INCIDENT 2026-08-31 03:56:33 trigger: php_rss=1641MB ================================================================== load: 1.40 0.96 0.88 5/714 3323891 ncpu:10 mem_avail: 6632MB/13777MB (48.1%) swap_used:2118MB swapout:472/s blocked(D):0 running:8 iowait:0.1% steal:0.0% php: 14 procs / 1641MB heaviest user: madalice (8 procs, 1326MB) apache: 83 procs tcp_estab: 71 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3009 madalice 8 1345 nobody 82 1266 root 246 962 netdata 7 207 evolution 7 99 vinesit 1 86 mailman 20 81 mailnull 4 64 cpanellogin 1 64 dovenull 6 46 lowrange 2 29 infinium 2 29 kurri 2 25 wp-toolkit 3 24 zabbix 1 19 dovecot 3 18 aaa 1 15 named 1 12 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 8 1351 evolution 3 91 vinesit 1 87 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5856 MB Active(file): 4451 MB Inactive(file): 1687 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 635 MB CommitLimit: 10984 MB Committed_AS: 9558 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-01:37:54 4436 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3081448 6.6 Ssl 3-01:37:23 /usr/sbin/mariadbd 3323675 510022 madalice 238912 19.5 R 00:18 php-fpm: pool madalice_com_au 3323684 510022 madalice 191320 18.8 R 00:17 php-fpm: pool madalice_com_au 508924 1 netdata 187704 1.9 Ssl 3-01:36:52 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3036527 3002570 root 186668 0.0 S 01:24:51 spamd child 3323678 510022 madalice 185560 17.7 R 00:18 php-fpm: pool madalice_com_au 3002570 1 root 176032 0.0 Ss 01:33:47 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3036528 3002570 root 168212 0.0 S 01:24:51 spamd child 3323683 510022 madalice 162344 15.0 S 00:17 php-fpm: pool madalice_com_au 3323686 510022 madalice 160636 14.6 S 00:16 php-fpm: pool madalice_com_au 3323616 510022 madalice 160108 20.4 S 00:23 php-fpm: pool madalice_com_au 3323677 510022 madalice 159184 19.3 S 00:18 php-fpm: pool madalice_com_au 3323676 510022 madalice 158416 19.8 S 00:18 php-fpm: pool madalice_com_au 3323859 3323792 vinesit 94412 56.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3231473 1353308 cpanellogin 65768 0.0 S 26:27 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 509640 508992 root 56620 0.0 Sl 3-01:36:47 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509236 509098 root 44284 0.0 Sl 3-01:36:49 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42056 0.1 Ss 40-01:15:15 cpsrvd (SSL) - waiting for connections 509266 1 root 40616 0.0 Ss 3-01:36:49 /usr/lib/systemd/systemd-journald 3323862 3323804 evolution 40616 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3323861 3323803 evolution 40352 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3001917 1 root 36156 0.0 Ss 01:34:19 lfd - sleeping 1463 1 root 26488 0.0 Ss 62-17:46:44 tailwatchd 1469 1 root 22804 0.1 Ss 62-17:46:44 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 22552 0.0 Ss 3-01:36:45 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3306423 506832 nobody 22456 0.0 S 05:14 /usr/sbin/httpd -k start 3306437 506832 nobody 22332 0.0 S 05:13 /usr/sbin/httpd -k start 3306445 506832 nobody 21820 0.0 S 05:13 /usr/sbin/httpd -k start 483898 1 zabbix 20764 0.2 Ssl 3-01:38:06 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3306439 506832 nobody 20372 0.0 S 05:13 /usr/sbin/httpd -k start 3306459 506832 nobody 20356 0.0 S 05:13 /usr/sbin/httpd -k start 3291519 506832 nobody 20292 0.0 S 07:38 /usr/sbin/httpd -k start 3323689 506832 nobody 20124 0.1 S 00:16 /usr/sbin/httpd -k start 3307126 506832 nobody 19864 0.0 S 04:06 /usr/sbin/httpd -k start 3323159 506832 nobody 19372 0.0 S 01:00 /usr/sbin/httpd -k start 3323081 506832 nobody 19220 0.1 S 01:04 /usr/sbin/httpd -k start 508720 1 mailnull 19180 0.0 Ss 3-01:36:56 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3323690 506832 nobody 19168 0.1 S 00:16 /usr/sbin/httpd -k start 3323364 506832 nobody 19104 0.0 S 00:46 /usr/sbin/httpd -k start 3323685 506832 nobody 19028 0.1 S 00:17 /usr/sbin/httpd -k start 3323185 506832 nobody 18924 0.0 S 00:57 /usr/sbin/httpd -k start 3323231 506832 nobody 18900 0.0 S 00:53 /usr/sbin/httpd -k start 3323774 506832 nobody 18868 0.4 S 00:05 /usr/sbin/httpd -k start 3323771 506832 nobody 18840 0.1 S 00:06 /usr/sbin/httpd -k start 3323174 506832 nobody 18832 0.0 S 00:58 /usr/sbin/httpd -k start 3323775 506832 nobody 18520 0.6 S 00:05 /usr/sbin/httpd -k start 3323186 506832 nobody 17904 0.0 S 00:57 /usr/sbin/httpd -k start 3322942 506832 nobody 17480 0.0 S 01:23 /usr/sbin/httpd -k start 3223941 1471 root 16912 0.0 S 28:01 cPhulkd - dbprocessor 3323752 508720 mailnull 16500 0.0 S 00:08 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3323796 506832 nobody 16496 0.0 S 00:04 /usr/sbin/httpd -k start 3323783 506832 nobody 16468 0.0 S 00:05 /usr/sbin/httpd -k start 3323765 506832 nobody 16436 0.0 S 00:06 /usr/sbin/httpd -k start 3323766 506832 nobody 16436 0.0 S 00:06 /usr/sbin/httpd -k start 3323768 506832 nobody 16436 0.0 S 00:06 /usr/sbin/httpd -k start 3323769 506832 nobody 16436 0.0 S 00:06 /usr/sbin/httpd -k start 3323776 506832 nobody 16436 0.0 S 00:05 /usr/sbin/httpd -k start 3323784 506832 nobody 16436 0.0 S 00:05 /usr/sbin/httpd -k start 3323797 506832 nobody 16436 0.0 S 00:04 /usr/sbin/httpd -k start 3323800 506832 nobody 16436 0.0 S 00:04 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4859160 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min infinium/infinium.net.au-ssl_log 217 evolution/portal.evolutionerp.com.au-ssl_log 129 evolution/portal.evolutionerp.com.au 92 aaa/aaadownunder.com.au 91 aaa/aaadownunder.com.au-ssl_log 66 candyfabcom/candyfab.com.au-ssl_log 46 lowrange/lowrange.com.au-ssl_log 45 madalice/madalice.com.au-ssl_log 18 customc/customcentral.com.au-ssl_log 8 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 197 20.48.250.41 158 74.248.24.12 156 20.220.227.7 56 20.220.10.235 46 52.139.44.162 45 20.104.104.62 24 203.54.180.238 7 20.48.251.3 7 13.215.45.225 5 118.127.40.55 3 32.195.67.60 1 34.231.118.144 1 20.203.141.11 1 137.131.59.88 1 114.119.146.16 --- top request paths across all vhosts (last 3 min) --- 24 GET /heartbeat.php 7 GET /wp-content/plugins/hellopress/wp_filemanager.php 7 GET /this_is_a_new_hello_world.php 5 GET /store/custom-north-melbourne-kids/ 4 POST /wp-cron.php 4 GET /sbhu.php 4 GET /m.php 4 GET /log.php 4 GET /file.php 4 GET /24.php 4 GET /166.php 3 GET /xda.php 3 GET /wp-admin/js/index.php 3 GET /wp-act.php 3 GET /wp-access.php 3 GET /t.php 3 GET /term.php 3 GET /num.php 3 GET /motu.php 3 GET /k.php --- busiest 3 vhosts: top paths + last 10 requests --- == infinium/infinium.net.au-ssl_log == -- top paths -- 3 POST /wp-cron.php 2 GET /xda.php 2 GET /wp-admin/js/index.php 2 GET /wp-access.php 2 GET /file.php 2 GET /222.php 1 POST /wp-admin/admin-ajax.php 1 GET /zoz.php 1 GET /zoom1.php 1 GET /yanz.php 1 GET /xxx.php 1 GET /xwpg.php -- last 10 requests -- 74.248.24.12 - - [31/Aug/2026:03:56:21 +1000] "GET /c.php HTTP/1.1" 404 13592 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [31/Aug/2026:03:56:22 +1000] "GET /f.php HTTP/1.1" 404 13592 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [31/Aug/2026:03:56:23 +1000] "GET /av.php HTTP/1.1" 404 13592 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [31/Aug/2026:03:56:24 +1000] "GET /file.php HTTP/1.1" 404 13592 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [31/Aug/2026:03:56:25 +1000] "GET /wp-includes/customize/index.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [31/Aug/2026:03:56:26 +1000] "GET /gmo.php HTTP/1.1" 404 13592 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [31/Aug/2026:03:56:27 +1000] "GET /classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [31/Aug/2026:03:56:27 +1000] "GET /404.php HTTP/1.1" 404 13592 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [31/Aug/2026:03:56:28 +1000] "GET /php.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [31/Aug/2026:03:56:28 +1000] "GET /init.php HTTP/1.1" 404 13592 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 24 GET /heartbeat.php 1 GET /zxekqlxb.php 1 GET /zu.php 1 GET /zoo.php 1 GET /xxw.php 1 GET /xs.php 1 GET /xsox.php 1 GET /xr.php 1 GET /ww.php 1 GET /ws69.php 1 GET /ws68.php 1 GET /ws66.php -- last 10 requests -- 20.48.250.41 - - [31/Aug/2026:03:55:54 +1000] "GET /mini.php HTTP/1.1" 404 - "-" "-" 203.54.180.238 - - [31/Aug/2026:03:55:53 +1000] "GET /heartbeat.php?sentAt=1788112553&bytes=106,148,110,169&_=1787918100391 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 20.48.250.41 - - [31/Aug/2026:03:55:54 +1000] "GET /amp.php HTTP/1.1" 404 - "-" "-" 20.48.250.41 - - [31/Aug/2026:03:55:55 +1000] "GET /cc13.php HTTP/1.1" 404 - "-" "-" 20.48.250.41 - - [31/Aug/2026:03:55:55 +1000] "GET /aa.php HTTP/1.1" 404 - "-" "-" 20.48.250.41 - - [31/Aug/2026:03:55:56 +1000] "GET /s1.php HTTP/1.1" 404 - "-" "-" 20.48.250.41 - - [31/Aug/2026:03:55:57 +1000] "GET /0byte.php HTTP/1.1" 404 - "-" "-" 20.48.250.41 - - [31/Aug/2026:03:55:57 +1000] "GET /xr.php HTTP/1.1" 404 - "-" "-" 20.48.250.41 - - [31/Aug/2026:03:55:58 +1000] "GET /h02ugyh.php HTTP/1.1" 404 - "-" "-" 20.48.250.41 - - [31/Aug/2026:03:55:58 +1000] "GET /xxw.php HTTP/1.1" 404 - "-" "-" == evolution/portal.evolutionerp.com.au == -- top paths -- 1 GET /zxekqlxb.php 1 GET /zu.php 1 GET /zoo.php 1 GET /xs.php 1 GET /xsox.php 1 GET /ww.php 1 GET /ws69.php 1 GET /ws68.php 1 GET /ws66.php 1 GET /ws58.php 1 GET /wp-style.php 1 GET /wp-scr1pts.php -- last 10 requests -- 20.48.250.41 - - [31/Aug/2026:03:55:48 +1000] "GET /tfm.php HTTP/1.1" 301 290 "-" "-" 20.48.250.41 - - [31/Aug/2026:03:55:48 +1000] "GET /Geforce.php HTTP/1.1" 301 294 "-" "-" 20.48.250.41 - - [31/Aug/2026:03:55:49 +1000] "GET /click.php?p= HTTP/1.1" 301 295 "-" "-" 20.48.250.41 - - [31/Aug/2026:03:55:49 +1000] "GET /ms.php HTTP/1.1" 301 289 "-" "-" 20.48.250.41 - - [31/Aug/2026:03:55:49 +1000] "GET /zxekqlxb.php HTTP/1.1" 301 295 "-" "-" 20.48.250.41 - - [31/Aug/2026:03:55:50 +1000] "GET /init.php HTTP/1.1" 301 291 "-" "-" 20.48.250.41 - - [31/Aug/2026:03:55:50 +1000] "GET /term.php HTTP/1.1" 301 291 "-" "-" 20.48.250.41 - - [31/Aug/2026:03:55:51 +1000] "GET /aaa.php HTTP/1.1" 301 290 "-" "-" 20.48.250.41 - - [31/Aug/2026:03:55:51 +1000] "GET /xsox.php HTTP/1.1" 301 291 "-" "-" 20.48.250.41 - - [31/Aug/2026:03:55:52 +1000] "GET /lkui.php HTTP/1.1" 301 291 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-31 03:54:12 L1=0.58 run=3 blk=0 avail=8555 (62.1%) swpO=0 conn=1 myRSS=3023 php=3 phpRSS=77 ap=17 tcp=29 topuser=infinium 2026-08-31 03:54:12 L1=0.58 run=3 blk=0 avail=8465 (61.4%) swpO=0 conn=1 myRSS=3023 php=2 phpRSS=34 ap=17 tcp=29 topuser=root 2026-08-31 03:54:22 L1=0.56 run=3 blk=0 avail=8451 (61.3%) swpO=0 conn=1 myRSS=3023 php=3 phpRSS=167 ap=17 tcp=28 topuser=madalice 2026-08-31 03:54:22 L1=0.56 run=3 blk=0 avail=8366 (60.7%) swpO=0 conn=1 myRSS=3023 php=4 phpRSS=290 ap=16 tcp=28 topuser=madalice 2026-08-31 03:54:32 L1=0.79 run=3 blk=0 avail=8277 (60.1%) swpO=0 conn=4 myRSS=3023 php=6 phpRSS=433 ap=16 tcp=29 topuser=infinium 2026-08-31 03:54:32 L1=0.79 run=4 blk=0 avail=8350 (60.6%) swpO=0 conn=1 myRSS=3023 php=4 phpRSS=287 ap=16 tcp=28 topuser=madalice 2026-08-31 03:54:42 L1=0.82 run=2 blk=0 avail=8417 (61.1%) swpO=0 conn=4 myRSS=3023 php=3 phpRSS=225 ap=16 tcp=26 topuser=madalice 2026-08-31 03:54:42 L1=0.82 run=1 blk=0 avail=8446 (61.3%) swpO=0 conn=1 myRSS=3023 php=3 phpRSS=190 ap=16 tcp=26 topuser=madalice 2026-08-31 03:54:52 L1=0.77 run=4 blk=0 avail=8406 (61.0%) swpO=0 conn=4 myRSS=3023 php=3 phpRSS=190 ap=16 tcp=23 topuser=madalice 2026-08-31 03:54:52 L1=0.77 run=1 blk=0 avail=8467 (61.5%) swpO=0 conn=1 myRSS=3023 php=3 phpRSS=190 ap=15 tcp=23 topuser=madalice 2026-08-31 03:55:02 L1=0.65 run=4 blk=0 avail=8395 (60.9%) swpO=0 conn=4 myRSS=3023 php=4 phpRSS=252 ap=14 tcp=23 topuser=madalice 2026-08-31 03:55:03 L1=0.65 run=2 blk=0 avail=8452 (61.4%) swpO=0 conn=1 myRSS=3023 php=3 phpRSS=190 ap=14 tcp=24 topuser=madalice 2026-08-31 03:55:12 L1=0.94 run=2 blk=0 avail=8448 (61.3%) swpO=0 conn=4 myRSS=3023 php=3 phpRSS=193 ap=15 tcp=27 topuser=madalice 2026-08-31 03:55:13 L1=0.94 run=4 blk=0 avail=8355 (60.6%) swpO=0 conn=2 myRSS=3023 php=4 phpRSS=326 ap=15 tcp=27 topuser=madalice 2026-08-31 03:55:22 L1=0.79 run=1 blk=0 avail=8451 (61.3%) swpO=0 conn=4 myRSS=3023 php=3 phpRSS=189 ap=15 tcp=25 topuser=madalice 2026-08-31 03:55:23 L1=0.79 run=2 blk=0 avail=8362 (60.7%) swpO=0 conn=2 myRSS=3023 php=4 phpRSS=308 ap=15 tcp=25 topuser=madalice 2026-08-31 03:55:32 L1=0.82 run=1 blk=0 avail=8436 (61.2%) swpO=0 conn=1 myRSS=3023 php=3 phpRSS=189 ap=16 tcp=28 topuser=madalice 2026-08-31 03:55:33 L1=0.82 run=2 blk=0 avail=8339 (60.5%) swpO=0 conn=2 myRSS=3023 php=4 phpRSS=309 ap=16 tcp=29 topuser=madalice 2026-08-31 03:55:42 L1=1.00 run=2 blk=0 avail=8436 (61.2%) swpO=0 conn=1 myRSS=3023 php=3 phpRSS=164 ap=21 tcp=34 topuser=infinium 2026-08-31 03:55:43 L1=1.00 run=4 blk=0 avail=8329 (60.5%) swpO=0 conn=2 myRSS=3023 php=5 phpRSS=335 ap=21 tcp=33 topuser=infinium 2026-08-31 03:55:52 L1=1.30 run=4 blk=0 avail=8311 (60.3%) swpO=0 conn=1 myRSS=3023 php=6 phpRSS=340 ap=25 tcp=36 topuser=madalice 2026-08-31 03:55:53 L1=1.30 run=4 blk=0 avail=8169 (59.3%) swpO=0 conn=2 myRSS=3023 php=5 phpRSS=371 ap=25 tcp=35 topuser=olympic 2026-08-31 03:56:02 L1=1.25 run=1 blk=0 avail=8424 (61.1%) swpO=0 conn=1 myRSS=3023 php=3 phpRSS=167 ap=23 tcp=32 topuser=madalice 2026-08-31 03:56:03 L1=1.25 run=3 blk=0 avail=8336 (60.5%) swpO=0 conn=2 myRSS=3023 php=5 phpRSS=317 ap=23 tcp=32 topuser=madalice 2026-08-31 03:56:12 L1=1.13 run=3 blk=0 avail=8351 (60.6%) swpO=0 conn=1 myRSS=3023 php=4 phpRSS=278 ap=22 tcp=29 topuser=madalice 2026-08-31 03:56:13 L1=1.13 run=3 blk=0 avail=8405 (61.0%) swpO=0 conn=3 myRSS=3023 php=5 phpRSS=254 ap=22 tcp=30 topuser=madalice 2026-08-31 03:56:22 L1=1.19 run=1 blk=0 avail=7395 (53.7%) swpO=33 conn=1 myRSS=3022 php=10 phpRSS=1113 ap=22 tcp=35 topuser=madalice 2026-08-31 03:56:23 L1=1.19 run=2 blk=0 avail=7338 (53.3%) swpO=33 conn=3 myRSS=3022 php=12 phpRSS=1230 ap=22 tcp=37 topuser=madalice 2026-08-31 03:56:32 L1=1.40 run=5 blk=0 avail=6846 (49.7%) swpO=472 conn=4 myRSS=3009 php=11 phpRSS=1341 ap=83 tcp=74 topuser=madalice 2026-08-31 03:56:33 L1=1.40 run=8 blk=0 avail=6632 (48.1%) swpO=472 conn=7 myRSS=3009 php=14 phpRSS=1641 ap=83 tcp=71 topuser=madalice