INCIDENT 2026-08-30 10:34:22 trigger: php_rss=1535MB ================================================================== load: 1.88 1.85 1.39 8/647 3943867 ncpu:10 mem_avail: 7182MB/13777MB (52.1%) swap_used:1818MB swapout:1/s blocked(D):0 running:7 iowait:0.0% steal:0.0% php: 11 procs / 1535MB heaviest user: madalice (8 procs, 1330MB) apache: 20 procs tcp_estab: 39 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2927 madalice 8 1355 root 246 1100 nobody 19 334 netdata 7 198 evolution 6 194 mailman 20 121 mailnull 4 84 cpanellogin 1 82 dovenull 6 46 wp-toolkit 3 31 kurri 2 26 zabbix 1 22 dovecot 3 19 vinesit 1 15 named 1 15 alison 1 14 aaa 1 13 polkitd 1 5 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 8 1358 evolution 2 186 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5168 MB Active(file): 4658 MB Inactive(file): 950 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 607 MB CommitLimit: 10984 MB Committed_AS: 8085 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-08:15:42 7704 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2998192 7.5 Ssl 2-08:15:11 /usr/sbin/mariadbd 3942326 510022 madalice 252808 13.5 S 02:03 php-fpm: pool madalice_com_au 3943825 510022 madalice 240828 113 R 00:02 php-fpm: pool madalice_com_au 3943827 510022 madalice 218384 113 R 00:02 php-fpm: pool madalice_com_au 2328310 2277352 root 189124 0.0 S 07:56:11 spamd child 3943835 3942303 evolution 181068 87.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 508924 1 netdata 178492 1.9 Ssl 2-08:14:40 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175580 0.0 Ss 08:11:17 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328311 2277352 root 167656 0.0 S 07:56:11 spamd child 509266 1 root 145576 0.0 Ss 2-08:14:37 /usr/lib/systemd/systemd-journald 3943826 510022 madalice 141316 85.5 R 00:02 php-fpm: pool madalice_com_au 3943829 510022 madalice 136452 67.0 S 00:02 php-fpm: pool madalice_com_au 3943832 510022 madalice 135912 64.5 S 00:02 php-fpm: pool madalice_com_au 3943828 510022 madalice 130396 72.0 R 00:02 php-fpm: pool madalice_com_au 3943831 510022 madalice 127564 60.5 R 00:02 php-fpm: pool madalice_com_au 3397810 1353308 cpanellogin 84480 0.0 S 02:40:29 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 509236 509098 root 53988 0.0 Sl 2-08:14:37 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 47580 0.0 Sl 2-08:14:35 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42220 0.1 Ss 39-07:53:03 cpsrvd (SSL) - waiting for connections 2275833 1 root 35916 0.0 Ss 08:12:07 lfd - sleeping 508720 1 mailnull 25296 0.0 Ss 2-08:14:44 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 24040 0.1 Ss 62-00:24:32 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23344 0.0 Ss 2-08:14:33 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3909187 506832 nobody 23344 0.0 S 09:30 /usr/sbin/httpd -k start 483898 1 zabbix 22908 0.2 Ssl 2-08:15:54 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3942606 506832 nobody 22228 0.1 S 02:00 /usr/sbin/httpd -k start 3941851 506832 nobody 22092 0.6 S 02:51 /usr/sbin/httpd -k start 3925893 506832 nobody 21992 0.0 S 04:42 /usr/sbin/httpd -k start 1463 1 root 21968 0.0 Ss 62-00:24:32 tailwatchd 3942607 506832 nobody 21152 0.0 S 02:00 /usr/sbin/httpd -k start 3925531 506832 nobody 21080 0.0 S 05:34 /usr/sbin/httpd -k start 3943816 508720 mailnull 20940 0.0 S 00:06 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3942623 506832 nobody 20880 0.0 S 01:59 /usr/sbin/httpd -k start 3942303 506832 nobody 20804 0.1 S 02:04 /usr/sbin/httpd -k start 3943789 508720 mailnull 20732 0.0 S 00:09 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3942677 506832 nobody 20544 0.0 S 01:57 /usr/sbin/httpd -k start 3942307 506832 nobody 20340 0.0 S 02:04 /usr/sbin/httpd -k start 3942624 506832 nobody 19660 0.0 S 01:59 /usr/sbin/httpd -k start 3943537 506832 nobody 19372 0.0 S 00:43 /usr/sbin/httpd -k start 3943836 508720 mailnull 19264 0.0 S 00:00 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 938582 1 wp-toolkit 18068 0.0 Ss 2-06:22:14 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 3943305 506832 nobody 18044 0.0 S 00:59 /usr/sbin/httpd -k start 1471 1 root 16996 0.0 Ss 62-00:24:32 cPhulkd - processor 3446928 1471 root 16776 0.0 S 02:28:32 cPhulkd - dbprocessor 3943837 506832 nobody 16488 0.0 S 00:00 /usr/sbin/httpd -k start 3943833 506832 nobody 16440 0.0 S 00:01 /usr/sbin/httpd -k start 3943838 506832 nobody 16440 0.0 S 00:00 /usr/sbin/httpd -k start 509671 508992 netdata 15780 2.1 Sl 2-08:14:35 /usr/libexec/netdata/plugins.d/apps.plugin 1 3930836 508511 vinesit 15744 0.0 S 04:16 dovecot/imap 508634 1 named 15648 0.0 Ssl 2-08:14:45 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 3858197 508511 kurri 15004 0.0 S 25:05 dovecot/imap 3943819 1471 root 14540 0.0 S 00:05 cPhulkd - processor - http socket 3889305 508511 alison 14408 0.0 S 19:04 dovecot/imap 3943538 506832 nobody 13948 0.0 S 00:43 /usr/sbin/httpd -k start 3943822 508511 aaa 13928 0.0 S 00:04 dovecot/imap 4180059 4180015 evolution 13364 0.0 Ss 2-10:34:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 3943607 508511 root 12744 0.0 S 00:31 dovecot/auth -w 3883280 508511 kurri 12432 0.0 S 20:32:32 dovecot/imap 938585 1 wp-toolkit 11436 0.0 Ss 2-06:22:14 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 508518 508511 dovenull 10868 0.0 S 2-08:14:45 dovecot/imap-login --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4465094 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 150 evolution/evolutionerp.com.au-ssl_log 133 alison/alisonarts.com.au-ssl_log 87 cosgrovecreative/cosgrovecreative.com.au-ssl_log 44 evolution/portal.evolutionerp.com.au-ssl_log 27 evolution/evolutionerp.com.au 20 olympic/olympicfencing.com.au-ssl_log 8 evolution/my.evolutionerp.com.au-ssl_log 2 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 178 52.139.37.240 85 158.23.184.117 54 34.74.120.94 50 20.63.81.20 44 20.104.104.62 25 203.54.180.238 10 141.98.11.41 8 146.70.36.124 3 101.182.108.127 2 118.127.40.55 1 52.167.144.221 1 2a03:2880:f802:6:: 1 129.153.70.84 1 114.119.146.16 1 114.119.143.14 --- top request paths across all vhosts (last 3 min) --- 25 GET /heartbeat.php 12 GET / 6 GET /wp-login.php 5 GET /edit.php 4 GET /wp-content/admin.php 4 GET /store/leopard-print-custom-kids-kicks/ 4 GET /atomlib.php 4 GET /as.php 3 GET /wp-mail.php 3 GET /wp-admin/ 3 GET /or.php 3 GET /adminfuns.php 2 POST /graphql 2 GET /xda.php 2 GET /wp_motu_myk3v.php 2 GET /wp-content/uploads/ 2 GET /wp-content/upgrade/index.php 2 GET /wp-content/themes/admin.php 2 GET /wp-blog-header.php 2 GET /wp-admin/maint --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 4 GET /store/leopard-print-custom-kids-kicks/ 3 GET /wp-login.php 2 POST /graphql 2 GET /wp-admin/maint 2 GET /wp-admin/ 2 GET /users/login 2 GET /user/login 2 GET /store/lover-custom-nike-dunks/ 2 GET /signup 2 GET /signin 2 GET /sign-in 2 GET /secure -- last 10 requests -- 158.23.184.117 - - [30/Aug/2026:10:32:41 +1000] "GET /baxa1.php HTTP/1.1" 404 36694 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 2a03:2880:f802:6:: - - [30/Aug/2026:10:32:41 +1000] "GET /wp-json/wp/v2/tags/823 HTTP/1.1" 200 1504 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; 114.119.130.40 - - [30/Aug/2026:10:32:54 +1000] "GET /store/light-blue-butterfly-custom-converse/?verified=1&rating=1&image=1&wcpr_image=1 HTTP/1.1" 404 36735 "https://madalice.com.au/store/light-blue-butterfly-custom-co 114.119.143.14 - - [30/Aug/2026:10:33:16 +1000] "GET /store/leopard-print-custom-kids-kicks/?verified=1&rating=5&wcpr_page=2 HTTP/1.1" 200 54571 "https://madalice.com.au/store/leopard-print-custom-kids-kicks/?verified=1& 129.153.70.84 - - [30/Aug/2026:10:33:28 +1000] "GET /wp-json/wp/v2/product/33239 HTTP/1.1" 200 4498 "-" "Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" 114.119.143.104 - - [30/Aug/2026:10:33:37 +1000] "GET /store/leopard-print-custom-kids-kicks/?rating=5&wcpr_verified=1 HTTP/1.1" 200 54825 "https://madalice.com.au/store/leopard-print-custom-kids-kicks/?rating=5&wcpr_ver 104.28.222.243 - - [30/Aug/2026:10:33:48 +1000] "GET /blog/ HTTP/1.1" 301 1 "https://madalice.com.au/blog/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 114.119.131.88 - - [30/Aug/2026:10:33:58 +1000] "GET /store/leopard-print-custom-kids-kicks/?rating=5&wcpr_page=2&wcpr_image=1 HTTP/1.1" 200 54682 "https://madalice.com.au/store/leopard-print-custom-kids-kicks/?rating=5& 34.74.120.94 - - [30/Aug/2026:10:34:19 +1000] "POST /graphql HTTP/1.1" 404 36648 "https://www.madalice.com.au" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537 114.119.146.16 - - [30/Aug/2026:10:34:20 +1000] "GET /store/leopard-print-custom-kids-kicks/?rating=3&verified=1&wcpr_rating=1 HTTP/1.1" 200 54573 "https://madalice.com.au/store/leopard-print-custom-kids-kicks/?rating=3& == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 3 GET /edit.php 1 GET /zwso.php 1 GET /zrjuyoos.php 1 GET /zfqipfss.php 1 GET /wp-seo.php 1 GET /wp.php 1 GET /wp_motu_ypdat.php 1 GET /wp_motu_myk3v.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-load.php 1 GET /wp-includes/SimplePie/admin.php -- last 10 requests -- 52.139.37.240 - - [30/Aug/2026:10:33:54 +1000] "GET /.well-known/index.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:10:33:55 +1000] "GET /wp-admin/user/wp-login.php HTTP/1.1" 404 29660 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:10:33:56 +1000] "GET /wp-admin/css/colors/blue/index.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 52.139.37.240 - - [30/Aug/2026:10:33:57 +1000] "GET /wp-content/radio.php HTTP/1.1" 404 30383 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:10:33:58 +1000] "GET /wp-content/about.php HTTP/1.1" 404 30383 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:10:33:59 +1000] "GET /wp-admin/admin.php HTTP/1.1" 302 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:10:34:00 +1000] "GET /wp-admin/css/admin.php HTTP/1.1" 404 29663 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:10:34:02 +1000] "GET /templates/beez3/index.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:10:34:03 +1000] "GET /wp-content/plugins/simple/simple.php HTTP/1.1" 404 29664 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/ 52.139.37.240 - - [30/Aug/2026:10:34:04 +1000] "GET /wp2.php HTTP/1.1" 404 30381 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == alison/alisonarts.com.au-ssl_log == -- top paths -- 9 GET / 1 GET /zup.php73 1 GET /x.php 1 GET /xleet.php 1 GET /ww5.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-good.php 1 GET /wpc.php 1 GET /wp-content/uploads/index.php -- last 10 requests -- 141.98.11.41 - - [30/Aug/2026:10:32:37 +1000] "GET /wp-login.php HTTP/1.1" 200 2081 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 141.98.11.41 - - [30/Aug/2026:10:32:38 +1000] "GET /?author=1 HTTP/1.1" 404 9211 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 141.98.11.41 - - [30/Aug/2026:10:32:40 +1000] "GET /?author=2 HTTP/1.1" 404 9211 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 141.98.11.41 - - [30/Aug/2026:10:32:41 +1000] "GET /?author=3 HTTP/1.1" 404 9211 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 141.98.11.41 - - [30/Aug/2026:10:32:43 +1000] "GET /?author=4 HTTP/1.1" 404 9211 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0" 141.98.11.41 - - [30/Aug/2026:10:32:44 +1000] "GET /?author=5 HTTP/1.1" 404 9211 "-" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" 141.98.11.41 - - [30/Aug/2026:10:32:46 +1000] "GET /?author=6 HTTP/1.1" 404 9211 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0" 141.98.11.41 - - [30/Aug/2026:10:32:47 +1000] "GET /?author=7 HTTP/1.1" 404 9211 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 141.98.11.41 - - [30/Aug/2026:10:32:49 +1000] "GET /?author=8 HTTP/1.1" 404 9211 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 141.98.11.41 - - [30/Aug/2026:10:32:51 +1000] "GET /?author=9 HTTP/1.1" 404 9211 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-30 10:31:52 L1=2.00 run=4 blk=0 avail=8085 (58.7%) swpO=1 conn=3 myRSS=2927 php=6 phpRSS=509 ap=23 tcp=31 topuser=madalice 2026-08-30 10:32:01 L1=2.08 run=4 blk=0 avail=8056 (58.5%) swpO=0 conn=3 myRSS=2927 php=6 phpRSS=536 ap=21 tcp=36 topuser=madalice 2026-08-30 10:32:02 L1=2.08 run=5 blk=0 avail=8014 (58.2%) swpO=0 conn=3 myRSS=2927 php=5 phpRSS=544 ap=21 tcp=32 topuser=madalice 2026-08-30 10:32:11 L1=2.15 run=5 blk=0 avail=8144 (59.1%) swpO=0 conn=3 myRSS=2927 php=5 phpRSS=406 ap=21 tcp=35 topuser=madalice 2026-08-30 10:32:12 L1=2.22 run=5 blk=0 avail=8127 (59.0%) swpO=0 conn=3 myRSS=2927 php=5 phpRSS=425 ap=21 tcp=33 topuser=madalice 2026-08-30 10:32:21 L1=2.44 run=9 blk=0 avail=6647 (48.3%) swpO=0 conn=10 myRSS=2927 php=13 phpRSS=1948 ap=39 tcp=59 topuser=madalice 2026-08-30 10:32:23 L1=2.89 run=16 blk=0 avail=6548 (47.5%) swpO=0 conn=12 myRSS=2927 php=13 phpRSS=1985 ap=51 tcp=62 topuser=madalice 2026-08-30 10:32:31 L1=3.54 run=3 blk=0 avail=6629 (48.1%) swpO=0 conn=4 myRSS=2927 php=13 phpRSS=1837 ap=55 tcp=50 topuser=madalice 2026-08-30 10:32:33 L1=3.49 run=5 blk=0 avail=6519 (47.3%) swpO=0 conn=6 myRSS=2927 php=14 phpRSS=2002 ap=54 tcp=37 topuser=madalice 2026-08-30 10:32:41 L1=3.37 run=4 blk=0 avail=6739 (48.9%) swpO=0 conn=3 myRSS=2927 php=14 phpRSS=1732 ap=45 tcp=33 topuser=madalice 2026-08-30 10:32:43 L1=3.42 run=1 blk=0 avail=6920 (50.2%) swpO=0 conn=1 myRSS=2927 php=12 phpRSS=1598 ap=44 tcp=30 topuser=madalice 2026-08-30 10:32:51 L1=3.39 run=4 blk=0 avail=6850 (49.7%) swpO=0 conn=3 myRSS=2927 php=14 phpRSS=1802 ap=35 tcp=27 topuser=madalice 2026-08-30 10:32:53 L1=3.36 run=3 blk=0 avail=6796 (49.3%) swpO=0 conn=3 myRSS=2927 php=14 phpRSS=1861 ap=34 tcp=28 topuser=madalice 2026-08-30 10:33:01 L1=3.25 run=2 blk=0 avail=6925 (50.3%) swpO=0 conn=2 myRSS=2927 php=13 phpRSS=1772 ap=25 tcp=26 topuser=madalice 2026-08-30 10:33:03 L1=3.07 run=2 blk=0 avail=7082 (51.4%) swpO=1 conn=1 myRSS=2927 php=12 phpRSS=1598 ap=24 tcp=25 topuser=madalice 2026-08-30 10:33:11 L1=2.98 run=2 blk=0 avail=8029 (58.3%) swpO=1 conn=2 myRSS=2927 php=6 phpRSS=576 ap=18 tcp=21 topuser=madalice 2026-08-30 10:33:13 L1=2.90 run=3 blk=0 avail=7875 (57.2%) swpO=0 conn=1 myRSS=2927 php=7 phpRSS=768 ap=17 tcp=24 topuser=madalice 2026-08-30 10:33:21 L1=2.61 run=2 blk=0 avail=8334 (60.5%) swpO=0 conn=2 myRSS=2927 php=4 phpRSS=250 ap=16 tcp=27 topuser=madalice 2026-08-30 10:33:23 L1=2.61 run=3 blk=0 avail=8256 (59.9%) swpO=0 conn=1 myRSS=2927 php=4 phpRSS=312 ap=17 tcp=24 topuser=madalice 2026-08-30 10:33:31 L1=2.21 run=1 blk=0 avail=8351 (60.6%) swpO=0 conn=2 myRSS=2927 php=3 phpRSS=192 ap=16 tcp=25 topuser=madalice 2026-08-30 10:33:33 L1=2.21 run=4 blk=0 avail=8272 (60.0%) swpO=0 conn=3 myRSS=2927 php=5 phpRSS=338 ap=16 tcp=27 topuser=evolution 2026-08-30 10:33:41 L1=2.10 run=2 blk=0 avail=8192 (59.5%) swpO=0 conn=2 myRSS=2927 php=4 phpRSS=369 ap=18 tcp=27 topuser=evolution 2026-08-30 10:33:43 L1=2.10 run=1 blk=0 avail=8330 (60.5%) swpO=0 conn=3 myRSS=2927 php=4 phpRSS=233 ap=18 tcp=28 topuser=madalice 2026-08-30 10:33:51 L1=1.93 run=2 blk=0 avail=8217 (59.6%) swpO=0 conn=2 myRSS=2927 php=4 phpRSS=346 ap=18 tcp=26 topuser=evolution 2026-08-30 10:33:53 L1=1.93 run=2 blk=0 avail=8291 (60.2%) swpO=0 conn=3 myRSS=2927 php=5 phpRSS=304 ap=17 tcp=30 topuser=madalice 2026-08-30 10:34:02 L1=1.78 run=1 blk=0 avail=8345 (60.6%) swpO=0 conn=2 myRSS=2927 php=3 phpRSS=192 ap=17 tcp=26 topuser=madalice 2026-08-30 10:34:03 L1=1.78 run=6 blk=0 avail=8220 (59.7%) swpO=0 conn=3 myRSS=2927 php=6 phpRSS=411 ap=17 tcp=26 topuser=evolution 2026-08-30 10:34:12 L1=1.66 run=3 blk=0 avail=8243 (59.8%) swpO=0 conn=2 myRSS=2927 php=4 phpRSS=334 ap=17 tcp=22 topuser=madalice 2026-08-30 10:34:13 L1=1.66 run=2 blk=0 avail=8183 (59.4%) swpO=0 conn=3 myRSS=2927 php=6 phpRSS=448 ap=17 tcp=25 topuser=evolution 2026-08-30 10:34:22 L1=1.88 run=7 blk=0 avail=7182 (52.1%) swpO=1 conn=7 myRSS=2927 php=11 phpRSS=1535 ap=20 tcp=39 topuser=madalice