INCIDENT 2026-08-30 09:41:35 trigger: php_rss=1977MB ================================================================== load: 1.89 1.54 1.30 18/729 3772295 ncpu:10 mem_avail: 6402MB/13777MB (46.5%) swap_used:1849MB swapout:0/s blocked(D):0 running:14 iowait:0.0% steal:0.0% php: 14 procs / 1977MB heaviest user: madalice (10 procs, 1859MB) apache: 95 procs tcp_estab: 126 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2876 madalice 10 1886 nobody 94 1574 root 247 1111 netdata 7 202 infinium 2 133 mailman 20 121 cpanellogin 1 79 mailnull 3 63 kurri 4 55 dovenull 6 46 wp-toolkit 3 31 alison 2 28 evolution 5 22 zabbix 1 21 dovecot 3 19 named 1 15 candyfabcom 1 14 polkitd 1 5 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1905 infinium 2 138 root 1 22 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5081 MB Active(file): 4596 MB Inactive(file): 914 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 607 MB CommitLimit: 10984 MB Committed_AS: 9981 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-07:22:56 7720 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2945788 7.5 Ssl 2-07:22:25 /usr/sbin/mariadbd 3772219 510022 madalice 254420 92.0 R 00:06 php-fpm: pool madalice_com_au 3772176 510022 madalice 254340 88.8 R 00:07 php-fpm: pool madalice_com_au 3772222 510022 madalice 217004 87.3 R 00:06 php-fpm: pool madalice_com_au 2328310 2277352 root 188484 0.0 S 07:03:25 spamd child 3771801 510022 madalice 186728 24.6 R 00:35 php-fpm: pool madalice_com_au 508924 1 netdata 182488 1.9 Ssl 2-07:21:54 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3772217 510022 madalice 181436 84.0 R 00:06 php-fpm: pool madalice_com_au 2277352 1 root 175580 0.0 Ss 07:18:31 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3772216 510022 madalice 172768 85.1 R 00:06 php-fpm: pool madalice_com_au 2328311 2277352 root 167656 0.0 S 07:03:25 spamd child 3772179 510022 madalice 166680 80.8 R 00:07 php-fpm: pool madalice_com_au 3772218 510022 madalice 161324 77.6 R 00:06 php-fpm: pool madalice_com_au 3772215 510022 madalice 160888 86.8 S 00:06 php-fpm: pool madalice_com_au 3772214 510022 madalice 159252 85.0 R 00:06 php-fpm: pool madalice_com_au 509266 1 root 143728 0.0 Ss 2-07:21:51 /usr/lib/systemd/systemd-journald 3772263 3772145 infinium 113028 45.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3397810 1353308 cpanellogin 81712 0.0 S 01:47:43 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 3772274 3772191 infinium 68956 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 509236 509098 root 52924 0.0 Sl 2-07:21:51 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 47052 0.0 Sl 2-07:21:49 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42212 0.1 Rs 39-07:00:17 cpsrvd (SSL) - waiting for connections 2275833 1 root 35900 0.0 Ss 07:19:21 lfd - sleeping 3755943 506832 nobody 25532 0.0 S 03:13 /usr/sbin/httpd -k start 508720 1 mailnull 25296 0.0 Ss 2-07:21:58 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 24024 0.1 Ss 61-23:31:46 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3739887 506832 nobody 23392 0.0 S 07:37 /usr/sbin/httpd -k start 510022 1 root 23344 0.0 Ss 2-07:21:47 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3754991 506832 nobody 23112 0.0 S 05:08 /usr/sbin/httpd -k start 483898 1 zabbix 22456 0.2 Ssl 2-07:23:08 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1463 1 root 21956 0.0 Ss 61-23:31:46 tailwatchd 3755945 506832 nobody 21616 0.0 S 03:13 /usr/sbin/httpd -k start 3756138 506832 nobody 21496 0.0 S 02:44 /usr/sbin/httpd -k start 3756253 506832 nobody 21328 0.0 S 02:43 /usr/sbin/httpd -k start 3771946 506832 nobody 21052 0.2 S 00:22 /usr/sbin/httpd -k start 3756765 506832 nobody 20820 0.0 S 02:41 /usr/sbin/httpd -k start 3772246 508720 mailnull 20740 0.0 S 00:02 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3757356 506832 nobody 20344 0.0 S 01:45 /usr/sbin/httpd -k start 3771955 506832 nobody 20220 0.1 S 00:21 /usr/sbin/httpd -k start 3772144 506832 nobody 20036 0.2 S 00:07 /usr/sbin/httpd -k start 3772138 506832 nobody 20000 0.2 S 00:07 /usr/sbin/httpd -k start 3772125 506832 nobody 19788 0.0 S 00:08 /usr/sbin/httpd -k start 3772141 506832 nobody 19776 0.1 S 00:07 /usr/sbin/httpd -k start 3757365 506832 nobody 19720 0.0 S 01:44 /usr/sbin/httpd -k start 3772111 506832 nobody 19676 0.0 S 00:09 /usr/sbin/httpd -k start 3772109 506832 nobody 19492 0.1 R 00:09 /usr/sbin/httpd -k start 3772070 506832 nobody 19232 0.1 S 00:11 /usr/sbin/httpd -k start 3772110 506832 nobody 19168 0.1 S 00:09 /usr/sbin/httpd -k start 3772213 506832 nobody 19112 0.1 S 00:06 /usr/sbin/httpd -k start 3772184 506832 nobody 19088 0.1 S 00:06 /usr/sbin/httpd -k start 3772102 506832 nobody 19076 0.2 S 00:10 /usr/sbin/httpd -k start 3772211 506832 nobody 19028 0.3 S 00:06 /usr/sbin/httpd -k start 3772182 506832 nobody 19024 0.3 S 00:06 /usr/sbin/httpd -k start 3772205 506832 nobody 19024 0.1 S 00:06 /usr/sbin/httpd -k start 3772212 506832 nobody 19024 0.1 S 00:06 /usr/sbin/httpd -k start 3772210 506832 nobody 19020 0.1 S 00:06 /usr/sbin/httpd -k start 3772229 506832 nobody 19020 0.2 S 00:04 /usr/sbin/httpd -k start 3772203 506832 nobody 18960 0.1 S 00:06 /usr/sbin/httpd -k start 3772126 506832 nobody 18956 0.2 S 00:08 /usr/sbin/httpd -k start 3772235 506832 nobody 18956 0.3 R 00:03 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4442955 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min candyfabcom/candyfab.com.au-ssl_log 179 evolution/portal.evolutionerp.com.au-ssl_log 26 madalice/madalice.com.au-ssl_log 14 infinium/infinium.net.au-ssl_log 10 evolution/my.evolutionerp.com.au-ssl_log 4 alison/alisonarts.com.au-ssl_log 2 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 109 20.48.250.41 70 52.139.44.162 26 203.54.180.238 3 118.127.40.55 3 114.119.146.16 2 97.74.87.194 2 207.46.13.9 2 114.119.143.226 2 101.182.108.127 1 94.154.43.84 1 94.154.43.180 1 94.154.43.158 1 94.154.43.146 1 94.154.43.129 1 94.154.43.125 --- top request paths across all vhosts (last 3 min) --- 26 GET /heartbeat.php 7 GET /store/toys-kids-custom-shoes/ 7 GET /.env 3 POST /wp-cron.php 3 GET /admin.php 2 POST /wp-login.php 2 POST /functions.php 2 GET /wp-login.php 2 GET /wp-json/wp/v2/users/me 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /this_is_a_new_hello_world.php 2 GET /index.php 2 GET /h02ugyh.php 2 GET /f35.php 2 GET /aaa.php 2 GET /8.php 2 GET /155.php 1 GET /zxekqlxb.php 1 GET /zu.php 1 GET /zoo.php --- busiest 3 vhosts: top paths + last 10 requests --- == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 3 GET /admin.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /this_is_a_new_hello_world.php 2 GET /h02ugyh.php 2 GET /f35.php 2 GET /aaa.php 2 GET /8.php 2 GET /155.php 1 GET /zxekqlxb.php 1 GET /zu.php 1 GET /zoo.php 1 GET /yj09.php -- last 10 requests -- 52.139.44.162 - - [30/Aug/2026:09:41:20 +1000] "GET /adminner.php HTTP/1.1" 404 5750 "-" "-" 52.139.44.162 - - [30/Aug/2026:09:41:21 +1000] "GET /file1221.php HTTP/1.1" 404 5750 "-" "-" 52.139.44.162 - - [30/Aug/2026:09:41:21 +1000] "GET /inx.php HTTP/1.1" 404 5750 "-" "-" 52.139.44.162 - - [30/Aug/2026:09:41:22 +1000] "GET /reviall.php HTTP/1.1" 404 5750 "-" "-" 52.139.44.162 - - [30/Aug/2026:09:41:22 +1000] "GET /11.php?p= HTTP/1.1" 404 5750 "-" "-" 52.139.44.162 - - [30/Aug/2026:09:41:22 +1000] "GET /File.php HTTP/1.1" 404 5750 "-" "-" 52.139.44.162 - - [30/Aug/2026:09:41:23 +1000] "GET /fi22.php HTTP/1.1" 404 5750 "-" "-" 52.139.44.162 - - [30/Aug/2026:09:41:23 +1000] "GET /3PJcpMFsD8B.php HTTP/1.1" 404 5750 "-" "-" 52.139.44.162 - - [30/Aug/2026:09:41:24 +1000] "GET /a3ampzmbipnkpxeqhqpsanCdefault.php HTTP/1.1" 404 5750 "-" "-" 52.139.44.162 - - [30/Aug/2026:09:41:24 +1000] "GET /4PJcpMFsD8B.php HTTP/1.1" 404 5750 "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 26 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [30/Aug/2026:09:40:23 +1000] "GET /heartbeat.php?sentAt=1788046824&bytes=106,147,109,232&_=1787897055333 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:09:40:23 +1000] "GET /heartbeat.php?sentAt=1788046823&bytes=106,147,109,231&_=1787918093818 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:09:40:33 +1000] "GET /heartbeat.php?sentAt=1788046834&bytes=106,147,109,242&_=1787897055334 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:09:40:33 +1000] "GET /heartbeat.php?sentAt=1788046833&bytes=106,147,109,241&_=1787918093819 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:09:40:43 +1000] "GET /heartbeat.php?sentAt=1788046844&bytes=106,147,109,252&_=1787897055335 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:09:40:43 +1000] "GET /heartbeat.php?sentAt=1788046843&bytes=106,147,109,251&_=1787918093820 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:09:40:53 +1000] "GET /heartbeat.php?sentAt=1788046854&bytes=106,147,110,6&_=1787897055336 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:09:40:53 +1000] "GET /heartbeat.php?sentAt=1788046853&bytes=106,147,110,5&_=1787918093821 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:09:41:03 +1000] "GET /heartbeat.php?sentAt=1788046864&bytes=106,147,110,16&_=1787897055337 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:09:41:03 +1000] "GET /heartbeat.php?sentAt=1788046863&bytes=106,147,110,15&_=1787918093822 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" == madalice/madalice.com.au-ssl_log == -- top paths -- 7 GET /store/toys-kids-custom-shoes/ 7 GET /.env -- last 10 requests -- 94.154.43.84 - - [30/Aug/2026:09:39:13 +1000] "GET /.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 94.154.43.129 - - [30/Aug/2026:09:39:13 +1000] "GET /.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 94.154.43.180 - - [30/Aug/2026:09:39:13 +1000] "GET /.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 94.154.43.122 - - [30/Aug/2026:09:39:15 +1000] "GET /.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 114.119.146.16 - - [30/Aug/2026:09:39:28 +1000] "GET /store/toys-kids-custom-shoes/?image=1&rating=3&verified=1&wcpr_image=1 HTTP/1.1" 200 55127 "https://madalice.com.au/store/toys-kids-custom-shoes/?image=1&rating=3&ver 114.119.146.16 - - [30/Aug/2026:09:39:49 +1000] "GET /store/toys-kids-custom-shoes/?amp%3Brating=5&wcpr_page=2&wcpr_verified=1&wcpr_rating=4 HTTP/1.1" 200 54993 "https://madalice.com.au/store/toys-kids-custom-shoes/?amp% 114.119.146.16 - - [30/Aug/2026:09:40:11 +1000] "GET /store/toys-kids-custom-shoes/?amp%3Brating=3&wcpr_page=2&wcpr_rating=2&wcpr_image=1 HTTP/1.1" 200 54985 "https://madalice.com.au/store/toys-kids-custom-shoes/?amp%3Br 114.119.131.88 - - [30/Aug/2026:09:40:35 +1000] "GET /store/toys-kids-custom-shoes/?amp%3Brating=3&wcpr_image=1&wcpr_page=4&wcpr_verified=1 HTTP/1.1" 200 54918 "https://madalice.com.au/store/toys-kids-custom-shoes/?amp%3 114.119.159.70 - - [30/Aug/2026:09:41:00 +1000] "GET /store/toys-kids-custom-shoes/?amp%3Brating=2&wcpr_rating=4&wcpr_image=1&wcpr_verified=1 HTTP/1.1" 200 54949 "https://madalice.com.au/store/toys-kids-custom-shoes/?amp 114.119.140.234 - - [30/Aug/2026:09:41:17 +1000] "GET /store/toys-kids-custom-shoes/?amp%3Brating=2&wcpr_page=2&wcpr_verified=1&rating=5 HTTP/1.1" 200 55147 "https://madalice.com.au/store/toys-kids-custom-shoes/?amp%3Bra --- last 30 samples (run-up to this incident) --- 2026-08-30 09:39:08 L1=3.72 run=2 blk=0 avail=7060 (51.2%) swpO=0 conn=1 myRSS=2876 php=12 phpRSS=1603 ap=41 tcp=26 topuser=madalice 2026-08-30 09:39:14 L1=3.59 run=1 blk=0 avail=7101 (51.5%) swpO=0 conn=1 myRSS=2876 php=12 phpRSS=1603 ap=34 tcp=28 topuser=madalice 2026-08-30 09:39:18 L1=3.46 run=3 blk=0 avail=7121 (51.7%) swpO=0 conn=1 myRSS=2876 php=12 phpRSS=1603 ap=31 tcp=32 topuser=madalice 2026-08-30 09:39:24 L1=3.18 run=1 blk=0 avail=7441 (54.0%) swpO=0 conn=1 myRSS=2876 php=10 phpRSS=1290 ap=24 tcp=26 topuser=madalice 2026-08-30 09:39:28 L1=2.93 run=2 blk=0 avail=7460 (54.1%) swpO=0 conn=1 myRSS=2876 php=10 phpRSS=1290 ap=21 tcp=25 topuser=madalice 2026-08-30 09:39:34 L1=2.69 run=3 blk=0 avail=7827 (56.8%) swpO=0 conn=1 myRSS=2876 php=7 phpRSS=816 ap=18 tcp=23 topuser=madalice 2026-08-30 09:39:38 L1=2.48 run=1 blk=0 avail=7887 (57.2%) swpO=0 conn=1 myRSS=2876 php=7 phpRSS=816 ap=17 tcp=24 topuser=madalice 2026-08-30 09:39:45 L1=2.28 run=1 blk=0 avail=7896 (57.3%) swpO=0 conn=1 myRSS=2876 php=7 phpRSS=816 ap=16 tcp=25 topuser=madalice 2026-08-30 09:39:48 L1=2.10 run=3 blk=0 avail=7703 (55.9%) swpO=0 conn=1 myRSS=2876 php=9 phpRSS=1070 ap=16 tcp=30 topuser=madalice 2026-08-30 09:39:55 L1=2.01 run=2 blk=0 avail=8145 (59.1%) swpO=0 conn=1 myRSS=2876 php=5 phpRSS=507 ap=19 tcp=32 topuser=madalice 2026-08-30 09:39:58 L1=1.85 run=1 blk=0 avail=8148 (59.1%) swpO=0 conn=1 myRSS=2876 php=5 phpRSS=507 ap=19 tcp=30 topuser=madalice 2026-08-30 09:40:05 L1=2.02 run=2 blk=0 avail=8151 (59.2%) swpO=0 conn=1 myRSS=2876 php=5 phpRSS=507 ap=18 tcp=28 topuser=madalice 2026-08-30 09:40:08 L1=1.86 run=3 blk=0 avail=8149 (59.2%) swpO=0 conn=1 myRSS=2876 php=5 phpRSS=507 ap=18 tcp=25 topuser=madalice 2026-08-30 09:40:15 L1=1.79 run=6 blk=0 avail=8363 (60.7%) swpO=0 conn=1 myRSS=2876 php=4 phpRSS=279 ap=18 tcp=30 topuser=madalice 2026-08-30 09:40:18 L1=1.81 run=1 blk=0 avail=8416 (61.1%) swpO=0 conn=1 myRSS=2876 php=3 phpRSS=193 ap=18 tcp=28 topuser=madalice 2026-08-30 09:40:25 L1=1.74 run=1 blk=0 avail=8418 (61.1%) swpO=0 conn=1 myRSS=2876 php=3 phpRSS=193 ap=18 tcp=27 topuser=madalice 2026-08-30 09:40:28 L1=1.60 run=1 blk=0 avail=8293 (60.2%) swpO=0 conn=1 myRSS=2876 php=4 phpRSS=344 ap=18 tcp=29 topuser=madalice 2026-08-30 09:40:35 L1=1.47 run=2 blk=0 avail=8509 (61.8%) swpO=0 conn=1 myRSS=2876 php=3 phpRSS=128 ap=16 tcp=27 topuser=tubesupplies 2026-08-30 09:40:38 L1=1.43 run=1 blk=0 avail=8460 (61.4%) swpO=0 conn=1 myRSS=2876 php=3 phpRSS=168 ap=16 tcp=26 topuser=madalice 2026-08-30 09:40:45 L1=1.32 run=1 blk=0 avail=8461 (61.4%) swpO=0 conn=1 myRSS=2876 php=3 phpRSS=168 ap=16 tcp=24 topuser=madalice 2026-08-30 09:40:48 L1=1.29 run=2 blk=1 avail=8369 (60.7%) swpO=0 conn=1 myRSS=2876 php=4 phpRSS=204 ap=16 tcp=23 topuser=madalice 2026-08-30 09:40:55 L1=1.19 run=1 blk=0 avail=8470 (61.5%) swpO=0 conn=1 myRSS=2876 php=3 phpRSS=168 ap=15 tcp=23 topuser=madalice 2026-08-30 09:40:58 L1=1.09 run=2 blk=0 avail=8514 (61.8%) swpO=0 conn=1 myRSS=2876 php=3 phpRSS=134 ap=15 tcp=24 topuser=corpkicks 2026-08-30 09:41:05 L1=1.09 run=1 blk=0 avail=8473 (61.5%) swpO=0 conn=1 myRSS=2876 php=3 phpRSS=168 ap=15 tcp=22 topuser=madalice 2026-08-30 09:41:08 L1=1.00 run=2 blk=0 avail=8412 (61.1%) swpO=0 conn=1 myRSS=2876 php=4 phpRSS=259 ap=15 tcp=21 topuser=madalice 2026-08-30 09:41:15 L1=0.92 run=1 blk=0 avail=8447 (61.3%) swpO=0 conn=1 myRSS=2876 php=3 phpRSS=168 ap=18 tcp=29 topuser=madalice 2026-08-30 09:41:18 L1=1.01 run=2 blk=0 avail=8340 (60.5%) swpO=0 conn=2 myRSS=2876 php=3 phpRSS=277 ap=18 tcp=26 topuser=madalice 2026-08-30 09:41:25 L1=1.00 run=1 blk=0 avail=8411 (61.1%) swpO=0 conn=1 myRSS=2876 php=3 phpRSS=190 ap=19 tcp=81 topuser=madalice 2026-08-30 09:41:28 L1=0.92 run=1 blk=0 avail=8207 (59.6%) swpO=0 conn=2 myRSS=2876 php=3 phpRSS=190 ap=49 tcp=123 topuser=madalice 2026-08-30 09:41:35 L1=1.89 run=14 blk=0 avail=6402 (46.5%) swpO=0 conn=12 myRSS=2876 php=14 phpRSS=1977 ap=95 tcp=126 topuser=madalice