INCIDENT 2026-08-30 06:10:42 trigger: php_rss=1746MB ================================================================== load: 2.11 1.65 1.29 4/707 3059583 ncpu:10 mem_avail: 6833MB/13777MB (49.6%) swap_used:1824MB swapout:0/s blocked(D):0 running:3 iowait:0.0% steal:0.0% php: 12 procs / 1746MB heaviest user: madalice (10 procs, 1709MB) apache: 62 procs tcp_estab: 61 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2765 madalice 10 1716 root 252 1166 nobody 61 1039 netdata 7 197 mailman 20 127 mailnull 4 86 cpanellogin 1 64 dovenull 6 46 evolution 11 44 wp-toolkit 3 32 lowrange 2 29 kurri 2 26 zabbix 1 22 dovecot 3 20 named 1 15 infinium 1 14 candyfabcom 1 14 cpanelphpmyadmin 1 8 polkitd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1717 root 1 22 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5513 MB Active(file): 4763 MB Inactive(file): 1172 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 646 MB CommitLimit: 10984 MB Committed_AS: 9204 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-03:52:03 7804 /usr/bin/imunify-agent-proxy 3043023 root 03:21 58760 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2831628 7.7 Ssl 2-03:51:32 /usr/sbin/mariadbd 3044583 510022 madalice 247668 25.6 S 01:08 php-fpm: pool madalice_com_au 3059239 510022 madalice 234236 52.8 R 00:15 php-fpm: pool madalice_com_au 2328310 2277352 root 185188 0.0 S 03:32:32 spamd child 508924 1 netdata 176712 1.9 Ssl 2-03:51:01 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175896 0.0 Ss 03:47:38 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328311 2277352 root 168448 0.0 S 03:32:32 spamd child 3059240 510022 madalice 164032 49.7 R 00:15 php-fpm: pool madalice_com_au 3043859 510022 madalice 163744 14.8 S 02:15 php-fpm: pool madalice_com_au 3059484 510022 madalice 159992 59.0 S 00:08 php-fpm: pool madalice_com_au 3059232 510022 madalice 159452 50.1 S 00:16 php-fpm: pool madalice_com_au 3059233 510022 madalice 159452 49.8 S 00:16 php-fpm: pool madalice_com_au 3059483 510022 madalice 159436 71.2 S 00:08 php-fpm: pool madalice_com_au 3059481 510022 madalice 159428 70.8 S 00:08 php-fpm: pool madalice_com_au 3059231 510022 madalice 159348 50.2 S 00:16 php-fpm: pool madalice_com_au 509266 1 root 134432 0.0 Ss 2-03:50:58 /usr/lib/systemd/systemd-journald 2975790 1353308 cpanellogin 66508 0.1 S 20:44 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 3043023 1 root 58760 0.7 Ssl 03:21 /opt/imunify360/venv/bin/python3 -m imav.run 509236 509098 root 54564 0.0 Sl 2-03:50:58 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 45048 0.0 Sl 2-03:50:56 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42356 0.1 Ss 39-03:29:24 cpsrvd (SSL) - waiting for connections 2275833 1 root 36868 0.0 Ss 03:48:28 lfd - sleeping 508720 1 mailnull 25564 0.0 Ss 2-03:51:05 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 23800 0.1 Ss 61-20:00:53 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23528 0.0 Ss 2-03:50:54 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 22936 0.2 Ssl 2-03:52:15 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3026094 506832 nobody 22904 0.0 S 08:02 /usr/sbin/httpd -k start 3044608 506832 nobody 22164 0.1 S 01:06 /usr/sbin/httpd -k start 3044006 506832 nobody 22084 0.0 S 01:53 /usr/sbin/httpd -k start 1463 1 root 21952 0.0 Ss 61-20:00:53 tailwatchd 3044800 506832 nobody 21072 0.1 S 00:53 /usr/sbin/httpd -k start 3059476 508720 mailnull 20948 0.0 S 00:09 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3059496 508720 mailnull 20948 0.0 S 00:06 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3044113 508720 mailnull 20740 0.0 S 01:45 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3059091 506832 nobody 20728 0.1 S 00:23 /usr/sbin/httpd -k start 3043557 506832 nobody 20480 0.0 S 02:43 /usr/sbin/httpd -k start 3059094 506832 nobody 20264 0.1 S 00:23 /usr/sbin/httpd -k start 3059075 506832 nobody 20220 0.1 S 00:24 /usr/sbin/httpd -k start 3025930 506832 nobody 20176 0.0 S 08:15 /usr/sbin/httpd -k start 3059064 506832 nobody 20176 0.1 S 00:25 /usr/sbin/httpd -k start 3059247 506832 nobody 20144 0.1 S 00:15 /usr/sbin/httpd -k start 3059503 506832 nobody 19660 0.1 S 00:06 /usr/sbin/httpd -k start 3044047 506832 nobody 19208 0.0 S 01:51 /usr/sbin/httpd -k start 3059093 506832 nobody 19184 0.0 S 00:23 /usr/sbin/httpd -k start 3059528 506832 nobody 19056 0.2 S 00:04 /usr/sbin/httpd -k start 3059524 506832 nobody 19052 0.2 S 00:04 /usr/sbin/httpd -k start 3059493 506832 nobody 19048 0.1 S 00:07 /usr/sbin/httpd -k start 3059526 506832 nobody 18996 0.2 S 00:04 /usr/sbin/httpd -k start 3059529 506832 nobody 18992 0.2 S 00:04 /usr/sbin/httpd -k start 3059513 506832 nobody 18988 0.2 S 00:05 /usr/sbin/httpd -k start 3059525 506832 nobody 18988 0.2 S 00:04 /usr/sbin/httpd -k start 3059530 506832 nobody 18988 0.2 S 00:04 /usr/sbin/httpd -k start 3059494 506832 nobody 18984 0.1 S 00:07 /usr/sbin/httpd -k start 3059500 506832 nobody 18984 0.1 S 00:06 /usr/sbin/httpd -k start 3059487 506832 nobody 18956 0.1 S 00:08 /usr/sbin/httpd -k start 3044081 506832 nobody 18948 0.0 S 01:50 /usr/sbin/httpd -k start 3059515 506832 nobody 18924 0.2 S 00:05 /usr/sbin/httpd -k start 3059527 506832 nobody 18924 0.2 S 00:04 /usr/sbin/httpd -k start 3044732 506832 nobody 18780 0.0 S 00:58 /usr/sbin/httpd -k start 3044091 506832 nobody 18772 0.0 S 01:49 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4354706 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min vinesit/vinesit.com.au-ssl_log 227 candyfabcom/candyfab.com.au-ssl_log 98 otterfencing/otterfencing.com.au-ssl_log 82 madalice/madalice.com.au-ssl_log 62 alison/alisonarts.com.au-ssl_log 43 otter2/otterfencing.net.au-ssl_log 43 evolution/portal.evolutionerp.com.au-ssl_log 28 nrg/nrgservices.net.au-ssl_log 20 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 219 34.83.74.192 98 20.104.18.15 81 20.151.200.44 43 52.139.44.162 43 35.231.130.18 36 20.48.179.39 28 203.54.180.238 19 52.139.37.240 7 54.213.134.84 2 66.42.61.105 2 51.68.107.138 2 129.146.118.6 2 118.127.40.55 2 114.119.131.88 2 112.86.225.181 --- top request paths across all vhosts (last 3 min) --- 28 GET /heartbeat.php 9 GET / 7 GET /store/custom-bandana-af1-shoes/ 5 GET /robots.txt 4 POST /wp-load.php 3 POST / 3 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 GET /this_is_a_new_hello_world.php 3 GET /login 3 GET /admin.php 3 GET /admin 2 POST /index.php 2 GET /wp.php 2 GET /w.php 2 GET /wp-content/uploads/ 2 GET /wp-content/themes/index.php 2 GET /users/login 2 GET /user/login 2 GET /simple.php 2 GET /signup --- busiest 3 vhosts: top paths + last 10 requests --- == vinesit/vinesit.com.au-ssl_log == -- top paths -- 3 GET /robots.txt 3 GET / 2 GET /@fs/proc/self/environ 1 POST /wp-cron.php 1 GET /.zsh_history 1 GET /wp-sitemap.xml 1 GET /wp-sitemap-taxonomies-category-1.xml 1 GET /wp-sitemap-posts-post-1.xml 1 GET /wp-sitemap-posts-page-1.xml 1 GET /wp-config.php.old 1 GET /wp-config.php.bak 1 GET /wp-config.php -- last 10 requests -- 34.83.74.192 - - [30/Aug/2026:06:10:18 +1000] "GET /config.toml HTTP/1.1" 401 53 "-" "Mozilla/5.0 (compatible; meta-externalagent/1.1; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.83.74.192 - - [30/Aug/2026:06:10:18 +1000] "GET /secrets.yaml HTTP/1.1" 401 53 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot) Chrome/ 34.83.74.192 - - [30/Aug/2026:06:10:18 +1000] "GET /core/settings.py HTTP/1.1" 401 53 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +h 34.83.74.192 - - [30/Aug/2026:06:10:18 +1000] "GET /application.properties HTTP/1.1" 401 53 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user 34.83.74.192 - - [30/Aug/2026:06:10:18 +1000] "GET /settings.py HTTP/1.1" 401 53 "-" "Mozilla/5.0 (compatible; Slackbot-LinkExpanding/1.0; +https://api.slack.com/robots)" 34.83.74.192 - - [30/Aug/2026:06:10:18 +1000] "GET /bootstrap.yml HTTP/1.1" 401 53 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.2; +https://opena 34.83.74.192 - - [30/Aug/2026:06:10:18 +1000] "GET /app/settings.py HTTP/1.1" 401 53 "-" "Mozilla/5.0 (compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)" 34.83.74.192 - - [30/Aug/2026:06:10:18 +1000] "GET /backend/settings.py HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko; compatible; OAI-SearchBot/1.3; +https://openai 34.83.74.192 - - [30/Aug/2026:06:10:18 +1000] "GET /instance/config.py HTTP/1.1" 401 53 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 34.83.74.192 - - [30/Aug/2026:06:10:22 +1000] "GET /.boto HTTP/1.1" 401 53 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko; compatible; meta-externalagent/1.1; +https://d == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 2 GET /goods.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /x.php 1 GET /wsd.php 1 GET /ws85.php 1 GET /ws55.php 1 GET /wp.php 1 GET /wp-includes/index.php 1 GET /w.php 1 GET /wp-content/uploads/ -- last 10 requests -- 20.104.18.15 - - [30/Aug/2026:06:09:45 +1000] "GET /x.php HTTP/1.1" 404 5750 "-" "-" 20.104.18.15 - - [30/Aug/2026:06:09:46 +1000] "GET /ssla.php HTTP/1.1" 404 5750 "-" "-" 20.104.18.15 - - [30/Aug/2026:06:09:46 +1000] "GET /wp-admin/maint/wp-is.php HTTP/1.1" 404 5750 "-" "-" 20.104.18.15 - - [30/Aug/2026:06:09:47 +1000] "GET /wp-aothait.php HTTP/1.1" 404 5750 "-" "-" 20.104.18.15 - - [30/Aug/2026:06:09:47 +1000] "GET /wp-includes/index.php HTTP/1.1" 404 5750 "-" "-" 20.104.18.15 - - [30/Aug/2026:06:09:48 +1000] "GET /file31.php HTTP/1.1" 404 5750 "-" "-" 20.104.18.15 - - [30/Aug/2026:06:09:48 +1000] "GET /dk.php HTTP/1.1" 404 5750 "-" "-" 20.104.18.15 - - [30/Aug/2026:06:09:49 +1000] "GET /ta.php HTTP/1.1" 404 5750 "-" "-" 20.104.18.15 - - [30/Aug/2026:06:09:49 +1000] "GET /bo.php HTTP/1.1" 404 5750 "-" "-" 20.104.18.15 - - [30/Aug/2026:06:09:49 +1000] "GET /44.php HTTP/1.1" 404 5750 "-" "-" == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 1 GET /ztv.php 1 GET /Zeiss.php 1 GET /zafir1.php 1 GET /yyy.php 1 GET /X7T6.php 1 GET /x23.php 1 GET /ww2.php 1 GET /ws66.php 1 GET /wp-wlx.php 1 GET /wp-gzone.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-ana.php -- last 10 requests -- 20.151.200.44 - - [30/Aug/2026:06:10:18 +1000] "GET /anz.php HTTP/1.1" 401 36 "-" "-" 20.151.200.44 - - [30/Aug/2026:06:10:18 +1000] "GET /bge.php HTTP/1.1" 401 36 "-" "-" 20.151.200.44 - - [30/Aug/2026:06:10:19 +1000] "GET /wp-ana.php HTTP/1.1" 401 36 "-" "-" 20.151.200.44 - - [30/Aug/2026:06:10:19 +1000] "GET /secret.php HTTP/1.1" 401 36 "-" "-" 20.151.200.44 - - [30/Aug/2026:06:10:19 +1000] "GET /pro.php HTTP/1.1" 401 36 "-" "-" 20.151.200.44 - - [30/Aug/2026:06:10:20 +1000] "GET /999.php HTTP/1.1" 401 36 "-" "-" 20.151.200.44 - - [30/Aug/2026:06:10:20 +1000] "GET /sef.php HTTP/1.1" 401 36 "-" "-" 20.151.200.44 - - [30/Aug/2026:06:10:21 +1000] "GET /admin123.php HTTP/1.1" 401 36 "-" "-" 20.151.200.44 - - [30/Aug/2026:06:10:21 +1000] "GET /7h.php HTTP/1.1" 401 36 "-" "-" 20.151.200.44 - - [30/Aug/2026:06:10:22 +1000] "GET /wp-gzone.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-30 06:08:12 L1=2.00 run=2 blk=0 avail=8423 (61.1%) swpO=0 conn=2 myRSS=2765 php=4 phpRSS=279 ap=21 tcp=32 topuser=madalice 2026-08-30 06:08:21 L1=1.77 run=1 blk=0 avail=8516 (61.8%) swpO=0 conn=2 myRSS=2765 php=3 phpRSS=168 ap=20 tcp=28 topuser=madalice 2026-08-30 06:08:22 L1=1.77 run=2 blk=0 avail=8461 (61.4%) swpO=0 conn=2 myRSS=2765 php=4 phpRSS=264 ap=20 tcp=28 topuser=madalice 2026-08-30 06:08:31 L1=1.82 run=3 blk=0 avail=8345 (60.6%) swpO=0 conn=2 myRSS=2765 php=5 phpRSS=413 ap=18 tcp=29 topuser=otterfencing 2026-08-30 06:08:32 L1=1.82 run=1 blk=0 avail=8528 (61.9%) swpO=0 conn=2 myRSS=2765 php=3 phpRSS=169 ap=18 tcp=28 topuser=madalice 2026-08-30 06:08:41 L1=1.61 run=1 blk=0 avail=8527 (61.9%) swpO=0 conn=2 myRSS=2765 php=3 phpRSS=169 ap=18 tcp=28 topuser=madalice 2026-08-30 06:08:42 L1=1.61 run=1 blk=0 avail=8533 (61.9%) swpO=0 conn=2 myRSS=2765 php=3 phpRSS=169 ap=18 tcp=27 topuser=madalice 2026-08-30 06:08:51 L1=1.44 run=2 blk=0 avail=8443 (61.3%) swpO=0 conn=2 myRSS=2765 php=4 phpRSS=271 ap=20 tcp=55 topuser=madalice 2026-08-30 06:08:52 L1=1.44 run=4 blk=0 avail=8399 (61.0%) swpO=0 conn=2 myRSS=2765 php=4 phpRSS=291 ap=24 tcp=55 topuser=madalice 2026-08-30 06:09:02 L1=1.29 run=3 blk=0 avail=8188 (59.4%) swpO=0 conn=2 myRSS=2765 php=4 phpRSS=272 ap=42 tcp=66 topuser=madalice 2026-08-30 06:09:02 L1=1.29 run=3 blk=0 avail=7974 (57.9%) swpO=0 conn=2 myRSS=2765 php=5 phpRSS=475 ap=42 tcp=41 topuser=evolution 2026-08-30 06:09:12 L1=1.17 run=4 blk=0 avail=8346 (60.6%) swpO=0 conn=2 myRSS=2765 php=4 phpRSS=281 ap=35 tcp=34 topuser=madalice 2026-08-30 06:09:13 L1=1.17 run=2 blk=0 avail=8326 (60.4%) swpO=0 conn=2 myRSS=2765 php=3 phpRSS=278 ap=34 tcp=32 topuser=madalice 2026-08-30 06:09:22 L1=0.99 run=2 blk=0 avail=8443 (61.3%) swpO=0 conn=2 myRSS=2765 php=4 phpRSS=221 ap=28 tcp=49 topuser=madalice 2026-08-30 06:09:23 L1=0.99 run=2 blk=0 avail=8357 (60.7%) swpO=0 conn=2 myRSS=2765 php=4 phpRSS=305 ap=28 tcp=33 topuser=alison 2026-08-30 06:09:32 L1=0.98 run=4 blk=0 avail=8365 (60.7%) swpO=0 conn=2 myRSS=2765 php=4 phpRSS=325 ap=26 tcp=33 topuser=customc 2026-08-30 06:09:33 L1=0.98 run=5 blk=0 avail=8284 (60.1%) swpO=0 conn=2 myRSS=2765 php=6 phpRSS=466 ap=25 tcp=36 topuser=infinium 2026-08-30 06:09:42 L1=0.91 run=5 blk=0 avail=8349 (60.6%) swpO=0 conn=2 myRSS=2765 php=4 phpRSS=343 ap=24 tcp=35 topuser=madalice 2026-08-30 06:09:43 L1=0.91 run=6 blk=0 avail=8105 (58.8%) swpO=0 conn=2 myRSS=2765 php=4 phpRSS=431 ap=24 tcp=68 topuser=madalice 2026-08-30 06:09:52 L1=0.93 run=3 blk=0 avail=8258 (59.9%) swpO=0 conn=2 myRSS=2765 php=4 phpRSS=401 ap=27 tcp=34 topuser=madalice 2026-08-30 06:09:53 L1=0.93 run=1 blk=0 avail=8318 (60.4%) swpO=0 conn=2 myRSS=2765 php=4 phpRSS=347 ap=27 tcp=34 topuser=madalice 2026-08-30 06:10:02 L1=0.94 run=3 blk=0 avail=8290 (60.2%) swpO=0 conn=2 myRSS=2765 php=4 phpRSS=349 ap=25 tcp=31 topuser=madalice 2026-08-30 06:10:03 L1=0.94 run=5 blk=0 avail=8253 (59.9%) swpO=0 conn=2 myRSS=2765 php=4 phpRSS=349 ap=25 tcp=47 topuser=madalice 2026-08-30 06:10:12 L1=0.87 run=1 blk=0 avail=8361 (60.7%) swpO=0 conn=2 myRSS=2765 php=4 phpRSS=349 ap=23 tcp=33 topuser=madalice 2026-08-30 06:10:13 L1=0.87 run=1 blk=0 avail=8255 (59.9%) swpO=0 conn=1 myRSS=2765 php=4 phpRSS=349 ap=23 tcp=48 topuser=madalice 2026-08-30 06:10:22 L1=0.73 run=4 blk=0 avail=8260 (60.0%) swpO=0 conn=2 myRSS=2765 php=5 phpRSS=432 ap=29 tcp=62 topuser=madalice 2026-08-30 06:10:23 L1=0.73 run=6 blk=0 avail=8146 (59.1%) swpO=0 conn=1 myRSS=2765 php=6 phpRSS=565 ap=30 tcp=46 topuser=madalice 2026-08-30 06:10:32 L1=1.17 run=3 blk=0 avail=7555 (54.8%) swpO=0 conn=2 myRSS=2765 php=9 phpRSS=1158 ap=34 tcp=48 topuser=madalice 2026-08-30 06:10:33 L1=1.17 run=2 blk=0 avail=7585 (55.1%) swpO=0 conn=1 myRSS=2765 php=9 phpRSS=1129 ap=33 tcp=41 topuser=madalice 2026-08-30 06:10:42 L1=2.11 run=3 blk=0 avail=6833 (49.6%) swpO=0 conn=4 myRSS=2765 php=12 phpRSS=1746 ap=62 tcp=61 topuser=madalice