INCIDENT 2026-08-30 10:32:21 trigger: php_rss=1948MB ================================================================== load: 2.44 1.69 1.27 11/673 3942377 ncpu:10 mem_avail: 6647MB/13777MB (48.3%) swap_used:1818MB swapout:0/s blocked(D):0 running:9 iowait:0.0% steal:0.0% php: 13 procs / 1948MB heaviest user: madalice (10 procs, 1759MB) apache: 39 procs tcp_estab: 59 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2927 madalice 10 1788 root 251 1167 nobody 38 689 netdata 7 198 evolution 6 184 mailman 20 121 cpanellogin 1 82 dovenull 6 46 mailnull 2 44 wp-toolkit 3 31 alison 2 29 kurri 2 26 zabbix 1 21 dovecot 3 19 vinesit 1 15 named 1 15 lowrange 1 13 polkitd 1 5 sshd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1794 evolution 2 176 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5171 MB Active(file): 4661 MB Inactive(file): 950 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 607 MB CommitLimit: 10984 MB Committed_AS: 8908 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-08:13:41 7704 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2998080 7.5 Ssl 2-08:13:10 /usr/sbin/mariadbd 3942289 510022 madalice 233724 95.5 R 00:04 php-fpm: pool madalice_com_au 3942326 510022 madalice 202544 100 R 00:02 php-fpm: pool madalice_com_au 2328310 2277352 root 189124 0.0 S 07:54:10 spamd child 508924 1 netdata 179104 1.9 Ssl 2-08:12:39 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3940736 510022 madalice 177760 27.1 R 01:41 php-fpm: pool madalice_com_au 3942336 3941851 evolution 175960 83.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2277352 1 root 175580 0.0 Ss 08:09:16 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328311 2277352 root 167656 0.0 S 07:54:10 spamd child 3942299 510022 madalice 164956 74.5 R 00:04 php-fpm: pool madalice_com_au 3942298 510022 madalice 163736 75.5 R 00:04 php-fpm: pool madalice_com_au 3941841 510022 madalice 160600 46.5 S 00:53 php-fpm: pool madalice_com_au 3942290 510022 madalice 159812 92.0 S 00:04 php-fpm: pool madalice_com_au 3942291 510022 madalice 159596 84.5 S 00:04 php-fpm: pool madalice_com_au 3942292 510022 madalice 159580 85.5 S 00:04 php-fpm: pool madalice_com_au 509266 1 root 145576 0.0 Ss 2-08:12:36 /usr/lib/systemd/systemd-journald 3942332 510022 madalice 125496 113 S 00:01 php-fpm: pool madalice_com_au 3397810 1353308 cpanellogin 84480 0.0 S 02:38:28 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 509236 509098 root 53988 0.0 Sl 2-08:12:36 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 47580 0.0 Sl 2-08:12:34 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42220 0.1 Ss 39-07:51:02 cpsrvd (SSL) - waiting for connections 2275833 1 root 35916 0.0 Ss 08:10:06 lfd - sleeping 3942347 1469 root 30228 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3942386 1469 root 30220 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 508720 1 mailnull 25296 0.0 Ss 2-08:12:43 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 24040 0.1 Ss 62-00:22:31 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3925237 506832 nobody 23564 0.0 S 04:01 /usr/sbin/httpd -k start 510022 1 root 23336 0.0 Ss 2-08:12:32 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3909187 506832 nobody 23132 0.0 S 07:29 /usr/sbin/httpd -k start 3925177 506832 nobody 22800 0.1 S 04:11 /usr/sbin/httpd -k start 3925275 506832 nobody 22740 0.3 S 03:54 /usr/sbin/httpd -k start 3925209 506832 nobody 22696 0.0 S 04:05 /usr/sbin/httpd -k start 483898 1 zabbix 22388 0.2 Ssl 2-08:13:53 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3925532 506832 nobody 22184 0.2 S 03:33 /usr/sbin/httpd -k start 1463 1 root 21968 0.0 Ss 62-00:22:31 tailwatchd 3940283 506832 nobody 21776 0.1 S 02:00 /usr/sbin/httpd -k start 3941854 506832 nobody 21776 0.1 S 00:50 /usr/sbin/httpd -k start 3925273 506832 nobody 21668 0.1 S 03:55 /usr/sbin/httpd -k start 3925466 506832 nobody 21580 0.5 S 03:43 /usr/sbin/httpd -k start 3941851 506832 nobody 20952 0.3 S 00:50 /usr/sbin/httpd -k start 3925531 506832 nobody 20740 0.1 S 03:33 /usr/sbin/httpd -k start 3940533 508720 mailnull 20732 0.0 S 01:49 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3941853 506832 nobody 20728 0.1 S 00:50 /usr/sbin/httpd -k start 3940898 506832 nobody 20396 0.2 S 01:36 /usr/sbin/httpd -k start 3940899 506832 nobody 20276 0.2 S 01:36 /usr/sbin/httpd -k start 3925583 506832 nobody 20156 0.0 S 03:28 /usr/sbin/httpd -k start 3942286 506832 nobody 20084 0.5 S 00:04 /usr/sbin/httpd -k start 3925893 506832 nobody 19428 0.0 S 02:41 /usr/sbin/httpd -k start 3942303 506832 nobody 19104 0.3 S 00:03 /usr/sbin/httpd -k start 3942261 506832 nobody 19084 0.1 S 00:06 /usr/sbin/httpd -k start 3942305 506832 nobody 19020 0.3 S 00:03 /usr/sbin/httpd -k start 3942308 506832 nobody 18976 0.3 S 00:03 /usr/sbin/httpd -k start 3941843 506832 nobody 18956 0.0 S 00:52 /usr/sbin/httpd -k start 3942302 506832 nobody 18952 0.3 S 00:03 /usr/sbin/httpd -k start 3942304 506832 nobody 18952 0.3 S 00:03 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18068 0.0 Ss 2-06:20:13 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1471 1 root 16996 0.0 Ss 62-00:22:31 cPhulkd - processor 3446928 1471 root 16776 0.0 S 02:26:31 cPhulkd - dbprocessor 3942342 506832 nobody 16548 0.0 S 00:00 /usr/sbin/httpd -k start 3942271 506832 nobody 16488 0.0 S 00:05 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4464770 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 4464759 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Creating sort index | SELECT post_id, meta_key, meta_value FROM QpCIPREUS_postmeta WHERE post_id IN (1002,820) ORDER BY meta_id ASC | +---------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 1072 evolution/evolutionerp.com.au-ssl_log 295 olympic/seb-mobile-auth.olympicfencing.com.au-ssl_log 135 olympic/seb-mobile-auth.olympicfencing.com.au 132 madalice/madalice.com.au-ssl_log 93 evolution/evolutionerp.com.au 38 alison/alisonarts.com.au-ssl_log 28 evolution/portal.evolutionerp.com.au-ssl_log 16 infinium/infinium.net.au-ssl_log 12 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 1072 40.115.94.245 267 20.48.179.39 126 52.139.37.240 122 68.155.159.216 106 20.63.81.20 69 158.23.184.117 16 203.54.180.238 9 34.74.120.94 6 203.153.19.214 5 118.127.40.55 3 114.119.137.101 3 114.119.131.88 2 50.6.169.131 2 170.64.135.172 2 114.119.131.42 --- top request paths across all vhosts (last 3 min) --- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 16 GET /heartbeat.php 9 GET /api/getItem/NA 9 GET /admin.php 8 GET /wp-login.php 7 GET /1.php 6 GET /simple.php 6 GET /goods.php 6 GET /file.php 6 GET /aaa.php 6 GET / 5 POST /wp-cron.php 5 GET /wp-content/themes/index.php 5 GET /wp-content/admin.php 5 GET /about.php 4 POST / --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 9 GET /api/getItem/NA 4 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 -- last 10 requests -- 40.115.94.245 - - [30/Aug/2026:10:31:13 +1000] "GET /api/getItem/RGW90 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:10:31:13 +1000] "GET /api/getItem/RGW100 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:10:31:13 +1000] "GET /api/getItem/RGW120 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:10:31:13 +1000] "GET /api/getItem/RGW160 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:10:31:13 +1000] "GET /api/getItem/RGW117T HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:10:31:13 +1000] "GET /api/getItem/RGW80 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:10:31:13 +1000] "GET /api/getItem/GP150x200x8 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:10:31:13 +1000] "GET /api/getItem/K125MSGB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:10:31:14 +1000] "GET /api/getItem/253-40SP HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:10:31:14 +1000] "GET /api/getItem/300558 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 3 GET /simple.php 3 GET /goods.php 3 GET /dropdown.php 3 GET /1.php 2 POST /wp-cron.php 2 GET /x.php 2 GET /xmlrpc.php 2 GET /wp-ws68.php 2 GET /wp-login.php 2 GET /wp-includes/js/jcrop/Jcrop.php 2 GET /wp-includes/IXR/index.php 2 GET /wp-includes/ID3/index.php -- last 10 requests -- 20.63.81.20 - - [30/Aug/2026:10:32:11 +1000] "GET /dvve.php HTTP/1.1" 404 205240 "-" "-" 52.139.37.240 - - [30/Aug/2026:10:32:12 +1000] "GET /wp-admin/maint/admin.php HTTP/1.1" 404 29665 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.81.20 - - [30/Aug/2026:10:32:13 +1000] "GET /doo.php HTTP/1.1" 404 205239 "-" "-" 52.139.37.240 - - [30/Aug/2026:10:32:14 +1000] "GET /ini.php HTTP/1.1" 404 30381 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:10:32:15 +1000] "GET /ok.php HTTP/1.1" 404 30380 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.81.20 - - [30/Aug/2026:10:32:15 +1000] "GET /adminer-4.6.6.php HTTP/1.1" 404 205249 "-" "-" 52.139.37.240 - - [30/Aug/2026:10:32:16 +1000] "GET /wp-admin/includes/about.php HTTP/1.1" 404 29663 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.81.20 - - [30/Aug/2026:10:32:17 +1000] "GET /gelap1.php HTTP/1.1" 404 205242 "-" "-" 52.139.37.240 - - [30/Aug/2026:10:32:18 +1000] "GET /wp-admin/maint.php HTTP/1.1" 404 30385 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.63.81.20 - - [30/Aug/2026:10:32:19 +1000] "GET /rsjlrria.php HTTP/1.1" 404 205244 "-" "-" == olympic/seb-mobile-auth.olympicfencing.com.au-ssl_log == -- top paths -- 3 GET /admin.php 2 GET /wp-content/themes/index.php 2 GET /av.php 1 GET /zoo1.php 1 GET /yj09.php 1 GET /xnm-apc.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp-temp.php 1 GET /wp.php 1 GET /wp-manager.php 1 GET /wp-mails.php -- last 10 requests -- 20.48.179.39 - - [30/Aug/2026:10:31:34 +1000] "GET /cgi-bin/admin.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [30/Aug/2026:10:31:34 +1000] "GET /wp-content/ HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [30/Aug/2026:10:31:34 +1000] "GET /wp-admin/css/colors/blue/ HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [30/Aug/2026:10:31:35 +1000] "GET /wp-includes/block-bindings/ HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [30/Aug/2026:10:31:35 +1000] "GET /wp-includes/assets/ HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [30/Aug/2026:10:31:36 +1000] "GET /wp-admin/css/colors/sunrise/ HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [30/Aug/2026:10:31:36 +1000] "GET /wp-admin/network/plugins.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [30/Aug/2026:10:31:36 +1000] "GET /wp-admin/maint/index.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [30/Aug/2026:10:31:37 +1000] "GET /wp-includes/blocks/post-comments-form/ HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [30/Aug/2026:10:31:37 +1000] "GET /qazwsx.php HTTP/1.1" 404 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-30 10:29:52 L1=0.95 run=1 blk=0 avail=8365 (60.7%) swpO=0 conn=1 myRSS=2927 php=3 phpRSS=190 ap=18 tcp=23 topuser=madalice 2026-08-30 10:30:00 L1=0.88 run=2 blk=0 avail=8370 (60.8%) swpO=0 conn=7 myRSS=2927 php=4 phpRSS=231 ap=17 tcp=24 topuser=madalice 2026-08-30 10:30:02 L1=1.37 run=9 blk=0 avail=8038 (58.3%) swpO=0 conn=1 myRSS=2927 php=8 phpRSS=637 ap=17 tcp=27 topuser=evolution 2026-08-30 10:30:10 L1=1.74 run=6 blk=0 avail=8121 (58.9%) swpO=0 conn=4 myRSS=2927 php=7 phpRSS=530 ap=18 tcp=27 topuser=evolution 2026-08-30 10:30:12 L1=1.84 run=5 blk=0 avail=8060 (58.5%) swpO=0 conn=1 myRSS=2927 php=6 phpRSS=579 ap=18 tcp=28 topuser=evolution 2026-08-30 10:30:20 L1=1.85 run=4 blk=0 avail=8035 (58.3%) swpO=0 conn=4 myRSS=2927 php=6 phpRSS=555 ap=18 tcp=28 topuser=evolution 2026-08-30 10:30:22 L1=1.79 run=2 blk=0 avail=8335 (60.5%) swpO=0 conn=1 myRSS=2927 php=5 phpRSS=223 ap=19 tcp=31 topuser=madalice 2026-08-30 10:30:30 L1=1.72 run=4 blk=0 avail=8088 (58.7%) swpO=0 conn=4 myRSS=2927 php=6 phpRSS=526 ap=22 tcp=27 topuser=evolution 2026-08-30 10:30:32 L1=1.82 run=4 blk=0 avail=8033 (58.3%) swpO=0 conn=3 myRSS=2927 php=7 phpRSS=615 ap=21 tcp=31 topuser=infinium 2026-08-30 10:30:40 L1=2.00 run=7 blk=0 avail=8043 (58.4%) swpO=1 conn=4 myRSS=2927 php=7 phpRSS=580 ap=22 tcp=35 topuser=madalice 2026-08-30 10:30:42 L1=2.16 run=5 blk=0 avail=7782 (56.5%) swpO=1 conn=3 myRSS=2927 php=7 phpRSS=830 ap=22 tcp=35 topuser=madalice 2026-08-30 10:30:50 L1=2.31 run=3 blk=0 avail=7884 (57.2%) swpO=0 conn=4 myRSS=2927 php=7 phpRSS=698 ap=25 tcp=32 topuser=madalice 2026-08-30 10:30:52 L1=2.20 run=5 blk=0 avail=7664 (55.6%) swpO=0 conn=3 myRSS=2927 php=10 phpRSS=1036 ap=24 tcp=35 topuser=madalice 2026-08-30 10:31:00 L1=2.27 run=3 blk=0 avail=7677 (55.7%) swpO=0 conn=4 myRSS=2927 php=8 phpRSS=857 ap=23 tcp=34 topuser=madalice 2026-08-30 10:31:02 L1=2.16 run=3 blk=0 avail=7816 (56.7%) swpO=0 conn=3 myRSS=2927 php=9 phpRSS=846 ap=23 tcp=33 topuser=madalice 2026-08-30 10:31:10 L1=2.15 run=3 blk=0 avail=7855 (57.0%) swpO=0 conn=3 myRSS=2927 php=6 phpRSS=674 ap=23 tcp=33 topuser=corpkicks 2026-08-30 10:31:12 L1=2.22 run=3 blk=0 avail=8166 (59.3%) swpO=0 conn=3 myRSS=2927 php=4 phpRSS=364 ap=23 tcp=31 topuser=evolution 2026-08-30 10:31:20 L1=2.12 run=2 blk=0 avail=8213 (59.6%) swpO=0 conn=3 myRSS=2927 php=4 phpRSS=332 ap=22 tcp=27 topuser=madalice 2026-08-30 10:31:22 L1=2.11 run=1 blk=0 avail=8328 (60.4%) swpO=0 conn=3 myRSS=2927 php=3 phpRSS=190 ap=22 tcp=26 topuser=madalice 2026-08-30 10:31:30 L1=2.02 run=3 blk=0 avail=7856 (57.0%) swpO=0 conn=3 myRSS=2927 php=7 phpRSS=735 ap=27 tcp=37 topuser=evolution 2026-08-30 10:31:32 L1=2.02 run=2 blk=0 avail=8145 (59.1%) swpO=0 conn=3 myRSS=2927 php=5 phpRSS=387 ap=27 tcp=36 topuser=madalice 2026-08-30 10:31:40 L1=2.02 run=3 blk=0 avail=7939 (57.6%) swpO=0 conn=3 myRSS=2927 php=6 phpRSS=632 ap=24 tcp=33 topuser=madalice 2026-08-30 10:31:42 L1=2.10 run=3 blk=0 avail=8128 (59.0%) swpO=0 conn=3 myRSS=2927 php=5 phpRSS=410 ap=24 tcp=34 topuser=madalice 2026-08-30 10:31:51 L1=2.09 run=4 blk=0 avail=8011 (58.2%) swpO=1 conn=3 myRSS=2927 php=6 phpRSS=562 ap=23 tcp=33 topuser=madalice 2026-08-30 10:31:52 L1=2.00 run=4 blk=0 avail=8085 (58.7%) swpO=1 conn=3 myRSS=2927 php=6 phpRSS=509 ap=23 tcp=31 topuser=madalice 2026-08-30 10:32:01 L1=2.08 run=4 blk=0 avail=8056 (58.5%) swpO=0 conn=3 myRSS=2927 php=6 phpRSS=536 ap=21 tcp=36 topuser=madalice 2026-08-30 10:32:02 L1=2.08 run=5 blk=0 avail=8014 (58.2%) swpO=0 conn=3 myRSS=2927 php=5 phpRSS=544 ap=21 tcp=32 topuser=madalice 2026-08-30 10:32:11 L1=2.15 run=5 blk=0 avail=8144 (59.1%) swpO=0 conn=3 myRSS=2927 php=5 phpRSS=406 ap=21 tcp=35 topuser=madalice 2026-08-30 10:32:12 L1=2.22 run=5 blk=0 avail=8127 (59.0%) swpO=0 conn=3 myRSS=2927 php=5 phpRSS=425 ap=21 tcp=33 topuser=madalice 2026-08-30 10:32:21 L1=2.44 run=9 blk=0 avail=6647 (48.3%) swpO=0 conn=10 myRSS=2927 php=13 phpRSS=1948 ap=39 tcp=59 topuser=madalice