INCIDENT 2026-08-30 04:13:38 trigger: php_rss=1561MB ================================================================== load: 0.89 0.98 1.10 3/670 2652621 ncpu:10 mem_avail: 7396MB/13777MB (53.7%) swap_used:1834MB swapout:0/s blocked(D):0 running:6 iowait:0.1% steal:0.0% php: 10 procs / 1561MB heaviest user: madalice (6 procs, 1315MB) apache: 22 procs tcp_estab: 49 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2689 madalice 6 1321 root 259 1200 nobody 21 348 netdata 7 195 olympic 1 132 mailman 20 127 infinium 3 114 dovenull 6 45 evolution 11 44 lowrange 3 42 wp-toolkit 3 32 kurri 2 26 mailnull 1 24 zabbix 1 21 dovecot 3 20 named 1 15 cpanellogin 1 13 corpkicks 1 13 vinesit 1 12 --- php workers by user --- USER PROCS RSS_MB madalice 6 1322 olympic 1 132 infinium 1 89 root 1 22 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5454 MB Active(file): 4606 MB Inactive(file): 1146 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 646 MB CommitLimit: 10984 MB Committed_AS: 8221 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-01:54:59 4236 /usr/bin/imunify-agent-proxy 2636609 root 04:06 57156 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2753808 7.9 Ssl 2-01:54:28 /usr/sbin/mariadbd 2651768 510022 madalice 238700 8.5 S 01:18 php-fpm: pool madalice_com_au 2652563 510022 madalice 233152 57.0 S 00:02 php-fpm: pool madalice_com_au 2652567 510022 madalice 233136 108 S 00:01 php-fpm: pool madalice_com_au 2652562 510022 madalice 232828 58.5 S 00:02 php-fpm: pool madalice_com_au 2652565 510022 madalice 232820 108 S 00:01 php-fpm: pool madalice_com_au 2652576 510022 madalice 193964 95.0 R 00:01 php-fpm: pool madalice_com_au 2328310 2277352 root 183316 0.0 S 01:35:28 spamd child 2277352 1 root 175896 0.0 Ss 01:50:34 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 508924 1 netdata 175292 1.9 Ssl 2-01:53:57 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2328311 2277352 root 168452 0.0 S 01:35:28 spamd child 2652554 2619268 olympic 135712 47.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509266 1 root 130644 0.0 Ss 2-01:53:54 /usr/lib/systemd/systemd-journald 2652585 2651743 infinium 101028 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 2636609 1 root 57156 0.5 Ssl 04:06 /opt/imunify360/venv/bin/python3 -m imav.run 509236 509098 root 55448 0.0 Sl 2-01:53:54 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 43992 0.0 Sl 2-01:53:52 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 41824 0.1 Ss 39-01:32:20 cpsrvd (SSL) - waiting for connections 2275833 1 root 36812 0.0 Ss 01:51:24 lfd - sleeping 2652584 1469 root 29940 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 508720 1 mailnull 25564 0.0 Ss 2-01:54:01 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 23752 0.1 Ss 61-18:03:49 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23532 0.0 Ss 2-01:53:50 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 2619268 506832 nobody 23260 0.0 S 10:29 /usr/sbin/httpd -k start 2635962 506832 nobody 22552 0.0 S 05:09 /usr/sbin/httpd -k start 2636115 506832 nobody 22420 0.0 S 04:47 /usr/sbin/httpd -k start 483898 1 zabbix 22008 0.2 Ssl 2-01:55:11 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1463 1 root 21836 0.0 Ss 61-18:03:49 tailwatchd 2651743 506832 nobody 20620 0.0 S 01:19 /usr/sbin/httpd -k start 2651741 506832 nobody 20248 0.0 S 01:19 /usr/sbin/httpd -k start 2651751 506832 nobody 20096 0.0 S 01:18 /usr/sbin/httpd -k start 2651753 506832 nobody 19952 0.0 S 01:18 /usr/sbin/httpd -k start 2651713 506832 nobody 19728 0.0 S 01:20 /usr/sbin/httpd -k start 2651304 506832 nobody 19540 0.0 S 02:13 /usr/sbin/httpd -k start 2651754 506832 nobody 19440 0.0 S 01:18 /usr/sbin/httpd -k start 2651764 506832 nobody 19336 0.0 S 01:18 /usr/sbin/httpd -k start 2651744 506832 nobody 18752 0.0 S 01:19 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18728 0.0 Ss 2-00:01:31 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1471 1 root 16728 0.0 Ss 61-18:03:49 cPhulkd - processor 2652550 506832 nobody 16448 0.0 S 00:03 /usr/sbin/httpd -k start 2652558 506832 nobody 16448 0.0 S 00:02 /usr/sbin/httpd -k start 2652572 506832 nobody 16432 0.0 S 00:01 /usr/sbin/httpd -k start 2327413 1471 root 16396 0.0 S 01:37:20 cPhulkd - dbprocessor 2652557 506832 nobody 16388 0.0 S 00:02 /usr/sbin/httpd -k start 509671 508992 netdata 15904 2.1 Sl 2-01:53:52 /usr/libexec/netdata/plugins.d/apps.plugin 1 508634 1 named 15900 0.0 Ssl 2-01:54:02 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1482727 508511 lowrange 15092 0.0 S 05:41:04 dovecot/imap 1876631 508511 infinium 14972 0.0 S 03:47:07 dovecot/imap 1742095 508511 lowrange 14756 0.0 S 04:26:46 dovecot/imap 2652543 508511 kurri 14564 0.0 S 00:04 dovecot/imap 2652511 1471 root 14364 0.0 S 00:10 cPhulkd - processor - http socket 2652583 508511 lowrange 14016 0.0 S 00:01 dovecot/imap 2652588 508511 corpkicks 13920 0.0 S 00:00 dovecot/imap 2652581 508511 infinium 13856 0.0 S 00:01 dovecot/imap 2652579 1471 root 13776 0.0 S 00:01 cPhulkd - processor - http socket 4180059 4180015 evolution 13564 0.0 Ss 2-04:13:39 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 2651982 1353308 cpanellogin 13356 0.0 S 00:59 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 2652580 508511 vinesit 13172 0.0 S 00:01 dovecot/imap 2652522 508511 root 12932 0.1 S 00:08 dovecot/auth -w 3883280 508511 kurri 12636 0.0 S 14:11:49 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------------+------------+---------+------+----------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------------+------------+---------+------+----------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4324585 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 4324573 | olympic_wp | olympic_wp | Query | 0 | starting | SELECT a.*, g.slug AS `group` FROM nqNZ24_actionscheduler_actions a LEFT JOIN nqNZ24_actionscheduler_groups g ON a.group_id=g.group_id WHERE a.action_id=41214 | +---------+------------+------------+---------+------+----------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min olytis/tis.com.au-ssl_log 93 evolution/portal.evolutionerp.com.au-ssl_log 31 olympic/seb-mobile-auth.olympicfencing.com.au-ssl_log 20 tubesupplies/tubesupplies.com.au-ssl_log 18 infinium/infinium.net.au-ssl_log 14 aaa/aaadownunder.com.au 10 madalice/madalice.com.au-ssl_log 6 aaa/aaadownunder.com.au-ssl_log 2 evolution/evolutionerp.com.au-ssl_log 2 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 93 20.48.179.39 31 203.54.180.238 20 52.139.37.240 16 20.104.18.15 12 141.98.11.42 11 118.127.40.55 2 168.63.79.147 2 114.119.140.234 2 103.138.189.71 1 78.26.151.106 1 74.7.228.2 1 50.6.169.131 1 40.77.167.14 1 2804:1b5c:113d:100:3716:bcc1:85d3:c3e3 1 114.119.145.239 --- top request paths across all vhosts (last 3 min) --- 31 GET /heartbeat.php 8 POST /wp-cron.php 3 POST / 3 GET /wp-login.php 2 POST /wp-login.php 2 GET /wsd.php 2 GET /wp.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /wp-content/languages/ 2 GET /wp-admin/maint/ 2 GET /wp-admin/includes/ 2 GET /this_is_a_new_hello_world.php 2 GET /store/custom-design-your-own-kicks-docs/ 2 GET /simple.php 2 GET /sf.php 2 GET /robots.txt 2 GET /ops.php 2 GET /media.php 2 GET /images.php 2 GET /goods.php --- busiest 3 vhosts: top paths + last 10 requests --- == olytis/tis.com.au-ssl_log == -- top paths -- 2 GET /goods.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /x.php 1 GET /wsd.php 1 GET /ws85.php 1 GET /ws55.php 1 GET /wp.php 1 GET /wp-includes/index.php 1 GET /w.php 1 GET /wp-content/uploads/ -- last 10 requests -- 20.48.179.39 - - [30/Aug/2026:04:12:44 +1000] "GET /wnnjpsby.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [30/Aug/2026:04:12:45 +1000] "GET /gigi.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [30/Aug/2026:04:12:45 +1000] "GET /info.php/new.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [30/Aug/2026:04:12:46 +1000] "GET /wp-content/uploads/ HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [30/Aug/2026:04:12:46 +1000] "GET /w.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [30/Aug/2026:04:12:47 +1000] "GET /x.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [30/Aug/2026:04:12:47 +1000] "GET /ssla.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [30/Aug/2026:04:12:47 +1000] "GET /wp-admin/maint/wp-is.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [30/Aug/2026:04:12:48 +1000] "GET /wp-aothait.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [30/Aug/2026:04:12:48 +1000] "GET /wp-includes/index.php HTTP/1.1" 401 36 "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 31 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [30/Aug/2026:04:12:43 +1000] "GET /heartbeat.php?sentAt=1788027164&bytes=106,147,33,28&_=1787918091852 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:04:12:53 +1000] "GET /heartbeat.php?sentAt=1788027174&bytes=106,147,33,38&_=1787897053368 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:04:12:53 +1000] "GET /heartbeat.php?sentAt=1788027174&bytes=106,147,33,38&_=1787918091853 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:04:13:03 +1000] "GET /heartbeat.php?sentAt=1788027184&bytes=106,147,33,48&_=1787897053369 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:04:13:03 +1000] "GET /heartbeat.php?sentAt=1788027184&bytes=106,147,33,48&_=1787918091854 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:04:13:13 +1000] "GET /heartbeat.php?sentAt=1788027194&bytes=106,147,33,58&_=1787897053370 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:04:13:13 +1000] "GET /heartbeat.php?sentAt=1788027194&bytes=106,147,33,58&_=1787918091855 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:04:13:23 +1000] "GET /heartbeat.php?sentAt=1788027204&bytes=106,147,33,68&_=1787897053371 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:04:13:23 +1000] "GET /heartbeat.php?sentAt=1788027204&bytes=106,147,33,68&_=1787918091856 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:04:13:33 +1000] "GET /heartbeat.php?sentAt=1788027214&bytes=106,147,33,78&_=1787897053372 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" == olympic/seb-mobile-auth.olympicfencing.com.au-ssl_log == -- top paths -- 1 GET /wp-signup.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-cron.php 1 GET /wp-conflg.php 1 GET /wp-comments-post.php 1 GET /wp-activate.php 1 GET /wp-2019.php 1 GET /upfile.php 1 GET /simple.php 1 GET /post.php 1 GET /mail.php -- last 10 requests -- 52.139.37.240 - - [30/Aug/2026:04:11:02 +1000] "GET /atomlib.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:04:11:03 +1000] "GET /simple.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:04:11:03 +1000] "GET /log.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:04:11:03 +1000] "GET /mail.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:04:11:03 +1000] "GET /lufix.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:04:11:04 +1000] "GET /bak.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:04:11:04 +1000] "GET /content.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:04:11:04 +1000] "GET /upfile.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:04:11:04 +1000] "GET /wp.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:04:11:04 +1000] "GET /wp-conflg.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-30 04:11:08 L1=0.60 run=1 blk=0 avail=8606 (62.5%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=193 ap=15 tcp=27 topuser=madalice 2026-08-30 04:11:18 L1=0.58 run=1 blk=0 avail=8601 (62.4%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=193 ap=16 tcp=28 topuser=madalice 2026-08-30 04:11:18 L1=0.58 run=1 blk=0 avail=8598 (62.4%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=193 ap=16 tcp=28 topuser=madalice 2026-08-30 04:11:28 L1=0.49 run=1 blk=0 avail=8584 (62.3%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=193 ap=18 tcp=33 topuser=madalice 2026-08-30 04:11:28 L1=0.49 run=1 blk=0 avail=8583 (62.3%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=193 ap=18 tcp=33 topuser=madalice 2026-08-30 04:11:38 L1=0.57 run=1 blk=0 avail=8697 (63.1%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=168 ap=17 tcp=28 topuser=madalice 2026-08-30 04:11:38 L1=0.57 run=1 blk=0 avail=8696 (63.1%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=168 ap=17 tcp=28 topuser=madalice 2026-08-30 04:11:48 L1=0.48 run=3 blk=0 avail=8714 (63.3%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=168 ap=15 tcp=25 topuser=madalice 2026-08-30 04:11:48 L1=0.48 run=1 blk=0 avail=8714 (63.2%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=168 ap=15 tcp=25 topuser=madalice 2026-08-30 04:11:58 L1=0.41 run=1 blk=0 avail=8721 (63.3%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=168 ap=14 tcp=28 topuser=madalice 2026-08-30 04:11:58 L1=0.41 run=1 blk=0 avail=8721 (63.3%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=168 ap=14 tcp=28 topuser=madalice 2026-08-30 04:12:08 L1=0.42 run=1 blk=0 avail=8715 (63.3%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=168 ap=14 tcp=28 topuser=madalice 2026-08-30 04:12:08 L1=0.42 run=1 blk=0 avail=8710 (63.2%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=168 ap=14 tcp=28 topuser=madalice 2026-08-30 04:12:18 L1=0.43 run=1 blk=0 avail=8643 (62.7%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=191 ap=20 tcp=58 topuser=madalice 2026-08-30 04:12:18 L1=0.43 run=2 blk=0 avail=8642 (62.7%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=191 ap=24 tcp=59 topuser=madalice 2026-08-30 04:12:28 L1=0.45 run=2 blk=0 avail=8382 (60.8%) swpO=0 conn=1 myRSS=2689 php=4 phpRSS=313 ap=42 tcp=34 topuser=madalice 2026-08-30 04:12:28 L1=0.45 run=1 blk=0 avail=8395 (60.9%) swpO=0 conn=1 myRSS=2689 php=4 phpRSS=313 ap=41 tcp=33 topuser=madalice 2026-08-30 04:12:38 L1=0.38 run=1 blk=0 avail=8455 (61.4%) swpO=0 conn=1 myRSS=2689 php=4 phpRSS=313 ap=32 tcp=36 topuser=madalice 2026-08-30 04:12:38 L1=0.38 run=1 blk=0 avail=8457 (61.4%) swpO=0 conn=1 myRSS=2689 php=4 phpRSS=313 ap=31 tcp=37 topuser=madalice 2026-08-30 04:12:48 L1=0.54 run=1 blk=0 avail=8589 (62.3%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=190 ap=22 tcp=32 topuser=madalice 2026-08-30 04:12:48 L1=0.54 run=1 blk=0 avail=8600 (62.4%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=190 ap=21 tcp=32 topuser=madalice 2026-08-30 04:12:58 L1=0.46 run=1 blk=0 avail=8630 (62.6%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=190 ap=16 tcp=31 topuser=madalice 2026-08-30 04:12:58 L1=0.46 run=1 blk=0 avail=8625 (62.6%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=190 ap=16 tcp=31 topuser=madalice 2026-08-30 04:13:08 L1=0.46 run=1 blk=0 avail=8644 (62.7%) swpO=2 conn=1 myRSS=2689 php=3 phpRSS=190 ap=16 tcp=35 topuser=madalice 2026-08-30 04:13:08 L1=0.46 run=4 blk=0 avail=8606 (62.5%) swpO=2 conn=1 myRSS=2689 php=4 phpRSS=261 ap=16 tcp=34 topuser=madalice 2026-08-30 04:13:18 L1=0.46 run=1 blk=0 avail=8637 (62.7%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=191 ap=16 tcp=30 topuser=madalice 2026-08-30 04:13:18 L1=0.46 run=1 blk=0 avail=8637 (62.7%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=191 ap=16 tcp=29 topuser=madalice 2026-08-30 04:13:28 L1=0.39 run=1 blk=0 avail=8649 (62.8%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=191 ap=16 tcp=29 topuser=madalice 2026-08-30 04:13:28 L1=0.39 run=1 blk=0 avail=8647 (62.8%) swpO=0 conn=1 myRSS=2689 php=3 phpRSS=191 ap=16 tcp=29 topuser=madalice 2026-08-30 04:13:38 L1=0.89 run=6 blk=0 avail=7396 (53.7%) swpO=0 conn=9 myRSS=2689 php=10 phpRSS=1561 ap=22 tcp=49 topuser=madalice