:37 L1=0.45 run=2 blk=0 avail=8750 (63.5%) swpO=0 conn=2 myRSS=2705 php=4 phpRSS=268 ap=15 tcp=32 topuser=madalice 2026-08-30 03:03:46 L1=0.38 run=1 blk=0 avail=8817 (64.0%) swpO=0 conn=1 myRSS=2705 php=3 phpRSS=169 ap=15 tcp=27 topuser=madalice 2026-08-30 03:03:47 L1=0.38 run=1 blk=0 avail=8818 (64.0%) swpO=0 conn=2 myRSS=2705 php=3 phpRSS=169 ap=15 tcp=27 topuser=madalice 2026-08-30 03:03:56 L1=0.32 run=1 blk=0 avail=8832 (64.1%) swpO=0 conn=1 myRSS=2705 php=3 phpRSS=169 ap=13 tcp=26 topuser=madalice 2026-08-30 03:03:57 L1=0.32 run=1 blk=0 avail=8832 (64.1%) swpO=0 conn=2 myRSS=2705 php=3 phpRSS=169 ap=13 tcp=28 topuser=madalice 2026-08-30 03:04:07 L1=1.23 run=10 blk=0 avail=7544 (54.8%) swpO=0 conn=7 myRSS=2705 php=9 phpRSS=1594 ap=14 tcp=33 topuser=madalice