INCIDENT 2026-08-30 20:09:09 trigger: php_rss=1572MB ================================================================== load: 1.24 1.37 1.51 5/723 1718121 ncpu:10 mem_avail: 6492MB/13777MB (47.1%) swap_used:1846MB swapout:25/s blocked(D):0 running:4 iowait:1.6% steal:0.0% php: 13 procs / 1572MB heaviest user: madalice (8 procs, 1123MB) apache: 100 procs tcp_estab: 31 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3013 nobody 99 1647 madalice 8 1123 root 241 959 corpkicks 2 309 netdata 7 200 infinium 1 122 cpanellogin 1 117 mailman 20 92 dovenull 6 40 wp-toolkit 3 26 mailnull 1 24 evolution 5 21 zabbix 1 20 dovecot 3 17 alison 1 14 named 1 11 kurri 1 11 polkitd 1 3 nscd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 8 1123 corpkicks 2 313 infinium 1 122 root 1 22 evolution 1 12 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5016 MB Active(file): 4617 MB Inactive(file): 740 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 601 MB CommitLimit: 10984 MB Committed_AS: 9626 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-17:50:30 6732 /usr/bin/imunify-agent-proxy 1700704 root 05:34 60328 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3086264 6.9 Ssl 2-17:49:59 /usr/sbin/mariadbd 1718065 1717861 corpkicks 206668 90.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 889551 2277352 root 188908 0.0 S 04:03:27 spamd child 508924 1 netdata 182792 1.9 Ssl 2-17:49:28 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 167392 0.0 Ss 17:46:05 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1717689 510022 madalice 159164 19.9 S 00:44 php-fpm: pool madalice_com_au 1718054 510022 madalice 157900 66.5 S 00:04 php-fpm: pool madalice_com_au 1718053 510022 madalice 157656 53.0 S 00:05 php-fpm: pool madalice_com_au 2328311 2277352 root 140272 0.0 S 17:30:59 spamd child 1718066 1717878 corpkicks 137992 51.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1718055 510022 madalice 135376 35.5 S 00:04 php-fpm: pool madalice_com_au 1718056 510022 madalice 135292 33.7 S 00:04 php-fpm: pool madalice_com_au 1718057 510022 madalice 135096 35.7 S 00:04 php-fpm: pool madalice_com_au 1718059 510022 madalice 135088 36.2 S 00:04 php-fpm: pool madalice_com_au 1718058 510022 madalice 135008 38.2 S 00:04 php-fpm: pool madalice_com_au 1718064 1717867 infinium 124964 40.3 S 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 4027958 1353308 cpanellogin 120648 0.0 S 09:10:56 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 1700704 1 root 60328 0.6 Ssl 05:34 /opt/imunify360/venv/bin/python3 -m imav.run 509640 508992 root 52420 0.0 Sl 2-17:49:23 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509236 509098 root 51684 0.0 Sl 2-17:49:25 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41060 0.1 Ss 39-17:27:51 cpsrvd (SSL) - waiting for connections 2275833 1 root 32872 0.0 Ss 17:46:55 lfd - sleeping 508720 1 mailnull 24608 0.0 Ss 2-17:49:32 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 22908 0.1 Ss 62-09:59:20 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 22776 0.0 Ss 2-17:49:21 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1717359 506832 nobody 21532 0.0 S 01:32 /usr/sbin/httpd -k start 1463 1 root 21376 0.0 Ss 62-09:59:20 tailwatchd 483898 1 zabbix 21320 0.2 Ssl 2-17:50:42 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1717352 506832 nobody 20828 0.0 S 01:33 /usr/sbin/httpd -k start 1717367 506832 nobody 20648 0.0 S 01:32 /usr/sbin/httpd -k start 1701853 506832 nobody 20124 0.0 S 04:27 /usr/sbin/httpd -k start 1717867 506832 nobody 19460 0.0 S 00:16 /usr/sbin/httpd -k start 1717940 506832 nobody 19452 0.0 S 00:13 /usr/sbin/httpd -k start 1717351 506832 nobody 19436 0.0 S 01:33 /usr/sbin/httpd -k start 1717938 506832 nobody 19416 0.0 S 00:13 /usr/sbin/httpd -k start 1717939 506832 nobody 19396 0.0 S 00:13 /usr/sbin/httpd -k start 1717870 506832 nobody 19308 0.1 S 00:15 /usr/sbin/httpd -k start 1717869 506832 nobody 19252 0.1 S 00:15 /usr/sbin/httpd -k start 1717866 506832 nobody 19188 0.1 S 00:16 /usr/sbin/httpd -k start 1717859 506832 nobody 19172 0.1 S 00:17 /usr/sbin/httpd -k start 1717862 506832 nobody 19160 0.0 S 00:16 /usr/sbin/httpd -k start 1717875 506832 nobody 19156 0.1 S 00:15 /usr/sbin/httpd -k start 1717876 506832 nobody 19152 0.1 S 00:15 /usr/sbin/httpd -k start 1717369 506832 nobody 19124 0.0 S 01:32 /usr/sbin/httpd -k start 1716841 506832 nobody 19068 0.0 S 02:33 /usr/sbin/httpd -k start 1717874 506832 nobody 19068 0.1 S 00:15 /usr/sbin/httpd -k start 1717696 506832 nobody 18980 0.0 S 00:41 /usr/sbin/httpd -k start 1717918 506832 nobody 18944 0.0 S 00:13 /usr/sbin/httpd -k start 1717947 506832 nobody 18944 0.0 S 00:13 /usr/sbin/httpd -k start 1717943 506832 nobody 18856 0.0 S 00:13 /usr/sbin/httpd -k start 1716811 506832 nobody 18804 0.0 S 02:34 /usr/sbin/httpd -k start 1717373 506832 nobody 18756 0.0 S 01:32 /usr/sbin/httpd -k start 1717936 506832 nobody 18756 0.0 S 00:13 /usr/sbin/httpd -k start 1717942 506832 nobody 18744 0.0 S 00:13 /usr/sbin/httpd -k start 1717881 506832 nobody 18548 0.0 S 00:15 /usr/sbin/httpd -k start 1717932 506832 nobody 18532 0.0 S 00:13 /usr/sbin/httpd -k start 1717368 506832 nobody 18508 0.0 S 01:32 /usr/sbin/httpd -k start 1717342 506832 nobody 18504 0.0 S 01:34 /usr/sbin/httpd -k start 1717858 506832 nobody 18076 0.0 S 00:17 /usr/sbin/httpd -k start 1717857 506832 nobody 18008 0.0 S 00:17 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+----------------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+----------------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4681480 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 4681472 | infinium_wp754 | infinium_wp754 | Query | 0 | init | SELECT * FROM wpnb_actionscheduler_actions WHERE action_id=60721 | +---------+----------------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/forms.evolutionerp.com.au-ssl_log 106 evolution/forms.evolutionerp.com.au 103 evolution/portal.evolutionerp.com.au-ssl_log 17 corpkicks/corporatekicks.com.au-ssl_log 16 madalice/madalice.com.au-ssl_log 7 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 209 20.151.8.82 17 203.54.180.238 14 137.131.61.214 2 216.73.217.52 1 57.141.16.10 1 34.196.51.17 1 185.191.171.8 1 114.119.143.14 1 114.119.143.104 1 114.119.137.101 1 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 17 GET /heartbeat.php 4 GET /wp-content/themes/index.php 4 GET /store/hand-painted-nike-af1-pink-pastel-flower/ 3 GET /av.php 3 GET /admin.php 2 GET /zoo1.php 2 GET /xnm-apc.php 2 GET /xiugai.php 2 GET /xamp.php 2 GET /wp-temp.php 2 GET /wp.php 2 GET /wp-manager.php 2 GET /wp-mails.php 2 GET /wp-includes/Text/Diff/Engine/about.php 2 GET /wp-includes/ID3/about.php 2 GET /wp-includes/blocks/details/ 2 GET /wp-includes/blocks/audio/ 2 GET /wp-content/index.php 2 GET /wp-content/admin.php 2 GET /wp-content/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/forms.evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /wp-content/themes/index.php 2 GET /av.php 2 GET /admin.php 1 GET /zoo1.php 1 GET /xnm-apc.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp-temp.php 1 GET /wp.php 1 GET /wp-manager.php 1 GET /wp-mails.php 1 GET /wp-includes/Text/Diff/Engine/about.php -- last 10 requests -- 20.151.8.82 - - [30/Aug/2026:20:07:40 +1000] "GET /wp-content/ HTTP/1.1" 404 - "-" "-" 20.151.8.82 - - [30/Aug/2026:20:07:40 +1000] "GET /wp-admin/css/colors/blue/ HTTP/1.1" 404 - "-" "-" 20.151.8.82 - - [30/Aug/2026:20:07:41 +1000] "GET /wp-includes/block-bindings/ HTTP/1.1" 404 - "-" "-" 20.151.8.82 - - [30/Aug/2026:20:07:41 +1000] "GET /wp-includes/assets/ HTTP/1.1" 404 - "-" "-" 20.151.8.82 - - [30/Aug/2026:20:07:42 +1000] "GET /wp-admin/css/colors/sunrise/ HTTP/1.1" 404 - "-" "-" 20.151.8.82 - - [30/Aug/2026:20:07:42 +1000] "GET /wp-admin/network/plugins.php HTTP/1.1" 404 - "-" "-" 20.151.8.82 - - [30/Aug/2026:20:07:43 +1000] "GET /wp-admin/maint/index.php HTTP/1.1" 404 - "-" "-" 20.151.8.82 - - [30/Aug/2026:20:07:43 +1000] "GET /wp-includes/blocks/post-comments-form/ HTTP/1.1" 404 - "-" "-" 20.151.8.82 - - [30/Aug/2026:20:07:43 +1000] "GET /qazwsx.php HTTP/1.1" 404 - "-" "-" 20.151.8.82 - - [30/Aug/2026:20:07:44 +1000] "GET /elp.php?p= HTTP/1.1" 403 13 "-" "-" == evolution/forms.evolutionerp.com.au == -- top paths -- 2 GET /wp-content/themes/index.php 1 GET /zoo1.php 1 GET /xnm-apc.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp-temp.php 1 GET /wp.php 1 GET /wp-manager.php 1 GET /wp-mails.php 1 GET /wp-includes/Text/Diff/Engine/about.php 1 GET //wp-includes/Requests/ 1 GET //wp-includes/l10n/ -- last 10 requests -- 20.151.8.82 - - [30/Aug/2026:20:07:39 +1000] "GET /wp-manager.php HTTP/1.1" 301 296 "-" "-" 20.151.8.82 - - [30/Aug/2026:20:07:39 +1000] "GET /wp-includes/Text/Diff/Engine/about.php HTTP/1.1" 301 320 "-" "-" 20.151.8.82 - - [30/Aug/2026:20:07:39 +1000] "GET //cgi-bin/admin.php HTTP/1.1" 301 299 "-" "-" 20.151.8.82 - - [30/Aug/2026:20:07:40 +1000] "GET /wp-content/ HTTP/1.1" 301 293 "-" "-" 20.151.8.82 - - [30/Aug/2026:20:07:40 +1000] "GET /wp-admin/css/colors/blue/ HTTP/1.1" 301 307 "-" "-" 20.151.8.82 - - [30/Aug/2026:20:07:41 +1000] "GET //wp-includes/block-bindings/ HTTP/1.1" 301 309 "-" "-" 20.151.8.82 - - [30/Aug/2026:20:07:41 +1000] "GET //wp-includes/assets/ HTTP/1.1" 301 301 "-" "-" 20.151.8.82 - - [30/Aug/2026:20:07:41 +1000] "GET /wp-admin/css/colors/sunrise/ HTTP/1.1" 301 310 "-" "-" 20.151.8.82 - - [30/Aug/2026:20:07:42 +1000] "GET /wp-admin/network/plugins.php HTTP/1.1" 301 310 "-" "-" 20.151.8.82 - - [30/Aug/2026:20:07:42 +1000] "GET /wp-admin/maint/index.php HTTP/1.1" 301 306 "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 17 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [30/Aug/2026:20:07:37 +1000] "GET /heartbeat.php?sentAt=1788084453&bytes=106,148,0,229&_=1787918097581 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:20:07:43 +1000] "GET /heartbeat.php?sentAt=1788084463&bytes=106,148,0,239&_=1787897059097 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:20:07:43 +1000] "GET /heartbeat.php?sentAt=1788084463&bytes=106,148,0,239&_=1787918097582 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:20:07:53 +1000] "GET /heartbeat.php?sentAt=1788084473&bytes=106,148,0,249&_=1787897059098 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:20:07:53 +1000] "GET /heartbeat.php?sentAt=1788084473&bytes=106,148,0,249&_=1787918097583 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:20:08:03 +1000] "GET /heartbeat.php?sentAt=1788084483&bytes=106,148,1,3&_=1787897059099 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" "M 203.54.180.238 - - [30/Aug/2026:20:08:03 +1000] "GET /heartbeat.php?sentAt=1788084483&bytes=106,148,1,3&_=1787918097584 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" "M 203.54.180.238 - - [30/Aug/2026:20:08:13 +1000] "GET /heartbeat.php?sentAt=1788084493&bytes=106,148,1,13&_=1787897059100 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" " 203.54.180.238 - - [30/Aug/2026:20:08:13 +1000] "GET /heartbeat.php?sentAt=1788084493&bytes=106,148,1,13&_=1787918097585 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" " 203.54.180.238 - - [30/Aug/2026:20:08:23 +1000] "GET /heartbeat.php?sentAt=1788084503&bytes=106,148,1,23&_=1787897059101 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" " --- last 30 samples (run-up to this incident) --- 2026-08-30 20:06:48 L1=0.93 run=1 blk=0 avail=8083 (58.7%) swpO=0 conn=1 myRSS=3026 php=4 phpRSS=350 ap=22 tcp=20 topuser=madalice 2026-08-30 20:06:48 L1=0.93 run=3 blk=0 avail=8083 (58.7%) swpO=0 conn=2 myRSS=3026 php=4 phpRSS=350 ap=22 tcp=20 topuser=madalice 2026-08-30 20:06:58 L1=0.94 run=3 blk=0 avail=8261 (60.0%) swpO=0 conn=2 myRSS=3026 php=4 phpRSS=210 ap=18 tcp=22 topuser=madalice 2026-08-30 20:06:58 L1=0.94 run=3 blk=0 avail=8261 (60.0%) swpO=0 conn=2 myRSS=3026 php=4 phpRSS=209 ap=18 tcp=22 topuser=madalice 2026-08-30 20:07:08 L1=0.96 run=4 blk=0 avail=8048 (58.4%) swpO=0 conn=2 myRSS=3026 php=5 phpRSS=464 ap=17 tcp=21 topuser=corpkicks 2026-08-30 20:07:08 L1=0.96 run=4 blk=0 avail=8047 (58.4%) swpO=0 conn=2 myRSS=3026 php=5 phpRSS=465 ap=17 tcp=21 topuser=corpkicks 2026-08-30 20:07:19 L1=1.04 run=3 blk=0 avail=8246 (59.9%) swpO=0 conn=2 myRSS=3026 php=3 phpRSS=201 ap=17 tcp=23 topuser=madalice 2026-08-30 20:07:19 L1=1.04 run=3 blk=0 avail=8248 (59.9%) swpO=0 conn=2 myRSS=3026 php=3 phpRSS=201 ap=17 tcp=23 topuser=madalice 2026-08-30 20:07:29 L1=1.27 run=2 blk=0 avail=8079 (58.6%) swpO=0 conn=2 myRSS=3026 php=4 phpRSS=395 ap=17 tcp=24 topuser=corpkicks 2026-08-30 20:07:29 L1=1.27 run=3 blk=0 avail=8078 (58.6%) swpO=0 conn=2 myRSS=3026 php=4 phpRSS=395 ap=17 tcp=24 topuser=corpkicks 2026-08-30 20:07:39 L1=1.16 run=2 blk=0 avail=7985 (58.0%) swpO=0 conn=2 myRSS=3026 php=4 phpRSS=289 ap=48 tcp=51 topuser=olympic 2026-08-30 20:07:39 L1=1.16 run=3 blk=0 avail=7985 (58.0%) swpO=0 conn=2 myRSS=3026 php=4 phpRSS=182 ap=48 tcp=51 topuser=madalice 2026-08-30 20:07:49 L1=1.28 run=4 blk=1 avail=8147 (59.1%) swpO=0 conn=2 myRSS=3026 php=3 phpRSS=167 ap=38 tcp=23 topuser=madalice 2026-08-30 20:07:49 L1=1.28 run=5 blk=0 avail=8147 (59.1%) swpO=0 conn=2 myRSS=3026 php=3 phpRSS=170 ap=38 tcp=23 topuser=madalice 2026-08-30 20:07:59 L1=1.24 run=2 blk=0 avail=7881 (57.2%) swpO=0 conn=3 myRSS=3026 php=5 phpRSS=571 ap=28 tcp=19 topuser=corpkicks 2026-08-30 20:07:59 L1=1.24 run=3 blk=0 avail=7878 (57.2%) swpO=0 conn=2 myRSS=3026 php=5 phpRSS=574 ap=28 tcp=19 topuser=corpkicks 2026-08-30 20:08:09 L1=1.05 run=3 blk=0 avail=8261 (60.0%) swpO=0 conn=3 myRSS=3026 php=3 phpRSS=190 ap=18 tcp=18 topuser=madalice 2026-08-30 20:08:09 L1=1.05 run=2 blk=0 avail=8260 (60.0%) swpO=0 conn=2 myRSS=3026 php=3 phpRSS=190 ap=18 tcp=18 topuser=madalice 2026-08-30 20:08:19 L1=0.89 run=3 blk=0 avail=8275 (60.1%) swpO=0 conn=3 myRSS=3026 php=4 phpRSS=246 ap=15 tcp=22 topuser=evolution 2026-08-30 20:08:19 L1=0.89 run=3 blk=0 avail=8274 (60.1%) swpO=0 conn=3 myRSS=3026 php=4 phpRSS=248 ap=15 tcp=22 topuser=evolution 2026-08-30 20:08:29 L1=0.99 run=4 blk=0 avail=8062 (58.5%) swpO=0 conn=3 myRSS=3026 php=5 phpRSS=463 ap=16 tcp=23 topuser=madalice 2026-08-30 20:08:29 L1=0.99 run=5 blk=0 avail=8055 (58.5%) swpO=0 conn=3 myRSS=3026 php=5 phpRSS=469 ap=16 tcp=23 topuser=madalice 2026-08-30 20:08:39 L1=0.92 run=2 blk=0 avail=8135 (59.0%) swpO=0 conn=3 myRSS=3026 php=4 phpRSS=363 ap=15 tcp=18 topuser=corpkicks 2026-08-30 20:08:39 L1=0.92 run=3 blk=0 avail=8131 (59.0%) swpO=0 conn=3 myRSS=3026 php=5 phpRSS=402 ap=15 tcp=18 topuser=corpkicks 2026-08-30 20:08:49 L1=1.00 run=2 blk=0 avail=8272 (60.0%) swpO=0 conn=3 myRSS=3026 php=3 phpRSS=190 ap=15 tcp=18 topuser=madalice 2026-08-30 20:08:49 L1=1.00 run=2 blk=0 avail=8270 (60.0%) swpO=0 conn=3 myRSS=3026 php=3 phpRSS=190 ap=15 tcp=18 topuser=madalice 2026-08-30 20:08:59 L1=1.09 run=5 blk=0 avail=7150 (51.9%) swpO=399 conn=6 myRSS=3014 php=7 phpRSS=800 ap=110 tcp=109 topuser=corpkicks 2026-08-30 20:08:59 L1=1.09 run=6 blk=0 avail=7135 (51.8%) swpO=399 conn=3 myRSS=3014 php=7 phpRSS=811 ap=110 tcp=109 topuser=corpkicks 2026-08-30 20:09:09 L1=1.24 run=4 blk=0 avail=6492 (47.1%) swpO=25 conn=5 myRSS=3013 php=13 phpRSS=1572 ap=100 tcp=31 topuser=madalice 2026-08-30 20:09:09 L1=1.24 run=5 blk=0 avail=6487 (47.1%) swpO=25 conn=4 myRSS=3013 php=13 phpRSS=1574 ap=100 tcp=31 topuser=madalice