INCIDENT 2026-08-30 04:53:21 trigger: php_rss=1507MB ================================================================== load: 1.22 0.96 0.96 3/661 2789705 ncpu:10 mem_avail: 7389MB/13777MB (53.6%) swap_used:1821MB swapout:0/s blocked(D):0 running:3 iowait:0.0% steal:0.0% php: 11 procs / 1507MB heaviest user: madalice (8 procs, 1337MB) apache: 16 procs tcp_estab: 32 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2764 madalice 8 1342 root 257 1128 nobody 15 269 netdata 7 197 evolution 12 178 mailman 20 127 mailnull 3 64 cpanellogin 1 64 dovenull 6 46 lowrange 3 44 wp-toolkit 3 32 kurri 2 26 zabbix 1 21 dovecot 3 20 named 1 15 infinium 1 14 candyfabcom 1 14 sshd 2 11 polkitd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 8 1343 evolution 2 147 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5511 MB Active(file): 4707 MB Inactive(file): 1214 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 646 MB CommitLimit: 10984 MB Committed_AS: 7922 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-02:34:41 4236 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2830688 7.9 Ssl 2-02:34:10 /usr/sbin/mariadbd 2788664 510022 madalice 252188 9.0 R 01:37 php-fpm: pool madalice_com_au 2328310 2277352 root 185188 0.0 S 02:15:10 spamd child 508924 1 netdata 176892 1.9 Ssl 2-02:33:39 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175896 0.0 Ss 02:30:16 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328311 2277352 root 168448 0.0 S 02:15:10 spamd child 2773932 510022 madalice 163576 11.2 S 03:24 php-fpm: pool madalice_com_au 2773163 510022 madalice 162300 11.7 S 04:52 php-fpm: pool madalice_com_au 2773933 510022 madalice 160788 11.5 S 03:23 php-fpm: pool madalice_com_au 2788668 510022 madalice 160132 8.0 S 01:37 php-fpm: pool madalice_com_au 2788662 510022 madalice 159540 8.1 S 01:37 php-fpm: pool madalice_com_au 2788665 510022 madalice 159344 8.0 S 01:37 php-fpm: pool madalice_com_au 2788663 510022 madalice 159324 9.2 S 01:37 php-fpm: pool madalice_com_au 2789652 2756528 evolution 145472 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 509266 1 root 132464 0.0 Ss 2-02:33:36 /usr/lib/systemd/systemd-journald 2651982 1353308 cpanellogin 65620 0.0 S 40:41 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 509236 509098 root 58612 0.0 Sl 2-02:33:36 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 44256 0.0 Sl 2-02:33:34 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42772 0.1 Ss 39-02:12:02 cpsrvd (SSL) - waiting for connections 2275833 1 root 36856 0.0 Ss 02:31:06 lfd - sleeping 508720 1 mailnull 25564 0.0 Ss 2-02:33:43 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2736085 506832 nobody 24760 0.0 S 17:32 /usr/sbin/httpd -k start 2754775 506832 nobody 24384 0.1 S 10:32 /usr/sbin/httpd -k start 1469 1 root 23776 0.1 Ss 61-18:43:31 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23532 0.0 Ss 2-02:33:32 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 2756528 506832 nobody 23236 0.0 S 08:31 /usr/sbin/httpd -k start 483898 1 zabbix 22520 0.2 Ssl 2-02:34:53 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2756580 506832 nobody 22276 0.1 S 08:25 /usr/sbin/httpd -k start 1463 1 root 21840 0.0 Ss 61-18:43:31 tailwatchd 2773558 506832 nobody 21120 0.0 S 04:11 /usr/sbin/httpd -k start 2788675 506832 nobody 20960 0.0 S 01:35 /usr/sbin/httpd -k start 2789636 508720 mailnull 20948 0.0 S 00:10 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2788013 506832 nobody 20516 0.0 S 02:36 /usr/sbin/httpd -k start 2773936 506832 nobody 19364 0.0 S 03:23 /usr/sbin/httpd -k start 2789653 508720 mailnull 19272 0.0 S 00:00 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2788677 506832 nobody 19124 0.0 S 01:35 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18728 0.0 Ss 2-00:41:13 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2788741 506832 nobody 18672 0.0 S 01:27 /usr/sbin/httpd -k start 2788745 506832 nobody 18292 0.0 S 01:25 /usr/sbin/httpd -k start 2789485 506832 nobody 17484 0.0 S 00:21 /usr/sbin/httpd -k start 2789484 506832 nobody 17444 0.0 S 00:21 /usr/sbin/httpd -k start 1471 1 root 16728 0.0 Ss 61-18:43:31 cPhulkd - processor 2756305 1471 root 16528 0.0 S 08:50 cPhulkd - processor - http socket 2327413 1471 root 16420 0.0 S 02:17:02 cPhulkd - dbprocessor 509671 508992 netdata 15904 2.1 Sl 2-02:33:34 /usr/libexec/netdata/plugins.d/apps.plugin 1 508634 1 named 15900 0.0 Ssl 2-02:33:44 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 2755663 508511 lowrange 15548 0.0 S 09:38 dovecot/pop3 1482727 508511 lowrange 15092 0.0 S 06:20:46 dovecot/imap 1876631 508511 infinium 14972 0.0 S 04:26:49 dovecot/imap 1742095 508511 lowrange 14756 0.0 S 05:06:28 dovecot/imap 2789651 508511 kurri 14612 0.0 S 00:01 dovecot/imap 2789650 508511 candyfabcom 14556 0.0 S 00:01 dovecot/imap 4180059 4180015 evolution 13564 0.0 Ss 2-04:53:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 2788501 508511 root 12796 0.0 S 01:59 dovecot/auth -w 3883280 508511 kurri 12636 0.0 S 14:51:31 dovecot/imap 938585 1 wp-toolkit 11860 0.0 Ss 2-00:41:13 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 508518 508511 dovenull 11144 0.0 S 2-02:33:44 dovecot/imap-login 506832 1 root 10424 0.0 Ss 2-02:34:09 /usr/sbin/httpd -k start 508514 508511 dovenull 10280 0.0 S 2-02:33:44 dovecot/imap-login 481558 1 root 9764 0.1 Ssl 2-02:36:03 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4335807 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min tubesupplies/tubesupplies.com.au-ssl_log 69 coscom/swms.coscom.com.au-ssl_log 58 madalice/madalice.com.au-ssl_log 58 madalice/madalice.com.au 43 evolution/wp.evolutionerp.com.au 25 evolution/portal.evolutionerp.com.au-ssl_log 20 customc/customcentral.com.au-ssl_log 5 infinium/infinium.net.au-ssl_log 5 olympic/olympicfencing.com.au-ssl_log 3 corpkicks/corporatekicks.com.au-ssl_log 2 evolution/evolutionerp.com.au-ssl_log 2 evolution/my.evolutionerp.com.au-ssl_log 2 evolution/evolutionerp.com.au 1 nrg/nrgservices.net.au-ssl_log 1 (total vhosts taking traffic: 14) --- top client IPs across all vhosts (last 3 min) --- 91 20.104.18.15 69 20.104.104.62 58 158.23.184.117 25 20.48.250.41 20 203.54.180.238 5 118.127.40.55 4 52.73.200.34 4 203.57.254.41 2 50.6.169.131 2 203.34.56.12 2 170.64.135.172 2 114.119.145.239 1 92.133.124.187 1 40.77.167.37 1 34.196.51.17 --- top request paths across all vhosts (last 3 min) --- 20 GET /heartbeat.php 7 GET / 5 POST /wp-cron.php 3 GET /ws13.php 3 GET /wp-ws68.php 3 GET /store/custom-butterfly-hand-painted-af1-shoes/ 3 GET /signon.php 3 GET /m.php 3 GET /55.php 2 GET /yj09.php 2 GET /xyn.php 2 GET /xx.php 2 GET /ws55.php 2 GET /wp-login.php 2 GET /uwu.php 2 GET /special.php 2 GET /sky.php 2 GET /sf.php 2 GET /SDsadqwrf.php 2 GET /scxy.php --- busiest 3 vhosts: top paths + last 10 requests --- == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 1 GET /ztv.php 1 GET /zoz.php 1 GET /Zeiss.php 1 GET /zafir1.php 1 GET /xcre1.php 1 GET /x0x.php 1 GET /ww3.php 1 GET /ww2.php 1 GET /wsz.php 1 GET /wp-wlx.php 1 GET /wp-gzone.php 1 GET /wp-ana.php -- last 10 requests -- 20.104.104.62 - - [30/Aug/2026:04:51:26 +1000] "GET /mh.php HTTP/1.1" 401 36 "-" "-" 20.104.104.62 - - [30/Aug/2026:04:51:26 +1000] "GET /f2r4.php HTTP/1.1" 401 36 "-" "-" 20.104.104.62 - - [30/Aug/2026:04:51:26 +1000] "GET /sadis.php HTTP/1.1" 401 36 "-" "-" 20.104.104.62 - - [30/Aug/2026:04:51:27 +1000] "GET /xcre1.php HTTP/1.1" 401 36 "-" "-" 20.104.104.62 - - [30/Aug/2026:04:51:27 +1000] "GET /motu.php HTTP/1.1" 401 36 "-" "-" 20.104.104.62 - - [30/Aug/2026:04:51:28 +1000] "GET /wefile.php HTTP/1.1" 401 36 "-" "-" 20.104.104.62 - - [30/Aug/2026:04:51:29 +1000] "GET /EM.php HTTP/1.1" 401 36 "-" "-" 20.104.104.62 - - [30/Aug/2026:04:51:29 +1000] "GET /ca4.php HTTP/1.1" 401 36 "-" "-" 20.104.104.62 - - [30/Aug/2026:04:51:30 +1000] "GET /x0x.php HTTP/1.1" 401 36 "-" "-" 20.104.104.62 - - [30/Aug/2026:04:51:30 +1000] "GET /fesa.php HTTP/1.1" 401 36 "-" "-" == coscom/swms.coscom.com.au-ssl_log == -- top paths -- 1 GET /xmr.php 1 GET /xmlrpc.php 1 GET /wp-trackback.php 1 GET /wp.php 1 GET /wp-includes/themes/uploads/config.php 1 GET /wp-includes/theme-compat 1 GET /wp-includes/Text.php 1 GET /wp-includes/Text/Diff/ 1 GET /wp-includes/Test.php 1 GET /wp-includes/style-engine/wp-conflg.php 1 GET /wp-includes/Requests/Exception/file.php 1 GET /wp-includes/pomo.php -- last 10 requests -- 158.23.184.117 - - [30/Aug/2026:04:51:47 +1000] "GET /new.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:04:51:47 +1000] "GET /wp-content/plugins/revslider/admin.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/5 158.23.184.117 - - [30/Aug/2026:04:51:47 +1000] "GET /wp-content/images/uploads/admin.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537. 158.23.184.117 - - [30/Aug/2026:04:51:47 +1000] "GET /tools.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:04:51:47 +1000] "GET /wp-content/uploads/my.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:04:51:48 +1000] "GET /wp-includes/themes/uploads/config.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/53 158.23.184.117 - - [30/Aug/2026:04:51:48 +1000] "GET /av.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:04:51:48 +1000] "GET /wp-includes/blocks/button HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:04:51:48 +1000] "GET /wp-includes/ID3/file.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:04:51:48 +1000] "GET /wp-admin/css/fff.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET /store/custom-butterfly-hand-painted-af1-shoes/ 2 GET /ws13.php 2 GET /wp-ws68.php 2 GET /signon.php 2 GET /m.php 2 GET /55.php 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /yj09.php 1 GET /xyn.php 1 GET /xx.php -- last 10 requests -- 20.104.18.15 - - [30/Aug/2026:04:52:25 +1000] "GET /.mopj.php HTTP/1.1" 404 215090 "-" "-" 20.104.18.15 - - [30/Aug/2026:04:52:27 +1000] "GET /bengi.php HTTP/1.1" 404 215090 "-" "-" 52.73.200.34 - - [30/Aug/2026:04:52:28 +1000] "GET /blog/ HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 2a03:2880:f802:42:: - - [30/Aug/2026:04:52:29 +1000] "GET /store/boot-charms-gold-moth/ HTTP/1.1" 200 51179 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (comp 20.104.18.15 - - [30/Aug/2026:04:52:29 +1000] "GET /file2.php HTTP/1.1" 404 215090 "-" "-" 20.104.18.15 - - [30/Aug/2026:04:52:31 +1000] "GET /gm.php HTTP/1.1" 404 215087 "-" "-" 114.119.140.234 - - [30/Aug/2026:04:52:32 +1000] "GET /store/custom-butterfly-hand-painted-af1-shoes/?rating=2&wcpr_image=1&wcpr_page=4&wcpr_rating=1 HTTP/1.1" 404 36661 "https://madalice.com.au/store/custom-butterfly-ha 20.104.18.15 - - [30/Aug/2026:04:52:34 +1000] "GET /ws55.php HTTP/1.1" 404 215089 "-" "-" 20.104.18.15 - - [30/Aug/2026:04:52:36 +1000] "GET /m.php?p= HTTP/1.1" 301 - "-" "-" 20.104.18.15 - - [30/Aug/2026:04:52:37 +1000] "GET /m.php HTTP/1.1" 404 215086 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-30 04:51:00 L1=0.85 run=2 blk=0 avail=8226 (59.7%) swpO=0 conn=3 myRSS=2764 php=5 phpRSS=509 ap=18 tcp=30 topuser=madalice 2026-08-30 04:51:00 L1=0.85 run=3 blk=0 avail=8224 (59.7%) swpO=0 conn=2 myRSS=2764 php=5 phpRSS=510 ap=18 tcp=30 topuser=madalice 2026-08-30 04:51:10 L1=0.87 run=1 blk=0 avail=8208 (59.6%) swpO=2 conn=3 myRSS=2764 php=5 phpRSS=511 ap=19 tcp=32 topuser=madalice 2026-08-30 04:51:10 L1=0.87 run=1 blk=0 avail=8218 (59.6%) swpO=2 conn=2 myRSS=2764 php=5 phpRSS=511 ap=19 tcp=32 topuser=madalice 2026-08-30 04:51:20 L1=1.12 run=4 blk=0 avail=8055 (58.5%) swpO=2 conn=3 myRSS=2764 php=6 phpRSS=716 ap=19 tcp=32 topuser=madalice 2026-08-30 04:51:20 L1=1.12 run=2 blk=0 avail=8142 (59.1%) swpO=2 conn=2 myRSS=2764 php=5 phpRSS=598 ap=19 tcp=31 topuser=madalice 2026-08-30 04:51:30 L1=1.03 run=2 blk=0 avail=8231 (59.7%) swpO=0 conn=3 myRSS=2764 php=5 phpRSS=516 ap=17 tcp=31 topuser=madalice 2026-08-30 04:51:30 L1=1.03 run=2 blk=0 avail=8214 (59.6%) swpO=0 conn=2 myRSS=2764 php=5 phpRSS=535 ap=17 tcp=31 topuser=madalice 2026-08-30 04:51:40 L1=0.94 run=2 blk=0 avail=8237 (59.8%) swpO=0 conn=3 myRSS=2764 php=5 phpRSS=511 ap=17 tcp=31 topuser=madalice 2026-08-30 04:51:40 L1=0.94 run=1 blk=0 avail=8237 (59.8%) swpO=0 conn=2 myRSS=2764 php=5 phpRSS=511 ap=17 tcp=31 topuser=madalice 2026-08-30 04:51:50 L1=1.12 run=3 blk=0 avail=7583 (55.0%) swpO=0 conn=2 myRSS=2764 php=10 phpRSS=1212 ap=25 tcp=39 topuser=madalice 2026-08-30 04:51:50 L1=1.12 run=3 blk=0 avail=7545 (54.8%) swpO=0 conn=2 myRSS=2764 php=10 phpRSS=1250 ap=25 tcp=44 topuser=madalice 2026-08-30 04:52:00 L1=1.02 run=1 blk=0 avail=7479 (54.3%) swpO=0 conn=2 myRSS=2764 php=10 phpRSS=1285 ap=31 tcp=29 topuser=madalice 2026-08-30 04:52:00 L1=1.02 run=1 blk=0 avail=7478 (54.3%) swpO=0 conn=2 myRSS=2764 php=10 phpRSS=1285 ap=31 tcp=29 topuser=madalice 2026-08-30 04:52:10 L1=1.02 run=5 blk=0 avail=7356 (53.4%) swpO=0 conn=4 myRSS=2764 php=11 phpRSS=1520 ap=21 tcp=28 topuser=madalice 2026-08-30 04:52:10 L1=1.02 run=8 blk=0 avail=7285 (52.9%) swpO=0 conn=2 myRSS=2764 php=11 phpRSS=1583 ap=21 tcp=29 topuser=madalice 2026-08-30 04:52:20 L1=1.02 run=2 blk=0 avail=7575 (55.0%) swpO=3 conn=2 myRSS=2763 php=10 phpRSS=1290 ap=17 tcp=29 topuser=madalice 2026-08-30 04:52:20 L1=1.02 run=2 blk=0 avail=7575 (55.0%) swpO=3 conn=4 myRSS=2763 php=10 phpRSS=1290 ap=17 tcp=29 topuser=madalice 2026-08-30 04:52:30 L1=1.02 run=1 blk=0 avail=7570 (54.9%) swpO=0 conn=1 myRSS=2763 php=10 phpRSS=1287 ap=17 tcp=32 topuser=madalice 2026-08-30 04:52:30 L1=1.02 run=1 blk=0 avail=7568 (54.9%) swpO=0 conn=4 myRSS=2763 php=10 phpRSS=1287 ap=17 tcp=32 topuser=madalice 2026-08-30 04:52:40 L1=1.25 run=4 blk=0 avail=7191 (52.2%) swpO=0 conn=6 myRSS=2764 php=14 phpRSS=1782 ap=17 tcp=38 topuser=madalice 2026-08-30 04:52:40 L1=1.25 run=5 blk=0 avail=7173 (52.1%) swpO=0 conn=6 myRSS=2764 php=14 phpRSS=1798 ap=17 tcp=38 topuser=madalice 2026-08-30 04:52:50 L1=1.28 run=2 blk=0 avail=7437 (54.0%) swpO=0 conn=6 myRSS=2764 php=11 phpRSS=1446 ap=17 tcp=34 topuser=madalice 2026-08-30 04:52:50 L1=1.28 run=3 blk=0 avail=7433 (54.0%) swpO=0 conn=2 myRSS=2764 php=11 phpRSS=1450 ap=17 tcp=34 topuser=madalice 2026-08-30 04:53:00 L1=1.25 run=4 blk=0 avail=7394 (53.7%) swpO=0 conn=3 myRSS=2764 php=12 phpRSS=1512 ap=19 tcp=36 topuser=madalice 2026-08-30 04:53:01 L1=1.25 run=5 blk=0 avail=7364 (53.5%) swpO=0 conn=4 myRSS=2764 php=12 phpRSS=1537 ap=19 tcp=36 topuser=madalice 2026-08-30 04:53:11 L1=1.35 run=2 blk=0 avail=7462 (54.2%) swpO=0 conn=3 myRSS=2764 php=11 phpRSS=1414 ap=18 tcp=31 topuser=madalice 2026-08-30 04:53:11 L1=1.35 run=3 blk=0 avail=7448 (54.1%) swpO=0 conn=4 myRSS=2764 php=11 phpRSS=1425 ap=18 tcp=30 topuser=madalice 2026-08-30 04:53:21 L1=1.22 run=3 blk=0 avail=7416 (53.8%) swpO=0 conn=3 myRSS=2764 php=11 phpRSS=1482 ap=16 tcp=32 topuser=madalice 2026-08-30 04:53:21 L1=1.22 run=3 blk=0 avail=7389 (53.6%) swpO=0 conn=3 myRSS=2764 php=11 phpRSS=1507 ap=16 tcp=32 topuser=madalice