INCIDENT 2026-08-30 14:02:54 trigger: php_rss=1655MB ================================================================== load: 2.86 1.75 1.38 5/659 459493 ncpu:10 mem_avail: 6888MB/13777MB (50.0%) swap_used:1767MB swapout:0/s blocked(D):0 running:7 iowait:0.0% steal:0.0% php: 11 procs / 1655MB heaviest user: madalice (8 procs, 1543MB) apache: 30 procs tcp_estab: 35 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3018 madalice 8 1374 root 247 986 nobody 29 511 netdata 7 198 mailman 20 121 alison 2 96 cpanellogin 1 75 dovenull 6 46 mailnull 2 45 wp-toolkit 3 31 kurri 2 27 evolution 5 22 vinesit 1 21 zabbix 1 20 dovecot 3 19 named 1 15 lowrange 1 14 candyfabcom 1 14 polkitd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 8 1376 alison 1 83 root 1 22 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5240 MB Active(file): 4708 MB Inactive(file): 945 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 603 MB CommitLimit: 10984 MB Committed_AS: 8267 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 443313 root 02:53 1240 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 489033 root 2-11:44:15 7704 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3091076 7.2 Ssl 2-11:43:44 /usr/sbin/mariadbd 2328310 2277352 root 207808 0.0 S 11:24:44 spamd child 459136 510022 madalice 197344 30.2 R 00:51 php-fpm: pool madalice_com_au 508924 1 netdata 178168 1.9 Ssl 2-11:43:13 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175488 0.0 Ss 11:39:50 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 459405 510022 madalice 166920 53.9 R 00:10 php-fpm: pool madalice_com_au 2328311 2277352 root 164216 0.0 S 11:24:44 spamd child 458557 510022 madalice 162764 16.8 S 01:48 php-fpm: pool madalice_com_au 459401 510022 madalice 159612 54.1 S 00:11 php-fpm: pool madalice_com_au 459404 510022 madalice 159520 54.3 S 00:11 php-fpm: pool madalice_com_au 459402 510022 madalice 159516 54.8 S 00:11 php-fpm: pool madalice_com_au 459403 510022 madalice 159420 55.8 S 00:11 php-fpm: pool madalice_com_au 459400 510022 madalice 159412 52.7 R 00:11 php-fpm: pool madalice_com_au 459464 459459 alison 91012 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4027958 1353308 cpanellogin 77296 0.0 S 03:04:41 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 509236 509098 root 52956 0.0 Sl 2-11:43:10 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 49684 0.0 Sl 2-11:43:08 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42536 0.1 Ss 39-11:21:36 cpsrvd (SSL) - waiting for connections 2275833 1 root 35932 0.0 Ss 11:40:40 lfd - sleeping 508720 1 mailnull 25296 0.0 Ss 2-11:43:17 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 24048 0.1 Ss 62-03:53:05 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 442833 506832 nobody 23616 0.0 S 03:39 /usr/sbin/httpd -k start 510022 1 root 23340 0.0 Ss 2-11:43:06 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 442832 506832 nobody 23036 0.1 S 03:39 /usr/sbin/httpd -k start 425659 508511 vinesit 22336 0.0 S 09:17 dovecot/imap 442834 506832 nobody 22072 0.2 S 03:39 /usr/sbin/httpd -k start 1463 1 root 21968 0.0 Ss 62-03:53:05 tailwatchd 442830 506832 nobody 21740 0.3 S 03:40 /usr/sbin/httpd -k start 458620 506832 nobody 21568 0.1 S 01:45 /usr/sbin/httpd -k start 458582 506832 nobody 21172 0.0 S 01:47 /usr/sbin/httpd -k start 459456 508720 mailnull 20940 0.0 S 00:07 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 442968 506832 nobody 20832 0.2 S 03:25 /usr/sbin/httpd -k start 483898 1 zabbix 20628 0.2 Ssl 2-11:44:27 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 458818 506832 nobody 20348 0.0 S 01:27 /usr/sbin/httpd -k start 459385 506832 nobody 20324 0.3 S 00:16 /usr/sbin/httpd -k start 459455 506832 nobody 20076 0.2 S 00:07 /usr/sbin/httpd -k start 459389 506832 nobody 20072 0.3 S 00:16 /usr/sbin/httpd -k start 459390 506832 nobody 20036 0.3 S 00:16 /usr/sbin/httpd -k start 459377 506832 nobody 19852 0.0 S 00:18 /usr/sbin/httpd -k start 459257 506832 nobody 19716 0.0 S 00:40 /usr/sbin/httpd -k start 459379 506832 nobody 19208 0.1 S 00:17 /usr/sbin/httpd -k start 459387 506832 nobody 19116 0.1 S 00:16 /usr/sbin/httpd -k start 459381 506832 nobody 19068 0.1 S 00:17 /usr/sbin/httpd -k start 459378 506832 nobody 18964 0.1 S 00:18 /usr/sbin/httpd -k start 459454 506832 nobody 18952 0.1 S 00:07 /usr/sbin/httpd -k start 459380 506832 nobody 18944 0.1 S 00:17 /usr/sbin/httpd -k start 459324 506832 nobody 18868 0.0 S 00:21 /usr/sbin/httpd -k start 459376 506832 nobody 18852 0.0 S 00:19 /usr/sbin/httpd -k start 459382 506832 nobody 18808 0.1 S 00:17 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18068 0.0 Ss 2-09:50:47 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 459391 506832 nobody 17860 0.0 S 00:16 /usr/sbin/httpd -k start 1471 1 root 16968 0.0 Ss 62-03:53:05 cPhulkd - processor 3446928 1471 root 16856 0.0 S 05:57:05 cPhulkd - dbprocessor 459453 506832 nobody 16632 0.0 S 00:08 /usr/sbin/httpd -k start 459459 506832 nobody 16552 0.0 S 00:05 /usr/sbin/httpd -k start 3960981 508511 kurri 16160 0.0 S 03:23:00 dovecot/imap 509671 508992 netdata 15780 2.1 Sl 2-11:43:08 /usr/libexec/netdata/plugins.d/apps.plugin 1 508634 1 named 15660 0.0 Ssl 2-11:43:18 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 306633 508511 alison 15336 0.0 S 46:27 dovecot/imap 459461 1471 root 15220 0.0 S 00:02 cPhulkd - processor - http socket --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4527156 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 1072 madalice/madalice.com.au-ssl_log 87 evolution/portal.evolutionerp.com.au-ssl_log 28 tubesupplies/tubesupplies.com.au-ssl_log 25 evolution/my.evolutionerp.com.au-ssl_log 4 aaa/aaadownunder.com.au-ssl_log 3 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 1072 40.115.94.245 68 34.175.206.134 28 203.54.180.238 24 34.65.71.202 4 101.118.119.49 3 118.127.40.55 2 114.119.159.70 2 114.119.146.16 1 52.167.144.218 1 45.162.210.114 1 45.148.10.120 1 43.173.182.150 1 43.173.179.182 1 43.172.194.81 1 40.77.167.35 --- top request paths across all vhosts (last 3 min) --- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 28 GET /heartbeat.php 9 GET /api/getItem/NA 7 POST / 6 GET /store/custom-melbourne-kids/ 6 GET / 4 GET /index.php 4 GET /api/getItem/PWFBW3151KG 3 GET /@fs/proc/self/environ 3 GET /@fs/proc/self/cwd/.env.production 3 GET /@fs/proc/self/cwd/.env.local 3 GET /@fs/proc/self/cwd/.env 3 GET /@fs/etc/passwd 2 POST /wp-cron.php 2 GET /store/custom-melbourne-storm-kids/ 2 GET /.git/config --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 9 GET /api/getItem/NA 4 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 -- last 10 requests -- 40.115.94.245 - - [30/Aug/2026:14:01:12 +1000] "GET /api/getItem/K150MSGB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:14:01:12 +1000] "GET /api/getItem/RGW90 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:14:01:12 +1000] "GET /api/getItem/RGW100 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:14:01:12 +1000] "GET /api/getItem/RGW120 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:14:01:12 +1000] "GET /api/getItem/RGW160 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:14:01:12 +1000] "GET /api/getItem/RGW117T HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:14:01:13 +1000] "GET /api/getItem/RGW80 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:14:01:13 +1000] "GET /api/getItem/GP150x200x8 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:14:01:13 +1000] "GET /api/getItem/K125MSGB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:14:01:13 +1000] "GET /api/getItem/253-40SP HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == madalice/madalice.com.au-ssl_log == -- top paths -- 7 POST / 6 GET /store/custom-melbourne-kids/ 5 GET / 2 GET /store/custom-melbourne-storm-kids/ 2 GET /.git/config 1 GET /www.zip 1 GET /www/.env 1 GET /wp-json/wp/v2/posts/26466 1 GET /wp-json/wc/store/v1/cart 1 GET /wp-config.php.txt 1 GET /wp-config.php.orig 1 GET /wp-config.php.old -- last 10 requests -- 34.175.206.134 - - [30/Aug/2026:14:02:50 +1000] "GET /config/config.php HTTP/1.1" 404 36645 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.206.134 - - [30/Aug/2026:14:02:51 +1000] "GET /config/database.php HTTP/1.1" 404 36650 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.206.134 - - [30/Aug/2026:14:02:51 +1000] "GET /config/app.php HTTP/1.1" 404 36650 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.206.134 - - [30/Aug/2026:14:02:51 +1000] "GET /database.php HTTP/1.1" 404 36644 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.206.134 - - [30/Aug/2026:14:02:51 +1000] "GET /db.php HTTP/1.1" 404 36644 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.206.134 - - [30/Aug/2026:14:02:51 +1000] "GET /db_config.php HTTP/1.1" 404 36649 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.206.134 - - [30/Aug/2026:14:02:52 +1000] "GET /database.yml HTTP/1.1" 404 36648 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.206.134 - - [30/Aug/2026:14:02:52 +1000] "GET /config/database.yml HTTP/1.1" 404 36652 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.206.134 - - [30/Aug/2026:14:02:52 +1000] "GET /config.yml HTTP/1.1" 404 36648 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.206.134 - - [30/Aug/2026:14:02:53 +1000] "GET /config.yaml HTTP/1.1" 404 36647 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 28 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [30/Aug/2026:14:01:33 +1000] "GET /heartbeat.php?sentAt=1788062493&bytes=106,147,171,29&_=1787897056900 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:14:01:33 +1000] "GET /heartbeat.php?sentAt=1788062493&bytes=106,147,171,29&_=1787918095385 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:14:01:43 +1000] "GET /heartbeat.php?sentAt=1788062503&bytes=106,147,171,39&_=1787897056901 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:14:01:43 +1000] "GET /heartbeat.php?sentAt=1788062503&bytes=106,147,171,39&_=1787918095386 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:14:01:53 +1000] "GET /heartbeat.php?sentAt=1788062513&bytes=106,147,171,49&_=1787897056902 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:14:01:53 +1000] "GET /heartbeat.php?sentAt=1788062513&bytes=106,147,171,49&_=1787918095387 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:14:02:03 +1000] "GET /heartbeat.php?sentAt=1788062523&bytes=106,147,171,59&_=1787897056903 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:14:02:03 +1000] "GET /heartbeat.php?sentAt=1788062523&bytes=106,147,171,59&_=1787918095388 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:14:02:13 +1000] "GET /heartbeat.php?sentAt=1788062533&bytes=106,147,171,69&_=1787897056904 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:14:02:13 +1000] "GET /heartbeat.php?sentAt=1788062533&bytes=106,147,171,69&_=1787918095389 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-08-30 14:00:24 L1=2.45 run=3 blk=0 avail=8261 (60.0%) swpO=0 conn=8 myRSS=3018 php=5 phpRSS=268 ap=16 tcp=23 topuser=madalice 2026-08-30 14:00:34 L1=2.33 run=3 blk=0 avail=8249 (59.9%) swpO=0 conn=5 myRSS=3018 php=6 phpRSS=299 ap=16 tcp=23 topuser=madalice 2026-08-30 14:00:34 L1=2.22 run=3 blk=0 avail=8260 (60.0%) swpO=0 conn=1 myRSS=3018 php=5 phpRSS=267 ap=16 tcp=23 topuser=madalice 2026-08-30 14:00:44 L1=2.12 run=2 blk=0 avail=8380 (60.8%) swpO=0 conn=5 myRSS=3018 php=5 phpRSS=150 ap=16 tcp=23 topuser=evolution 2026-08-30 14:00:44 L1=1.95 run=4 blk=0 avail=8354 (60.6%) swpO=0 conn=1 myRSS=3018 php=3 phpRSS=108 ap=16 tcp=23 topuser=tubesupplies 2026-08-30 14:00:54 L1=1.88 run=2 blk=0 avail=8265 (60.0%) swpO=0 conn=5 myRSS=3018 php=5 phpRSS=248 ap=15 tcp=26 topuser=madalice 2026-08-30 14:00:54 L1=1.81 run=3 blk=0 avail=8266 (60.0%) swpO=0 conn=1 myRSS=3018 php=5 phpRSS=267 ap=15 tcp=25 topuser=madalice 2026-08-30 14:01:04 L1=1.76 run=5 blk=0 avail=8165 (59.3%) swpO=0 conn=5 myRSS=3018 php=6 phpRSS=368 ap=16 tcp=26 topuser=madalice 2026-08-30 14:01:04 L1=1.76 run=2 blk=0 avail=8261 (60.0%) swpO=0 conn=1 myRSS=3018 php=3 phpRSS=190 ap=16 tcp=25 topuser=madalice 2026-08-30 14:01:14 L1=1.87 run=2 blk=0 avail=8052 (58.4%) swpO=0 conn=4 myRSS=3018 php=7 phpRSS=485 ap=21 tcp=28 topuser=madalice 2026-08-30 14:01:14 L1=1.87 run=2 blk=0 avail=8037 (58.3%) swpO=0 conn=1 myRSS=3018 php=6 phpRSS=450 ap=21 tcp=27 topuser=madalice 2026-08-30 14:01:24 L1=1.66 run=3 blk=0 avail=8098 (58.8%) swpO=0 conn=4 myRSS=3018 php=7 phpRSS=490 ap=14 tcp=25 topuser=madalice 2026-08-30 14:01:24 L1=1.66 run=3 blk=0 avail=8009 (58.1%) swpO=0 conn=1 myRSS=3018 php=5 phpRSS=520 ap=14 tcp=25 topuser=madalice 2026-08-30 14:01:34 L1=1.48 run=1 blk=0 avail=8140 (59.1%) swpO=0 conn=4 myRSS=3018 php=6 phpRSS=425 ap=13 tcp=25 topuser=madalice 2026-08-30 14:01:34 L1=1.48 run=1 blk=0 avail=8161 (59.2%) swpO=0 conn=1 myRSS=3018 php=4 phpRSS=345 ap=13 tcp=25 topuser=madalice 2026-08-30 14:01:44 L1=1.25 run=1 blk=0 avail=8134 (59.0%) swpO=0 conn=4 myRSS=3018 php=6 phpRSS=425 ap=13 tcp=25 topuser=madalice 2026-08-30 14:01:45 L1=1.25 run=1 blk=0 avail=8157 (59.2%) swpO=0 conn=1 myRSS=3018 php=4 phpRSS=345 ap=13 tcp=25 topuser=madalice 2026-08-30 14:01:54 L1=1.13 run=1 blk=0 avail=8286 (60.1%) swpO=0 conn=4 myRSS=3018 php=4 phpRSS=231 ap=13 tcp=20 topuser=madalice 2026-08-30 14:01:55 L1=1.13 run=1 blk=0 avail=8298 (60.2%) swpO=0 conn=1 myRSS=3018 php=3 phpRSS=191 ap=13 tcp=20 topuser=madalice 2026-08-30 14:02:04 L1=1.19 run=2 blk=0 avail=8041 (58.4%) swpO=0 conn=4 myRSS=3018 php=5 phpRSS=435 ap=13 tcp=22 topuser=madalice 2026-08-30 14:02:05 L1=1.19 run=1 blk=0 avail=8125 (59.0%) swpO=0 conn=1 myRSS=3018 php=4 phpRSS=321 ap=13 tcp=22 topuser=madalice 2026-08-30 14:02:14 L1=1.16 run=2 blk=0 avail=8125 (59.0%) swpO=0 conn=2 myRSS=3018 php=5 phpRSS=391 ap=13 tcp=24 topuser=madalice 2026-08-30 14:02:15 L1=1.16 run=3 blk=0 avail=8065 (58.5%) swpO=0 conn=1 myRSS=3018 php=5 phpRSS=472 ap=13 tcp=24 topuser=madalice 2026-08-30 14:02:24 L1=0.98 run=1 blk=0 avail=8150 (59.2%) swpO=0 conn=2 myRSS=3018 php=4 phpRSS=347 ap=14 tcp=21 topuser=madalice 2026-08-30 14:02:25 L1=0.98 run=1 blk=0 avail=8149 (59.2%) swpO=0 conn=1 myRSS=3018 php=4 phpRSS=347 ap=14 tcp=21 topuser=madalice 2026-08-30 14:02:34 L1=1.14 run=2 blk=0 avail=8098 (58.8%) swpO=0 conn=2 myRSS=3018 php=4 phpRSS=396 ap=15 tcp=26 topuser=madalice 2026-08-30 14:02:35 L1=1.14 run=1 blk=0 avail=8137 (59.1%) swpO=0 conn=1 myRSS=3018 php=4 phpRSS=351 ap=15 tcp=25 topuser=madalice 2026-08-30 14:02:44 L1=1.75 run=11 blk=0 avail=7083 (51.4%) swpO=1 conn=2 myRSS=3018 php=10 phpRSS=1452 ap=27 tcp=34 topuser=madalice 2026-08-30 14:02:45 L1=1.75 run=6 blk=0 avail=7128 (51.7%) swpO=1 conn=1 myRSS=3018 php=10 phpRSS=1397 ap=27 tcp=33 topuser=madalice 2026-08-30 14:02:54 L1=2.86 run=7 blk=0 avail=6888 (50.0%) swpO=0 conn=5 myRSS=3018 php=11 phpRSS=1655 ap=30 tcp=35 topuser=madalice