INCIDENT 2026-08-31 07:07:10 trigger: php_rss=2026MB ================================================================== load: 0.52 1.09 1.33 9/709 3988037 ncpu:10 mem_avail: 6022MB/13777MB (43.7%) swap_used:2068MB swapout:0/s blocked(D):0 running:12 iowait:0.1% steal:0.0% php: 13 procs / 2026MB heaviest user: madalice (10 procs, 1841MB) apache: 70 procs tcp_estab: 48 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3185 madalice 10 1836 nobody 69 1171 root 253 998 netdata 7 204 speedlin 1 155 mailnull 5 78 mailman 20 76 cpanellogin 1 66 dovenull 6 46 alison 3 45 kurri 2 25 wp-toolkit 3 22 zabbix 1 19 evolution 5 19 dovecot 3 18 lowrange 1 14 named 1 11 nscd 1 4 polkitd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1801 speedlin 1 155 root 1 22 evolution 1 12 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4402 MB Active(file): 3810 MB Inactive(file): 806 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 512 MB CommitLimit: 10984 MB Committed_AS: 9593 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-04:48:31 4532 /usr/bin/imunify-agent-proxy 3954983 root 07:09 3160 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3261876 6.5 Ssl 3-04:48:00 /usr/sbin/mariadbd 3987993 510022 madalice 251704 73.5 R 00:02 php-fpm: pool madalice_com_au 3987989 510022 madalice 235080 59.5 R 00:02 php-fpm: pool madalice_com_au 3988001 510022 madalice 218084 113 R 00:01 php-fpm: pool madalice_com_au 3988002 510022 madalice 207668 119 R 00:01 php-fpm: pool madalice_com_au 3987990 510022 madalice 204432 53.0 R 00:02 php-fpm: pool madalice_com_au 3987585 510022 madalice 193508 17.6 S 00:48 php-fpm: pool madalice_com_au 3036527 3002570 root 186808 0.0 S 04:35:28 spamd child 508924 1 netdata 185712 1.9 Ssl 3-04:47:29 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3002570 1 root 167488 0.0 Ss 04:44:24 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3988005 510022 madalice 164724 85.0 R 00:01 php-fpm: pool madalice_com_au 3036528 3002570 root 158600 0.0 S 04:35:28 spamd child 3987991 510022 madalice 139184 71.0 S 00:02 php-fpm: pool madalice_com_au 3987998 510022 madalice 136460 142 S 00:01 php-fpm: pool madalice_com_au 3987994 510022 madalice 136428 69.0 S 00:02 php-fpm: pool madalice_com_au 3898926 1353308 cpanellogin 68004 0.1 S 25:08 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 509640 508992 root 58720 0.0 Sl 3-04:47:24 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509266 1 root 46096 0.0 Ss 3-04:47:26 /usr/lib/systemd/systemd-journald 509236 509098 root 42660 0.0 Sl 3-04:47:26 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41996 0.1 Ss 40-04:25:52 cpsrvd (SSL) - waiting for connections 3001917 1 root 34104 0.0 Ss 04:44:56 lfd - sleeping 1463 1 root 26048 0.0 Ss 62-20:57:21 tailwatchd 510022 1 root 22596 0.0 Ss 3-04:47:22 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1469 1 root 22492 0.1 Ss 62-20:57:21 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3972505 506832 nobody 22392 0.0 S 02:54 /usr/sbin/httpd -k start 3971692 506832 nobody 21664 0.0 S 04:12 /usr/sbin/httpd -k start 3972480 506832 nobody 21504 0.0 S 02:56 /usr/sbin/httpd -k start 3986959 506832 nobody 21292 0.0 S 01:50 /usr/sbin/httpd -k start 3971706 506832 nobody 21076 0.0 S 04:12 /usr/sbin/httpd -k start 3986962 506832 nobody 20940 0.0 S 01:50 /usr/sbin/httpd -k start 3986877 506832 nobody 20476 0.0 S 01:56 /usr/sbin/httpd -k start 3972292 506832 nobody 20376 0.0 S 03:13 /usr/sbin/httpd -k start 3972587 506832 nobody 20376 0.0 S 02:47 /usr/sbin/httpd -k start 3979113 506832 nobody 20376 0.0 S 02:04 /usr/sbin/httpd -k start 3987339 506832 nobody 20044 0.0 S 01:13 /usr/sbin/httpd -k start 483898 1 zabbix 19944 0.2 Ssl 3-04:48:43 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3987654 506832 nobody 19872 0.0 S 00:40 /usr/sbin/httpd -k start 3972486 506832 nobody 19664 0.0 S 02:55 /usr/sbin/httpd -k start 3987727 506832 nobody 19380 0.0 S 00:31 /usr/sbin/httpd -k start 3987726 506832 nobody 19372 0.0 S 00:31 /usr/sbin/httpd -k start 3987609 506832 nobody 19340 0.0 S 00:41 /usr/sbin/httpd -k start 3987610 506832 nobody 19268 0.0 S 00:41 /usr/sbin/httpd -k start 3987728 506832 nobody 19224 0.0 S 00:31 /usr/sbin/httpd -k start 3987752 506832 nobody 19032 0.0 S 00:31 /usr/sbin/httpd -k start 3979115 506832 nobody 19028 0.0 S 02:04 /usr/sbin/httpd -k start 3987717 506832 nobody 19008 0.0 S 00:32 /usr/sbin/httpd -k start 3987722 506832 nobody 18916 0.0 S 00:31 /usr/sbin/httpd -k start 3987723 506832 nobody 18892 0.0 S 00:31 /usr/sbin/httpd -k start 3987082 506832 nobody 18780 0.0 S 01:36 /usr/sbin/httpd -k start 3987671 506832 nobody 18668 0.0 S 00:39 /usr/sbin/httpd -k start 3987673 506832 nobody 18620 0.0 S 00:39 /usr/sbin/httpd -k start 3987751 506832 nobody 18600 0.0 S 00:31 /usr/sbin/httpd -k start 3986965 506832 nobody 18300 0.0 S 01:50 /usr/sbin/httpd -k start 508720 1 mailnull 18024 0.0 Ss 3-04:47:33 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3987675 506832 nobody 17848 0.0 S 00:39 /usr/sbin/httpd -k start 3987686 506832 nobody 17780 0.0 S 00:35 /usr/sbin/httpd -k start 3987687 506832 nobody 17780 0.0 S 00:35 /usr/sbin/httpd -k start 3987698 506832 nobody 17756 0.0 S 00:33 /usr/sbin/httpd -k start 3987676 506832 nobody 17748 0.0 S 00:39 /usr/sbin/httpd -k start 3987724 506832 nobody 17424 0.0 S 00:31 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 5119791 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 5119785 | madalice_wp | madalice_wp | Query | 0 | Sending data | SELECT option_value FROM AMuqf6qZ_options WHERE option_name LIKE 'wc_square_background_sync_job_%' AND ( option_value LIKE '%\"status\":\"queued\"%' OR option_value LIKE '%\"status\":\"processing\"%' ) ORDER BY option_id ASC LIMIT 1 | | 5119778 | madalice_wp | madalice_wp | Query | 0 | Creating sort index | SELECT post_id, meta_key, meta_value FROM AMuqf6qZ_postmeta WHERE post_id IN (31263,19977,27804,31603) ORDER BY meta_id ASC | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 184 kamcool/kamcool.com.au-ssl_log 158 evolution/portal.evolutionerp.com.au-ssl_log 101 speedlin/speedlinefencing.com.au-ssl_log 12 madalice/madalice.com.au-ssl_log 10 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 158 20.240.128.207 122 203.54.180.238 77 103.104.165.99 73 101.166.96.210 14 182.239.240.254 7 103.104.164.114 3 45.148.10.166 2 52.167.144.222 2 114.119.146.16 2 110.249.202.28 1 62.60.130.199 1 217.29.24.158 1 180.181.236.49 1 150.228.243.152 1 114.119.159.70 --- top request paths across all vhosts (last 3 min) --- 65 POST /functions.php 36 GET /heartbeat.php 35 GET /app/ajax.php 25 GET /factory_session_checker.php 22 GET /index.php 13 POST /quoteditsave.php 13 POST /plugins/csvexporter/plugin.php 12 POST /plugins/fencecosting/plugin.php 12 GET /factory_session_processed_qty.php 12 GET /factory_session_joiner.php 7 POST /app/ajax.php 7 GET / 6 POST /app/ajax/selectFilterSingle.php 4 POST /itemModify.php 3 GET /wp-json/contact-form-7/v1/contact-forms/678/feedback/schema 3 GET /store/new-balance-550-cartoon/ 2 POST /portal/register 2 POST /pickingsave.php 2 POST /login.php 2 POST /jobeditsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 65 POST /functions.php 35 GET /app/ajax.php 15 GET /index.php 13 POST /quoteditsave.php 13 POST /plugins/csvexporter/plugin.php 12 POST /plugins/fencecosting/plugin.php 7 POST /app/ajax.php 6 POST /app/ajax/selectFilterSingle.php 4 POST /itemModify.php 4 GET / 2 POST /pickingsave.php 2 POST /jobeditsave.php -- last 10 requests -- 52.167.144.222 - - [31/Aug/2026:07:06:25 +1000] "GET /index.php?page=activities&keyword=mail+ru+showstars+mari HTTP/1.1" 200 5282 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://w 103.104.165.99 - - [31/Aug/2026:07:06:25 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 103.104.164.114 - - [31/Aug/2026:07:06:25 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 103.104.165.99 - - [31/Aug/2026:07:06:27 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invedit&id=7366&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 103.104.165.99 - - [31/Aug/2026:07:06:28 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36898" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 203.54.180.238 - - [31/Aug/2026:07:06:31 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=mfstatus" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 203.54.180.238 - - [31/Aug/2026:07:06:31 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=purchasereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 203.54.180.238 - - [31/Aug/2026:07:06:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=dispatchedit&dispatchid=33977" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 203.54.180.238 - - [31/Aug/2026:07:06:45 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=pickingedit&pickingid=37946" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; 103.104.165.99 - - [31/Aug/2026:07:06:49 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. == kamcool/kamcool.com.au-ssl_log == -- top paths -- 2 GET /222.php 1 GET /zoom1.php 1 GET /yanz.php 1 GET /xxx.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-themes.php 1 GET /wp-mail.php 1 GET /wp-logs.php -- last 10 requests -- 20.240.128.207 - - [31/Aug/2026:07:05:50 +1000] "GET /wp-includes/fonts/admin.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [31/Aug/2026:07:05:50 +1000] "GET /m.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [31/Aug/2026:07:05:51 +1000] "GET /wp-admin/css/wp-login.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [31/Aug/2026:07:05:51 +1000] "GET /222.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [31/Aug/2026:07:05:51 +1000] "GET /mini.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [31/Aug/2026:07:05:52 +1000] "GET /aa.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [31/Aug/2026:07:05:52 +1000] "GET /c.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [31/Aug/2026:07:05:52 +1000] "GET /f.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [31/Aug/2026:07:05:52 +1000] "GET /av.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.240.128.207 - - [31/Aug/2026:07:05:53 +1000] "GET /file.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 36 GET /heartbeat.php 25 GET /factory_session_checker.php 12 GET /factory_session_processed_qty.php 12 GET /factory_session_joiner.php 7 GET /index.php 2 POST /portal/register 2 POST /factory_functions.php 1 POST /login.php 1 GET /vapidPublicKey 1 GET /userlogin.php 1 GET /uploadsave.php 1 GET /logoff.php -- last 10 requests -- 203.54.180.238 - - [31/Aug/2026:07:06:47 +1000] "GET /heartbeat.php?sentAt=1788124007&bytes=106,148,155,103&_=1788122837581 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=8 203.54.180.238 - - [31/Aug/2026:07:06:48 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [31/Aug/2026:07:06:54 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [31/Aug/2026:07:06:53 +1000] "GET /heartbeat.php?sentAt=1788124013&bytes=106,148,155,109&_=1787897063052 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [31/Aug/2026:07:06:53 +1000] "GET /heartbeat.php?sentAt=1788124013&bytes=106,148,155,109&_=1787918101537 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [31/Aug/2026:07:06:54 +1000] "GET /factory_session_joiner.php?id=34950 HTTP/1.1" 200 92 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [31/Aug/2026:07:06:54 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 120 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [31/Aug/2026:07:06:57 +1000] "GET /heartbeat.php?sentAt=1788124017&bytes=106,148,155,113&_=1788122837582 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=8 203.54.180.238 - - [31/Aug/2026:07:06:59 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [31/Aug/2026:07:07:04 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 --- last 30 samples (run-up to this incident) --- 2026-08-31 07:04:50 L1=0.91 run=1 blk=0 avail=8205 (59.6%) swpO=0 conn=1 myRSS=3184 php=3 phpRSS=178 ap=24 tcp=25 topuser=madalice 2026-08-31 07:04:50 L1=0.91 run=1 blk=0 avail=8206 (59.6%) swpO=0 conn=1 myRSS=3184 php=3 phpRSS=178 ap=24 tcp=25 topuser=madalice 2026-08-31 07:05:00 L1=0.77 run=1 blk=0 avail=8214 (59.6%) swpO=0 conn=1 myRSS=3184 php=3 phpRSS=192 ap=20 tcp=29 topuser=madalice 2026-08-31 07:05:00 L1=0.77 run=1 blk=0 avail=8215 (59.6%) swpO=0 conn=1 myRSS=3184 php=3 phpRSS=192 ap=20 tcp=28 topuser=madalice 2026-08-31 07:05:10 L1=1.06 run=3 blk=1 avail=8175 (59.3%) swpO=0 conn=1 myRSS=3184 php=3 phpRSS=192 ap=25 tcp=37 topuser=madalice 2026-08-31 07:05:10 L1=1.06 run=3 blk=0 avail=8160 (59.2%) swpO=0 conn=2 myRSS=3184 php=4 phpRSS=249 ap=25 tcp=37 topuser=madalice 2026-08-31 07:05:20 L1=0.97 run=1 blk=0 avail=8259 (59.9%) swpO=0 conn=1 myRSS=3184 php=2 phpRSS=34 ap=33 tcp=38 topuser=root 2026-08-31 07:05:20 L1=0.97 run=1 blk=0 avail=8256 (59.9%) swpO=0 conn=2 myRSS=3184 php=2 phpRSS=34 ap=33 tcp=38 topuser=root 2026-08-31 07:05:30 L1=0.97 run=6 blk=0 avail=8043 (58.4%) swpO=0 conn=3 myRSS=3184 php=4 phpRSS=266 ap=38 tcp=38 topuser=madalice 2026-08-31 07:05:30 L1=0.97 run=3 blk=0 avail=8005 (58.1%) swpO=0 conn=2 myRSS=3184 php=4 phpRSS=302 ap=38 tcp=38 topuser=madalice 2026-08-31 07:05:40 L1=0.90 run=1 blk=0 avail=8109 (58.9%) swpO=0 conn=3 myRSS=3184 php=3 phpRSS=189 ap=35 tcp=33 topuser=madalice 2026-08-31 07:05:40 L1=0.90 run=1 blk=0 avail=8107 (58.8%) swpO=0 conn=2 myRSS=3184 php=3 phpRSS=189 ap=35 tcp=32 topuser=madalice 2026-08-31 07:05:50 L1=1.24 run=2 blk=0 avail=8077 (58.6%) swpO=0 conn=3 myRSS=3184 php=4 phpRSS=260 ap=31 tcp=34 topuser=madalice 2026-08-31 07:05:50 L1=1.24 run=2 blk=0 avail=8092 (58.7%) swpO=0 conn=2 myRSS=3184 php=3 phpRSS=190 ap=31 tcp=34 topuser=madalice 2026-08-31 07:06:00 L1=1.29 run=1 blk=0 avail=8127 (59.0%) swpO=0 conn=3 myRSS=3184 php=3 phpRSS=174 ap=32 tcp=38 topuser=madalice 2026-08-31 07:06:00 L1=1.29 run=2 blk=0 avail=8128 (59.0%) swpO=0 conn=2 myRSS=3184 php=3 phpRSS=174 ap=32 tcp=38 topuser=madalice 2026-08-31 07:06:10 L1=1.09 run=2 blk=0 avail=8144 (59.1%) swpO=2 conn=3 myRSS=3184 php=4 phpRSS=243 ap=25 tcp=31 topuser=madalice 2026-08-31 07:06:10 L1=1.09 run=2 blk=0 avail=8161 (59.2%) swpO=2 conn=2 myRSS=3184 php=4 phpRSS=229 ap=25 tcp=31 topuser=madalice 2026-08-31 07:06:20 L1=1.07 run=2 blk=0 avail=8283 (60.1%) swpO=0 conn=3 myRSS=3184 php=2 phpRSS=34 ap=23 tcp=31 topuser=root 2026-08-31 07:06:20 L1=1.07 run=1 blk=0 avail=8297 (60.2%) swpO=0 conn=2 myRSS=3184 php=2 phpRSS=34 ap=23 tcp=31 topuser=root 2026-08-31 07:06:30 L1=0.90 run=1 blk=0 avail=8174 (59.3%) swpO=0 conn=1 myRSS=3185 php=3 phpRSS=167 ap=25 tcp=38 topuser=madalice 2026-08-31 07:06:30 L1=0.90 run=1 blk=0 avail=8173 (59.3%) swpO=0 conn=2 myRSS=3185 php=3 phpRSS=167 ap=29 tcp=41 topuser=madalice 2026-08-31 07:06:40 L1=0.76 run=2 blk=0 avail=7584 (55.0%) swpO=0 conn=1 myRSS=3185 php=4 phpRSS=287 ap=99 tcp=91 topuser=madalice 2026-08-31 07:06:40 L1=0.76 run=1 blk=0 avail=7634 (55.4%) swpO=0 conn=2 myRSS=3185 php=4 phpRSS=230 ap=99 tcp=91 topuser=madalice 2026-08-31 07:06:50 L1=0.65 run=1 blk=0 avail=7712 (56.0%) swpO=0 conn=1 myRSS=3185 php=3 phpRSS=189 ap=90 tcp=40 topuser=madalice 2026-08-31 07:06:50 L1=0.65 run=1 blk=0 avail=7713 (56.0%) swpO=0 conn=2 myRSS=3185 php=3 phpRSS=189 ap=89 tcp=38 topuser=madalice 2026-08-31 07:07:00 L1=0.62 run=1 blk=0 avail=7778 (56.5%) swpO=0 conn=1 myRSS=3185 php=3 phpRSS=192 ap=80 tcp=38 topuser=madalice 2026-08-31 07:07:00 L1=0.62 run=2 blk=0 avail=7784 (56.5%) swpO=0 conn=2 myRSS=3185 php=3 phpRSS=192 ap=79 tcp=37 topuser=madalice 2026-08-31 07:07:10 L1=0.52 run=12 blk=0 avail=6022 (43.7%) swpO=0 conn=10 myRSS=3185 php=13 phpRSS=2026 ap=70 tcp=48 topuser=madalice 2026-08-31 07:07:10 L1=0.52 run=11 blk=0 avail=6316 (45.8%) swpO=0 conn=8 myRSS=3185 php=12 phpRSS=1928 ap=69 tcp=51 topuser=madalice