INCIDENT 2026-08-31 12:19:40 trigger: php_rss=1689MB ================================================================== load: 3.39 2.72 2.37 5/690 972910 ncpu:10 mem_avail: 6405MB/13777MB (46.5%) swap_used:2158MB swapout:0/s blocked(D):0 running:3 iowait:0.1% steal:0.0% php: 16 procs / 1689MB heaviest user: madalice (10 procs, 1240MB) apache: 41 procs tcp_estab: 67 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3389 madalice 10 1239 root 251 958 nobody 40 723 evolution 12 484 netdata 7 209 mailman 20 74 mailnull 5 68 cpanellogin 1 62 infinium 2 58 dovenull 6 46 candyfabcom 3 40 lowrange 2 28 wp-toolkit 3 20 zabbix 1 19 dovecot 3 18 vinesit 1 14 corpkicks 1 14 alison 1 14 kurri 1 12 --- php workers by user --- USER PROCS RSS_MB madalice 10 1215 evolution 6 481 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4972 MB Active(file): 4327 MB Inactive(file): 854 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 487 MB CommitLimit: 10984 MB Committed_AS: 9106 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-10:01:01 4140 /usr/bin/imunify-agent-proxy 896009 root 19:39 1268 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3471132 8.5 Ssl 3-10:00:30 /usr/sbin/mariadbd 3036527 3002570 root 197640 0.1 S 09:47:58 spamd child 508924 1 netdata 190088 1.9 Ssl 3-09:59:59 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 969844 510022 madalice 164304 8.0 S 02:23 php-fpm: pool madalice_com_au 969831 510022 madalice 162228 8.7 S 02:24 php-fpm: pool madalice_com_au 969840 510022 madalice 161580 9.1 S 02:23 php-fpm: pool madalice_com_au 970835 510022 madalice 158936 8.3 S 01:49 php-fpm: pool madalice_com_au 3002570 1 root 132380 0.0 Ss 09:56:54 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3036528 3002570 root 123444 0.0 S 09:47:58 spamd child 969838 510022 madalice 121892 8.3 S 02:24 php-fpm: pool madalice_com_au 969835 510022 madalice 117764 9.1 S 02:24 php-fpm: pool madalice_com_au 969842 510022 madalice 98736 8.3 S 02:23 php-fpm: pool madalice_com_au 969833 510022 madalice 96472 8.6 S 02:24 php-fpm: pool madalice_com_au 970832 510022 madalice 94124 7.1 S 01:49 php-fpm: pool madalice_com_au 972850 971608 evolution 89788 97.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 969832 510022 madalice 68460 8.0 S 02:24 php-fpm: pool madalice_com_au 972880 972047 evolution 67240 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509640 508992 root 64252 0.0 Sl 3-09:59:54 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 873062 1353308 cpanellogin 63784 0.0 S 28:22 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 509266 1 root 61460 0.0 Ss 3-09:59:56 /usr/lib/systemd/systemd-journald 972907 969857 evolution 57476 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509236 509098 root 49144 0.0 Sl 3-09:59:56 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 949496 508511 infinium 44712 0.0 S 07:59 dovecot/imap 1353308 1 root 42008 0.1 Ss 40-09:38:22 cpsrvd (SSL) - waiting for connections 972860 971281 evolution 40664 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3001917 1 root 33852 0.0 Ss 09:57:26 lfd - sleeping 1463 1 root 23972 0.0 Ss 63-02:09:51 tailwatchd 510022 1 root 22556 0.0 Ss 3-09:59:52 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 950425 506832 nobody 22392 0.1 S 06:46 /usr/sbin/httpd -k start 950253 506832 nobody 21992 0.0 S 07:00 /usr/sbin/httpd -k start 951928 506832 nobody 21908 0.1 S 05:04 /usr/sbin/httpd -k start 969786 506832 nobody 21712 0.0 S 02:27 /usr/sbin/httpd -k start 969857 506832 nobody 21544 0.0 S 02:23 /usr/sbin/httpd -k start 1469 1 root 21496 0.1 Ss 63-02:09:51 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 970689 506832 nobody 21376 0.0 S 01:54 /usr/sbin/httpd -k start 972037 506832 nobody 21052 0.1 S 00:51 /usr/sbin/httpd -k start 972052 506832 nobody 21012 0.0 S 00:50 /usr/sbin/httpd -k start 972047 506832 nobody 21000 0.1 S 00:50 /usr/sbin/httpd -k start 970727 506832 nobody 20756 0.0 S 01:52 /usr/sbin/httpd -k start 968303 506832 nobody 20628 0.0 S 03:42 /usr/sbin/httpd -k start 972308 506832 nobody 20168 0.2 S 00:33 /usr/sbin/httpd -k start 970869 506832 nobody 20112 0.0 S 01:47 /usr/sbin/httpd -k start 971609 506832 nobody 20048 0.0 S 01:02 /usr/sbin/httpd -k start 483898 1 zabbix 20024 0.2 Ssl 3-10:01:13 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 972053 506832 nobody 20008 0.1 S 00:50 /usr/sbin/httpd -k start 971281 506832 nobody 19864 0.0 S 01:26 /usr/sbin/httpd -k start 970927 506832 nobody 19388 0.1 S 01:43 /usr/sbin/httpd -k start 972026 506832 nobody 19232 0.0 S 00:52 /usr/sbin/httpd -k start 972464 506832 nobody 19184 0.1 S 00:22 /usr/sbin/httpd -k start 971307 506832 nobody 19080 0.0 S 01:24 /usr/sbin/httpd -k start 971595 506832 nobody 19080 0.0 S 01:03 /usr/sbin/httpd -k start 971619 506832 nobody 18904 0.0 S 01:01 /usr/sbin/httpd -k start 969734 506832 nobody 18868 0.0 S 02:30 /usr/sbin/httpd -k start 971280 506832 nobody 18724 0.0 S 01:26 /usr/sbin/httpd -k start 972035 506832 nobody 18332 0.0 S 00:51 /usr/sbin/httpd -k start 972048 506832 nobody 18200 0.0 S 00:50 /usr/sbin/httpd -k start 972049 506832 nobody 18168 0.0 S 00:50 /usr/sbin/httpd -k start 972006 506832 nobody 18056 0.0 S 00:53 /usr/sbin/httpd -k start 971608 506832 nobody 17964 0.0 S 01:02 /usr/sbin/httpd -k start 972433 506832 nobody 17760 0.0 S 00:25 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 7731574 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 653 evolution/portal.evolutionerp.com.au-ssl_log 201 madalice/madalice.com.au-ssl_log 195 kamcool/kamcool.com.au-ssl_log 156 vinesit/vinesit.com.au-ssl_log 110 evolution/evolutionerp.com.au-ssl_log 25 corpkicks/corporatekicks.com.au-ssl_log 23 evolution/evolutionerp.com.au 17 alison/alisonarts.com.au-ssl_log 7 customc/customcentral.com.au-ssl_log 5 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 529 203.54.180.238 156 4.205.62.107 130 195.178.110.104 110 52.139.44.162 101 103.104.164.114 80 180.181.236.49 53 93.123.109.166 51 13.213.5.99 48 165.225.233.87 31 103.104.165.99 25 118.127.40.55 17 150.228.243.152 12 147.161.213.78 7 182.9.34.248 6 182.239.240.254 --- top request paths across all vhosts (last 3 min) --- 264 POST /functions.php 132 GET / 112 GET /app/ajax.php 78 GET /heartbeat.php 61 GET /index.php 61 GET /factory_session_checker.php 31 GET /factory_session_processed_qty.php 31 GET /factory_session_joiner.php 22 POST /app/ajax.php 21 POST /clienteditsave.php 20 POST /plugins/csvexporter/plugin.php 17 POST /app/ajax/selectFilterSingle.php 15 POST /quoteditsave.php 15 POST /app/ajax/selectFilter.php 15 POST / 14 POST /itemModify.php 12 POST /jobeditsave.php 10 POST /app/ajax/contactFilter.php 9 POST /billaddsave.php 8 POST /logsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 264 POST /functions.php 112 GET /app/ajax.php 57 GET /index.php 22 POST /app/ajax.php 21 POST /clienteditsave.php 20 POST /plugins/csvexporter/plugin.php 17 POST /app/ajax/selectFilterSingle.php 15 POST /quoteditsave.php 15 POST /app/ajax/selectFilter.php 14 POST /itemModify.php 12 POST /jobeditsave.php 10 POST /app/ajax/contactFilter.php -- last 10 requests -- 165.225.233.87 - - [31/Aug/2026:12:19:40 +1000] "POST /logsave.php?call=getHistory&id=14220&module=job HTTP/1.1" 200 408 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=14220" "Mozilla/5.0 (Windows NT 10.0; Win 203.54.180.238 - - [31/Aug/2026:12:19:40 +1000] "GET /plugins/fensa/fensa-ajax.php?function_name=load_fensa_modal HTTP/1.1" 200 357 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; 120.150.225.142 - - [31/Aug/2026:12:19:40 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=3206%2Findex.php%3Fpage%3Dinvoiceadd&invoiceid=32 103.104.164.114 - - [31/Aug/2026:12:19:40 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=11813057247 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/inde 103.104.164.114 - - [31/Aug/2026:12:19:40 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=13471939419 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/ind 103.104.164.114 - - [31/Aug/2026:12:19:40 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Ddispatchedit%26dispatchid%3D195&call=getUserSetting&caller=ajaxSubmitLocal&seq=18337454569 HTTP/1.1" 200 116 203.54.180.238 - - [31/Aug/2026:12:19:40 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotereg&call=getUserSetting&caller=ajaxSubmitLocal&seq=17501654499 HTTP/1.1" 200 90 "https://my.evolutionerp.com.au/index.php?p 165.225.233.87 - - [31/Aug/2026:12:19:40 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=14350891756 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 165.225.233.87 - - [31/Aug/2026:12:19:40 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=13610493657 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 165.225.233.87 - - [31/Aug/2026:12:19:40 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Djobedit%26id%3D14220&call=getUserSetting&caller=ajaxSubmitLocal&seq=14496261648 HTTP/1.1" 200 112 "https://my. == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 78 GET /heartbeat.php 61 GET /factory_session_checker.php 31 GET /factory_session_processed_qty.php 31 GET /factory_session_joiner.php -- last 10 requests -- 203.54.180.238 - - [31/Aug/2026:12:19:27 +1000] "GET /factory_session_joiner.php?id=34981 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [31/Aug/2026:12:19:27 +1000] "GET /heartbeat.php?sentAt=1788142768&bytes=106,148,228,176&_=1788141208055 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=8 203.54.180.238 - - [31/Aug/2026:12:19:29 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [31/Aug/2026:12:19:30 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [31/Aug/2026:12:19:30 +1000] "GET /heartbeat.php?sentAt=1788142770&bytes=106,148,228,178&_=1788140245359 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [31/Aug/2026:12:19:33 +1000] "GET /heartbeat.php?sentAt=1788142773&bytes=106,148,228,181&_=1788136103086 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=9 203.54.180.238 - - [31/Aug/2026:12:19:33 +1000] "GET /heartbeat.php?sentAt=1788142773&bytes=106,148,228,181&_=1787918103413 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [31/Aug/2026:12:19:34 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 124 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [31/Aug/2026:12:19:34 +1000] "GET /factory_session_joiner.php?id=34974 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [31/Aug/2026:12:19:34 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == madalice/madalice.com.au-ssl_log == -- top paths -- 122 GET / 7 POST / 6 GET /store/custom-afl-crows-kids/ 2 POST /index.php 2 GET /wp/v2/posts/999999 2 GET /wp-login.php 2 GET /wp-admin/ 1 POST /wp-admin/admin-ajax.php 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /z9x8c7v6b5-debug-trigger-mail.madalice.com.au -- last 10 requests -- 195.178.110.104 - - [31/Aug/2026:12:19:32 +1000] "GET /?rest_route=/wp/v2/posts/999999&author_exclude=1%29+%2F%2A%2A%2FAND%2F%2A%2A%2F1%3D0+UNION+ALL+SELECT+999999%2C0x323032302d30312d30312030303a30303a3030%2C0x323032302 195.178.110.104 - - [31/Aug/2026:12:19:32 +1000] "GET /?rest_route=/wp/v2/posts/999999&author_exclude=1%29+%2F%2A%2A%2FAND%2F%2A%2A%2F1%3D0+UNION+ALL+SELECT+999999%2C0x323032302d30312d30312030303a30303a3030%2C0x323032302 118.127.40.55 - - [31/Aug/2026:12:19:34 +1000] "POST /?wordfence_syncAttackData=1788142773.9652 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://madalice.com.au" 195.178.110.104 - - [31/Aug/2026:12:19:33 +1000] "GET /?rest_route=/wp/v2/posts/999999&author_exclude=1%29+%2F%2A%2A%2FAND%2F%2A%2A%2F1%3D0+UNION+ALL+SELECT+999999%2C0x323032302d30312d30312030303a30303a3030%2C0x323032302 195.178.110.104 - - [31/Aug/2026:12:19:35 +1000] "GET /?rest_route=/wp/v2/posts/999999&author_exclude=1%29+%2F%2A%2A%2FAND%2F%2A%2A%2F1%3D0+UNION+ALL+SELECT+999999%2C0x323032302d30312d30312030303a30303a3030%2C0x323032302 195.178.110.104 - - [31/Aug/2026:12:19:37 +1000] "GET /?rest_route=/wp/v2/posts/999999&author_exclude=1%29+%2F%2A%2A%2FAND%2F%2A%2A%2F1%3D0+UNION+ALL+SELECT+999999%2C0x323032302d30312d30312030303a30303a3030%2C0x323032302 195.178.110.104 - - [31/Aug/2026:12:19:39 +1000] "GET /?rest_route=/wp/v2/posts/999999&author_exclude=1%29+AND+1%3D0+UNION+ALL+SELECT+999999%2C0x323032302d30312d30312030303a30303a3030%2C0x323032302d30312d30312030303a3030 195.178.110.104 - - [31/Aug/2026:12:19:39 +1000] "GET /?rest_route=/wp/v2/posts/999999&author_exclude=1%29+AND+1%3D0+UNION+ALL+select+999999%2C0x323032302d30312d30312030303a30303a3030%2C0x323032302d30312d30312030303a3030 195.178.110.104 - - [31/Aug/2026:12:19:40 +1000] "GET /?rest_route=/wp/v2/posts/999999&author_exclude=1%29+AND+1%3D0+UNION+ALL+SeLeCt+999999%2C0x323032302d30312d30312030303a30303a3030%2C0x323032302d30312d30312030303a3030 195.178.110.104 - - [31/Aug/2026:12:19:40 +1000] "GET /?rest_route=/wp/v2/posts/999999&author_exclude=1%29+AND+1%3D0+UNION+ALL+%2F%2A%2150000SELECT%2A%2F+999999%2C0x323032302d30312d30312030303a30303a3030%2C0x323032302d30 --- last 30 samples (run-up to this incident) --- 2026-08-31 12:17:09 L1=2.68 run=7 blk=0 avail=7142 (51.8%) swpO=0 conn=5 myRSS=3385 php=8 phpRSS=675 ap=44 tcp=53 topuser=corpkicks 2026-08-31 12:17:19 L1=3.11 run=6 blk=0 avail=6066 (44.0%) swpO=0 conn=6 myRSS=3385 php=18 phpRSS=2004 ap=55 tcp=67 topuser=madalice 2026-08-31 12:17:20 L1=3.11 run=9 blk=0 avail=6022 (43.7%) swpO=0 conn=6 myRSS=3385 php=17 phpRSS=2009 ap=55 tcp=67 topuser=madalice 2026-08-31 12:17:30 L1=3.24 run=5 blk=0 avail=6159 (44.7%) swpO=0 conn=4 myRSS=3387 php=13 phpRSS=1806 ap=51 tcp=42 topuser=madalice 2026-08-31 12:17:30 L1=3.30 run=3 blk=0 avail=6224 (45.2%) swpO=0 conn=4 myRSS=3387 php=14 phpRSS=1775 ap=51 tcp=41 topuser=madalice 2026-08-31 12:17:40 L1=2.94 run=1 blk=0 avail=6367 (46.2%) swpO=0 conn=2 myRSS=3387 php=13 phpRSS=1659 ap=42 tcp=40 topuser=madalice 2026-08-31 12:17:40 L1=2.94 run=1 blk=0 avail=6367 (46.2%) swpO=0 conn=2 myRSS=3387 php=13 phpRSS=1659 ap=42 tcp=43 topuser=madalice 2026-08-31 12:17:50 L1=2.87 run=3 blk=0 avail=6395 (46.4%) swpO=0 conn=4 myRSS=3387 php=17 phpRSS=1722 ap=45 tcp=49 topuser=madalice 2026-08-31 12:17:50 L1=2.87 run=3 blk=0 avail=6527 (47.4%) swpO=0 conn=4 myRSS=3387 php=16 phpRSS=1569 ap=45 tcp=49 topuser=madalice 2026-08-31 12:18:00 L1=2.96 run=3 blk=0 avail=6180 (44.9%) swpO=0 conn=4 myRSS=3387 php=13 phpRSS=1772 ap=52 tcp=55 topuser=madalice 2026-08-31 12:18:00 L1=2.96 run=3 blk=0 avail=6125 (44.5%) swpO=0 conn=4 myRSS=3387 php=13 phpRSS=1825 ap=52 tcp=53 topuser=madalice 2026-08-31 12:18:10 L1=2.81 run=4 blk=0 avail=6242 (45.3%) swpO=0 conn=3 myRSS=3388 php=13 phpRSS=1749 ap=43 tcp=50 topuser=madalice 2026-08-31 12:18:10 L1=2.81 run=2 blk=0 avail=6344 (46.1%) swpO=0 conn=2 myRSS=3388 php=13 phpRSS=1657 ap=43 tcp=50 topuser=madalice 2026-08-31 12:18:20 L1=2.45 run=1 blk=0 avail=6817 (49.5%) swpO=0 conn=3 myRSS=3388 php=13 phpRSS=1125 ap=54 tcp=46 topuser=madalice 2026-08-31 12:18:20 L1=2.45 run=2 blk=0 avail=6853 (49.7%) swpO=0 conn=2 myRSS=3388 php=14 phpRSS=1116 ap=54 tcp=50 topuser=madalice 2026-08-31 12:18:30 L1=2.24 run=3 blk=0 avail=6854 (49.7%) swpO=0 conn=3 myRSS=3388 php=13 phpRSS=1127 ap=47 tcp=49 topuser=madalice 2026-08-31 12:18:30 L1=2.24 run=2 blk=0 avail=6805 (49.4%) swpO=0 conn=2 myRSS=3388 php=13 phpRSS=1176 ap=47 tcp=50 topuser=madalice 2026-08-31 12:18:40 L1=2.43 run=6 blk=0 avail=6646 (48.2%) swpO=0 conn=3 myRSS=3388 php=19 phpRSS=1390 ap=57 tcp=59 topuser=madalice 2026-08-31 12:18:40 L1=2.43 run=8 blk=0 avail=6545 (47.5%) swpO=0 conn=8 myRSS=3388 php=22 phpRSS=1644 ap=57 tcp=59 topuser=madalice 2026-08-31 12:18:50 L1=2.67 run=1 blk=0 avail=7030 (51.0%) swpO=0 conn=3 myRSS=3388 php=14 phpRSS=838 ap=68 tcp=66 topuser=madalice 2026-08-31 12:18:51 L1=2.67 run=5 blk=0 avail=6896 (50.1%) swpO=0 conn=3 myRSS=3388 php=15 phpRSS=1002 ap=68 tcp=61 topuser=madalice 2026-08-31 12:19:00 L1=2.87 run=2 blk=0 avail=7141 (51.8%) swpO=0 conn=3 myRSS=3388 php=15 phpRSS=835 ap=59 tcp=50 topuser=madalice 2026-08-31 12:19:01 L1=2.87 run=4 blk=0 avail=7132 (51.8%) swpO=0 conn=3 myRSS=3388 php=15 phpRSS=860 ap=58 tcp=46 topuser=madalice 2026-08-31 12:19:10 L1=2.83 run=3 blk=0 avail=7348 (53.3%) swpO=0 conn=3 myRSS=3388 php=15 phpRSS=676 ap=51 tcp=51 topuser=madalice 2026-08-31 12:19:11 L1=2.83 run=2 blk=0 avail=7382 (53.6%) swpO=0 conn=3 myRSS=3388 php=13 phpRSS=590 ap=51 tcp=46 topuser=madalice 2026-08-31 12:19:20 L1=3.16 run=6 blk=0 avail=6702 (48.7%) swpO=0 conn=3 myRSS=3389 php=16 phpRSS=1303 ap=54 tcp=55 topuser=madalice 2026-08-31 12:19:21 L1=3.16 run=4 blk=0 avail=6676 (48.5%) swpO=0 conn=3 myRSS=3389 php=14 phpRSS=1283 ap=53 tcp=51 topuser=madalice 2026-08-31 12:19:30 L1=3.36 run=3 blk=0 avail=6459 (46.9%) swpO=0 conn=4 myRSS=3389 php=14 phpRSS=1550 ap=45 tcp=43 topuser=madalice 2026-08-31 12:19:31 L1=3.36 run=3 blk=0 avail=6489 (47.1%) swpO=0 conn=3 myRSS=3389 php=12 phpRSS=1471 ap=44 tcp=43 topuser=madalice 2026-08-31 12:19:40 L1=3.39 run=3 blk=0 avail=6405 (46.5%) swpO=0 conn=4 myRSS=3389 php=16 phpRSS=1689 ap=41 tcp=67 topuser=madalice