INCIDENT 2026-08-30 03:18:01 trigger: php_rss=1811MB ================================================================== load: 0.93 0.91 0.84 10/670 2465311 ncpu:10 mem_avail: 7275MB/13777MB (52.8%) swap_used:1827MB swapout:0/s blocked(D):0 running:17 iowait:0.0% steal:0.0% php: 12 procs / 1811MB heaviest user: madalice (10 procs, 1774MB) apache: 27 procs tcp_estab: 45 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2705 madalice 10 1526 root 258 1088 nobody 26 452 netdata 7 200 mailman 20 127 cpanellogin 1 62 dovenull 6 45 evolution 11 44 wp-toolkit 3 32 lowrange 2 29 kurri 2 26 zabbix 1 22 dovecot 3 20 named 1 15 infinium 1 14 alison 1 14 polkitd 1 5 mailnull 1 5 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1537 root 1 22 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6111 MB Active(file): 4513 MB Inactive(file): 2019 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 688 MB CommitLimit: 10984 MB Committed_AS: 8166 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-00:59:22 4236 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2769992 8.0 Ssl 2-00:58:51 /usr/sbin/mariadbd 2465130 510022 madalice 223700 50.0 R 00:11 php-fpm: pool madalice_com_au 2465133 510022 madalice 223084 50.4 R 00:11 php-fpm: pool madalice_com_au 2328310 2277352 root 181172 0.0 S 39:51 spamd child 508924 1 netdata 180320 1.9 Ssl 2-00:58:20 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175896 0.1 Ss 54:57 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328311 2277352 root 168472 0.0 S 39:51 spamd child 2465150 510022 madalice 162988 34.0 R 00:11 php-fpm: pool madalice_com_au 2464738 510022 madalice 162968 16.0 R 00:57 php-fpm: pool madalice_com_au 2465184 510022 madalice 162116 41.8 R 00:10 php-fpm: pool madalice_com_au 2465132 510022 madalice 161940 36.9 R 00:11 php-fpm: pool madalice_com_au 2465242 510022 madalice 128976 74.0 R 00:02 php-fpm: pool madalice_com_au 509266 1 root 128172 0.0 Ss 2-00:58:17 /usr/lib/systemd/systemd-journald 2465244 510022 madalice 127400 83.0 S 00:02 php-fpm: pool madalice_com_au 2465241 510022 madalice 125536 73.0 S 00:02 php-fpm: pool madalice_com_au 2465243 510022 madalice 125452 72.0 S 00:02 php-fpm: pool madalice_com_au 2293638 1353308 cpanellogin 64460 0.1 S 50:18 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 509236 509098 root 55564 0.0 Sl 2-00:58:17 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 43468 0.0 Sl 2-00:58:15 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 41496 0.1 Ss 39-00:36:43 cpsrvd (SSL) - waiting for connections 2275833 1 root 36896 0.0 Ss 55:47 lfd - sleeping 1469 1 root 23800 0.1 Ss 61-17:08:12 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23532 0.0 Ss 2-00:58:13 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 2447359 506832 nobody 23432 0.1 S 05:52 /usr/sbin/httpd -k start 2448234 506832 nobody 22980 0.0 S 03:56 /usr/sbin/httpd -k start 483898 1 zabbix 22552 0.2 Ssl 2-00:59:34 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2446922 506832 nobody 22228 0.0 S 06:54 /usr/sbin/httpd -k start 2448301 506832 nobody 21600 0.0 S 03:51 /usr/sbin/httpd -k start 2463382 506832 nobody 20676 0.2 S 02:23 /usr/sbin/httpd -k start 2462854 506832 nobody 20644 0.1 S 02:49 /usr/sbin/httpd -k start 2459073 506832 nobody 20492 0.0 S 02:52 /usr/sbin/httpd -k start 1463 1 root 20344 0.0 Ss 61-17:08:12 tailwatchd 2464746 506832 nobody 20292 0.0 S 00:56 /usr/sbin/httpd -k start 2465183 506832 nobody 18980 0.1 S 00:10 /usr/sbin/httpd -k start 2465188 506832 nobody 18980 0.1 S 00:09 /usr/sbin/httpd -k start 2465195 506832 nobody 18980 0.1 S 00:08 /usr/sbin/httpd -k start 2465189 506832 nobody 18956 0.2 S 00:09 /usr/sbin/httpd -k start 2465194 506832 nobody 18952 0.1 S 00:08 /usr/sbin/httpd -k start 2464781 506832 nobody 18904 0.0 S 00:51 /usr/sbin/httpd -k start 2462856 506832 nobody 18788 0.0 S 02:49 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18780 0.0 Ss 1-23:05:54 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2465196 506832 nobody 17544 0.0 S 00:08 /usr/sbin/httpd -k start 2465197 506832 nobody 17480 0.1 S 00:08 /usr/sbin/httpd -k start 2464765 506832 nobody 17008 0.1 S 00:53 /usr/sbin/httpd -k start 2465208 506832 nobody 16488 0.0 S 00:07 /usr/sbin/httpd -k start 2465209 506832 nobody 16488 0.0 S 00:07 /usr/sbin/httpd -k start 2465210 506832 nobody 16488 0.0 S 00:07 /usr/sbin/httpd -k start 2465205 506832 nobody 16440 0.0 S 00:07 /usr/sbin/httpd -k start 2465206 506832 nobody 16440 0.0 S 00:07 /usr/sbin/httpd -k start 2465207 506832 nobody 16440 0.0 S 00:07 /usr/sbin/httpd -k start 2327413 1471 root 16304 0.0 S 41:43 cPhulkd - dbprocessor 509671 508992 netdata 15956 2.1 Sl 2-00:58:15 /usr/libexec/netdata/plugins.d/apps.plugin 1 508634 1 named 15720 0.0 Ssl 2-00:58:25 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1471 1 root 15164 0.0 Ss 61-17:08:12 cPhulkd - processor 1482727 508511 lowrange 15096 0.0 S 04:45:27 dovecot/imap 1876631 508511 infinium 14972 0.0 S 02:51:30 dovecot/imap 1742095 508511 lowrange 14652 0.0 S 03:31:09 dovecot/imap 2465228 508511 kurri 14432 0.0 S 00:05 dovecot/imap 2432179 508511 alison 14428 0.0 S 08:35 dovecot/imap 2448624 1471 root 13704 0.0 S 03:29 cPhulkd - processor - http socket --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4301970 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min tubesupplies/tubesupplies.com.au-ssl_log 215 evolution/app.evolutionerp.com.au-ssl_log 196 bigdeals/bigdeals.com.au-ssl_log 153 whiz/whizengineering.com.au-ssl_log 118 madalice/madalice.com.au-ssl_log 19 evolution/portal.evolutionerp.com.au-ssl_log 18 vinesit/westpanel.vinesit.com.au-ssl_log 1 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 215 34.116.190.52 196 40.115.94.245 151 20.100.175.163 77 52.139.37.240 41 158.23.184.117 18 203.54.180.238 12 35.231.130.18 2 172.234.250.175 2 114.119.159.70 2 114.119.140.234 1 52.139.44.162 1 34.135.152.197 1 144.24.20.130 1 114.119.143.104 --- top request paths across all vhosts (last 3 min) --- 111 GET /api/getItem/LWFBW2001KG 18 GET /heartbeat.php 5 GET /store/custom-manly-sea-eagles-kids/ 4 POST / 4 GET / 3 GET /i.php 2 GET /x.php 2 GET /xmlrpc.php 2 GET /wp-trackback.php 2 GET /wp-mail.php 2 GET /wp-includes/Text/Diff/ 2 GET /wp-includes/ID3/ 2 GET /wp-good.php 2 GET /wp-content/themes/admin.php 2 GET /wp-admin/js/index.php 2 GET /wp-admin/classwithtostring.php 2 GET /wp-admin/ 2 GET /wk/index.php 2 GET /.well-known/ 2 GET /u.php --- busiest 3 vhosts: top paths + last 10 requests --- == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/.env 1 GET /wp/.env 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /web/.env 1 GET /vue/.env 1 GET /vite/.env 1 GET /vendor/.env 1 GET /var/www/html/.env -- last 10 requests -- 34.116.190.52 - - [30/Aug/2026:03:17:53 +1000] "GET /beta/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.190.52 - - [30/Aug/2026:03:17:53 +1000] "GET /uat/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.190.52 - - [30/Aug/2026:03:17:54 +1000] "GET /stage/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.190.52 - - [30/Aug/2026:03:17:54 +1000] "GET /development/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.190.52 - - [30/Aug/2026:03:17:54 +1000] "GET /production/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.190.52 - - [30/Aug/2026:03:17:55 +1000] "GET /config/app/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.190.52 - - [30/Aug/2026:03:17:55 +1000] "GET /phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.190.52 - - [30/Aug/2026:03:17:55 +1000] "GET /info.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.190.52 - - [30/Aug/2026:03:17:55 +1000] "GET /php.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.116.190.52 - - [30/Aug/2026:03:17:56 +1000] "GET /i.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 111 GET /api/getItem/LWFBW2001KG 2 GET /api/getItem/GEB12-DL 1 GET /api/getItem/SPHDG15040 1 GET /api/getItem/S6 1 GET /api/getItem/S5 1 GET /api/getItem/S4 1 GET /api/getItem/S3 1 GET /api/getItem/S2 1 GET /api/getItem/S1 1 GET /api/getItem/RGW90 1 GET /api/getItem/RGW80 1 GET /api/getItem/RGW160 -- last 10 requests -- 40.115.94.245 - - [30/Aug/2026:03:16:12 +1000] "GET /api/getItem/RGW90 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:16:13 +1000] "GET /api/getItem/RGW100 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:16:13 +1000] "GET /api/getItem/RGW120 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:16:13 +1000] "GET /api/getItem/RGW160 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:16:13 +1000] "GET /api/getItem/RGW117T HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:16:13 +1000] "GET /api/getItem/RGW80 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:16:13 +1000] "GET /api/getItem/GP150x200x8 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:16:13 +1000] "GET /api/getItem/K125MSGB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:16:13 +1000] "GET /api/getItem/253-40SP HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:03:16:13 +1000] "GET /api/getItem/300558 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 2 GET / 1 GET /zoom1.php 1 GET /yanz.php 1 GET /xxx.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-themes.php 1 GET /wp-mail.php 1 GET /wp-logs.php -- last 10 requests -- 20.100.175.163 - - [30/Aug/2026:03:17:58 +1000] "GET /wp-includes/SimplePie/index.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 20.100.175.163 - - [30/Aug/2026:03:17:58 +1000] "GET /gifclass.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [30/Aug/2026:03:17:58 +1000] "GET /wp-includes/certificates/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [30/Aug/2026:03:17:59 +1000] "GET /wp-content/plugins/admin.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [30/Aug/2026:03:17:59 +1000] "GET /css/index.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [30/Aug/2026:03:17:59 +1000] "GET /wp-cron.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [30/Aug/2026:03:17:59 +1000] "GET /wp-block.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [30/Aug/2026:03:18:00 +1000] "GET /wp-includes/fonts/admin.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [30/Aug/2026:03:18:00 +1000] "GET /m.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [30/Aug/2026:03:18:00 +1000] "GET /wp-admin/css/wp-login.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-30 03:15:40 L1=1.55 run=1 blk=0 avail=8497 (61.7%) swpO=0 conn=6 myRSS=2705 php=4 phpRSS=353 ap=26 tcp=35 topuser=madalice 2026-08-30 03:15:40 L1=1.55 run=2 blk=0 avail=8486 (61.6%) swpO=0 conn=3 myRSS=2705 php=4 phpRSS=353 ap=26 tcp=35 topuser=madalice 2026-08-30 03:15:50 L1=1.45 run=3 blk=0 avail=8542 (62.0%) swpO=3 conn=6 myRSS=2705 php=5 phpRSS=393 ap=20 tcp=31 topuser=madalice 2026-08-30 03:15:50 L1=1.45 run=2 blk=0 avail=8545 (62.0%) swpO=3 conn=3 myRSS=2705 php=5 phpRSS=387 ap=20 tcp=31 topuser=madalice 2026-08-30 03:16:00 L1=1.47 run=1 blk=0 avail=8720 (63.3%) swpO=0 conn=1 myRSS=2705 php=4 phpRSS=219 ap=20 tcp=32 topuser=madalice 2026-08-30 03:16:00 L1=1.47 run=2 blk=0 avail=8714 (63.3%) swpO=0 conn=3 myRSS=2705 php=3 phpRSS=196 ap=20 tcp=32 topuser=madalice 2026-08-30 03:16:10 L1=1.39 run=1 blk=1 avail=8705 (63.2%) swpO=0 conn=1 myRSS=2705 php=3 phpRSS=196 ap=19 tcp=27 topuser=madalice 2026-08-30 03:16:10 L1=1.39 run=2 blk=1 avail=8703 (63.2%) swpO=0 conn=3 myRSS=2705 php=3 phpRSS=196 ap=19 tcp=27 topuser=madalice 2026-08-30 03:16:20 L1=1.55 run=1 blk=0 avail=8614 (62.5%) swpO=0 conn=1 myRSS=2705 php=4 phpRSS=350 ap=17 tcp=30 topuser=madalice 2026-08-30 03:16:20 L1=1.55 run=1 blk=0 avail=8614 (62.5%) swpO=0 conn=1 myRSS=2705 php=4 phpRSS=350 ap=17 tcp=30 topuser=madalice 2026-08-30 03:16:30 L1=1.31 run=1 blk=0 avail=8622 (62.6%) swpO=0 conn=1 myRSS=2705 php=4 phpRSS=350 ap=16 tcp=27 topuser=madalice 2026-08-30 03:16:31 L1=1.31 run=1 blk=0 avail=8622 (62.6%) swpO=0 conn=1 myRSS=2705 php=4 phpRSS=350 ap=16 tcp=26 topuser=madalice 2026-08-30 03:16:40 L1=1.11 run=2 blk=0 avail=8763 (63.6%) swpO=0 conn=1 myRSS=2705 php=3 phpRSS=192 ap=15 tcp=29 topuser=madalice 2026-08-30 03:16:41 L1=1.11 run=2 blk=0 avail=8758 (63.6%) swpO=0 conn=1 myRSS=2705 php=3 phpRSS=195 ap=15 tcp=29 topuser=madalice 2026-08-30 03:16:50 L1=1.01 run=2 blk=0 avail=8742 (63.5%) swpO=0 conn=1 myRSS=2705 php=4 phpRSS=246 ap=15 tcp=28 topuser=madalice 2026-08-30 03:16:51 L1=1.01 run=2 blk=0 avail=8689 (63.1%) swpO=0 conn=1 myRSS=2705 php=4 phpRSS=301 ap=15 tcp=27 topuser=madalice 2026-08-30 03:17:00 L1=0.93 run=1 blk=0 avail=8777 (63.7%) swpO=0 conn=1 myRSS=2705 php=3 phpRSS=191 ap=14 tcp=26 topuser=madalice 2026-08-30 03:17:01 L1=0.93 run=2 blk=0 avail=8776 (63.7%) swpO=0 conn=1 myRSS=2705 php=3 phpRSS=191 ap=14 tcp=26 topuser=madalice 2026-08-30 03:17:10 L1=0.79 run=1 blk=0 avail=8779 (63.7%) swpO=1 conn=1 myRSS=2705 php=3 phpRSS=169 ap=17 tcp=32 topuser=madalice 2026-08-30 03:17:11 L1=0.79 run=2 blk=0 avail=8779 (63.7%) swpO=1 conn=1 myRSS=2705 php=3 phpRSS=169 ap=17 tcp=32 topuser=madalice 2026-08-30 03:17:21 L1=0.67 run=1 blk=0 avail=8755 (63.5%) swpO=0 conn=1 myRSS=2705 php=3 phpRSS=192 ap=17 tcp=32 topuser=madalice 2026-08-30 03:17:21 L1=0.67 run=4 blk=0 avail=8757 (63.6%) swpO=0 conn=1 myRSS=2705 php=3 phpRSS=192 ap=17 tcp=32 topuser=madalice 2026-08-30 03:17:31 L1=0.56 run=2 blk=0 avail=8748 (63.5%) swpO=0 conn=1 myRSS=2705 php=3 phpRSS=192 ap=17 tcp=33 topuser=madalice 2026-08-30 03:17:31 L1=0.56 run=1 blk=0 avail=8752 (63.5%) swpO=0 conn=1 myRSS=2705 php=3 phpRSS=192 ap=17 tcp=33 topuser=madalice 2026-08-30 03:17:41 L1=0.48 run=1 blk=0 avail=8760 (63.6%) swpO=0 conn=1 myRSS=2705 php=3 phpRSS=192 ap=17 tcp=27 topuser=madalice 2026-08-30 03:17:41 L1=0.48 run=1 blk=0 avail=8758 (63.6%) swpO=0 conn=1 myRSS=2705 php=3 phpRSS=192 ap=17 tcp=29 topuser=madalice 2026-08-30 03:17:51 L1=0.48 run=5 blk=0 avail=8720 (63.3%) swpO=0 conn=1 myRSS=2705 php=6 phpRSS=288 ap=15 tcp=33 topuser=madalice 2026-08-30 03:17:51 L1=0.48 run=7 blk=0 avail=8534 (61.9%) swpO=0 conn=1 myRSS=2705 php=7 phpRSS=501 ap=15 tcp=34 topuser=madalice 2026-08-30 03:18:01 L1=0.93 run=17 blk=0 avail=7275 (52.8%) swpO=0 conn=9 myRSS=2705 php=12 phpRSS=1811 ap=27 tcp=45 topuser=madalice 2026-08-30 03:18:01 L1=0.93 run=14 blk=0 avail=7481 (54.3%) swpO=0 conn=7 myRSS=2705 php=12 phpRSS=1606 ap=27 tcp=45 topuser=madalice