INCIDENT 2026-08-30 06:37:00 trigger: php_rss=1771MB ================================================================== load: 1.20 0.67 0.86 4/659 3145513 ncpu:10 mem_avail: 7153MB/13777MB (51.9%) swap_used:1826MB swapout:0/s blocked(D):0 running:4 iowait:0.0% steal:0.0% php: 12 procs / 1771MB heaviest user: madalice (7 procs, 1162MB) apache: 22 procs tcp_estab: 29 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2763 madalice 7 1171 root 249 1147 corpkicks 3 586 nobody 21 356 netdata 7 196 mailman 20 127 mailnull 4 85 cpanellogin 1 67 dovenull 6 46 evolution 11 44 wp-toolkit 3 32 lowrange 2 29 kurri 2 26 zabbix 1 22 dovecot 3 20 named 1 15 infinium 1 14 polkitd 1 5 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 7 1172 corpkicks 3 590 root 1 22 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5538 MB Active(file): 4782 MB Inactive(file): 1184 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 648 MB CommitLimit: 10984 MB Committed_AS: 8331 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-04:18:21 7804 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2830240 7.7 Ssl 2-04:17:50 /usr/sbin/mariadbd 3145454 3145317 corpkicks 280520 71.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3145320 510022 madalice 249780 31.7 R 00:22 php-fpm: pool madalice_com_au 2328310 2277352 root 185196 0.0 S 03:58:50 spamd child 508924 1 netdata 176340 1.9 Ssl 2-04:17:19 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175896 0.0 Ss 04:13:56 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328311 2277352 root 168448 0.0 S 03:58:50 spamd child 3145484 3145380 corpkicks 167000 65.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3145149 510022 madalice 163180 23.8 S 00:49 php-fpm: pool madalice_com_au 3129327 510022 madalice 161936 11.8 S 04:29 php-fpm: pool madalice_com_au 3145373 510022 madalice 159516 21.7 S 00:17 php-fpm: pool madalice_com_au 3145374 510022 madalice 159360 21.4 S 00:17 php-fpm: pool madalice_com_au 3145376 510022 madalice 159220 21.4 S 00:17 php-fpm: pool madalice_com_au 3145377 510022 madalice 159152 22.0 S 00:17 php-fpm: pool madalice_com_au 509266 1 root 134960 0.0 Ss 2-04:17:16 /usr/lib/systemd/systemd-journald 2975790 1353308 cpanellogin 69528 0.0 S 47:02 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 509236 509098 root 55684 0.0 Sl 2-04:17:16 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 45312 0.0 Sl 2-04:17:14 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42388 0.1 Ss 39-03:55:42 cpsrvd (SSL) - waiting for connections 2275833 1 root 36916 0.0 Ss 04:14:46 lfd - sleeping 1466 1 root 25584 0.0 Ss 61-20:27:11 dnsadmin - server mode 508720 1 mailnull 25564 0.0 Ss 2-04:17:23 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 23808 0.1 Ss 61-20:27:11 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23524 0.0 Ss 2-04:17:12 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3144931 3144919 root 23348 0.1 S 01:05 /usr/sbin/exim -q 483898 1 zabbix 22868 0.2 Ssl 2-04:18:33 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3145318 506832 nobody 22524 0.5 S 00:26 /usr/sbin/httpd -k start 3128994 506832 nobody 22464 0.0 S 05:02 /usr/sbin/httpd -k start 1463 1 root 21956 0.0 Ss 61-20:27:11 tailwatchd 3128942 506832 nobody 21948 0.0 S 05:04 /usr/sbin/httpd -k start 3129831 506832 nobody 21548 0.0 S 03:20 /usr/sbin/httpd -k start 3144916 506832 nobody 21228 0.0 S 01:06 /usr/sbin/httpd -k start 3145447 508720 mailnull 20948 0.0 S 00:08 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3127802 506832 nobody 20764 0.0 S 06:21 /usr/sbin/httpd -k start 3145452 508720 mailnull 20748 0.0 S 00:03 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3128990 506832 nobody 20644 0.0 S 05:02 /usr/sbin/httpd -k start 3135840 506832 nobody 20600 0.1 S 01:55 /usr/sbin/httpd -k start 3144933 3144931 mailnull 20288 0.0 S 01:05 /usr/sbin/exim -q 3145317 506832 nobody 19264 0.0 S 00:27 /usr/sbin/httpd -k start 3145378 506832 nobody 19212 0.1 S 00:17 /usr/sbin/httpd -k start 3145380 506832 nobody 19116 0.0 S 00:16 /usr/sbin/httpd -k start 3145386 506832 nobody 19052 0.0 S 00:14 /usr/sbin/httpd -k start 3145379 506832 nobody 18968 0.0 S 00:16 /usr/sbin/httpd -k start 3145381 506832 nobody 18920 0.1 S 00:15 /usr/sbin/httpd -k start 3145319 506832 nobody 18816 0.0 S 00:26 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18728 0.0 Ss 2-02:24:53 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 3145384 506832 nobody 17996 0.0 S 00:15 /usr/sbin/httpd -k start 3145382 506832 nobody 16980 0.0 S 00:15 /usr/sbin/httpd -k start 3145391 506832 nobody 16888 0.0 S 00:14 /usr/sbin/httpd -k start 3062027 1471 root 16808 0.0 S 22:43 cPhulkd - dbprocessor 509671 508992 netdata 15916 2.1 Sl 2-04:17:14 /usr/libexec/netdata/plugins.d/apps.plugin 1 508634 1 named 15900 0.0 Ssl 2-04:17:24 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1471 1 root 15624 0.0 Ss 61-20:27:11 cPhulkd - processor 1482727 508511 lowrange 15092 0.0 S 08:04:26 dovecot/imap 1876631 508511 infinium 14972 0.0 S 06:10:29 dovecot/imap 1742095 508511 lowrange 14756 0.0 S 06:50:08 dovecot/imap 3140172 508511 kurri 14524 0.0 S 01:52 dovecot/imap 4180059 4180015 evolution 13560 0.0 Ss 2-06:37:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 3129782 508511 root 12760 0.0 S 03:24 dovecot/auth -w 3883280 508511 kurri 12636 0.0 S 16:35:11 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4361871 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min corpkicks/corporatekicks.com.au-ssl_log 81 evolution/evolutionerp.com.au-ssl_log 80 cosgrovecreative/cosgrovecreative.com.au-ssl_log 31 madalice/madalice.com.au-ssl_log 29 evolution/portal.evolutionerp.com.au-ssl_log 19 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 79 20.104.104.62 79 158.23.184.117 31 20.220.204.93 19 203.54.180.238 6 74.7.227.13 3 98.87.4.110 3 57.129.136.36 2 170.64.135.172 2 168.63.79.147 2 118.127.40.55 2 114.119.146.16 1 74.208.74.35 1 50.6.169.131 1 34.196.51.17 1 23.106.53.229 --- top request paths across all vhosts (last 3 min) --- 19 GET /heartbeat.php 4 GET / 3 GET /store/custom-afl-geelong-cats-kids/ 2 POST /wp-cron.php 2 POST /graphql 2 GET /wp-json/wp/v2/users 2 GET /wp-json/ldlms/v2/users 2 GET /grsiuk.php 2 GET /155.php 1 POST /api/graphql 1 HEAD / 1 GET /zxekqlxb.php 1 GET /ztv.php 1 GET /z.php 1 GET /zfcwswoly.php 1 GET /Zeiss.php 1 GET /zafir1.php 1 GET /yyy.php 1 GET /xmlrpc.php 1 GET /X7T6.php --- busiest 3 vhosts: top paths + last 10 requests --- == corpkicks/corporatekicks.com.au-ssl_log == -- top paths -- 1 POST /wp-cron.php 1 HEAD / 1 GET /ztv.php 1 GET /Zeiss.php 1 GET /zafir1.php 1 GET /yyy.php 1 GET /X7T6.php 1 GET /x23.php 1 GET /ww2.php 1 GET /ws66.php 1 GET /wp-wlx.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php -- last 10 requests -- 20.104.104.62 - - [30/Aug/2026:06:36:04 +1000] "GET /Zeiss.php HTTP/1.1" 404 5750 "-" "-" 20.104.104.62 - - [30/Aug/2026:06:36:05 +1000] "GET /ww2.php HTTP/1.1" 404 5750 "-" "-" 20.104.104.62 - - [30/Aug/2026:06:36:05 +1000] "GET /anz.php HTTP/1.1" 404 5750 "-" "-" 20.104.104.62 - - [30/Aug/2026:06:36:06 +1000] "GET /bge.php HTTP/1.1" 404 5750 "-" "-" 20.104.104.62 - - [30/Aug/2026:06:36:06 +1000] "GET /wp-ana.php HTTP/1.1" 404 5750 "-" "-" 20.104.104.62 - - [30/Aug/2026:06:36:06 +1000] "GET /secret.php HTTP/1.1" 404 5750 "-" "-" 20.104.104.62 - - [30/Aug/2026:06:36:07 +1000] "GET /pro.php HTTP/1.1" 404 5750 "-" "-" 20.104.104.62 - - [30/Aug/2026:06:36:07 +1000] "GET /999.php HTTP/1.1" 404 5750 "-" "-" 20.104.104.62 - - [30/Aug/2026:06:36:08 +1000] "GET /sef.php HTTP/1.1" 404 5750 "-" "-" 20.104.104.62 - - [30/Aug/2026:06:36:08 +1000] "GET /admin123.php HTTP/1.1" 404 5750 "-" "-" == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 1 POST /wp-cron.php 1 GET /z.php 1 GET /zfcwswoly.php 1 GET /xmlrpc.php 1 GET /wsoyanzv3.5enc.php 1 GET /wpx.php 1 GET /wp-trackback.php 1 GET /wp-site.php 1 GET /wp-page-update.php 1 GET /wp-mail.php 1 GET /wp-includestemplates.php 1 GET /wp-crons.php -- last 10 requests -- 158.23.184.117 - - [30/Aug/2026:06:35:13 +1000] "GET /cykeObNUpj.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:06:35:13 +1000] "GET /fm1.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:06:35:13 +1000] "GET /alq1xouj.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:06:35:13 +1000] "GET /jp.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:06:35:13 +1000] "GET /evmyQPhtn1U.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:06:35:13 +1000] "GET /log403.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:06:35:14 +1000] "GET /hehe.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:06:35:14 +1000] "GET /SEEP77.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [30/Aug/2026:06:35:14 +1000] "GET /class-wp-block-editor-context-cookie.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Saf 118.127.40.55 - - [30/Aug/2026:06:35:16 +1000] "POST /wp-cron.php?doing_wp_cron=1788035716.6838750839233398437500 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://evolutionerp.com.au" == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 1 GET /zxekqlxb.php 1 GET /wp-scr1pts.php 1 GET /wp-p2r3q9c8k4.php 1 GET /wp-act.php 1 GET /tfm.php 1 GET /term.php 1 GET /num.php 1 GET /ms.php 1 GET /kbfr.php 1 GET /init.php 1 GET /h2a2ck.php 1 GET /grsiuk.php -- last 10 requests -- 20.220.204.93 - - [30/Aug/2026:06:35:09 +1000] "GET /wp-scr1pts.php HTTP/1.1" 401 36 "-" "-" 20.220.204.93 - - [30/Aug/2026:06:35:10 +1000] "GET /num.php HTTP/1.1" 401 36 "-" "-" 20.220.204.93 - - [30/Aug/2026:06:35:10 +1000] "GET /a4.php HTTP/1.1" 401 36 "-" "-" 20.220.204.93 - - [30/Aug/2026:06:35:11 +1000] "GET /tfm.php HTTP/1.1" 401 36 "-" "-" 20.220.204.93 - - [30/Aug/2026:06:35:11 +1000] "GET /Geforce.php HTTP/1.1" 401 36 "-" "-" 20.220.204.93 - - [30/Aug/2026:06:35:12 +1000] "GET /click.php HTTP/1.1" 401 36 "-" "-" 20.220.204.93 - - [30/Aug/2026:06:35:12 +1000] "GET /ms.php HTTP/1.1" 401 36 "-" "-" 20.220.204.93 - - [30/Aug/2026:06:35:12 +1000] "GET /zxekqlxb.php HTTP/1.1" 401 36 "-" "-" 20.220.204.93 - - [30/Aug/2026:06:35:13 +1000] "GET /init.php HTTP/1.1" 401 36 "-" "-" 20.220.204.93 - - [30/Aug/2026:06:35:13 +1000] "GET /term.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-30 06:34:39 L1=0.16 run=1 blk=0 avail=8572 (62.2%) swpO=0 conn=1 myRSS=2763 php=3 phpRSS=191 ap=16 tcp=30 topuser=madalice 2026-08-30 06:34:40 L1=0.16 run=1 blk=0 avail=8571 (62.2%) swpO=0 conn=1 myRSS=2763 php=3 phpRSS=191 ap=16 tcp=27 topuser=madalice 2026-08-30 06:34:49 L1=0.14 run=1 blk=0 avail=8570 (62.2%) swpO=0 conn=1 myRSS=2763 php=3 phpRSS=191 ap=16 tcp=32 topuser=madalice 2026-08-30 06:34:50 L1=0.14 run=1 blk=0 avail=8567 (62.2%) swpO=0 conn=1 myRSS=2763 php=3 phpRSS=191 ap=16 tcp=29 topuser=madalice 2026-08-30 06:34:59 L1=0.12 run=1 blk=0 avail=8556 (62.1%) swpO=0 conn=1 myRSS=2763 php=3 phpRSS=191 ap=17 tcp=32 topuser=madalice 2026-08-30 06:35:00 L1=0.12 run=1 blk=0 avail=8552 (62.1%) swpO=0 conn=1 myRSS=2763 php=3 phpRSS=191 ap=17 tcp=33 topuser=madalice 2026-08-30 06:35:09 L1=0.25 run=3 blk=0 avail=8185 (59.4%) swpO=0 conn=1 myRSS=2763 php=5 phpRSS=597 ap=19 tcp=39 topuser=corpkicks 2026-08-30 06:35:10 L1=0.25 run=3 blk=0 avail=8537 (62.0%) swpO=0 conn=1 myRSS=2763 php=3 phpRSS=191 ap=19 tcp=29 topuser=madalice 2026-08-30 06:35:19 L1=0.21 run=1 blk=0 avail=8541 (62.0%) swpO=0 conn=1 myRSS=2763 php=3 phpRSS=191 ap=19 tcp=28 topuser=madalice 2026-08-30 06:35:20 L1=0.21 run=1 blk=0 avail=8547 (62.0%) swpO=0 conn=1 myRSS=2763 php=3 phpRSS=191 ap=19 tcp=29 topuser=madalice 2026-08-30 06:35:29 L1=0.18 run=1 blk=0 avail=8566 (62.2%) swpO=0 conn=1 myRSS=2763 php=3 phpRSS=191 ap=17 tcp=28 topuser=madalice 2026-08-30 06:35:30 L1=0.18 run=1 blk=0 avail=8567 (62.2%) swpO=0 conn=1 myRSS=2763 php=3 phpRSS=191 ap=17 tcp=25 topuser=madalice 2026-08-30 06:35:39 L1=0.15 run=1 blk=0 avail=8589 (62.3%) swpO=0 conn=1 myRSS=2763 php=3 phpRSS=192 ap=15 tcp=26 topuser=madalice 2026-08-30 06:35:40 L1=0.15 run=1 blk=0 avail=8587 (62.3%) swpO=0 conn=1 myRSS=2763 php=3 phpRSS=192 ap=15 tcp=25 topuser=madalice 2026-08-30 06:35:49 L1=0.20 run=1 blk=0 avail=8573 (62.2%) swpO=0 conn=1 myRSS=2763 php=3 phpRSS=191 ap=16 tcp=31 topuser=madalice 2026-08-30 06:35:50 L1=0.20 run=3 blk=0 avail=8521 (61.8%) swpO=0 conn=1 myRSS=2763 php=3 phpRSS=246 ap=16 tcp=30 topuser=madalice 2026-08-30 06:35:59 L1=0.24 run=1 blk=0 avail=8548 (62.0%) swpO=0 conn=1 myRSS=2763 php=3 phpRSS=192 ap=17 tcp=29 topuser=madalice 2026-08-30 06:36:00 L1=0.24 run=2 blk=0 avail=8475 (61.5%) swpO=0 conn=1 myRSS=2763 php=4 phpRSS=298 ap=17 tcp=29 topuser=madalice 2026-08-30 06:36:09 L1=0.29 run=2 blk=0 avail=8482 (61.6%) swpO=0 conn=1 myRSS=2763 php=4 phpRSS=282 ap=18 tcp=28 topuser=madalice 2026-08-30 06:36:10 L1=0.29 run=2 blk=0 avail=8508 (61.8%) swpO=0 conn=1 myRSS=2763 php=4 phpRSS=256 ap=18 tcp=29 topuser=madalice 2026-08-30 06:36:19 L1=0.32 run=1 blk=0 avail=8394 (60.9%) swpO=0 conn=1 myRSS=2763 php=4 phpRSS=348 ap=19 tcp=33 topuser=madalice 2026-08-30 06:36:20 L1=0.32 run=1 blk=0 avail=8393 (60.9%) swpO=0 conn=1 myRSS=2763 php=4 phpRSS=348 ap=19 tcp=34 topuser=madalice 2026-08-30 06:36:29 L1=0.35 run=2 blk=0 avail=8401 (61.0%) swpO=0 conn=1 myRSS=2763 php=4 phpRSS=355 ap=17 tcp=29 topuser=madalice 2026-08-30 06:36:30 L1=0.35 run=1 blk=0 avail=8278 (60.1%) swpO=0 conn=1 myRSS=2763 php=5 phpRSS=504 ap=17 tcp=30 topuser=madalice 2026-08-30 06:36:39 L1=0.52 run=3 blk=0 avail=8176 (59.3%) swpO=0 conn=1 myRSS=2763 php=5 phpRSS=584 ap=19 tcp=30 topuser=madalice 2026-08-30 06:36:40 L1=0.52 run=3 blk=0 avail=8202 (59.5%) swpO=0 conn=1 myRSS=2763 php=5 phpRSS=560 ap=19 tcp=30 topuser=madalice 2026-08-30 06:36:49 L1=1.04 run=5 blk=0 avail=7573 (55.0%) swpO=0 conn=1 myRSS=2763 php=10 phpRSS=1220 ap=32 tcp=36 topuser=madalice 2026-08-30 06:36:50 L1=1.04 run=5 blk=0 avail=7522 (54.6%) swpO=0 conn=1 myRSS=2763 php=9 phpRSS=1152 ap=32 tcp=33 topuser=madalice 2026-08-30 06:37:00 L1=1.20 run=3 blk=0 avail=7479 (54.3%) swpO=0 conn=3 myRSS=2763 php=10 phpRSS=1370 ap=23 tcp=27 topuser=madalice 2026-08-30 06:37:00 L1=1.20 run=4 blk=0 avail=7153 (51.9%) swpO=0 conn=5 myRSS=2763 php=12 phpRSS=1771 ap=22 tcp=29 topuser=madalice