INCIDENT 2026-08-30 10:50:06 trigger: php_rss=2110MB ================================================================== load: 1.66 1.08 1.09 10/668 3999690 ncpu:10 mem_avail: 6408MB/13777MB (46.5%) swap_used:1819MB swapout:0/s blocked(D):0 running:16 iowait:0.1% steal:0.0% php: 13 procs / 2110MB heaviest user: madalice (10 procs, 1935MB) apache: 31 procs tcp_estab: 53 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2927 madalice 10 1963 root 251 1114 nobody 30 517 netdata 7 198 speedlin 1 143 mailman 20 121 cpanellogin 1 82 mailnull 3 65 dovenull 6 46 wp-toolkit 3 31 infinium 2 28 evolution 7 28 kurri 2 26 zabbix 1 21 dovecot 3 19 vinesit 1 15 named 1 15 polkitd 1 5 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1960 speedlin 1 144 root 1 22 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5271 MB Active(file): 4681 MB Inactive(file): 955 MB Dirty: 159 MB Writeback: 0 MB SReclaimable: 607 MB CommitLimit: 10984 MB Committed_AS: 8757 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-08:31:27 7704 /usr/bin/imunify-agent-proxy 3996031 root 00:05 3228 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2997736 7.4 Ssl 2-08:30:56 /usr/sbin/mariadbd 3995952 510022 madalice 251704 42.3 S 00:11 php-fpm: pool madalice_com_au 3995951 510022 madalice 214800 49.2 R 00:11 php-fpm: pool madalice_com_au 3995949 510022 madalice 193160 48.3 R 00:11 php-fpm: pool madalice_com_au 2328310 2277352 root 189740 0.0 S 08:11:56 spamd child 508924 1 netdata 178416 1.9 Ssl 2-08:30:25 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175580 0.0 Ss 08:27:02 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328311 2277352 root 167656 0.0 S 08:11:56 spamd child 3995950 510022 madalice 160392 56.7 S 00:11 php-fpm: pool madalice_com_au 3995954 510022 madalice 159604 47.5 S 00:10 php-fpm: pool madalice_com_au 3995948 510022 madalice 159424 53.5 S 00:11 php-fpm: pool madalice_com_au 3995953 510022 madalice 159368 41.3 S 00:11 php-fpm: pool madalice_com_au 3997948 510022 madalice 159040 78.3 S 00:03 php-fpm: pool madalice_com_au 3998030 510022 madalice 158952 82.0 S 00:03 php-fpm: pool madalice_com_au 3998031 510022 madalice 156292 73.6 S 00:03 php-fpm: pool madalice_com_au 509266 1 root 146260 0.0 Ss 2-08:30:22 /usr/lib/systemd/systemd-journald 3397810 1353308 cpanellogin 84860 0.0 S 02:56:14 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 509236 509098 root 53988 0.0 Sl 2-08:30:22 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 47844 0.0 Sl 2-08:30:20 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42224 0.1 Ss 39-08:08:48 cpsrvd (SSL) - waiting for connections 2275833 1 root 35916 0.0 Ss 08:27:52 lfd - sleeping 508720 1 mailnull 25296 0.0 Ss 2-08:30:29 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 24048 0.1 Ss 62-00:40:17 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23340 0.0 Ss 2-08:30:18 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 22516 0.2 Ssl 2-08:31:39 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1463 1 root 21968 0.0 Ss 62-00:40:17 tailwatchd 3977644 506832 nobody 21336 0.0 S 05:44 /usr/sbin/httpd -k start 3998239 508720 mailnull 20940 0.0 S 00:03 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3998406 508720 mailnull 20940 0.0 S 00:02 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3995838 506832 nobody 20836 0.1 S 00:29 /usr/sbin/httpd -k start 3995825 506832 nobody 20504 0.1 S 00:30 /usr/sbin/httpd -k start 3995797 506832 nobody 20440 0.1 S 00:31 /usr/sbin/httpd -k start 3995798 506832 nobody 20396 0.1 S 00:31 /usr/sbin/httpd -k start 3994646 506832 nobody 20284 0.0 S 02:23 /usr/sbin/httpd -k start 3995980 506832 nobody 20136 0.3 S 00:09 /usr/sbin/httpd -k start 3995978 506832 nobody 20112 0.2 S 00:10 /usr/sbin/httpd -k start 3995979 506832 nobody 20076 0.2 S 00:09 /usr/sbin/httpd -k start 3994049 506832 nobody 19260 0.0 S 03:30 /usr/sbin/httpd -k start 3996011 506832 nobody 19120 0.2 S 00:07 /usr/sbin/httpd -k start 3995824 506832 nobody 19072 0.0 S 00:30 /usr/sbin/httpd -k start 3994335 506832 nobody 19052 0.0 S 02:51 /usr/sbin/httpd -k start 3996008 506832 nobody 18888 0.1 S 00:07 /usr/sbin/httpd -k start 3996007 506832 nobody 18748 0.1 S 00:08 /usr/sbin/httpd -k start 3995688 506832 nobody 18664 0.0 S 00:43 /usr/sbin/httpd -k start 3996005 506832 nobody 18652 0.1 S 00:08 /usr/sbin/httpd -k start 3996010 506832 nobody 18348 0.0 S 00:07 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18068 0.0 Ss 2-06:37:59 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 3995841 506832 nobody 18004 0.0 S 00:29 /usr/sbin/httpd -k start 3996006 506832 nobody 17812 0.0 S 00:08 /usr/sbin/httpd -k start 3996013 506832 nobody 17612 0.1 S 00:07 /usr/sbin/httpd -k start 3995837 506832 nobody 17324 0.0 S 00:29 /usr/sbin/httpd -k start 1471 1 root 16996 0.0 Ss 62-00:40:17 cPhulkd - processor 3996009 506832 nobody 16988 0.0 S 00:07 /usr/sbin/httpd -k start 3996004 506832 nobody 16916 0.1 S 00:08 /usr/sbin/httpd -k start 3995823 506832 nobody 16912 0.0 S 00:30 /usr/sbin/httpd -k start 3996014 506832 nobody 16856 0.0 S 00:07 /usr/sbin/httpd -k start 3446928 1471 root 16776 0.0 S 02:44:17 cPhulkd - dbprocessor 3997990 506832 nobody 16520 0.0 S 00:03 /usr/sbin/httpd -k start 3999345 506832 nobody 16488 0.0 S 00:01 /usr/sbin/httpd -k start 509671 508992 netdata 15780 2.1 Sl 2-08:30:20 /usr/libexec/netdata/plugins.d/apps.plugin 1 --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4469002 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 4468998 | madalice_wp | madalice_wp | Query | 0 | Sending data | SELECT option_value FROM AMuqf6qZ_options WHERE option_name LIKE 'wc_square_background_sync_job_%' AND ( option_value LIKE '%\"status\":\"queued\"%' OR option_value LIKE '%\"status\":\"processing\"%' ) ORDER BY option_id ASC LIMIT 1 | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min vinesit/westpanel.vinesit.com.au-ssl_log 186 coscom/coscom.com.au-ssl_log 101 kurri/kurrimotorinn.com.au-ssl_log 32 evolution/portal.evolutionerp.com.au-ssl_log 24 madalice/madalice.com.au-ssl_log 10 infinium/infinium.net.au-ssl_log 7 olympic/olympicfencing.com.au-ssl_log 2 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 186 52.139.37.240 101 20.48.250.41 32 20.48.160.90 24 203.54.180.238 8 35.231.130.18 3 52.42.169.159 2 170.64.135.172 2 146.70.36.124 2 118.127.40.55 1 147.224.254.164 1 114.119.146.16 --- top request paths across all vhosts (last 3 min) --- 24 GET /heartbeat.php 2 POST /wp-cron.php 2 GET /wp-login.php 2 GET /mar.php 2 GET /edit.php 2 GET /403.php 2 GET /0x.php 1 POST /wp-login.php 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /zxekqlxb.php 1 GET /zwso.php 1 GET /zu.php 1 GET /zoo.php 1 GET /zi.php 1 GET /yj.php 1 GET /xs.php 1 GET /xsox.php 1 GET /xl.php --- busiest 3 vhosts: top paths + last 10 requests --- == vinesit/westpanel.vinesit.com.au-ssl_log == -- top paths -- 1 GET /zwso.php 1 GET /xl.php 1 GET /ws.php 1 GET /wso.php 1 GET /wp-seo.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-load.php 1 GET /wp-includes/widgets/include.php 1 GET /wp-includes/widgets/about.php 1 GET /wp-includes/Text/index.php -- last 10 requests -- 52.139.37.240 - - [30/Aug/2026:10:49:51 +1000] "GET /wp-admin/css/colors/about.php HTTP/1.1" 500 718 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:10:49:52 +1000] "GET /.well-known/classwithtostring.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 52.139.37.240 - - [30/Aug/2026:10:49:52 +1000] "GET /wp-admin/js/about.php HTTP/1.1" 500 718 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:10:49:52 +1000] "GET /comfunctions.php HTTP/1.1" 500 718 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:10:49:53 +1000] "GET /images/class-config.php HTTP/1.1" 500 718 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:10:49:54 +1000] "GET /wp-includes/widgets/include.php HTTP/1.1" 500 718 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:10:49:54 +1000] "GET /install.php HTTP/1.1" 500 718 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:10:49:55 +1000] "GET /.well-known/file.php/ HTTP/1.1" 500 718 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:10:49:56 +1000] "GET /wp-includes/SimplePie/gzdecodes.php HTTP/1.1" 500 718 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537 52.139.37.240 - - [30/Aug/2026:10:49:56 +1000] "GET /wp-back.php HTTP/1.1" 500 718 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == coscom/coscom.com.au-ssl_log == -- top paths -- 1 GET /zxekqlxb.php 1 GET /zu.php 1 GET /zoo.php 1 GET /xs.php 1 GET /xsox.php 1 GET /ww.php 1 GET /ws69.php 1 GET /ws68.php 1 GET /ws66.php 1 GET /ws58.php 1 GET /wp-style.php 1 GET /wp-scr1pts.php -- last 10 requests -- 20.48.250.41 - - [30/Aug/2026:10:49:29 +1000] "GET /lkui.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [30/Aug/2026:10:49:30 +1000] "GET /wp-admin/css/colors/blue/about.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [30/Aug/2026:10:49:30 +1000] "GET /motu.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [30/Aug/2026:10:49:30 +1000] "GET /Ov-Simple1.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [30/Aug/2026:10:49:31 +1000] "GET /wp-blogs.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [30/Aug/2026:10:49:31 +1000] "GET /mini.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [30/Aug/2026:10:49:32 +1000] "GET /amp.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [30/Aug/2026:10:49:32 +1000] "GET /cc13.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [30/Aug/2026:10:49:33 +1000] "GET /aa.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [30/Aug/2026:10:49:33 +1000] "GET /s1.php HTTP/1.1" 401 36 "-" "-" == kurri/kurrimotorinn.com.au-ssl_log == -- top paths -- 1 GET /zi.php 1 GET /yj.php 1 GET /wp_motu_ypdat.php 1 GET /wp_motu_myk3v.php 1 GET /ue.php 1 GET /tqkdqbbv.php 1 GET /tf.php 1 GET /rsjlrria.php 1 GET /replace.php 1 GET /px.php 1 GET /or.php 1 GET /okxoby.php -- last 10 requests -- 20.48.160.90 - - [30/Aug/2026:10:48:10 +1000] "GET /replace.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [30/Aug/2026:10:48:10 +1000] "GET /gulu.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [30/Aug/2026:10:48:11 +1000] "GET /gtghklk.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [30/Aug/2026:10:48:11 +1000] "GET /comand.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [30/Aug/2026:10:48:11 +1000] "GET /wp_motu_myk3v.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [30/Aug/2026:10:48:12 +1000] "GET /wp_motu_ypdat.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [30/Aug/2026:10:48:12 +1000] "GET /edit.php?p= HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [30/Aug/2026:10:48:13 +1000] "GET /tqkdqbbv.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [30/Aug/2026:10:48:13 +1000] "GET /kjyehoxl.php HTTP/1.1" 404 5750 "-" "-" 20.48.160.90 - - [30/Aug/2026:10:48:14 +1000] "GET /llyuxaqd.php HTTP/1.1" 404 5750 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-30 10:47:37 L1=1.08 run=1 blk=0 avail=8513 (61.8%) swpO=0 conn=1 myRSS=2927 php=2 phpRSS=35 ap=16 tcp=29 topuser=root 2026-08-30 10:47:46 L1=1.00 run=4 blk=0 avail=8188 (59.4%) swpO=0 conn=3 myRSS=2927 php=5 phpRSS=409 ap=23 tcp=32 topuser=speedlin 2026-08-30 10:47:47 L1=1.00 run=3 blk=0 avail=8299 (60.2%) swpO=0 conn=1 myRSS=2927 php=4 phpRSS=266 ap=23 tcp=31 topuser=speedlin 2026-08-30 10:47:56 L1=1.00 run=2 blk=0 avail=8313 (60.3%) swpO=0 conn=3 myRSS=2927 php=3 phpRSS=234 ap=20 tcp=29 topuser=madalice 2026-08-30 10:47:57 L1=0.92 run=2 blk=0 avail=8380 (60.8%) swpO=0 conn=1 myRSS=2927 php=3 phpRSS=169 ap=20 tcp=28 topuser=madalice 2026-08-30 10:48:06 L1=0.84 run=1 blk=0 avail=8392 (60.9%) swpO=0 conn=3 myRSS=2927 php=3 phpRSS=169 ap=18 tcp=24 topuser=madalice 2026-08-30 10:48:07 L1=0.77 run=1 blk=0 avail=8393 (60.9%) swpO=0 conn=1 myRSS=2927 php=3 phpRSS=169 ap=18 tcp=24 topuser=madalice 2026-08-30 10:48:16 L1=0.71 run=1 blk=0 avail=8401 (61.0%) swpO=0 conn=1 myRSS=2927 php=3 phpRSS=169 ap=17 tcp=25 topuser=madalice 2026-08-30 10:48:17 L1=0.66 run=1 blk=0 avail=8400 (61.0%) swpO=0 conn=1 myRSS=2927 php=3 phpRSS=169 ap=17 tcp=25 topuser=madalice 2026-08-30 10:48:26 L1=0.60 run=1 blk=0 avail=8520 (61.8%) swpO=0 conn=1 myRSS=2927 php=2 phpRSS=35 ap=16 tcp=23 topuser=root 2026-08-30 10:48:27 L1=0.55 run=1 blk=0 avail=8520 (61.8%) swpO=0 conn=1 myRSS=2927 php=2 phpRSS=35 ap=16 tcp=23 topuser=root 2026-08-30 10:48:36 L1=0.51 run=1 blk=0 avail=8527 (61.9%) swpO=0 conn=1 myRSS=2927 php=2 phpRSS=35 ap=15 tcp=24 topuser=root 2026-08-30 10:48:37 L1=0.47 run=2 blk=0 avail=8462 (61.4%) swpO=0 conn=2 myRSS=2927 php=3 phpRSS=132 ap=15 tcp=25 topuser=olympic 2026-08-30 10:48:46 L1=0.51 run=1 blk=0 avail=8527 (61.9%) swpO=1 conn=1 myRSS=2927 php=2 phpRSS=35 ap=15 tcp=28 topuser=root 2026-08-30 10:48:47 L1=0.47 run=1 blk=0 avail=8523 (61.9%) swpO=1 conn=2 myRSS=2927 php=2 phpRSS=35 ap=15 tcp=30 topuser=root 2026-08-30 10:48:56 L1=0.43 run=1 blk=0 avail=8514 (61.8%) swpO=0 conn=1 myRSS=2927 php=2 phpRSS=35 ap=16 tcp=28 topuser=root 2026-08-30 10:48:57 L1=0.40 run=1 blk=0 avail=8508 (61.8%) swpO=0 conn=2 myRSS=2927 php=2 phpRSS=35 ap=16 tcp=27 topuser=root 2026-08-30 10:49:06 L1=0.37 run=2 blk=0 avail=8460 (61.4%) swpO=0 conn=1 myRSS=2927 php=3 phpRSS=127 ap=15 tcp=27 topuser=infinium 2026-08-30 10:49:07 L1=0.50 run=2 blk=0 avail=8446 (61.3%) swpO=0 conn=2 myRSS=2927 php=3 phpRSS=136 ap=16 tcp=27 topuser=infinium 2026-08-30 10:49:16 L1=0.54 run=2 blk=0 avail=8343 (60.6%) swpO=0 conn=3 myRSS=2927 php=4 phpRSS=284 ap=15 tcp=26 topuser=olympic 2026-08-30 10:49:17 L1=0.65 run=3 blk=0 avail=8526 (61.9%) swpO=0 conn=2 myRSS=2927 php=2 phpRSS=35 ap=15 tcp=25 topuser=root 2026-08-30 10:49:26 L1=0.84 run=2 blk=0 avail=8470 (61.5%) swpO=0 conn=3 myRSS=2927 php=3 phpRSS=101 ap=16 tcp=25 topuser=madalice 2026-08-30 10:49:27 L1=0.86 run=1 blk=0 avail=8417 (61.1%) swpO=0 conn=2 myRSS=2927 php=3 phpRSS=157 ap=16 tcp=25 topuser=madalice 2026-08-30 10:49:36 L1=0.79 run=1 blk=0 avail=8404 (61.0%) swpO=0 conn=3 myRSS=2927 php=3 phpRSS=157 ap=19 tcp=40 topuser=madalice 2026-08-30 10:49:37 L1=0.80 run=2 blk=0 avail=8128 (59.0%) swpO=0 conn=3 myRSS=2927 php=5 phpRSS=404 ap=31 tcp=43 topuser=infinium 2026-08-30 10:49:46 L1=0.82 run=1 blk=0 avail=8359 (60.7%) swpO=1 conn=3 myRSS=2927 php=3 phpRSS=157 ap=26 tcp=27 topuser=madalice 2026-08-30 10:49:48 L1=0.75 run=1 blk=0 avail=8375 (60.8%) swpO=1 conn=3 myRSS=2927 php=3 phpRSS=157 ap=24 tcp=26 topuser=madalice 2026-08-30 10:49:56 L1=0.69 run=8 blk=0 avail=7699 (55.9%) swpO=0 conn=3 myRSS=2927 php=9 phpRSS=987 ap=17 tcp=31 topuser=madalice 2026-08-30 10:49:58 L1=1.28 run=8 blk=0 avail=7744 (56.2%) swpO=0 conn=3 myRSS=2927 php=9 phpRSS=932 ap=20 tcp=35 topuser=madalice 2026-08-30 10:50:06 L1=1.66 run=16 blk=0 avail=6408 (46.5%) swpO=0 conn=8 myRSS=2927 php=13 phpRSS=2110 ap=31 tcp=53 topuser=madalice