INCIDENT 2026-08-30 04:52:10 trigger: php_rss=1520MB ================================================================== load: 1.02 0.85 0.92 4/660 2788891 ncpu:10 mem_avail: 7356MB/13777MB (53.4%) swap_used:1821MB swapout:0/s blocked(D):0 running:5 iowait:0.0% steal:0.0% php: 11 procs / 1520MB heaviest user: madalice (8 procs, 1331MB) apache: 21 procs tcp_estab: 28 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2764 madalice 8 1346 root 255 1120 nobody 20 338 evolution 12 199 netdata 7 198 mailman 20 127 cpanellogin 1 64 dovenull 6 46 lowrange 3 44 wp-toolkit 3 32 kurri 2 26 mailnull 1 24 zabbix 1 22 dovecot 3 20 named 1 15 infinium 1 14 sshd 1 6 polkitd 1 5 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 8 1350 evolution 2 170 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5517 MB Active(file): 4708 MB Inactive(file): 1218 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 646 MB CommitLimit: 10984 MB Committed_AS: 8011 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-02:33:31 4236 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2830440 7.9 Ssl 2-02:33:00 /usr/sbin/mariadbd 2788662 510022 madalice 249060 13.1 R 00:27 php-fpm: pool madalice_com_au 2788668 510022 madalice 187916 11.2 R 00:27 php-fpm: pool madalice_com_au 2328310 2277352 root 185188 0.0 S 02:14:00 spamd child 508924 1 netdata 178488 1.9 Ssl 2-02:32:29 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175896 0.0 Ss 02:29:06 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328311 2277352 root 168448 0.0 S 02:14:00 spamd child 2788862 2756528 evolution 165268 73.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2773932 510022 madalice 163564 13.1 S 02:14 php-fpm: pool madalice_com_au 2773163 510022 madalice 160604 12.9 S 03:42 php-fpm: pool madalice_com_au 2788664 510022 madalice 159756 12.4 S 00:27 php-fpm: pool madalice_com_au 2788665 510022 madalice 159280 12.9 S 00:27 php-fpm: pool madalice_com_au 2788663 510022 madalice 159264 12.7 S 00:27 php-fpm: pool madalice_com_au 2773933 510022 madalice 159028 13.3 S 02:13 php-fpm: pool madalice_com_au 509266 1 root 132464 0.0 Ss 2-02:32:26 /usr/lib/systemd/systemd-journald 2651982 1353308 cpanellogin 65552 0.0 S 39:31 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 509236 509098 root 58612 0.0 Sl 2-02:32:26 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 44256 0.0 Sl 2-02:32:24 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42772 0.1 Ss 39-02:10:52 cpsrvd (SSL) - waiting for connections 2275833 1 root 36856 0.0 Ss 02:29:56 lfd - sleeping 508720 1 mailnull 25564 0.0 Ss 2-02:32:33 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2736085 506832 nobody 24676 0.1 S 16:22 /usr/sbin/httpd -k start 2756175 506832 nobody 24148 0.0 S 07:44 /usr/sbin/httpd -k start 1469 1 root 23776 0.1 Ss 61-18:42:21 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2754775 506832 nobody 23536 0.1 S 09:22 /usr/sbin/httpd -k start 510022 1 root 23532 0.0 Ss 2-02:32:22 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 2756528 506832 nobody 23208 0.0 S 07:21 /usr/sbin/httpd -k start 483898 1 zabbix 22992 0.2 Ssl 2-02:33:43 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2756580 506832 nobody 22276 0.1 S 07:15 /usr/sbin/httpd -k start 2773344 506832 nobody 22184 0.0 S 03:23 /usr/sbin/httpd -k start 1463 1 root 21840 0.0 Ss 61-18:42:21 tailwatchd 2773558 506832 nobody 21120 0.0 S 03:01 /usr/sbin/httpd -k start 2788013 506832 nobody 20276 0.0 S 01:26 /usr/sbin/httpd -k start 2788307 506832 nobody 20104 0.0 S 01:07 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18728 0.0 Ss 2-00:40:03 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2773936 506832 nobody 18296 0.0 S 02:13 /usr/sbin/httpd -k start 2788741 506832 nobody 17548 0.0 S 00:17 /usr/sbin/httpd -k start 2788740 506832 nobody 17484 0.0 S 00:17 /usr/sbin/httpd -k start 2788675 506832 nobody 17140 0.0 S 00:25 /usr/sbin/httpd -k start 2788678 506832 nobody 17112 0.0 S 00:25 /usr/sbin/httpd -k start 2788677 506832 nobody 17048 0.0 S 00:25 /usr/sbin/httpd -k start 1471 1 root 16728 0.0 Ss 61-18:42:21 cPhulkd - processor 2756305 1471 root 16520 0.0 S 07:40 cPhulkd - processor - http socket 2788739 506832 nobody 16448 0.0 S 00:17 /usr/sbin/httpd -k start 2788745 506832 nobody 16448 0.0 S 00:15 /usr/sbin/httpd -k start 2327413 1471 root 16420 0.0 S 02:15:52 cPhulkd - dbprocessor 509671 508992 netdata 15904 2.1 Sl 2-02:32:24 /usr/libexec/netdata/plugins.d/apps.plugin 1 508634 1 named 15900 0.0 Ssl 2-02:32:34 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 2755663 508511 lowrange 15548 0.0 S 08:28 dovecot/pop3 1482727 508511 lowrange 15092 0.0 S 06:19:36 dovecot/imap 1876631 508511 infinium 14972 0.0 S 04:25:39 dovecot/imap 1742095 508511 lowrange 14756 0.0 S 05:05:18 dovecot/imap 2788839 508511 kurri 14584 0.0 S 00:03 dovecot/imap 4180059 4180015 evolution 13564 0.0 Ss 2-04:52:11 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 2788501 508511 root 12796 0.0 S 00:49 dovecot/auth -w 3883280 508511 kurri 12636 0.0 S 14:50:21 dovecot/imap 938585 1 wp-toolkit 11860 0.0 Ss 2-00:40:03 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 508518 508511 dovenull 11144 0.0 S 2-02:32:34 dovecot/imap-login 506832 1 root 10424 0.0 Ss 2-02:32:59 /usr/sbin/httpd -k start 508514 508511 dovenull 10280 0.0 S 2-02:32:34 dovecot/imap-login --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4335662 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 4335657 | madalice_wp | madalice_wp | Query | 0 | Statistics | SELECT t.*, tt.* FROM AMuqf6qZ_terms AS t INNER JOIN AMuqf6qZ_term_taxonomy AS tt ON t.term_id = tt.term_id WHERE t.term_id IN (472,972,973,1167,814,1005,1019,1132,875,1171,1192,1169,502,1133,1135,1134,974,854) | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min tubesupplies/tubesupplies.com.au-ssl_log 101 coscom/swms.coscom.com.au-ssl_log 57 madalice/madalice.com.au-ssl_log 53 evolution/portal.evolutionerp.com.au-ssl_log 23 alison/alisonarts.com.au-ssl_log 13 customc/customcentral.com.au-ssl_log 8 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 101 20.104.104.62 57 158.23.184.117 42 20.104.18.15 23 203.54.180.238 13 192.104.34.34 7 203.57.254.41 3 52.73.200.34 2 114.119.146.16 2 114.119.130.40 1 57.129.136.36 1 50.87.179.84 1 192.250.239.107 1 118.127.40.55 1 114.119.159.70 --- top request paths across all vhosts (last 3 min) --- 23 GET /heartbeat.php 10 GET / 3 GET /store/custom-butterfly-hand-painted-af1-shoes/ 2 GET /ws13.php 2 GET /wp-ws68.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /this_is_a_new_hello_world.php 2 GET /sf.php 2 GET /admin.php 2 GET /about.php 2 GET /55.php 1 POST /wp-cron.php 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /ztv.php 1 GET /zoz.php 1 GET /Zeiss.php 1 GET /zafir1.php 1 GET /yyy.php --- busiest 3 vhosts: top paths + last 10 requests --- == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 1 GET /ztv.php 1 GET /zoz.php 1 GET /Zeiss.php 1 GET /zafir1.php 1 GET /yyy.php 1 GET /xcre1.php 1 GET /X7T6.php 1 GET /x23.php 1 GET /ww3.php 1 GET /ww2.php 1 GET /wsz.php 1 GET /ws66.php -- last 10 requests -- 20.104.104.62 - - [30/Aug/2026:04:51:24 +1000] "GET /msy.php HTTP/1.1" 401 36 "-" "-" 20.104.104.62 - - [30/Aug/2026:04:51:24 +1000] "GET /siln.php HTTP/1.1" 401 36 "-" "-" 20.104.104.62 - - [30/Aug/2026:04:51:25 +1000] "GET /f-401.php HTTP/1.1" 401 36 "-" "-" 20.104.104.62 - - [30/Aug/2026:04:51:25 +1000] "GET /hq.php HTTP/1.1" 401 36 "-" "-" 20.104.104.62 - - [30/Aug/2026:04:51:26 +1000] "GET /mh.php HTTP/1.1" 401 36 "-" "-" 20.104.104.62 - - [30/Aug/2026:04:51:26 +1000] "GET /f2r4.php HTTP/1.1" 401 36 "-" "-" 20.104.104.62 - - [30/Aug/2026:04:51:26 +1000] "GET /sadis.php HTTP/1.1" 401 36 "-" "-" 20.104.104.62 - - [30/Aug/2026:04:51:27 +1000] "GET /xcre1.php HTTP/1.1" 401 36 "-" "-" 20.104.104.62 - - [30/Aug/2026:04:51:27 +1000] "GET /motu.php HTTP/1.1" 401 36 "-" "-" 20.104.104.62 - - [30/Aug/2026:04:51:28 +1000] "GET /wefile.php HTTP/1.1" 401 36 "-" "-" == coscom/swms.coscom.com.au-ssl_log == -- top paths -- 1 GET /xmr.php 1 GET /xmlrpc.php 1 GET /wp-trackback.php 1 GET /wp.php 1 GET /wp-includes/themes/uploads/config.php 1 GET /wp-includes/theme-compat 1 GET /wp-includes/Text.php 1 GET /wp-includes/Text/Diff/ 1 GET /wp-includes/Test.php 1 GET /wp-includes/style-engine/wp-conflg.php 1 GET /wp-includes/Requests/Exception/file.php 1 GET /wp-includes/pomo.php -- last 10 requests -- 158.23.184.117 - - [30/Aug/2026:04:51:47 +1000] "GET /wp-content/export.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:04:51:47 +1000] "GET /new.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:04:51:47 +1000] "GET /wp-content/plugins/revslider/admin.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/5 158.23.184.117 - - [30/Aug/2026:04:51:47 +1000] "GET /wp-content/images/uploads/admin.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537. 158.23.184.117 - - [30/Aug/2026:04:51:47 +1000] "GET /tools.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:04:51:47 +1000] "GET /wp-content/uploads/my.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:04:51:48 +1000] "GET /wp-includes/themes/uploads/config.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/53 158.23.184.117 - - [30/Aug/2026:04:51:48 +1000] "GET /av.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:04:51:48 +1000] "GET /wp-includes/blocks/button HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:04:51:48 +1000] "GET /wp-includes/ID3/file.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET /store/custom-butterfly-hand-painted-af1-shoes/ 2 GET /ws13.php 2 GET /wp-ws68.php 2 GET /admin.php 2 GET /about.php 2 GET /55.php 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /yj09.php 1 GET /xyn.php 1 GET /xx.php -- last 10 requests -- 20.104.18.15 - - [30/Aug/2026:04:51:47 +1000] "GET /1xmomo.php HTTP/1.1" 404 215091 "-" "-" 20.104.18.15 - - [30/Aug/2026:04:51:49 +1000] "GET /mosty.php HTTP/1.1" 404 215090 "-" "-" 52.73.200.34 - - [30/Aug/2026:04:51:51 +1000] "POST /v1/graphql HTTP/1.1" 404 36646 "https://madalice.com.au" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537. 20.104.18.15 - - [30/Aug/2026:04:51:52 +1000] "GET /blurbs.php HTTP/1.1" 404 215091 "-" "-" 20.104.18.15 - - [30/Aug/2026:04:51:54 +1000] "GET /h.php HTTP/1.1" 404 215086 "-" "-" 20.104.18.15 - - [30/Aug/2026:04:51:56 +1000] "GET /ano.php HTTP/1.1" 404 215088 "-" "-" 20.104.18.15 - - [30/Aug/2026:04:51:58 +1000] "GET /ai.php HTTP/1.1" 404 215087 "-" "-" 20.104.18.15 - - [30/Aug/2026:04:52:00 +1000] "GET /sf.php HTTP/1.1" 403 13 "-" "-" 20.104.18.15 - - [30/Aug/2026:04:52:01 +1000] "GET /xx.php HTTP/1.1" 404 215087 "-" "-" 20.104.18.15 - - [30/Aug/2026:04:52:03 +1000] "GET /uwu.php HTTP/1.1" 404 215088 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-30 04:49:49 L1=0.18 run=1 blk=0 avail=8554 (62.1%) swpO=0 conn=1 myRSS=2764 php=3 phpRSS=192 ap=13 tcp=26 topuser=madalice 2026-08-30 04:49:50 L1=0.18 run=1 blk=0 avail=8552 (62.1%) swpO=0 conn=1 myRSS=2764 php=3 phpRSS=192 ap=13 tcp=26 topuser=madalice 2026-08-30 04:49:59 L1=0.63 run=1 blk=0 avail=8325 (60.4%) swpO=2 conn=1 myRSS=2764 php=5 phpRSS=447 ap=16 tcp=28 topuser=madalice 2026-08-30 04:50:00 L1=0.63 run=1 blk=0 avail=8322 (60.4%) swpO=2 conn=1 myRSS=2764 php=5 phpRSS=447 ap=16 tcp=28 topuser=madalice 2026-08-30 04:50:09 L1=0.83 run=3 blk=0 avail=8261 (60.0%) swpO=0 conn=1 myRSS=2764 php=6 phpRSS=523 ap=16 tcp=28 topuser=madalice 2026-08-30 04:50:10 L1=0.83 run=4 blk=0 avail=8208 (59.6%) swpO=0 conn=1 myRSS=2764 php=7 phpRSS=613 ap=16 tcp=28 topuser=madalice 2026-08-30 04:50:19 L1=0.70 run=1 blk=0 avail=8274 (60.1%) swpO=0 conn=1 myRSS=2764 php=5 phpRSS=493 ap=15 tcp=26 topuser=madalice 2026-08-30 04:50:20 L1=0.70 run=1 blk=0 avail=8272 (60.0%) swpO=0 conn=1 myRSS=2764 php=5 phpRSS=493 ap=15 tcp=26 topuser=madalice 2026-08-30 04:50:30 L1=0.67 run=3 blk=0 avail=8040 (58.4%) swpO=0 conn=1 myRSS=2764 php=7 phpRSS=786 ap=15 tcp=26 topuser=madalice 2026-08-30 04:50:30 L1=0.67 run=2 blk=0 avail=8153 (59.2%) swpO=0 conn=2 myRSS=2764 php=6 phpRSS=642 ap=15 tcp=27 topuser=madalice 2026-08-30 04:50:40 L1=0.73 run=2 blk=0 avail=8158 (59.2%) swpO=0 conn=1 myRSS=2764 php=6 phpRSS=634 ap=15 tcp=29 topuser=madalice 2026-08-30 04:50:40 L1=0.73 run=4 blk=0 avail=8132 (59.0%) swpO=0 conn=2 myRSS=2764 php=6 phpRSS=657 ap=15 tcp=29 topuser=madalice 2026-08-30 04:50:50 L1=0.92 run=4 blk=0 avail=8048 (58.4%) swpO=0 conn=3 myRSS=2764 php=7 phpRSS=735 ap=22 tcp=32 topuser=madalice 2026-08-30 04:50:50 L1=0.92 run=4 blk=0 avail=8069 (58.6%) swpO=0 conn=2 myRSS=2764 php=7 phpRSS=716 ap=22 tcp=32 topuser=madalice 2026-08-30 04:51:00 L1=0.85 run=2 blk=0 avail=8226 (59.7%) swpO=0 conn=3 myRSS=2764 php=5 phpRSS=509 ap=18 tcp=30 topuser=madalice 2026-08-30 04:51:00 L1=0.85 run=3 blk=0 avail=8224 (59.7%) swpO=0 conn=2 myRSS=2764 php=5 phpRSS=510 ap=18 tcp=30 topuser=madalice 2026-08-30 04:51:10 L1=0.87 run=1 blk=0 avail=8208 (59.6%) swpO=2 conn=3 myRSS=2764 php=5 phpRSS=511 ap=19 tcp=32 topuser=madalice 2026-08-30 04:51:10 L1=0.87 run=1 blk=0 avail=8218 (59.6%) swpO=2 conn=2 myRSS=2764 php=5 phpRSS=511 ap=19 tcp=32 topuser=madalice 2026-08-30 04:51:20 L1=1.12 run=4 blk=0 avail=8055 (58.5%) swpO=2 conn=3 myRSS=2764 php=6 phpRSS=716 ap=19 tcp=32 topuser=madalice 2026-08-30 04:51:20 L1=1.12 run=2 blk=0 avail=8142 (59.1%) swpO=2 conn=2 myRSS=2764 php=5 phpRSS=598 ap=19 tcp=31 topuser=madalice 2026-08-30 04:51:30 L1=1.03 run=2 blk=0 avail=8231 (59.7%) swpO=0 conn=3 myRSS=2764 php=5 phpRSS=516 ap=17 tcp=31 topuser=madalice 2026-08-30 04:51:30 L1=1.03 run=2 blk=0 avail=8214 (59.6%) swpO=0 conn=2 myRSS=2764 php=5 phpRSS=535 ap=17 tcp=31 topuser=madalice 2026-08-30 04:51:40 L1=0.94 run=2 blk=0 avail=8237 (59.8%) swpO=0 conn=3 myRSS=2764 php=5 phpRSS=511 ap=17 tcp=31 topuser=madalice 2026-08-30 04:51:40 L1=0.94 run=1 blk=0 avail=8237 (59.8%) swpO=0 conn=2 myRSS=2764 php=5 phpRSS=511 ap=17 tcp=31 topuser=madalice 2026-08-30 04:51:50 L1=1.12 run=3 blk=0 avail=7583 (55.0%) swpO=0 conn=2 myRSS=2764 php=10 phpRSS=1212 ap=25 tcp=39 topuser=madalice 2026-08-30 04:51:50 L1=1.12 run=3 blk=0 avail=7545 (54.8%) swpO=0 conn=2 myRSS=2764 php=10 phpRSS=1250 ap=25 tcp=44 topuser=madalice 2026-08-30 04:52:00 L1=1.02 run=1 blk=0 avail=7479 (54.3%) swpO=0 conn=2 myRSS=2764 php=10 phpRSS=1285 ap=31 tcp=29 topuser=madalice 2026-08-30 04:52:00 L1=1.02 run=1 blk=0 avail=7478 (54.3%) swpO=0 conn=2 myRSS=2764 php=10 phpRSS=1285 ap=31 tcp=29 topuser=madalice 2026-08-30 04:52:10 L1=1.02 run=5 blk=0 avail=7356 (53.4%) swpO=0 conn=4 myRSS=2764 php=11 phpRSS=1520 ap=21 tcp=28 topuser=madalice 2026-08-30 04:52:10 L1=1.02 run=8 blk=0 avail=7285 (52.9%) swpO=0 conn=2 myRSS=2764 php=11 phpRSS=1583 ap=21 tcp=29 topuser=madalice