INCIDENT 2026-08-30 14:03:55 trigger: php_rss=1614MB ================================================================== load: 2.33 1.86 1.44 2/644 460118 ncpu:10 mem_avail: 7053MB/13777MB (51.2%) swap_used:1767MB swapout:0/s blocked(D):0 running:4 iowait:0.1% steal:0.0% php: 12 procs / 1614MB heaviest user: madalice (10 procs, 1578MB) apache: 17 procs tcp_estab: 24 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3018 madalice 10 1579 root 248 985 nobody 16 287 netdata 7 197 mailman 20 121 cpanellogin 1 75 dovenull 6 46 wp-toolkit 3 31 kurri 2 27 mailnull 1 24 evolution 5 22 vinesit 1 21 zabbix 1 20 dovecot 3 19 named 1 15 lowrange 1 14 alison 1 14 polkitd 1 5 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1579 root 1 22 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5207 MB Active(file): 4707 MB Inactive(file): 945 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 603 MB CommitLimit: 10984 MB Committed_AS: 8072 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 443313 root 03:54 1240 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 489033 root 2-11:45:16 7704 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3091068 7.2 Ssl 2-11:44:45 /usr/sbin/mariadbd 2328310 2277352 root 207808 0.0 S 11:25:45 spamd child 508924 1 netdata 177980 1.9 Ssl 2-11:44:14 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175488 0.0 Ss 11:40:51 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 458557 510022 madalice 169664 19.3 R 02:49 php-fpm: pool madalice_com_au 2328311 2277352 root 164208 0.0 S 11:25:45 spamd child 459136 510022 madalice 162792 26.6 S 01:52 php-fpm: pool madalice_com_au 459400 510022 madalice 162244 29.1 S 01:12 php-fpm: pool madalice_com_au 459401 510022 madalice 161284 27.6 S 01:12 php-fpm: pool madalice_com_au 459402 510022 madalice 161268 28.0 S 01:12 php-fpm: pool madalice_com_au 459403 510022 madalice 161260 27.8 S 01:12 php-fpm: pool madalice_com_au 459405 510022 madalice 160292 28.0 S 01:11 php-fpm: pool madalice_com_au 459404 510022 madalice 160136 28.8 S 01:12 php-fpm: pool madalice_com_au 459883 510022 madalice 160056 10.5 S 00:36 php-fpm: pool madalice_com_au 459877 510022 madalice 159960 13.8 S 00:36 php-fpm: pool madalice_com_au 4027958 1353308 cpanellogin 77296 0.0 S 03:05:42 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 509236 509098 root 52956 0.0 Sl 2-11:44:11 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 49684 0.0 Sl 2-11:44:09 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42536 0.1 Ss 39-11:22:37 cpsrvd (SSL) - waiting for connections 2275833 1 root 35932 0.0 Ss 11:41:41 lfd - sleeping 508720 1 mailnull 25296 0.0 Ss 2-11:44:18 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 24048 0.1 Ss 62-03:54:06 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 442833 506832 nobody 24048 0.0 S 04:40 /usr/sbin/httpd -k start 510022 1 root 23340 0.0 Ss 2-11:44:07 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 425659 508511 vinesit 22336 0.0 S 10:18 dovecot/imap 442834 506832 nobody 22084 0.2 S 04:40 /usr/sbin/httpd -k start 1463 1 root 21968 0.0 Ss 62-03:54:06 tailwatchd 442830 506832 nobody 21852 0.3 S 04:41 /usr/sbin/httpd -k start 459387 506832 nobody 20812 0.0 S 01:17 /usr/sbin/httpd -k start 483898 1 zabbix 20804 0.2 Ssl 2-11:45:28 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 459389 506832 nobody 20424 0.1 S 01:17 /usr/sbin/httpd -k start 459379 506832 nobody 20392 0.2 S 01:18 /usr/sbin/httpd -k start 459381 506832 nobody 20392 0.0 S 01:18 /usr/sbin/httpd -k start 459455 506832 nobody 20228 0.2 S 01:08 /usr/sbin/httpd -k start 459874 506832 nobody 20192 0.0 S 00:39 /usr/sbin/httpd -k start 459390 506832 nobody 20036 0.3 S 01:17 /usr/sbin/httpd -k start 459391 506832 nobody 19592 0.0 S 01:17 /usr/sbin/httpd -k start 459875 506832 nobody 19380 0.0 S 00:39 /usr/sbin/httpd -k start 459888 506832 nobody 19216 0.0 S 00:35 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18068 0.0 Ss 2-09:51:48 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 459873 506832 nobody 17648 0.0 S 00:39 /usr/sbin/httpd -k start 1471 1 root 16968 0.0 Ss 62-03:54:06 cPhulkd - processor 3446928 1471 root 16856 0.0 S 05:58:06 cPhulkd - dbprocessor 3960981 508511 kurri 16160 0.0 S 03:24:01 dovecot/imap 509671 508992 netdata 15776 2.1 Sl 2-11:44:09 /usr/libexec/netdata/plugins.d/apps.plugin 1 508634 1 named 15660 0.0 Ssl 2-11:44:19 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 306633 508511 alison 15336 0.0 S 47:28 dovecot/imap 460084 1471 root 14544 0.0 S 00:08 cPhulkd - processor - http socket 390314 508511 lowrange 14500 0.0 S 22:10 dovecot/imap 4180059 4180015 evolution 13364 0.0 Ss 2-14:03:56 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 459320 508511 root 12832 0.0 S 01:25 dovecot/auth -w 3883280 508511 kurri 12364 0.0 S 1-00:02:06 dovecot/imap 938585 1 wp-toolkit 11432 0.0 Ss 2-09:51:48 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 508518 508511 dovenull 10868 0.0 S 2-11:44:19 dovecot/imap-login 506832 1 root 10216 0.0 Ss 2-11:44:44 /usr/sbin/httpd -k start 508514 508511 dovenull 10000 0.0 S 2-11:44:19 dovecot/imap-login 508529 508511 dovecot 9476 0.0 S 2-11:44:19 dovecot/auth 481558 1 root 9412 0.1 Ssl 2-11:46:38 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 454473 1 root 9076 0.0 Ss 2-11:50:19 queueprocd - waiting up to 60s to process a task 508519 508511 dovenull 8888 0.0 S 2-11:44:19 dovecot/pop3-login --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4527323 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 215 madalice/madalice.com.au-ssl_log 170 evolution/portal.evolutionerp.com.au-ssl_log 26 tubesupplies/tubesupplies.com.au-ssl_log 13 aaa/aaadownunder.com.au-ssl_log 9 corpkicks/corporatekicks.com.au-ssl_log 2 nrg/nrgservices.net.au-ssl_log 2 olympic/olympicfencing.com.au-ssl_log 2 speedlin/speedlinefencing.com.au-ssl_log 2 alison/alisonarts.com.au-ssl_log 1 infinium/infinium.net.au-ssl_log 1 kamcool/kamcool.com.au-ssl_log 1 kurri/kurrimotorinn.com.au 1 olympic/olympicfencing.com.au 1 (total vhosts taking traffic: 14) --- top client IPs across all vhosts (last 3 min) --- 215 40.115.94.245 144 34.175.206.134 26 203.54.180.238 13 118.127.40.55 12 34.65.71.202 4 206.189.22.215 4 101.118.119.49 3 45.148.10.120 2 82.80.249.243 2 45.59.124.89 2 216.73.216.20 2 194.59.31.219 2 114.119.159.70 2 114.119.146.16 2 114.119.130.40 --- top request paths across all vhosts (last 3 min) --- 103 GET /api/getItem/LWFBW2001KG 26 GET /heartbeat.php 14 GET / 13 POST / 7 GET /store/custom-melbourne-kids/ 6 POST /wp-cron.php 4 POST /wp-login.php 4 GET /.git/config 2 GET /dashboard 2 GET /api/getItem/IPC2525 2 GET /api/getItem/GEB12-DL 2 GET /admin 1 POST /wp-admin/admin-ajax.php 1 HEAD / 1 GET /.zsh_history 1 GET /www.zip 1 GET /www/.env 1 GET /wp.sql 1 GET /wp-json/wp/v2/posts/26466 1 GET /wp-json/wc/store/v1/cart --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 103 GET /api/getItem/LWFBW2001KG 2 GET /api/getItem/IPC2525 2 GET /api/getItem/GEB12-DL 1 GET /api/getItem/SPHDG15040 1 GET /api/getItem/SGC-100 1 GET /api/getItem/S6 1 GET /api/getItem/S5 1 GET /api/getItem/S4 1 GET /api/getItem/S3 1 GET /api/getItem/S2 1 GET /api/getItem/S1 1 GET /api/getItem/RGW90 -- last 10 requests -- 40.115.94.245 - - [30/Aug/2026:14:01:14 +1000] "GET /api/getItem/PC15050 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:14:01:14 +1000] "GET /api/getItem/PC16 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:14:01:14 +1000] "GET /api/getItem/PC19 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:14:01:14 +1000] "GET /api/getItem/PC5025BL HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:14:01:14 +1000] "GET /api/getItem/PC7550 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:14:01:14 +1000] "GET /api/getItem/HCR-32 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:14:01:14 +1000] "GET /api/getItem/HCR-25 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:14:01:15 +1000] "GET /api/getItem/HCR-40 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:14:01:15 +1000] "GET /api/getItem/L2 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:14:01:15 +1000] "GET /api/getItem/FBM1230G HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == madalice/madalice.com.au-ssl_log == -- top paths -- 13 POST / 7 GET /store/custom-melbourne-kids/ 6 GET / 2 GET /.git/config 1 GET /.zsh_history 1 GET /www.zip 1 GET /www/.env 1 GET /wp.sql 1 GET /wp-json/wp/v2/posts/26466 1 GET /wp-json/wc/store/v1/cart 1 GET /wp-content/debug.log 1 GET /wp-config.php.txt -- last 10 requests -- 118.127.40.55 - - [30/Aug/2026:14:03:20 +1000] "POST /?wordfence_syncAttackData=1788062600.2167 HTTP/1.1" 200 42773 "-" "WordPress/7.1; https://madalice.com.au" 34.175.206.134 - - [30/Aug/2026:14:03:19 +1000] "GET /configuration.php~ HTTP/1.1" 404 36650 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.206.134 - - [30/Aug/2026:14:03:19 +1000] "GET /configuration.php.old HTTP/1.1" 404 36652 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 118.127.40.55 - - [30/Aug/2026:14:03:20 +1000] "POST /?wordfence_syncAttackData=1788062600.2449 HTTP/1.1" 200 42766 "-" "WordPress/7.1; https://madalice.com.au" 118.127.40.55 - - [30/Aug/2026:14:03:20 +1000] "POST /?wordfence_syncAttackData=1788062600.2969 HTTP/1.1" 200 42774 "-" "WordPress/7.1; https://madalice.com.au" 34.175.206.134 - - [30/Aug/2026:14:03:21 +1000] "GET /config.inc.php.bak HTTP/1.1" 404 36651 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.206.134 - - [30/Aug/2026:14:03:21 +1000] "GET /config.inc.php~ HTTP/1.1" 404 36650 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.206.134 - - [30/Aug/2026:14:03:22 +1000] "GET /sites/default/settings.local.php HTTP/1.1" 404 36656 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537 34.175.206.134 - - [30/Aug/2026:14:03:22 +1000] "GET /settings.php HTTP/1.1" 404 36642 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.175.206.134 - - [30/Aug/2026:14:03:23 +1000] "GET /wp-content/debug.log HTTP/1.1" 404 36650 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 26 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [30/Aug/2026:14:02:23 +1000] "GET /heartbeat.php?sentAt=1788062543&bytes=106,147,171,79&_=1787897056905 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:14:02:23 +1000] "GET /heartbeat.php?sentAt=1788062543&bytes=106,147,171,79&_=1787918095390 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:14:02:33 +1000] "GET /heartbeat.php?sentAt=1788062553&bytes=106,147,171,89&_=1787897056906 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:14:02:33 +1000] "GET /heartbeat.php?sentAt=1788062553&bytes=106,147,171,89&_=1787918095391 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:14:02:43 +1000] "GET /heartbeat.php?sentAt=1788062563&bytes=106,147,171,99&_=1787897056907 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:14:02:43 +1000] "GET /heartbeat.php?sentAt=1788062563&bytes=106,147,171,99&_=1787918095392 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:14:02:53 +1000] "GET /heartbeat.php?sentAt=1788062573&bytes=106,147,171,109&_=1787897056908 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:14:02:53 +1000] "GET /heartbeat.php?sentAt=1788062573&bytes=106,147,171,109&_=1787918095393 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:14:03:03 +1000] "GET /heartbeat.php?sentAt=1788062583&bytes=106,147,171,119&_=1787897056909 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:14:03:03 +1000] "GET /heartbeat.php?sentAt=1788062583&bytes=106,147,171,119&_=1787918095394 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 --- last 30 samples (run-up to this incident) --- 2026-08-30 14:01:34 L1=1.48 run=1 blk=0 avail=8140 (59.1%) swpO=0 conn=4 myRSS=3018 php=6 phpRSS=425 ap=13 tcp=25 topuser=madalice 2026-08-30 14:01:34 L1=1.48 run=1 blk=0 avail=8161 (59.2%) swpO=0 conn=1 myRSS=3018 php=4 phpRSS=345 ap=13 tcp=25 topuser=madalice 2026-08-30 14:01:44 L1=1.25 run=1 blk=0 avail=8134 (59.0%) swpO=0 conn=4 myRSS=3018 php=6 phpRSS=425 ap=13 tcp=25 topuser=madalice 2026-08-30 14:01:45 L1=1.25 run=1 blk=0 avail=8157 (59.2%) swpO=0 conn=1 myRSS=3018 php=4 phpRSS=345 ap=13 tcp=25 topuser=madalice 2026-08-30 14:01:54 L1=1.13 run=1 blk=0 avail=8286 (60.1%) swpO=0 conn=4 myRSS=3018 php=4 phpRSS=231 ap=13 tcp=20 topuser=madalice 2026-08-30 14:01:55 L1=1.13 run=1 blk=0 avail=8298 (60.2%) swpO=0 conn=1 myRSS=3018 php=3 phpRSS=191 ap=13 tcp=20 topuser=madalice 2026-08-30 14:02:04 L1=1.19 run=2 blk=0 avail=8041 (58.4%) swpO=0 conn=4 myRSS=3018 php=5 phpRSS=435 ap=13 tcp=22 topuser=madalice 2026-08-30 14:02:05 L1=1.19 run=1 blk=0 avail=8125 (59.0%) swpO=0 conn=1 myRSS=3018 php=4 phpRSS=321 ap=13 tcp=22 topuser=madalice 2026-08-30 14:02:14 L1=1.16 run=2 blk=0 avail=8125 (59.0%) swpO=0 conn=2 myRSS=3018 php=5 phpRSS=391 ap=13 tcp=24 topuser=madalice 2026-08-30 14:02:15 L1=1.16 run=3 blk=0 avail=8065 (58.5%) swpO=0 conn=1 myRSS=3018 php=5 phpRSS=472 ap=13 tcp=24 topuser=madalice 2026-08-30 14:02:24 L1=0.98 run=1 blk=0 avail=8150 (59.2%) swpO=0 conn=2 myRSS=3018 php=4 phpRSS=347 ap=14 tcp=21 topuser=madalice 2026-08-30 14:02:25 L1=0.98 run=1 blk=0 avail=8149 (59.2%) swpO=0 conn=1 myRSS=3018 php=4 phpRSS=347 ap=14 tcp=21 topuser=madalice 2026-08-30 14:02:34 L1=1.14 run=2 blk=0 avail=8098 (58.8%) swpO=0 conn=2 myRSS=3018 php=4 phpRSS=396 ap=15 tcp=26 topuser=madalice 2026-08-30 14:02:35 L1=1.14 run=1 blk=0 avail=8137 (59.1%) swpO=0 conn=1 myRSS=3018 php=4 phpRSS=351 ap=15 tcp=25 topuser=madalice 2026-08-30 14:02:44 L1=1.75 run=11 blk=0 avail=7083 (51.4%) swpO=1 conn=2 myRSS=3018 php=10 phpRSS=1452 ap=27 tcp=34 topuser=madalice 2026-08-30 14:02:45 L1=1.75 run=6 blk=0 avail=7128 (51.7%) swpO=1 conn=1 myRSS=3018 php=10 phpRSS=1397 ap=27 tcp=33 topuser=madalice 2026-08-30 14:02:54 L1=2.86 run=7 blk=0 avail=6888 (50.0%) swpO=0 conn=5 myRSS=3018 php=11 phpRSS=1655 ap=30 tcp=35 topuser=madalice 2026-08-30 14:02:55 L1=2.86 run=6 blk=0 avail=6989 (50.7%) swpO=0 conn=6 myRSS=3018 php=11 phpRSS=1561 ap=29 tcp=35 topuser=madalice 2026-08-30 14:03:05 L1=3.10 run=7 blk=0 avail=7128 (51.7%) swpO=0 conn=5 myRSS=3018 php=10 phpRSS=1398 ap=27 tcp=36 topuser=madalice 2026-08-30 14:03:05 L1=3.10 run=8 blk=0 avail=7065 (51.3%) swpO=0 conn=6 myRSS=3018 php=10 phpRSS=1462 ap=27 tcp=36 topuser=madalice 2026-08-30 14:03:15 L1=3.39 run=6 blk=0 avail=7188 (52.2%) swpO=0 conn=5 myRSS=3018 php=10 phpRSS=1339 ap=25 tcp=38 topuser=madalice 2026-08-30 14:03:15 L1=3.39 run=7 blk=0 avail=7157 (51.9%) swpO=0 conn=6 myRSS=3018 php=10 phpRSS=1369 ap=26 tcp=38 topuser=madalice 2026-08-30 14:03:25 L1=3.09 run=2 blk=0 avail=6915 (50.2%) swpO=0 conn=1 myRSS=3018 php=12 phpRSS=1613 ap=32 tcp=39 topuser=madalice 2026-08-30 14:03:25 L1=3.09 run=1 blk=0 avail=6916 (50.2%) swpO=0 conn=1 myRSS=3018 php=12 phpRSS=1613 ap=32 tcp=39 topuser=madalice 2026-08-30 14:03:35 L1=2.86 run=2 blk=0 avail=6999 (50.8%) swpO=0 conn=2 myRSS=3018 php=12 phpRSS=1616 ap=22 tcp=28 topuser=madalice 2026-08-30 14:03:35 L1=2.86 run=2 blk=0 avail=6996 (50.8%) swpO=0 conn=2 myRSS=3018 php=12 phpRSS=1619 ap=22 tcp=28 topuser=madalice 2026-08-30 14:03:45 L1=2.49 run=2 blk=0 avail=7034 (51.1%) swpO=0 conn=2 myRSS=3018 php=12 phpRSS=1616 ap=17 tcp=22 topuser=madalice 2026-08-30 14:03:45 L1=2.49 run=3 blk=0 avail=7032 (51.0%) swpO=0 conn=2 myRSS=3018 php=12 phpRSS=1617 ap=17 tcp=22 topuser=madalice 2026-08-30 14:03:55 L1=2.33 run=4 blk=0 avail=7053 (51.2%) swpO=0 conn=2 myRSS=3018 php=12 phpRSS=1614 ap=17 tcp=24 topuser=madalice 2026-08-30 14:03:55 L1=2.33 run=3 blk=0 avail=7046 (51.1%) swpO=0 conn=2 myRSS=3018 php=12 phpRSS=1616 ap=17 tcp=24 topuser=madalice