INCIDENT 2026-08-30 13:01:57 trigger: php_rss=1996MB ================================================================== load: 1.68 1.29 0.99 8/665 256412 ncpu:10 mem_avail: 6489MB/13777MB (47.1%) swap_used:1825MB swapout:0/s blocked(D):0 running:12 iowait:0.0% steal:0.0% php: 12 procs / 1996MB heaviest user: madalice (10 procs, 1961MB) apache: 31 procs tcp_estab: 47 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3014 madalice 10 1807 root 251 1124 nobody 30 538 netdata 7 197 mailman 20 121 cpanellogin 1 64 dovenull 6 46 mailnull 2 44 wp-toolkit 3 31 kurri 2 27 evolution 5 22 zabbix 1 21 lowrange 1 21 dovecot 3 19 infinium 1 18 named 1 15 alison 1 14 polkitd 1 5 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1814 root 1 22 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5166 MB Active(file): 4698 MB Inactive(file): 908 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 601 MB CommitLimit: 10984 MB Committed_AS: 8554 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 240132 root 01:57 1240 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 489033 root 2-10:43:18 7704 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3087200 7.3 Ssl 2-10:42:47 /usr/sbin/mariadbd 256343 510022 madalice 252168 84.3 S 00:03 php-fpm: pool madalice_com_au 256220 510022 madalice 244800 42.9 R 00:12 php-fpm: pool madalice_com_au 2328310 2277352 root 208232 0.0 S 10:23:47 spamd child 256342 510022 madalice 188772 80.6 R 00:03 php-fpm: pool madalice_com_au 508924 1 netdata 177832 1.9 Ssl 2-10:42:16 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175488 0.0 Ss 10:38:53 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 255866 510022 madalice 167680 19.3 R 00:44 php-fpm: pool madalice_com_au 2328311 2277352 root 165104 0.0 S 10:23:47 spamd child 255254 510022 madalice 164256 16.2 S 01:06 php-fpm: pool madalice_com_au 256217 510022 madalice 162448 37.5 S 00:13 php-fpm: pool madalice_com_au 256216 510022 madalice 162444 37.5 S 00:13 php-fpm: pool madalice_com_au 256222 510022 madalice 159620 41.0 S 00:12 php-fpm: pool madalice_com_au 256227 510022 madalice 159468 40.3 S 00:12 php-fpm: pool madalice_com_au 509266 1 root 148888 0.0 Ss 2-10:42:13 /usr/lib/systemd/systemd-journald 256344 510022 madalice 135376 63.6 R 00:03 php-fpm: pool madalice_com_au 4027958 1353308 cpanellogin 65788 0.0 S 02:03:44 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 509236 509098 root 52956 0.0 Sl 2-10:42:13 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 49156 0.0 Sl 2-10:42:11 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42524 0.1 Ss 39-10:20:39 cpsrvd (SSL) - waiting for connections 2275833 1 root 35928 0.0 Ss 10:39:43 lfd - sleeping 508720 1 mailnull 25296 0.0 Ss 2-10:42:20 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 24040 0.1 Ss 62-02:52:08 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 222621 506832 nobody 23780 0.1 S 08:43 /usr/sbin/httpd -k start 510022 1 root 23344 0.0 Ss 2-10:42:09 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 238979 506832 nobody 22868 0.1 S 04:21 /usr/sbin/httpd -k start 239595 506832 nobody 22808 0.1 S 03:02 /usr/sbin/httpd -k start 483898 1 zabbix 22488 0.2 Ssl 2-10:43:30 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 239849 506832 nobody 22468 0.2 S 02:40 /usr/sbin/httpd -k start 239097 506832 nobody 22432 0.0 S 04:07 /usr/sbin/httpd -k start 252777 508511 lowrange 22276 0.0 S 01:47 dovecot/imap 1463 1 root 21968 0.0 Ss 62-02:52:08 tailwatchd 239111 506832 nobody 21944 0.3 S 04:05 /usr/sbin/httpd -k start 239232 506832 nobody 21808 0.1 S 03:53 /usr/sbin/httpd -k start 255357 506832 nobody 21356 0.0 S 01:01 /usr/sbin/httpd -k start 238026 506832 nobody 21164 0.1 S 05:49 /usr/sbin/httpd -k start 239180 506832 nobody 20844 0.1 S 04:01 /usr/sbin/httpd -k start 256335 508720 mailnull 20740 0.0 S 00:04 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 256112 506832 nobody 20704 0.1 S 00:22 /usr/sbin/httpd -k start 239793 506832 nobody 20344 0.0 S 02:42 /usr/sbin/httpd -k start 254544 506832 nobody 19780 0.3 S 01:34 /usr/sbin/httpd -k start 255314 506832 nobody 19404 0.0 S 01:03 /usr/sbin/httpd -k start 252788 508511 infinium 19256 0.1 S 01:47 dovecot/imap 256239 506832 nobody 19044 0.1 S 00:11 /usr/sbin/httpd -k start 256238 506832 nobody 19012 0.1 S 00:11 /usr/sbin/httpd -k start 239792 506832 nobody 18816 0.2 S 02:42 /usr/sbin/httpd -k start 256300 506832 nobody 18788 0.2 S 00:09 /usr/sbin/httpd -k start 256224 506832 nobody 18760 0.1 S 00:12 /usr/sbin/httpd -k start 256350 506832 nobody 18712 0.0 R 00:02 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18068 0.0 Ss 2-08:49:50 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 256304 506832 nobody 17476 0.0 S 00:09 /usr/sbin/httpd -k start 256305 506832 nobody 17476 0.0 S 00:09 /usr/sbin/httpd -k start 256302 506832 nobody 17124 0.1 S 00:09 /usr/sbin/httpd -k start 256291 506832 nobody 17068 0.0 S 00:10 /usr/sbin/httpd -k start 1471 1 root 16968 0.0 Ss 62-02:52:08 cPhulkd - processor 3446928 1471 root 16856 0.0 S 04:56:08 cPhulkd - dbprocessor 256357 506832 nobody 16488 0.0 S 00:01 /usr/sbin/httpd -k start 256299 506832 nobody 16440 0.0 S 00:09 /usr/sbin/httpd -k start 256356 506832 nobody 16440 0.0 S 00:01 /usr/sbin/httpd -k start 509671 508992 netdata 15780 2.1 Sl 2-10:42:11 /usr/libexec/netdata/plugins.d/apps.plugin 1 --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4511927 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 1075 customkidscom/customkids.com.au-ssl_log 133 tubesupplies/tubesupplies.com.au-ssl_log 75 otterfencing/otterfencing.com.au-ssl_log 57 whiz/whizengineering.com.au-ssl_log 53 alison/alisonarts.com.au-ssl_log 46 evolution/portal.evolutionerp.com.au-ssl_log 28 madalice/madalice.com.au-ssl_log 18 aaa/aaadownunder.com.au-ssl_log 12 infinium/infinium.net.au-ssl_log 6 kamcool/kamcool.com.au-ssl_log 5 (total vhosts taking traffic: 11) --- top client IPs across all vhosts (last 3 min) --- 1075 40.115.94.245 133 52.139.44.162 72 34.125.154.25 58 158.23.184.117 53 20.63.81.20 50 52.139.37.240 28 203.54.180.238 8 118.127.40.55 5 35.231.130.18 4 134.185.86.231 4 114.119.143.14 2 91.92.243.249 2 209.141.33.142 2 2001:8004:14b3:854f:89bf:1540:714e:b0bd 2 162.144.20.85 --- top request paths across all vhosts (last 3 min) --- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 28 GET /heartbeat.php 9 GET /api/getItem/NA 7 GET /store/diamond-bling-laces/ 6 GET /wp-login.php 5 POST /wp-login.php 5 POST /wp-cron.php 5 POST /wp-admin/admin-ajax.php 5 POST / 5 GET / 4 GET /av.php 4 GET /api/getItem/PWFBW3151KG 3 GET /new.php 3 GET /@fs/proc/self/cwd/.env.production 3 GET /@fs/proc/self/cwd/.env 2 GET /zoo2.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 9 GET /api/getItem/NA 4 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 -- last 10 requests -- 40.115.94.245 - - [30/Aug/2026:13:01:14 +1000] "GET /api/getItem/RGW90 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:13:01:14 +1000] "GET /api/getItem/RGW100 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:13:01:14 +1000] "GET /api/getItem/RGW120 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:13:01:14 +1000] "GET /api/getItem/RGW160 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:13:01:14 +1000] "GET /api/getItem/RGW117T HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:13:01:14 +1000] "GET /api/getItem/RGW80 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:13:01:14 +1000] "GET /api/getItem/GP150x200x8 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:13:01:14 +1000] "GET /api/getItem/K125MSGB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:13:01:14 +1000] "GET /api/getItem/253-40SP HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:13:01:15 +1000] "GET /api/getItem/300558 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == customkidscom/customkids.com.au-ssl_log == -- top paths -- 2 GET /goods.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /x.php 1 GET /xmini4.php 1 GET /wsd.php 1 GET /ws85.php 1 GET /ws55.php 1 GET /wp-trackback.php 1 GET /wp-safe.php 1 GET /wp.php -- last 10 requests -- 52.139.44.162 - - [30/Aug/2026:13:01:24 +1000] "GET /blog.php HTTP/1.1" 404 5750 "-" "-" 52.139.44.162 - - [30/Aug/2026:13:01:25 +1000] "GET /wp-admin/js/wp-load.php HTTP/1.1" 404 5750 "-" "-" 52.139.44.162 - - [30/Aug/2026:13:01:25 +1000] "GET /robot.php HTTP/1.1" 404 5750 "-" "-" 52.139.44.162 - - [30/Aug/2026:13:01:25 +1000] "GET /revo.php HTTP/1.1" 404 5750 "-" "-" 52.139.44.162 - - [30/Aug/2026:13:01:26 +1000] "GET /birrs.php HTTP/1.1" 404 5750 "-" "-" 52.139.44.162 - - [30/Aug/2026:13:01:26 +1000] "GET /sss.php?p= HTTP/1.1" 404 5750 "-" "-" 52.139.44.162 - - [30/Aug/2026:13:01:27 +1000] "GET /wp-content/themes/gaukingo/ HTTP/1.1" 404 5750 "-" "-" 52.139.44.162 - - [30/Aug/2026:13:01:27 +1000] "GET /wp-includes/ID3/moon.php HTTP/1.1" 404 5750 "-" "-" 52.139.44.162 - - [30/Aug/2026:13:01:28 +1000] "GET /xmini4.php HTTP/1.1" 404 5750 "-" "-" 52.139.44.162 - - [30/Aug/2026:13:01:28 +1000] "GET /gulu.php HTTP/1.1" 404 5750 "-" "-" == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 4 POST / 3 GET /@fs/proc/self/cwd/.env.production 3 GET /@fs/proc/self/cwd/.env 2 POST /wp-login.php 2 GET /@fs/proc/self/cwd/.env.local 2 GET /.env.save 2 GET /.env.old 2 GET /.env.bak 2 GET /.env.backup 2 GET / 1 POST /wp-cron.php 1 GET /www.zip -- last 10 requests -- 34.125.154.25 - - [30/Aug/2026:13:00:20 +1000] "GET /public_html.zip HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.125.154.25 - - [30/Aug/2026:13:00:20 +1000] "GET /backup.tar.gz HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.125.154.25 - - [30/Aug/2026:13:00:21 +1000] "GET /@fs/proc/self/cwd/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.125.154.25 - - [30/Aug/2026:13:00:21 +1000] "GET /@fs/proc/self/cwd/.env?raw HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.125.154.25 - - [30/Aug/2026:13:00:21 +1000] "GET /@fs/proc/self/cwd/.env?import&raw HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/ 34.125.154.25 - - [30/Aug/2026:13:00:21 +1000] "GET /@fs/proc/self/cwd/.env.production HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/ 34.125.154.25 - - [30/Aug/2026:13:00:21 +1000] "GET /@fs/proc/self/cwd/.env.production?raw HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Saf 34.125.154.25 - - [30/Aug/2026:13:00:22 +1000] "GET /@fs/proc/self/cwd/.env.production?import&raw HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0. 34.125.154.25 - - [30/Aug/2026:13:00:22 +1000] "GET /@fs/proc/self/cwd/.env.local HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3 34.125.154.25 - - [30/Aug/2026:13:00:22 +1000] "GET /@fs/proc/self/cwd/.env.local?raw HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/5 --- last 30 samples (run-up to this incident) --- 2026-08-30 12:59:36 L1=1.48 run=3 blk=0 avail=8168 (59.3%) swpO=0 conn=4 myRSS=3014 php=5 phpRSS=367 ap=16 tcp=23 topuser=madalice 2026-08-30 12:59:36 L1=1.48 run=3 blk=0 avail=8168 (59.3%) swpO=0 conn=4 myRSS=3014 php=5 phpRSS=367 ap=16 tcp=23 topuser=madalice 2026-08-30 12:59:46 L1=1.49 run=3 blk=0 avail=8041 (58.4%) swpO=0 conn=4 myRSS=3014 php=5 phpRSS=496 ap=16 tcp=23 topuser=madalice 2026-08-30 12:59:46 L1=1.49 run=3 blk=0 avail=8041 (58.4%) swpO=0 conn=4 myRSS=3014 php=5 phpRSS=496 ap=16 tcp=23 topuser=madalice 2026-08-30 12:59:56 L1=1.41 run=3 blk=0 avail=8174 (59.3%) swpO=1 conn=4 myRSS=3014 php=4 phpRSS=214 ap=16 tcp=22 topuser=madalice 2026-08-30 12:59:56 L1=1.41 run=4 blk=0 avail=8174 (59.3%) swpO=1 conn=1 myRSS=3014 php=4 phpRSS=214 ap=16 tcp=22 topuser=madalice 2026-08-30 13:00:06 L1=1.83 run=5 blk=0 avail=8195 (59.5%) swpO=1 conn=1 myRSS=3014 php=6 phpRSS=376 ap=16 tcp=26 topuser=madalice 2026-08-30 13:00:06 L1=1.83 run=7 blk=0 avail=8186 (59.4%) swpO=1 conn=4 myRSS=3014 php=5 phpRSS=338 ap=16 tcp=26 topuser=madalice 2026-08-30 13:00:16 L1=2.09 run=3 blk=0 avail=8170 (59.3%) swpO=0 conn=1 myRSS=3014 php=5 phpRSS=345 ap=16 tcp=30 topuser=madalice 2026-08-30 13:00:16 L1=2.09 run=3 blk=0 avail=8170 (59.3%) swpO=0 conn=3 myRSS=3014 php=5 phpRSS=345 ap=16 tcp=30 topuser=madalice 2026-08-30 13:00:26 L1=2.23 run=3 blk=1 avail=8140 (59.1%) swpO=0 conn=1 myRSS=3014 php=4 phpRSS=333 ap=17 tcp=27 topuser=madalice 2026-08-30 13:00:26 L1=2.23 run=6 blk=0 avail=8145 (59.1%) swpO=0 conn=3 myRSS=3014 php=4 phpRSS=335 ap=17 tcp=27 topuser=madalice 2026-08-30 13:00:36 L1=2.12 run=1 blk=0 avail=8264 (60.0%) swpO=0 conn=1 myRSS=3014 php=4 phpRSS=208 ap=17 tcp=24 topuser=madalice 2026-08-30 13:00:36 L1=2.12 run=7 blk=0 avail=8256 (59.9%) swpO=0 conn=3 myRSS=3014 php=4 phpRSS=232 ap=17 tcp=24 topuser=madalice 2026-08-30 13:00:46 L1=2.02 run=1 blk=0 avail=8269 (60.0%) swpO=0 conn=1 myRSS=3014 php=4 phpRSS=216 ap=16 tcp=26 topuser=madalice 2026-08-30 13:00:46 L1=2.02 run=3 blk=0 avail=8258 (59.9%) swpO=0 conn=3 myRSS=3014 php=3 phpRSS=190 ap=16 tcp=26 topuser=madalice 2026-08-30 13:00:56 L1=2.10 run=2 blk=0 avail=8031 (58.3%) swpO=0 conn=2 myRSS=3014 php=4 phpRSS=433 ap=18 tcp=28 topuser=corpkicks 2026-08-30 13:00:56 L1=2.10 run=3 blk=0 avail=8041 (58.4%) swpO=0 conn=3 myRSS=3014 php=5 phpRSS=467 ap=18 tcp=28 topuser=corpkicks 2026-08-30 13:01:06 L1=2.09 run=1 blk=0 avail=8286 (60.1%) swpO=0 conn=2 myRSS=3014 php=4 phpRSS=179 ap=18 tcp=28 topuser=madalice 2026-08-30 13:01:06 L1=2.09 run=5 blk=0 avail=8279 (60.1%) swpO=0 conn=3 myRSS=3014 php=4 phpRSS=206 ap=18 tcp=26 topuser=madalice 2026-08-30 13:01:17 L1=2.23 run=7 blk=0 avail=7905 (57.4%) swpO=1 conn=2 myRSS=3014 php=5 phpRSS=593 ap=18 tcp=27 topuser=madalice 2026-08-30 13:01:17 L1=2.23 run=5 blk=0 avail=7910 (57.4%) swpO=1 conn=2 myRSS=3014 php=5 phpRSS=577 ap=18 tcp=27 topuser=madalice 2026-08-30 13:01:27 L1=1.89 run=1 blk=0 avail=8150 (59.2%) swpO=0 conn=2 myRSS=3014 php=4 phpRSS=324 ap=18 tcp=24 topuser=madalice 2026-08-30 13:01:27 L1=1.89 run=2 blk=0 avail=8152 (59.2%) swpO=0 conn=2 myRSS=3014 php=4 phpRSS=324 ap=18 tcp=24 topuser=madalice 2026-08-30 13:01:37 L1=1.75 run=2 blk=0 avail=8143 (59.1%) swpO=0 conn=2 myRSS=3014 php=4 phpRSS=323 ap=19 tcp=24 topuser=madalice 2026-08-30 13:01:37 L1=1.75 run=2 blk=0 avail=8143 (59.1%) swpO=0 conn=2 myRSS=3014 php=4 phpRSS=323 ap=19 tcp=24 topuser=madalice 2026-08-30 13:01:47 L1=1.55 run=6 blk=0 avail=7435 (54.0%) swpO=0 conn=2 myRSS=3014 php=10 phpRSS=1153 ap=21 tcp=36 topuser=madalice 2026-08-30 13:01:47 L1=1.55 run=9 blk=0 avail=7431 (53.9%) swpO=0 conn=2 myRSS=3014 php=10 phpRSS=1154 ap=21 tcp=36 topuser=madalice 2026-08-30 13:01:57 L1=1.68 run=12 blk=0 avail=6489 (47.1%) swpO=0 conn=7 myRSS=3014 php=12 phpRSS=1996 ap=31 tcp=47 topuser=madalice 2026-08-30 13:01:57 L1=1.68 run=17 blk=0 avail=6487 (47.1%) swpO=0 conn=7 myRSS=3014 php=12 phpRSS=2005 ap=31 tcp=47 topuser=madalice