INCIDENT 2026-08-30 12:18:13 trigger: php_rss=2013MB ================================================================== load: 1.53 0.88 0.79 12/724 105275 ncpu:10 mem_avail: 6315MB/13777MB (45.8%) swap_used:1824MB swapout:0/s blocked(D):0 running:22 iowait:0.0% steal:0.0% php: 14 procs / 2013MB heaviest user: madalice (10 procs, 1898MB) apache: 92 procs tcp_estab: 48 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2925 madalice 10 1845 nobody 91 1605 root 246 1121 netdata 7 197 mailman 20 121 evolution 7 101 cpanellogin 1 63 kurri 4 56 alison 4 56 dovenull 6 46 mailnull 2 45 wp-toolkit 3 31 zabbix 1 22 dovecot 3 19 named 1 15 polkitd 1 5 nscd 1 4 cpanelconnecttrack 1 3 rpc 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 10 1868 evolution 3 92 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5263 MB Active(file): 4696 MB Inactive(file): 1003 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 606 MB CommitLimit: 10984 MB Committed_AS: 9953 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-09:59:34 7704 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2995904 7.3 Ssl 2-09:59:03 /usr/sbin/mariadbd 105200 510022 madalice 211688 53.7 R 00:08 php-fpm: pool madalice_com_au 2328310 2277352 root 208656 0.0 S 09:40:03 spamd child 105198 510022 madalice 206420 54.8 R 00:08 php-fpm: pool madalice_com_au 105241 510022 madalice 193512 88.0 R 00:01 php-fpm: pool madalice_com_au 105242 510022 madalice 178936 84.0 R 00:01 php-fpm: pool madalice_com_au 508924 1 netdata 178000 1.9 Ssl 2-09:58:32 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175488 0.0 Ss 09:55:09 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 103550 510022 madalice 166224 15.3 R 02:26 php-fpm: pool madalice_com_au 2328311 2277352 root 166028 0.0 S 09:40:03 spamd child 105199 510022 madalice 161180 45.6 S 00:08 php-fpm: pool madalice_com_au 105203 510022 madalice 159800 43.1 S 00:08 php-fpm: pool madalice_com_au 105205 510022 madalice 159644 41.3 S 00:08 php-fpm: pool madalice_com_au 105202 510022 madalice 159612 43.6 S 00:08 php-fpm: pool madalice_com_au 105209 510022 madalice 159560 47.8 S 00:05 php-fpm: pool madalice_com_au 509266 1 root 148028 0.0 Ss 2-09:58:29 /usr/lib/systemd/systemd-journald 4027958 1353308 cpanellogin 65196 0.0 S 01:20:00 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 509236 509098 root 53032 0.0 Sl 2-09:58:29 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 48628 0.0 Sl 2-09:58:27 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42480 0.1 Ss 39-09:36:55 cpsrvd (SSL) - waiting for connections 105245 104715 evolution 40668 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 105244 102812 evolution 40652 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2275833 1 root 35924 0.0 Ss 09:55:59 lfd - sleeping 508720 1 mailnull 25296 0.0 Ss 2-09:58:36 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 24084 0.1 Ss 62-02:08:24 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23344 0.0 Ss 2-09:58:25 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 22856 0.2 Ssl 2-09:59:46 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 102818 506832 nobody 22280 0.1 S 02:58 /usr/sbin/httpd -k start 1463 1 root 21976 0.0 Ss 62-02:08:24 tailwatchd 102812 506832 nobody 21420 0.0 S 02:58 /usr/sbin/httpd -k start 87419 506832 nobody 21088 0.0 S 04:57 /usr/sbin/httpd -k start 102844 506832 nobody 21008 0.0 S 02:57 /usr/sbin/httpd -k start 105195 508720 mailnull 20940 0.0 S 00:10 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 88162 506832 nobody 20500 0.1 S 03:45 /usr/sbin/httpd -k start 104697 506832 nobody 20320 0.0 S 00:56 /usr/sbin/httpd -k start 104712 506832 nobody 20256 0.0 S 00:54 /usr/sbin/httpd -k start 104766 506832 nobody 20148 0.0 S 00:52 /usr/sbin/httpd -k start 104689 506832 nobody 19860 0.0 S 00:57 /usr/sbin/httpd -k start 104769 506832 nobody 19736 0.0 S 00:52 /usr/sbin/httpd -k start 104084 506832 nobody 19712 0.0 S 02:02 /usr/sbin/httpd -k start 104832 506832 nobody 19708 0.0 S 00:50 /usr/sbin/httpd -k start 104700 506832 nobody 19648 0.0 S 00:55 /usr/sbin/httpd -k start 104743 506832 nobody 19576 0.0 S 00:53 /usr/sbin/httpd -k start 104755 506832 nobody 19444 0.0 S 00:52 /usr/sbin/httpd -k start 104753 506832 nobody 19416 0.0 S 00:53 /usr/sbin/httpd -k start 104765 506832 nobody 19408 0.0 S 00:52 /usr/sbin/httpd -k start 104722 506832 nobody 19360 0.0 S 00:53 /usr/sbin/httpd -k start 104775 506832 nobody 19328 0.0 S 00:52 /usr/sbin/httpd -k start 104695 506832 nobody 19264 0.0 S 00:56 /usr/sbin/httpd -k start 104726 506832 nobody 19252 0.0 S 00:53 /usr/sbin/httpd -k start 104829 506832 nobody 19236 0.0 S 00:50 /usr/sbin/httpd -k start 104748 506832 nobody 19200 0.0 S 00:53 /usr/sbin/httpd -k start 104744 506832 nobody 19136 0.0 S 00:53 /usr/sbin/httpd -k start 104759 506832 nobody 19136 0.0 S 00:52 /usr/sbin/httpd -k start 104822 506832 nobody 19096 0.0 S 00:50 /usr/sbin/httpd -k start 104705 506832 nobody 19060 0.0 S 00:55 /usr/sbin/httpd -k start 104725 506832 nobody 19008 0.0 S 00:53 /usr/sbin/httpd -k start 102847 506832 nobody 18916 0.0 S 02:57 /usr/sbin/httpd -k start 104736 506832 nobody 18912 0.0 S 00:53 /usr/sbin/httpd -k start 104739 506832 nobody 18832 0.0 S 00:53 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4501059 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 228 bigdeals/bigdeals.com.au-ssl_log 117 candyfabcom/candyfab.com.au-ssl_log 79 madalice/madalice.com.au-ssl_log 21 evolution/portal.evolutionerp.com.au-ssl_log 16 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 228 40.115.94.245 117 52.139.37.240 79 136.108.4.72 16 203.54.180.238 6 123.50.132.96 2 35.231.130.18 2 114.119.159.70 1 98.84.70.201 1 66.249.68.68 1 54.235.125.129 1 44.206.65.8 1 3.89.176.255 1 23.21.179.120 1 114.119.146.16 1 114.119.140.234 --- top request paths across all vhosts (last 3 min) --- 135 GET /api/getItem/LWFBW2001KG 16 GET /heartbeat.php 8 GET /api/getItem/LWPG2001KG 7 GET / 3 GET /store/hand-painted-nike-af1-afl-north-melbourne/ 2 POST /graphql 2 GET /store/hand-painted-nike-af1-afl-gws-goldcostsun/ 2 GET /mar.php 2 GET /_image 2 GET /function.php 2 GET /api/getItem/GEB12-DL 1 POST /v1/graphql 1 POST /api/graphql 1 POST / 1 GET /z9x8c7v6b5-debug-trigger-webdisk.candyfab.com.au 1 GET /xxx.php 1 GET /xx.php 1 GET /xpw.php 1 GET /x.php 1 GET /xmlrpc.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 135 GET /api/getItem/LWFBW2001KG 8 GET /api/getItem/LWPG2001KG 2 GET /api/getItem/GEB12-DL 1 GET /api/getItem/SPHDG15040 1 GET /api/getItem/S6 1 GET /api/getItem/S5 1 GET /api/getItem/S4 1 GET /api/getItem/S3 1 GET /api/getItem/S2 1 GET /api/getItem/S1 1 GET /api/getItem/RGW90 1 GET /api/getItem/RGW80 -- last 10 requests -- 40.115.94.245 - - [30/Aug/2026:12:16:15 +1000] "GET /api/getItem/RGW90 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:12:16:15 +1000] "GET /api/getItem/RGW100 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:12:16:15 +1000] "GET /api/getItem/RGW120 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:12:16:15 +1000] "GET /api/getItem/RGW160 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:12:16:15 +1000] "GET /api/getItem/RGW117T HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:12:16:15 +1000] "GET /api/getItem/RGW80 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:12:16:15 +1000] "GET /api/getItem/GP150x200x8 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:12:16:16 +1000] "GET /api/getItem/K125MSGB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:12:16:16 +1000] "GET /api/getItem/253-40SP HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:12:16:16 +1000] "GET /api/getItem/300558 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 2 GET /mar.php 2 GET /function.php 1 GET /xxx.php 1 GET /xx.php 1 GET /xpw.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /wp-signup.php 1 GET /wp-links.php 1 GET /wp-includes/wp-includes_function.php 1 GET /wp-includes/Text/autoload_classmap.php 1 GET /wp-includes/SimplePie/admin.php -- last 10 requests -- 52.139.37.240 - - [30/Aug/2026:12:18:06 +1000] "GET /system_log.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:12:18:06 +1000] "GET /wp-admin/maint/admin.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:12:18:07 +1000] "GET /ini.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:12:18:08 +1000] "GET /ok.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:12:18:08 +1000] "GET /wp-admin/includes/about.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:12:18:09 +1000] "GET /wp-admin/maint.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:12:18:10 +1000] "GET /wp-configs.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:12:18:10 +1000] "GET /01.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:12:18:11 +1000] "GET /wp-includes/SimplePie/admin.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:12:18:12 +1000] "GET /wp-admin/css/colors/midnight/colors.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/ == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 2 GET /_image 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /z9x8c7v6b5-debug-trigger-webdisk.candyfab.com.au 1 GET /wp-json 1 GET /wp/.env 1 GET /wp-config.php.swp 1 GET /wp-config.php~ 1 GET /wp-config.old 1 GET /web/.env 1 GET /web.config -- last 10 requests -- 136.108.4.72 - - [30/Aug/2026:12:16:16 +1000] "GET /@fs/root/.env?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 136.108.4.72 - - [30/Aug/2026:12:16:16 +1000] "GET /_image?href=/proc/self/environ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 136.108.4.72 - - [30/Aug/2026:12:16:16 +1000] "GET /_image?href=/../../../.env HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 136.108.4.72 - - [30/Aug/2026:12:16:18 +1000] "GET /debug/pprof/cmdline HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 136.108.4.72 - - [30/Aug/2026:12:16:18 +1000] "GET /debug/vars HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 136.108.4.72 - - [30/Aug/2026:12:16:18 +1000] "GET /metrics HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 136.108.4.72 - - [30/Aug/2026:12:16:18 +1000] "GET /config/runtime.exs HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 136.108.4.72 - - [30/Aug/2026:12:16:18 +1000] "GET /config.toml HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 136.108.4.72 - - [30/Aug/2026:12:16:18 +1000] "GET /config.yaml HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 136.108.4.72 - - [30/Aug/2026:12:16:18 +1000] "GET /config/prod.exs HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-30 12:15:52 L1=1.19 run=2 blk=0 avail=8180 (59.4%) swpO=0 conn=2 myRSS=2925 php=5 phpRSS=346 ap=19 tcp=30 topuser=madalice 2026-08-30 12:15:53 L1=1.17 run=2 blk=0 avail=8178 (59.4%) swpO=0 conn=2 myRSS=2925 php=4 phpRSS=325 ap=19 tcp=29 topuser=madalice 2026-08-30 12:16:02 L1=1.08 run=4 blk=0 avail=8055 (58.5%) swpO=0 conn=2 myRSS=2925 php=5 phpRSS=473 ap=19 tcp=26 topuser=madalice 2026-08-30 12:16:03 L1=1.23 run=4 blk=0 avail=8090 (58.7%) swpO=0 conn=2 myRSS=2925 php=5 phpRSS=452 ap=19 tcp=25 topuser=madalice 2026-08-30 12:16:12 L1=1.29 run=3 blk=0 avail=8014 (58.2%) swpO=0 conn=2 myRSS=2925 php=6 phpRSS=490 ap=22 tcp=35 topuser=madalice 2026-08-30 12:16:13 L1=1.35 run=1 blk=0 avail=8101 (58.8%) swpO=0 conn=2 myRSS=2925 php=5 phpRSS=357 ap=22 tcp=32 topuser=madalice 2026-08-30 12:16:22 L1=1.32 run=4 blk=0 avail=7907 (57.4%) swpO=0 conn=2 myRSS=2925 php=5 phpRSS=611 ap=23 tcp=28 topuser=madalice 2026-08-30 12:16:23 L1=1.46 run=4 blk=0 avail=7649 (55.5%) swpO=0 conn=2 myRSS=2925 php=6 phpRSS=900 ap=23 tcp=29 topuser=madalice 2026-08-30 12:16:32 L1=1.34 run=1 blk=0 avail=8182 (59.4%) swpO=0 conn=2 myRSS=2925 php=4 phpRSS=346 ap=17 tcp=24 topuser=madalice 2026-08-30 12:16:33 L1=1.23 run=1 blk=0 avail=8187 (59.4%) swpO=0 conn=2 myRSS=2925 php=4 phpRSS=346 ap=16 tcp=24 topuser=madalice 2026-08-30 12:16:42 L1=1.13 run=4 blk=0 avail=7870 (57.1%) swpO=0 conn=4 myRSS=2925 php=7 phpRSS=752 ap=15 tcp=29 topuser=madalice 2026-08-30 12:16:43 L1=1.12 run=4 blk=0 avail=8012 (58.2%) swpO=0 conn=2 myRSS=2925 php=6 phpRSS=575 ap=15 tcp=31 topuser=madalice 2026-08-30 12:16:52 L1=1.03 run=1 blk=0 avail=8315 (60.4%) swpO=0 conn=4 myRSS=2925 php=3 phpRSS=195 ap=15 tcp=23 topuser=madalice 2026-08-30 12:16:53 L1=0.95 run=1 blk=0 avail=8322 (60.4%) swpO=0 conn=2 myRSS=2925 php=3 phpRSS=195 ap=15 tcp=24 topuser=madalice 2026-08-30 12:17:02 L1=0.87 run=2 blk=0 avail=8270 (60.0%) swpO=0 conn=4 myRSS=2925 php=3 phpRSS=251 ap=14 tcp=24 topuser=madalice 2026-08-30 12:17:03 L1=0.88 run=1 blk=0 avail=8321 (60.4%) swpO=0 conn=1 myRSS=2925 php=3 phpRSS=194 ap=14 tcp=27 topuser=madalice 2026-08-30 12:17:12 L1=0.81 run=2 blk=0 avail=8136 (59.1%) swpO=0 conn=4 myRSS=2925 php=4 phpRSS=423 ap=14 tcp=25 topuser=corpkicks 2026-08-30 12:17:13 L1=0.75 run=2 blk=0 avail=8332 (60.5%) swpO=0 conn=1 myRSS=2925 php=4 phpRSS=223 ap=14 tcp=26 topuser=madalice 2026-08-30 12:17:22 L1=0.77 run=2 blk=0 avail=7738 (56.2%) swpO=0 conn=4 myRSS=2925 php=3 phpRSS=194 ap=109 tcp=133 topuser=madalice 2026-08-30 12:17:23 L1=0.79 run=3 blk=0 avail=7517 (54.6%) swpO=0 conn=1 myRSS=2925 php=3 phpRSS=233 ap=141 tcp=135 topuser=madalice 2026-08-30 12:17:32 L1=0.80 run=1 blk=0 avail=7561 (54.9%) swpO=0 conn=4 myRSS=2925 php=3 phpRSS=195 ap=133 tcp=21 topuser=madalice 2026-08-30 12:17:33 L1=0.82 run=2 blk=0 avail=7557 (54.9%) swpO=0 conn=1 myRSS=2925 php=4 phpRSS=235 ap=132 tcp=22 topuser=madalice 2026-08-30 12:17:42 L1=0.75 run=2 blk=0 avail=7611 (55.2%) swpO=0 conn=2 myRSS=2925 php=4 phpRSS=239 ap=123 tcp=32 topuser=madalice 2026-08-30 12:17:43 L1=0.77 run=4 blk=0 avail=7541 (54.7%) swpO=0 conn=1 myRSS=2925 php=6 phpRSS=375 ap=122 tcp=35 topuser=madalice 2026-08-30 12:17:53 L1=0.71 run=1 blk=0 avail=7678 (55.7%) swpO=0 conn=2 myRSS=2925 php=3 phpRSS=195 ap=113 tcp=37 topuser=madalice 2026-08-30 12:17:53 L1=0.65 run=2 blk=0 avail=7650 (55.5%) swpO=0 conn=1 myRSS=2925 php=5 phpRSS=289 ap=112 tcp=38 topuser=madalice 2026-08-30 12:18:03 L1=0.60 run=2 blk=0 avail=7685 (55.8%) swpO=0 conn=2 myRSS=2925 php=3 phpRSS=253 ap=103 tcp=22 topuser=madalice 2026-08-30 12:18:03 L1=0.63 run=1 blk=0 avail=7729 (56.1%) swpO=0 conn=3 myRSS=2925 php=5 phpRSS=273 ap=102 tcp=24 topuser=madalice 2026-08-30 12:18:13 L1=1.53 run=7 blk=0 avail=6883 (50.0%) swpO=0 conn=2 myRSS=2925 php=10 phpRSS=1272 ap=93 tcp=60 topuser=madalice 2026-08-30 12:18:13 L1=1.53 run=22 blk=0 avail=6315 (45.8%) swpO=0 conn=12 myRSS=2925 php=14 phpRSS=2013 ap=92 tcp=48 topuser=madalice