INCIDENT 2026-08-30 04:28:03 trigger: php_rss=1752MB ================================================================== load: 1.82 1.57 1.27 4/662 2703350 ncpu:10 mem_avail: 7302MB/13777MB (53.0%) swap_used:1835MB swapout:0/s blocked(D):0 running:2 iowait:0.0% steal:0.0% php: 14 procs / 1752MB heaviest user: madalice (10 procs, 1567MB) apache: 18 procs tcp_estab: 34 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2688 madalice 10 1567 root 254 1108 nobody 17 311 netdata 7 195 mailman 20 127 evolution 13 123 alison 1 112 mailnull 3 65 cpanellogin 1 62 dovenull 6 46 wp-toolkit 3 32 lowrange 2 29 kurri 2 26 zabbix 1 21 dovecot 3 20 named 1 15 infinium 1 14 polkitd 1 5 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1567 alison 1 113 evolution 3 92 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5486 MB Active(file): 4677 MB Inactive(file): 1151 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 646 MB CommitLimit: 10984 MB Committed_AS: 8543 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-02:09:24 4236 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2752548 7.9 Ssl 2-02:08:53 /usr/sbin/mariadbd 2328310 2277352 root 183316 0.0 S 01:49:53 spamd child 2277352 1 root 175896 0.0 Ss 02:04:59 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 508924 1 netdata 175116 1.9 Ssl 2-02:08:22 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2328311 2277352 root 168452 0.0 S 01:49:53 spamd child 2701562 510022 madalice 162208 11.1 S 02:49 php-fpm: pool madalice_com_au 2701823 510022 madalice 161584 11.7 S 02:07 php-fpm: pool madalice_com_au 2701822 510022 madalice 161456 12.0 S 02:07 php-fpm: pool madalice_com_au 2701694 510022 madalice 161424 10.6 S 02:28 php-fpm: pool madalice_com_au 2701693 510022 madalice 160784 11.0 S 02:28 php-fpm: pool madalice_com_au 2701692 510022 madalice 160776 10.8 S 02:28 php-fpm: pool madalice_com_au 2701827 510022 madalice 160692 13.2 S 02:06 php-fpm: pool madalice_com_au 2701831 510022 madalice 159056 12.9 S 02:06 php-fpm: pool madalice_com_au 2701825 510022 madalice 158856 13.0 S 02:06 php-fpm: pool madalice_com_au 2701832 510022 madalice 158520 12.2 S 02:06 php-fpm: pool madalice_com_au 509266 1 root 131868 0.0 Ss 2-02:08:19 /usr/lib/systemd/systemd-journald 2703294 2701888 alison 121788 82.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2651982 1353308 cpanellogin 64000 0.0 S 15:24 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 509236 509098 root 58612 0.0 Sl 2-02:08:19 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 43992 0.0 Sl 2-02:08:17 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42692 0.1 Ss 39-01:46:45 cpsrvd (SSL) - waiting for connections 2703296 2702283 evolution 40604 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2703322 2701701 evolution 40560 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2275833 1 root 36856 0.0 Ss 02:05:49 lfd - sleeping 508720 1 mailnull 25564 0.0 Ss 2-02:08:26 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 23756 0.1 Ss 61-18:18:14 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23532 0.0 Ss 2-02:08:15 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 2701842 506832 nobody 22172 0.0 S 02:03 /usr/sbin/httpd -k start 1463 1 root 21840 0.0 Ss 61-18:18:14 tailwatchd 483898 1 zabbix 21716 0.2 Ssl 2-02:09:36 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2701702 506832 nobody 21716 0.0 S 02:23 /usr/sbin/httpd -k start 2701849 506832 nobody 21328 0.0 S 02:03 /usr/sbin/httpd -k start 2701838 506832 nobody 21284 0.0 S 02:04 /usr/sbin/httpd -k start 2702344 506832 nobody 21260 0.0 S 01:37 /usr/sbin/httpd -k start 2702333 506832 nobody 21204 0.0 S 01:40 /usr/sbin/httpd -k start 2702283 506832 nobody 21124 0.0 S 01:41 /usr/sbin/httpd -k start 2702346 506832 nobody 21124 0.0 S 01:36 /usr/sbin/httpd -k start 2701892 506832 nobody 21024 0.0 S 02:02 /usr/sbin/httpd -k start 2701886 506832 nobody 20992 0.0 S 02:02 /usr/sbin/httpd -k start 2701701 506832 nobody 20856 0.1 S 02:23 /usr/sbin/httpd -k start 2703192 508720 mailnull 20740 0.0 S 00:13 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2703259 508720 mailnull 20740 0.0 S 00:05 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2702341 506832 nobody 20264 0.0 S 01:38 /usr/sbin/httpd -k start 2702347 506832 nobody 19704 0.0 S 01:36 /usr/sbin/httpd -k start 2701888 506832 nobody 19700 0.0 S 02:02 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18728 0.0 Ss 2-00:15:56 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2701703 506832 nobody 17604 0.0 S 02:23 /usr/sbin/httpd -k start 1471 1 root 16728 0.0 Ss 61-18:18:14 cPhulkd - processor 2653013 1471 root 16532 0.0 S 14:12 cPhulkd - processor - http socket 2327413 1471 root 16400 0.0 S 01:51:45 cPhulkd - dbprocessor 509671 508992 netdata 15904 2.1 Sl 2-02:08:17 /usr/libexec/netdata/plugins.d/apps.plugin 1 508634 1 named 15900 0.0 Ssl 2-02:08:27 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1482727 508511 lowrange 15092 0.0 S 05:55:29 dovecot/imap 1876631 508511 infinium 14972 0.0 S 04:01:32 dovecot/imap 1742095 508511 lowrange 14756 0.0 S 04:41:11 dovecot/imap 2703260 508511 kurri 14340 0.0 S 00:05 dovecot/imap 4180059 4180015 evolution 13564 0.0 Ss 2-04:28:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 2703120 508511 root 12884 0.0 S 00:21 dovecot/auth -w 3883280 508511 kurri 12636 0.0 S 14:26:14 dovecot/imap 938585 1 wp-toolkit 11860 0.0 Ss 2-00:15:56 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4328487 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 104 madalice/madalice.com.au-ssl_log 104 evolution/release.evolutionerp.com.au 45 alison/alisonarts.com.au 38 alison/alisonarts.com.au-ssl_log 31 evolution/portal.evolutionerp.com.au-ssl_log 14 infinium/infinium.net.au-ssl_log 13 aaa/aaadownunder.com.au-ssl_log 5 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 121 20.220.10.235 69 20.48.160.90 61 20.63.219.114 38 18.216.26.228 25 52.139.37.240 14 203.54.180.238 5 118.127.40.55 4 141.98.11.42 2 47.86.33.52 2 207.46.13.36 2 197.155.134.251 2 143.95.209.25 1 83.233.100.119 1 52.167.144.173 1 50.6.207.27 --- top request paths across all vhosts (last 3 min) --- 14 GET /heartbeat.php 6 GET /wp-login.php 4 POST /wp-cron.php 3 POST /wp-login.php 3 GET /store/custom-cowboys-kids/ 3 GET /post.php 3 GET /k.php 2 GET /ztv.php 2 GET /Zeiss.php 2 GET /zafir1.php 2 GET /X7T6.php 2 GET /x23.php 2 GET /ww2.php 2 GET /wsd.php 2 GET /ws66.php 2 GET /wp-wlx.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /wp-2019.php 2 GET /waw.php 2 GET /waf.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 1 POST /functions.php 1 GET /ztv.php 1 GET /zoz.php 1 GET /Zeiss.php 1 GET /zafir1.php 1 GET /xmrlpc.php 1 GET /xcre1.php 1 GET /X7T6.php 1 GET /x23.php 1 GET /x0x.php 1 GET /ww3.php 1 GET /ww2.php -- last 10 requests -- 52.139.37.240 - - [30/Aug/2026:04:26:53 +1000] "GET /bak.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:04:26:54 +1000] "GET /content.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:04:26:54 +1000] "GET /upfile.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:04:26:54 +1000] "GET /wp.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:04:26:54 +1000] "GET /wp-conflg.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:04:26:54 +1000] "GET /bypass.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:04:26:55 +1000] "GET /404.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:04:26:55 +1000] "GET /xmrlpc.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:04:26:55 +1000] "GET /ae.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:04:26:55 +1000] "GET /moon.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET /store/custom-cowboys-kids/ 2 GET /users/login 2 GET /user/login 2 GET /signup 2 GET /signin 2 GET /sign-in 2 GET /secure 2 GET /register 2 GET /post.php 2 GET /meta.php 2 GET /login 2 GET /forgot-password -- last 10 requests -- 20.63.219.114 - - [30/Aug/2026:04:27:15 +1000] "GET /alfa-rex1.php HTTP/1.1" 404 36645 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.219.114 - - [30/Aug/2026:04:27:16 +1000] "GET /headerg.php HTTP/1.1" 404 36642 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.219.114 - - [30/Aug/2026:04:27:17 +1000] "GET /meta.php HTTP/1.1" 404 36644 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.219.114 - - [30/Aug/2026:04:27:19 +1000] "GET /dxc.php HTTP/1.1" 404 36642 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.219.114 - - [30/Aug/2026:04:27:20 +1000] "GET /wp-2019.php HTTP/1.1" 404 36645 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.219.114 - - [30/Aug/2026:04:27:21 +1000] "GET /menu.php HTTP/1.1" 404 36641 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.219.114 - - [30/Aug/2026:04:27:23 +1000] "GET /alfa.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 129.146.56.234 - - [30/Aug/2026:04:27:22 +1000] "GET /wp-json/wp/v2/product/33647 HTTP/1.1" 200 7107 "-" "Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" 20.63.219.114 - - [30/Aug/2026:04:27:23 +1000] "GET /feed-rss2-queue.php HTTP/1.1" 404 36648 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.219.114 - - [30/Aug/2026:04:27:24 +1000] "GET /inputs.php HTTP/1.1" 404 36641 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/release.evolutionerp.com.au == -- top paths -- 1 GET /ztv.php 1 GET /Zeiss.php 1 GET /zafir1.php 1 GET /X7T6.php 1 GET /x23.php 1 GET /ww2.php 1 GET /ws66.php 1 GET /wp-wlx.php 1 GET /wp-admin/zwso.php 1 GET /waw.php 1 GET /waf.php 1 GET /vbbn.php -- last 10 requests -- 20.220.10.235 - - [30/Aug/2026:04:26:14 +1000] "GET /tajj.php HTTP/1.1" 301 287 "-" "-" 20.220.10.235 - - [30/Aug/2026:04:26:14 +1000] "GET /grsiuk.php HTTP/1.1" 301 289 "-" "-" 20.220.10.235 - - [30/Aug/2026:04:26:15 +1000] "GET /ahy66.php HTTP/1.1" 301 288 "-" "-" 20.220.10.235 - - [30/Aug/2026:04:26:15 +1000] "GET /gaje.php HTTP/1.1" 301 287 "-" "-" 20.220.10.235 - - [30/Aug/2026:04:26:16 +1000] "GET /wp-admin/zwso.php HTTP/1.1" 403 13 "-" "-" 20.220.10.235 - - [30/Aug/2026:04:26:16 +1000] "GET /Contrller.php HTTP/1.1" 301 292 "-" "-" 20.220.10.235 - - [30/Aug/2026:04:26:16 +1000] "GET /Zeiss.php HTTP/1.1" 301 288 "-" "-" 20.220.10.235 - - [30/Aug/2026:04:26:17 +1000] "GET /ww2.php HTTP/1.1" 301 286 "-" "-" 20.220.10.235 - - [30/Aug/2026:04:26:17 +1000] "GET /anz.php HTTP/1.1" 301 286 "-" "-" 20.220.10.235 - - [30/Aug/2026:04:26:17 +1000] "GET /bge.php HTTP/1.1" 301 286 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-30 04:25:42 L1=1.11 run=2 blk=0 avail=8589 (62.3%) swpO=0 conn=3 myRSS=2688 php=6 phpRSS=252 ap=21 tcp=28 topuser=madalice 2026-08-30 04:25:42 L1=1.11 run=1 blk=0 avail=8590 (62.4%) swpO=0 conn=1 myRSS=2688 php=6 phpRSS=252 ap=21 tcp=28 topuser=madalice 2026-08-30 04:25:52 L1=1.29 run=2 blk=0 avail=8597 (62.4%) swpO=0 conn=1 myRSS=2688 php=6 phpRSS=252 ap=18 tcp=28 topuser=madalice 2026-08-30 04:25:52 L1=1.29 run=2 blk=0 avail=8597 (62.4%) swpO=0 conn=3 myRSS=2688 php=6 phpRSS=252 ap=18 tcp=28 topuser=madalice 2026-08-30 04:26:02 L1=1.84 run=5 blk=0 avail=7032 (51.0%) swpO=0 conn=5 myRSS=2688 php=14 phpRSS=1833 ap=48 tcp=52 topuser=madalice 2026-08-30 04:26:02 L1=1.84 run=5 blk=0 avail=7030 (51.0%) swpO=0 conn=4 myRSS=2688 php=14 phpRSS=1833 ap=48 tcp=52 topuser=madalice 2026-08-30 04:26:12 L1=2.17 run=3 blk=0 avail=7165 (52.0%) swpO=1 conn=3 myRSS=2688 php=13 phpRSS=1709 ap=44 tcp=45 topuser=madalice 2026-08-30 04:26:12 L1=2.17 run=3 blk=0 avail=7103 (51.6%) swpO=1 conn=3 myRSS=2688 php=13 phpRSS=1772 ap=43 tcp=44 topuser=madalice 2026-08-30 04:26:22 L1=2.29 run=16 blk=0 avail=7264 (52.7%) swpO=2 conn=11 myRSS=2688 php=12 phpRSS=1619 ap=34 tcp=48 topuser=madalice 2026-08-30 04:26:22 L1=2.29 run=16 blk=0 avail=7251 (52.6%) swpO=2 conn=11 myRSS=2688 php=12 phpRSS=1653 ap=34 tcp=50 topuser=madalice 2026-08-30 04:26:32 L1=3.60 run=14 blk=0 avail=6723 (48.8%) swpO=0 conn=9 myRSS=2688 php=13 phpRSS=2155 ap=40 tcp=47 topuser=madalice 2026-08-30 04:26:33 L1=3.60 run=7 blk=0 avail=7040 (51.1%) swpO=0 conn=6 myRSS=2688 php=13 phpRSS=1779 ap=40 tcp=47 topuser=madalice 2026-08-30 04:26:43 L1=3.36 run=4 blk=0 avail=7190 (52.2%) swpO=0 conn=4 myRSS=2688 php=13 phpRSS=1715 ap=36 tcp=34 topuser=madalice 2026-08-30 04:26:43 L1=3.36 run=4 blk=0 avail=7094 (51.5%) swpO=0 conn=4 myRSS=2688 php=13 phpRSS=1813 ap=36 tcp=34 topuser=madalice 2026-08-30 04:26:53 L1=2.99 run=3 blk=0 avail=7285 (52.9%) swpO=0 conn=3 myRSS=2688 php=13 phpRSS=1689 ap=26 tcp=33 topuser=madalice 2026-08-30 04:26:53 L1=2.99 run=3 blk=0 avail=7220 (52.4%) swpO=0 conn=3 myRSS=2688 php=13 phpRSS=1757 ap=26 tcp=33 topuser=madalice 2026-08-30 04:27:03 L1=2.91 run=3 blk=0 avail=7183 (52.1%) swpO=0 conn=2 myRSS=2688 php=13 phpRSS=1811 ap=23 tcp=33 topuser=madalice 2026-08-30 04:27:03 L1=2.91 run=11 blk=0 avail=7140 (51.8%) swpO=0 conn=4 myRSS=2688 php=13 phpRSS=1854 ap=23 tcp=34 topuser=madalice 2026-08-30 04:27:13 L1=2.54 run=4 blk=0 avail=7228 (52.5%) swpO=0 conn=4 myRSS=2688 php=13 phpRSS=1768 ap=23 tcp=33 topuser=madalice 2026-08-30 04:27:13 L1=2.54 run=6 blk=0 avail=7226 (52.5%) swpO=0 conn=3 myRSS=2688 php=13 phpRSS=1770 ap=23 tcp=33 topuser=madalice 2026-08-30 04:27:23 L1=2.38 run=6 blk=0 avail=7104 (51.6%) swpO=0 conn=6 myRSS=2688 php=14 phpRSS=1921 ap=23 tcp=35 topuser=madalice 2026-08-30 04:27:23 L1=2.38 run=7 blk=0 avail=7103 (51.6%) swpO=0 conn=5 myRSS=2688 php=14 phpRSS=1922 ap=23 tcp=35 topuser=madalice 2026-08-30 04:27:33 L1=2.16 run=2 blk=0 avail=7329 (53.2%) swpO=1 conn=2 myRSS=2688 php=12 phpRSS=1636 ap=23 tcp=36 topuser=madalice 2026-08-30 04:27:33 L1=2.16 run=4 blk=0 avail=7325 (53.2%) swpO=1 conn=3 myRSS=2688 php=13 phpRSS=1661 ap=23 tcp=36 topuser=madalice 2026-08-30 04:27:43 L1=2.14 run=5 blk=0 avail=7230 (52.5%) swpO=0 conn=3 myRSS=2688 php=14 phpRSS=1786 ap=23 tcp=38 topuser=madalice 2026-08-30 04:27:43 L1=2.14 run=4 blk=0 avail=7228 (52.5%) swpO=0 conn=3 myRSS=2688 php=14 phpRSS=1664 ap=23 tcp=38 topuser=madalice 2026-08-30 04:27:53 L1=1.96 run=2 blk=0 avail=7326 (53.2%) swpO=0 conn=3 myRSS=2688 php=14 phpRSS=1712 ap=21 tcp=32 topuser=madalice 2026-08-30 04:27:53 L1=1.96 run=4 blk=0 avail=7324 (53.2%) swpO=0 conn=3 myRSS=2688 php=14 phpRSS=1713 ap=21 tcp=32 topuser=madalice 2026-08-30 04:28:03 L1=1.82 run=2 blk=0 avail=7302 (53.0%) swpO=0 conn=3 myRSS=2688 php=14 phpRSS=1752 ap=18 tcp=34 topuser=madalice 2026-08-30 04:28:03 L1=1.82 run=4 blk=0 avail=7301 (53.0%) swpO=0 conn=4 myRSS=2688 php=15 phpRSS=1786 ap=18 tcp=34 topuser=madalice