INCIDENT 2026-08-30 06:46:23 trigger: php_rss=1507MB ================================================================== load: 1.54 1.06 0.97 1/658 3178940 ncpu:10 mem_avail: 7485MB/13777MB (54.3%) swap_used:1826MB swapout:0/s blocked(D):0 running:1 iowait:0.0% steal:0.0% php: 14 procs / 1507MB heaviest user: madalice (10 procs, 1390MB) apache: 19 procs tcp_estab: 27 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2763 madalice 10 1390 root 250 1111 nobody 18 278 netdata 7 195 mailman 20 127 evolution 13 124 cpanellogin 1 70 dovenull 6 46 mailnull 2 45 lowrange 3 44 wp-toolkit 3 32 kurri 2 26 zabbix 1 21 dovecot 3 20 named 1 15 infinium 1 14 polkitd 1 5 nscd 1 4 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1390 evolution 3 93 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5590 MB Active(file): 4800 MB Inactive(file): 1215 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 649 MB CommitLimit: 10984 MB Committed_AS: 8150 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-04:27:44 7804 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2830292 7.7 Ssl 2-04:27:13 /usr/sbin/mariadbd 2328310 2277352 root 185196 0.0 S 04:08:13 spamd child 2277352 1 root 175896 0.0 Ss 04:23:19 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 508924 1 netdata 174832 1.9 Ssl 2-04:26:42 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2328311 2277352 root 168448 0.0 S 04:08:13 spamd child 3162912 510022 madalice 160480 10.1 S 02:28 php-fpm: pool madalice_com_au 3178665 510022 madalice 158748 13.0 S 00:17 php-fpm: pool madalice_com_au 3178659 510022 madalice 158172 12.9 S 00:18 php-fpm: pool madalice_com_au 3178662 510022 madalice 135412 7.6 S 00:17 php-fpm: pool madalice_com_au 3178658 510022 madalice 135384 7.9 S 00:18 php-fpm: pool madalice_com_au 3178666 510022 madalice 135304 8.6 S 00:17 php-fpm: pool madalice_com_au 3178660 510022 madalice 135300 8.0 S 00:18 php-fpm: pool madalice_com_au 3178675 510022 madalice 135240 8.4 S 00:17 php-fpm: pool madalice_com_au 509266 1 root 135224 0.0 Ss 2-04:26:39 /usr/lib/systemd/systemd-journald 3178668 510022 madalice 134992 8.5 S 00:17 php-fpm: pool madalice_com_au 3178678 510022 madalice 134952 7.8 S 00:17 php-fpm: pool madalice_com_au 2975790 1353308 cpanellogin 72480 0.0 S 56:25 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 509236 509098 root 55684 0.0 Sl 2-04:26:39 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 45312 0.0 Sl 2-04:26:37 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42388 0.1 Ss 39-04:05:05 cpsrvd (SSL) - waiting for connections 3178909 3163088 evolution 41772 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3178911 3162913 evolution 40436 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2275833 1 root 36916 0.0 Ss 04:24:09 lfd - sleeping 508720 1 mailnull 25564 0.0 Ss 2-04:26:46 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 23808 0.1 Ss 61-20:36:34 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23532 0.0 Ss 2-04:26:35 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3145861 506832 nobody 22768 0.1 S 09:10 /usr/sbin/httpd -k start 483898 1 zabbix 22056 0.2 Ssl 2-04:27:56 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1463 1 root 21956 0.0 Ss 61-20:36:34 tailwatchd 3178882 508720 mailnull 20740 0.0 S 00:05 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3163088 506832 nobody 20548 0.2 S 02:03 /usr/sbin/httpd -k start 3177644 506832 nobody 20184 0.4 S 01:00 /usr/sbin/httpd -k start 3162913 506832 nobody 19416 0.3 S 02:28 /usr/sbin/httpd -k start 3178721 506832 nobody 19412 0.0 S 00:14 /usr/sbin/httpd -k start 3165070 506832 nobody 19204 0.5 S 01:20 /usr/sbin/httpd -k start 3178686 506832 nobody 18988 0.0 S 00:16 /usr/sbin/httpd -k start 3178674 506832 nobody 18960 0.0 S 00:17 /usr/sbin/httpd -k start 3178687 506832 nobody 18920 0.0 S 00:16 /usr/sbin/httpd -k start 3178703 506832 nobody 18856 0.0 S 00:15 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18728 0.0 Ss 2-02:34:16 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 3178722 506832 nobody 17484 0.0 S 00:14 /usr/sbin/httpd -k start 3178723 506832 nobody 17484 0.0 S 00:14 /usr/sbin/httpd -k start 3062027 1471 root 16832 0.0 S 32:06 cPhulkd - dbprocessor 3178724 506832 nobody 16448 0.0 S 00:14 /usr/sbin/httpd -k start 3178704 506832 nobody 16300 1.2 S 00:15 /usr/sbin/httpd -k start 509671 508992 netdata 15916 2.1 Sl 2-04:26:37 /usr/libexec/netdata/plugins.d/apps.plugin 1 508634 1 named 15900 0.0 Ssl 2-04:26:47 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 3162722 508511 lowrange 15816 0.0 S 02:56 dovecot/pop3 1471 1 root 15624 0.0 Ss 61-20:36:34 cPhulkd - processor 3163220 1471 root 15152 0.0 S 01:48 cPhulkd - processor - http socket 1482727 508511 lowrange 15092 0.0 S 08:13:49 dovecot/imap 1876631 508511 infinium 14972 0.0 S 06:19:52 dovecot/imap 1742095 508511 lowrange 14756 0.0 S 06:59:31 dovecot/imap 3178910 508511 kurri 14564 0.0 S 00:00 dovecot/imap 4180059 4180015 evolution 13560 0.0 Ss 2-06:46:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 3163346 508511 root 13340 0.0 S 01:24 dovecot/auth -w 3883280 508511 kurri 12636 0.0 S 16:44:34 dovecot/imap 3178702 506832 nobody 12372 0.0 S 00:15 /usr/sbin/httpd -k start 938585 1 wp-toolkit 11860 0.0 Ss 2-02:34:16 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 508518 508511 dovenull 11144 0.0 S 2-04:26:47 dovecot/imap-login --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4365329 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 1075 evolution/support.evolutionerp.com.au 120 corpkicks/corporatekicks.com.au-ssl_log 54 madalice/madalice.com.au-ssl_log 26 bigdeals/bigdeals.com.au-ssl_log 19 evolution/portal.evolutionerp.com.au-ssl_log 19 kurri/kurrimotorinn.com.au-ssl_log 5 evolution/evolutionerp.com.au-ssl_log 3 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 1075 40.115.94.245 120 158.23.147.79 73 52.139.37.240 19 203.54.180.238 3 168.63.79.147 2 50.6.169.131 2 160.153.252.100 2 143.95.209.25 2 114.119.146.16 2 103.239.138.71 1 69.57.172.117 1 66.116.251.167 1 45.84.119.226 1 45.229.175.220 1 45.117.154.220 --- top request paths across all vhosts (last 3 min) --- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 19 GET /heartbeat.php 9 GET /api/getItem/NA 5 GET /store/custom-afl-carlton-kids/ 4 GET /api/getItem/PWFBW3151KG 3 GET /wp-mail.php 3 GET /simple.php 3 GET /atomlib.php 2 GET /wp-content/uploads/index.php 2 GET /wp-content/index.php 2 GET /wp-content/admin.php 2 GET /wp-admin/classwithtostring.php 2 GET /index/function.php 2 GET /dropdown.php 2 GET /content.php 2 GET /api/getItem/SHSG8989508 --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 9 GET /api/getItem/NA 4 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 -- last 10 requests -- 40.115.94.245 - - [30/Aug/2026:06:46:14 +1000] "GET /api/getItem/RGW90 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:06:46:14 +1000] "GET /api/getItem/RGW100 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:06:46:14 +1000] "GET /api/getItem/RGW120 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:06:46:14 +1000] "GET /api/getItem/RGW160 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:06:46:14 +1000] "GET /api/getItem/RGW117T HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:06:46:14 +1000] "GET /api/getItem/RGW80 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:06:46:14 +1000] "GET /api/getItem/GP150x200x8 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:06:46:14 +1000] "GET /api/getItem/K125MSGB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:06:46:15 +1000] "GET /api/getItem/253-40SP HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:06:46:15 +1000] "GET /api/getItem/300558 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == evolution/support.evolutionerp.com.au == -- top paths -- 2 GET /dropdown.php 1 GET /xmlrpc.php 1 GET /wzy.php 1 GET /ws.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-l0gin.php 1 GET /wp-includes/widgets/index.php 1 GET /wp-includes/Text/index.php 1 GET /wp-includes/Text/Diff/index.php 1 GET /wp-includes/Text/about.php 1 GET /wp-includes/sitemaps/providers/index.php -- last 10 requests -- 158.23.147.79 - - [30/Aug/2026:06:45:57 +1000] "GET /wp-admin/setup-config.php HTTP/1.1" 404 - "-" "-" 158.23.147.79 - - [30/Aug/2026:06:45:57 +1000] "GET /wp-content/themes/themes/Cyb3r.php HTTP/1.1" 404 - "-" "-" 158.23.147.79 - - [30/Aug/2026:06:45:57 +1000] "GET /wp-content/plugins/plugins/Cyb3r.php HTTP/1.1" 404 - "-" "-" 158.23.147.79 - - [30/Aug/2026:06:45:58 +1000] "GET /wp-includes/SimplePie/about.php HTTP/1.1" 404 - "-" "-" 158.23.147.79 - - [30/Aug/2026:06:45:58 +1000] "GET /wp-includes/SimplePie/Content/index.php HTTP/1.1" 404 - "-" "-" 158.23.147.79 - - [30/Aug/2026:06:45:58 +1000] "GET /packed.php HTTP/1.1" 404 - "-" "-" 158.23.147.79 - - [30/Aug/2026:06:45:58 +1000] "GET /wp-content/packed.php HTTP/1.1" 404 - "-" "-" 158.23.147.79 - - [30/Aug/2026:06:45:58 +1000] "GET /wp-l0gin.php HTTP/1.1" 404 - "-" "-" 158.23.147.79 - - [30/Aug/2026:06:45:58 +1000] "GET /wp-content/plugins/google-seo-rank/module.php HTTP/1.1" 404 - "-" "-" 158.23.147.79 - - [30/Aug/2026:06:45:59 +1000] "GET /ioxi002.PhP7 HTTP/1.1" 404 - "-" "-" == corpkicks/corporatekicks.com.au-ssl_log == -- top paths -- 1 GET /zup.php73 1 GET /x.php 1 GET /ww5.php 1 GET /ws83.php 1 GET /wp-mail.php 1 GET /wp-good.php 1 GET /wpc.php 1 GET /wp-content/uploads/index.php 1 GET /wp-content/uploads/ 1 GET /wp-content/themes/admin.php 1 GET /wp-content/index.php 1 GET /wp-content/admin.php -- last 10 requests -- 52.139.37.240 - - [30/Aug/2026:06:44:36 +1000] "GET /ncx.php HTTP/1.1" 403 2074 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:06:44:37 +1000] "GET /wp-admin/js/index.php HTTP/1.1" 403 2079 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:06:44:38 +1000] "GET /zup.php73 HTTP/1.1" 403 2079 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:06:44:39 +1000] "GET /wp-blink.php HTTP/1.1" 403 2077 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:06:44:40 +1000] "GET /randkeyword.PhP7 HTTP/1.1" 403 2078 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:06:44:41 +1000] "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1" 403 2079 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:06:44:42 +1000] "GET /wp-content/ HTTP/1.1" 200 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:06:44:42 +1000] "GET /ww5.php HTTP/1.1" 403 2076 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:06:44:43 +1000] "GET /wp-admin/classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:06:44:43 +1000] "GET /atomlib.php HTTP/1.1" 403 2075 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-30 06:44:02 L1=0.85 run=1 blk=0 avail=8443 (61.3%) swpO=0 conn=1 myRSS=2763 php=4 phpRSS=315 ap=18 tcp=31 topuser=madalice 2026-08-30 06:44:03 L1=0.85 run=2 blk=0 avail=8446 (61.3%) swpO=0 conn=1 myRSS=2763 php=5 phpRSS=352 ap=17 tcp=32 topuser=madalice 2026-08-30 06:44:12 L1=0.80 run=2 blk=0 avail=8331 (60.5%) swpO=0 conn=1 myRSS=2763 php=5 phpRSS=478 ap=16 tcp=32 topuser=madalice 2026-08-30 06:44:13 L1=0.80 run=1 blk=0 avail=8466 (61.4%) swpO=0 conn=1 myRSS=2763 php=4 phpRSS=313 ap=15 tcp=33 topuser=madalice 2026-08-30 06:44:22 L1=0.67 run=3 blk=0 avail=8367 (60.7%) swpO=0 conn=1 myRSS=2763 php=5 phpRSS=419 ap=19 tcp=38 topuser=madalice 2026-08-30 06:44:23 L1=0.67 run=2 blk=0 avail=8336 (60.5%) swpO=0 conn=2 myRSS=2763 php=5 phpRSS=450 ap=19 tcp=36 topuser=madalice 2026-08-30 06:44:32 L1=0.72 run=2 blk=0 avail=8336 (60.5%) swpO=0 conn=1 myRSS=2763 php=5 phpRSS=458 ap=17 tcp=32 topuser=madalice 2026-08-30 06:44:33 L1=0.72 run=3 blk=0 avail=8229 (59.7%) swpO=0 conn=2 myRSS=2763 php=5 phpRSS=581 ap=16 tcp=26 topuser=madalice 2026-08-30 06:44:42 L1=0.77 run=1 blk=0 avail=8442 (61.3%) swpO=0 conn=1 myRSS=2763 php=4 phpRSS=347 ap=16 tcp=29 topuser=madalice 2026-08-30 06:44:43 L1=0.77 run=1 blk=0 avail=8441 (61.3%) swpO=0 conn=2 myRSS=2763 php=4 phpRSS=347 ap=16 tcp=30 topuser=madalice 2026-08-30 06:44:52 L1=0.80 run=1 blk=0 avail=8449 (61.3%) swpO=0 conn=1 myRSS=2763 php=4 phpRSS=347 ap=16 tcp=26 topuser=madalice 2026-08-30 06:44:53 L1=0.80 run=2 blk=0 avail=8456 (61.4%) swpO=0 conn=2 myRSS=2763 php=4 phpRSS=347 ap=15 tcp=26 topuser=madalice 2026-08-30 06:45:02 L1=0.67 run=2 blk=0 avail=8367 (60.7%) swpO=0 conn=3 myRSS=2763 php=6 phpRSS=439 ap=14 tcp=29 topuser=madalice 2026-08-30 06:45:03 L1=0.67 run=8 blk=0 avail=8262 (60.0%) swpO=0 conn=2 myRSS=2763 php=7 phpRSS=606 ap=14 tcp=32 topuser=madalice 2026-08-30 06:45:12 L1=1.19 run=3 blk=0 avail=8275 (60.1%) swpO=0 conn=3 myRSS=2763 php=7 phpRSS=578 ap=17 tcp=27 topuser=madalice 2026-08-30 06:45:13 L1=1.19 run=2 blk=0 avail=8390 (60.9%) swpO=0 conn=2 myRSS=2763 php=6 phpRSS=452 ap=16 tcp=28 topuser=madalice 2026-08-30 06:45:22 L1=1.64 run=3 blk=0 avail=8385 (60.9%) swpO=0 conn=3 myRSS=2763 php=5 phpRSS=415 ap=15 tcp=29 topuser=madalice 2026-08-30 06:45:23 L1=1.64 run=5 blk=0 avail=8377 (60.8%) swpO=0 conn=4 myRSS=2763 php=7 phpRSS=494 ap=15 tcp=31 topuser=madalice 2026-08-30 06:45:32 L1=1.53 run=1 blk=0 avail=8426 (61.2%) swpO=0 conn=3 myRSS=2763 php=5 phpRSS=367 ap=17 tcp=27 topuser=madalice 2026-08-30 06:45:33 L1=1.53 run=1 blk=0 avail=8416 (61.1%) swpO=0 conn=4 myRSS=2763 php=5 phpRSS=387 ap=16 tcp=28 topuser=madalice 2026-08-30 06:45:42 L1=1.30 run=3 blk=0 avail=8413 (61.1%) swpO=0 conn=3 myRSS=2763 php=5 phpRSS=385 ap=16 tcp=29 topuser=madalice 2026-08-30 06:45:43 L1=1.30 run=4 blk=0 avail=8385 (60.9%) swpO=0 conn=4 myRSS=2763 php=8 phpRSS=511 ap=16 tcp=31 topuser=madalice 2026-08-30 06:45:52 L1=1.32 run=2 blk=0 avail=8568 (62.2%) swpO=0 conn=3 myRSS=2763 php=4 phpRSS=229 ap=16 tcp=28 topuser=madalice 2026-08-30 06:45:53 L1=1.32 run=4 blk=0 avail=8559 (62.1%) swpO=0 conn=4 myRSS=2763 php=6 phpRSS=305 ap=16 tcp=30 topuser=madalice 2026-08-30 06:46:02 L1=1.35 run=2 blk=0 avail=8574 (62.2%) swpO=0 conn=1 myRSS=2763 php=4 phpRSS=214 ap=15 tcp=27 topuser=madalice 2026-08-30 06:46:03 L1=1.35 run=2 blk=0 avail=8555 (62.1%) swpO=0 conn=4 myRSS=2763 php=6 phpRSS=309 ap=15 tcp=29 topuser=madalice 2026-08-30 06:46:12 L1=1.38 run=2 blk=0 avail=7437 (54.0%) swpO=0 conn=1 myRSS=2763 php=12 phpRSS=1404 ap=30 tcp=37 topuser=madalice 2026-08-30 06:46:13 L1=1.38 run=1 blk=0 avail=7432 (53.9%) swpO=0 conn=4 myRSS=2763 php=14 phpRSS=1483 ap=29 tcp=32 topuser=madalice 2026-08-30 06:46:22 L1=1.54 run=1 blk=0 avail=7499 (54.4%) swpO=0 conn=1 myRSS=2763 php=12 phpRSS=1426 ap=20 tcp=25 topuser=madalice 2026-08-30 06:46:23 L1=1.54 run=1 blk=0 avail=7485 (54.3%) swpO=0 conn=3 myRSS=2763 php=14 phpRSS=1507 ap=19 tcp=27 topuser=madalice