INCIDENT 2026-08-30 05:19:08 trigger: php_rss=1508MB ================================================================== load: 1.62 1.08 0.81 5/668 2874658 ncpu:10 mem_avail: 7291MB/13777MB (52.9%) swap_used:1821MB swapout:0/s blocked(D):0 running:6 iowait:0.0% steal:0.0% php: 10 procs / 1508MB heaviest user: madalice (8 procs, 1471MB) apache: 29 procs tcp_estab: 56 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2768 madalice 8 1284 root 255 1102 nobody 28 486 netdata 7 196 mailman 20 127 cpanellogin 1 64 mailnull 3 62 dovenull 6 46 evolution 11 44 wp-toolkit 3 32 lowrange 2 29 kurri 2 26 zabbix 1 22 dovecot 3 20 named 1 15 infinium 1 14 polkitd 1 5 nscd 1 4 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 8 1202 root 1 22 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5512 MB Active(file): 4701 MB Inactive(file): 1225 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 646 MB CommitLimit: 10984 MB Committed_AS: 7912 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-03:00:29 7748 /usr/bin/imunify-agent-proxy 2807787 root 19:07 1228 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2834812 7.8 Ssl 2-02:59:58 /usr/sbin/mariadbd 2328310 2277352 root 185188 0.0 S 02:40:58 spamd child 508924 1 netdata 176120 1.9 Ssl 2-02:59:27 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175896 0.0 Ss 02:56:04 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328311 2277352 root 168448 0.0 S 02:40:58 spamd child 2874274 510022 madalice 160308 11.9 S 00:47 php-fpm: pool madalice_com_au 2874581 510022 madalice 159716 56.2 S 00:04 php-fpm: pool madalice_com_au 2874587 510022 madalice 159052 78.3 S 00:03 php-fpm: pool madalice_com_au 2874580 510022 madalice 159044 56.0 S 00:04 php-fpm: pool madalice_com_au 2874582 510022 madalice 159040 60.2 S 00:04 php-fpm: pool madalice_com_au 2874583 510022 madalice 159036 60.0 S 00:04 php-fpm: pool madalice_com_au 2874586 510022 madalice 140392 50.6 R 00:03 php-fpm: pool madalice_com_au 2874588 510022 madalice 136508 49.0 R 00:03 php-fpm: pool madalice_com_au 509266 1 root 133052 0.0 Ss 2-02:59:24 /usr/lib/systemd/systemd-journald 2651982 1353308 cpanellogin 66080 0.0 S 01:06:29 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 509236 509098 root 54564 0.0 Sl 2-02:59:24 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 44520 0.0 Sl 2-02:59:22 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42816 0.1 Ss 39-02:37:50 cpsrvd (SSL) - waiting for connections 2275833 1 root 36868 0.0 Ss 02:56:54 lfd - sleeping 508720 1 mailnull 25564 0.0 Ss 2-02:59:31 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 23780 0.1 Ss 61-19:09:19 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23532 0.0 Ss 2-02:59:20 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 2857309 506832 nobody 23208 0.0 S 04:40 /usr/sbin/httpd -k start 2872142 506832 nobody 22964 0.0 S 03:33 /usr/sbin/httpd -k start 483898 1 zabbix 22656 0.2 Ssl 2-03:00:41 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2857326 506832 nobody 22528 0.1 S 04:38 /usr/sbin/httpd -k start 2856303 506832 nobody 22148 0.1 S 06:54 /usr/sbin/httpd -k start 2872161 506832 nobody 22144 0.1 S 03:32 /usr/sbin/httpd -k start 1463 1 root 21840 0.0 Ss 61-19:09:19 tailwatchd 2874496 508720 mailnull 20948 0.0 S 00:11 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2872231 506832 nobody 20908 0.1 S 03:31 /usr/sbin/httpd -k start 2873254 506832 nobody 20064 0.0 S 02:24 /usr/sbin/httpd -k start 2873767 506832 nobody 19580 0.0 S 01:49 /usr/sbin/httpd -k start 2874596 506832 nobody 19052 0.5 S 00:02 /usr/sbin/httpd -k start 2874280 506832 nobody 19032 0.0 S 00:46 /usr/sbin/httpd -k start 2874590 506832 nobody 18968 0.3 S 00:03 /usr/sbin/httpd -k start 2874585 506832 nobody 18964 0.2 S 00:04 /usr/sbin/httpd -k start 2874597 506832 nobody 18964 0.5 S 00:02 /usr/sbin/httpd -k start 2874595 506832 nobody 18920 0.5 S 00:02 /usr/sbin/httpd -k start 2874591 506832 nobody 18836 0.3 S 00:03 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18728 0.0 Ss 2-01:07:01 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2874273 506832 nobody 18096 0.0 S 00:48 /usr/sbin/httpd -k start 2874594 508720 mailnull 17784 0.0 S 00:02 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2874284 506832 nobody 17192 0.1 S 00:45 /usr/sbin/httpd -k start 1471 1 root 16728 0.0 Ss 61-19:09:19 cPhulkd - processor 2874624 506832 nobody 16496 0.0 S 00:01 /usr/sbin/httpd -k start 2874598 506832 nobody 16448 0.0 S 00:02 /usr/sbin/httpd -k start 2874622 506832 nobody 16448 0.0 S 00:01 /usr/sbin/httpd -k start 2874623 506832 nobody 16448 0.0 S 00:01 /usr/sbin/httpd -k start 2874627 506832 nobody 16448 0.0 S 00:01 /usr/sbin/httpd -k start 2874628 506832 nobody 16448 0.0 S 00:01 /usr/sbin/httpd -k start 2874629 506832 nobody 16448 0.0 S 00:01 /usr/sbin/httpd -k start 2874626 506832 nobody 16436 0.0 S 00:01 /usr/sbin/httpd -k start 2874625 506832 nobody 16432 0.0 S 00:01 /usr/sbin/httpd -k start 2327413 1471 root 16420 0.0 S 02:42:50 cPhulkd - dbprocessor 509671 508992 netdata 15904 2.1 Sl 2-02:59:22 /usr/libexec/netdata/plugins.d/apps.plugin 1 508634 1 named 15900 0.0 Ssl 2-02:59:32 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1482727 508511 lowrange 15092 0.0 S 06:46:34 dovecot/imap 2874040 1471 root 15080 0.0 S 01:17 cPhulkd - processor - http socket 1876631 508511 infinium 14972 0.0 S 04:52:37 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4342872 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/wp.evolutionerp.com.au 71 otter2/otterfencing.net.au-ssl_log 57 vinesit/vinesit.com.au-ssl_log 45 aaa/aaadownunder.com.au-ssl_log 26 evolution/portal.evolutionerp.com.au-ssl_log 16 speedlin/speedlinefencing.com.au-ssl_log 11 madalice/madalice.com.au-ssl_log 9 corpkicks/corporatekicks.com.au-ssl_log 5 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 72 20.63.81.20 58 158.23.184.117 45 158.23.147.79 18 52.139.37.240 16 203.54.180.238 6 118.127.40.55 2 43.165.198.5 2 35.231.130.18 2 205.185.121.17 2 160.153.252.100 2 114.119.146.16 2 114.119.131.88 2 103.74.116.219 1 52.167.144.231 1 50.6.169.131 --- top request paths across all vhosts (last 3 min) --- 16 GET /heartbeat.php 6 POST /wp-cron.php 6 GET /store/custom-brisbane-lions-shoes/ 6 GET / 4 GET /goods.php 2 POST /wp-login.php 2 GET /ws55.php 2 GET /wp-trackback.php 2 GET /wp.php 2 GET /wp-login.php 2 GET /wp-json/wp/v2/users 2 GET /wp-includes/index.php 2 GET /sym.php 2 GET /sign.php 2 GET /new.php 2 GET /dev.php 2 GET /alfa.php 2 GET /admin.php 2 GET /about.php 1 POST /graphql --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/wp.evolutionerp.com.au == -- top paths -- 3 GET /goods.php 2 GET /ws55.php 2 GET /sym.php 2 GET /sign.php 2 GET /dev.php 1 GET /x.php 1 GET /wp-trackback.php 1 GET /wp.php 1 GET /wp-includes/index.php 1 GET /wp-includes/ 1 GET /w.php 1 GET /wp-content/uploads/ -- last 10 requests -- 20.63.81.20 - - [30/Aug/2026:05:18:09 +1000] "GET /dev.php?p HTTP/1.1" 301 - "-" "-" 20.63.81.20 - - [30/Aug/2026:05:18:10 +1000] "GET /dev.php HTTP/1.1" 404 131436 "-" "-" 20.63.81.20 - - [30/Aug/2026:05:18:11 +1000] "GET /gos.php HTTP/1.1" 404 131436 "-" "-" 20.63.81.20 - - [30/Aug/2026:05:18:12 +1000] "GET /132.php HTTP/1.1" 404 131436 "-" "-" 20.63.81.20 - - [30/Aug/2026:05:18:13 +1000] "GET /v22.php HTTP/1.1" 404 131436 "-" "-" 20.63.81.20 - - [30/Aug/2026:05:18:14 +1000] "GET /wp-activate.php HTTP/1.1" 302 - "-" "-" 20.63.81.20 - - [30/Aug/2026:05:18:19 +1000] "GET /wp-trackback.php HTTP/1.1" 404 135 "-" "-" 20.63.81.20 - - [30/Aug/2026:05:18:20 +1000] "GET /pri.php HTTP/1.1" 404 131436 "-" "-" 20.63.81.20 - - [30/Aug/2026:05:18:22 +1000] "GET /wp_blog_footer.php HTTP/1.1" 404 131447 "-" "-" 20.63.81.20 - - [30/Aug/2026:05:18:23 +1000] "GET /sushi.php HTTP/1.1" 404 131438 "-" "-" == otter2/otterfencing.net.au-ssl_log == -- top paths -- 1 GET /xmr.php 1 GET /xmlrpc.php 1 GET /wp-trackback.php 1 GET /wp.php 1 GET /wp-includes/themes/uploads/config.php 1 GET /wp-includes/theme-compat 1 GET /wp-includes/Text.php 1 GET /wp-includes/Text/Diff/ 1 GET /wp-includes/Test.php 1 GET /wp-includes/style-engine/wp-conflg.php 1 GET /wp-includes/Requests/Exception/file.php 1 GET /wp-includes/pomo.php -- last 10 requests -- 158.23.184.117 - - [30/Aug/2026:05:17:21 +1000] "GET /wp-content/export.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:05:17:21 +1000] "GET /new.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:05:17:21 +1000] "GET /wp-content/plugins/revslider/admin.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safar 158.23.184.117 - - [30/Aug/2026:05:17:22 +1000] "GET /wp-content/images/uploads/admin.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/5 158.23.184.117 - - [30/Aug/2026:05:17:22 +1000] "GET /tools.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:05:17:22 +1000] "GET /wp-content/uploads/my.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:05:17:22 +1000] "GET /wp-includes/themes/uploads/config.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari 158.23.184.117 - - [30/Aug/2026:05:17:22 +1000] "GET /av.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:05:17:22 +1000] "GET /wp-includes/blocks/button HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:05:17:23 +1000] "GET /wp-includes/ID3/file.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == vinesit/vinesit.com.au-ssl_log == -- top paths -- 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-includes/sitemaps/providers/index.php 1 GET /wp-includes/Requests/about.php 1 GET /wp-includes/plugins.php 1 GET /wp-includes/js/thickbox/thickbox.php 1 GET /wp-includes/js/jcrop/Jcrop.php 1 GET /wp-includes/js/index.php 1 GET /wp-includes/IXR/index.php 1 GET /wp-includes/index.php 1 GET /wp-includes/ID3/index.php 1 GET /wp-includes/customize/index.php -- last 10 requests -- 158.23.147.79 - - [30/Aug/2026:05:17:13 +1000] "GET /mah.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [30/Aug/2026:05:17:14 +1000] "GET /wp-blog-header.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [30/Aug/2026:05:17:14 +1000] "GET /wp-content/plugins/ioxi/alfa-ioxi.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [30/Aug/2026:05:17:15 +1000] "GET /wp-admin/user/index.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [30/Aug/2026:05:17:15 +1000] "GET /wp-includes/plugins.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [30/Aug/2026:05:17:16 +1000] "GET /wp-includes/js/thickbox/thickbox.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [30/Aug/2026:05:17:16 +1000] "GET /goat1.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [30/Aug/2026:05:17:16 +1000] "GET /wp-includes/certificates/index.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [30/Aug/2026:05:17:17 +1000] "GET /wp-admin/network/index.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [30/Aug/2026:05:17:17 +1000] "GET /wp-includes/sitemaps/providers/index.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-30 05:16:47 L1=1.48 run=1 blk=0 avail=8537 (62.0%) swpO=0 conn=2 myRSS=2768 php=4 phpRSS=197 ap=17 tcp=28 topuser=madalice 2026-08-30 05:16:48 L1=1.48 run=3 blk=0 avail=8351 (60.6%) swpO=0 conn=1 myRSS=2768 php=5 phpRSS=438 ap=17 tcp=28 topuser=madalice 2026-08-30 05:16:57 L1=1.64 run=3 blk=0 avail=8437 (61.2%) swpO=0 conn=2 myRSS=2768 php=4 phpRSS=315 ap=17 tcp=28 topuser=madalice 2026-08-30 05:16:58 L1=1.58 run=5 blk=0 avail=8462 (61.4%) swpO=0 conn=2 myRSS=2768 php=4 phpRSS=299 ap=17 tcp=31 topuser=madalice 2026-08-30 05:17:07 L1=1.54 run=1 blk=0 avail=8518 (61.8%) swpO=0 conn=2 myRSS=2768 php=3 phpRSS=194 ap=18 tcp=31 topuser=madalice 2026-08-30 05:17:08 L1=1.66 run=3 blk=0 avail=8475 (61.5%) swpO=0 conn=2 myRSS=2768 php=4 phpRSS=261 ap=18 tcp=32 topuser=madalice 2026-08-30 05:17:17 L1=1.60 run=3 blk=0 avail=8500 (61.7%) swpO=1 conn=2 myRSS=2768 php=4 phpRSS=259 ap=18 tcp=32 topuser=madalice 2026-08-30 05:17:18 L1=1.55 run=2 blk=0 avail=8412 (61.1%) swpO=1 conn=2 myRSS=2768 php=4 phpRSS=337 ap=18 tcp=33 topuser=madalice 2026-08-30 05:17:27 L1=1.59 run=2 blk=0 avail=8409 (61.0%) swpO=0 conn=2 myRSS=2768 php=4 phpRSS=328 ap=19 tcp=30 topuser=madalice 2026-08-30 05:17:28 L1=1.54 run=1 blk=0 avail=8514 (61.8%) swpO=0 conn=2 myRSS=2768 php=3 phpRSS=194 ap=19 tcp=30 topuser=madalice 2026-08-30 05:17:37 L1=1.58 run=2 blk=0 avail=8445 (61.3%) swpO=0 conn=2 myRSS=2768 php=4 phpRSS=317 ap=18 tcp=29 topuser=madalice 2026-08-30 05:17:38 L1=1.53 run=1 blk=0 avail=8535 (62.0%) swpO=0 conn=2 myRSS=2768 php=3 phpRSS=194 ap=18 tcp=30 topuser=madalice 2026-08-30 05:17:47 L1=1.57 run=2 blk=0 avail=8531 (61.9%) swpO=0 conn=2 myRSS=2768 php=4 phpRSS=252 ap=16 tcp=25 topuser=madalice 2026-08-30 05:17:48 L1=1.52 run=2 blk=0 avail=8442 (61.3%) swpO=0 conn=2 myRSS=2768 php=4 phpRSS=331 ap=16 tcp=25 topuser=madalice 2026-08-30 05:17:57 L1=1.48 run=3 blk=0 avail=8443 (61.3%) swpO=0 conn=2 myRSS=2768 php=4 phpRSS=328 ap=16 tcp=28 topuser=madalice 2026-08-30 05:17:58 L1=1.44 run=1 blk=0 avail=8545 (62.0%) swpO=0 conn=1 myRSS=2768 php=3 phpRSS=194 ap=16 tcp=28 topuser=madalice 2026-08-30 05:18:07 L1=1.33 run=5 blk=0 avail=8496 (61.7%) swpO=0 conn=2 myRSS=2768 php=6 phpRSS=342 ap=16 tcp=31 topuser=madalice 2026-08-30 05:18:08 L1=1.46 run=4 blk=0 avail=8324 (60.4%) swpO=0 conn=1 myRSS=2768 php=6 phpRSS=502 ap=16 tcp=32 topuser=speedlin 2026-08-30 05:18:17 L1=1.42 run=2 blk=0 avail=8457 (61.4%) swpO=0 conn=2 myRSS=2768 php=4 phpRSS=308 ap=16 tcp=34 topuser=madalice 2026-08-30 05:18:18 L1=1.47 run=3 blk=0 avail=8325 (60.4%) swpO=0 conn=1 myRSS=2768 php=4 phpRSS=327 ap=16 tcp=33 topuser=madalice 2026-08-30 05:18:27 L1=1.59 run=5 blk=0 avail=8309 (60.3%) swpO=3 conn=2 myRSS=2768 php=5 phpRSS=451 ap=20 tcp=37 topuser=madalice 2026-08-30 05:18:28 L1=1.55 run=1 blk=0 avail=8398 (61.0%) swpO=3 conn=1 myRSS=2768 php=4 phpRSS=328 ap=20 tcp=38 topuser=madalice 2026-08-30 05:18:38 L1=1.50 run=1 blk=0 avail=8410 (61.0%) swpO=0 conn=1 myRSS=2768 php=4 phpRSS=328 ap=19 tcp=31 topuser=madalice 2026-08-30 05:18:38 L1=1.46 run=1 blk=0 avail=8411 (61.1%) swpO=0 conn=1 myRSS=2768 php=4 phpRSS=328 ap=18 tcp=30 topuser=madalice 2026-08-30 05:18:48 L1=1.31 run=2 blk=0 avail=8413 (61.1%) swpO=0 conn=1 myRSS=2768 php=5 phpRSS=378 ap=15 tcp=30 topuser=madalice 2026-08-30 05:18:48 L1=1.31 run=3 blk=0 avail=8308 (60.3%) swpO=0 conn=1 myRSS=2768 php=5 phpRSS=484 ap=15 tcp=30 topuser=madalice 2026-08-30 05:18:58 L1=1.26 run=1 blk=0 avail=8558 (62.1%) swpO=0 conn=1 myRSS=2768 php=3 phpRSS=191 ap=14 tcp=28 topuser=madalice 2026-08-30 05:18:58 L1=1.26 run=2 blk=0 avail=8558 (62.1%) swpO=0 conn=1 myRSS=2768 php=3 phpRSS=191 ap=14 tcp=29 topuser=madalice 2026-08-30 05:19:08 L1=1.62 run=8 blk=0 avail=7295 (52.9%) swpO=0 conn=1 myRSS=2768 php=10 phpRSS=1490 ap=21 tcp=55 topuser=madalice 2026-08-30 05:19:08 L1=1.62 run=6 blk=0 avail=7291 (52.9%) swpO=0 conn=3 myRSS=2768 php=10 phpRSS=1508 ap=29 tcp=56 topuser=madalice