INCIDENT 2026-08-31 16:12:07 trigger: php_rss=1652MB ================================================================== load: 2.05 1.77 1.81 8/679 1852458 ncpu:10 mem_avail: 6534MB/13777MB (47.4%) swap_used:2246MB swapout:0/s blocked(D):0 running:10 iowait:0.0% steal:0.0% php: 11 procs / 1652MB heaviest user: madalice (7 procs, 1498MB) apache: 34 procs tcp_estab: 49 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3387 madalice 7 1245 root 252 990 nobody 33 573 netdata 7 204 evolution 8 97 infinium 2 81 alison 2 80 cpanellogin 1 76 mailman 20 72 mailnull 5 64 dovenull 6 46 aaa 2 30 zabbix 1 21 wp-toolkit 3 19 dovecot 3 18 lowrange 1 14 candyfabcom 1 14 kurri 1 12 named 1 11 --- php workers by user --- USER PROCS RSS_MB madalice 7 1249 evolution 2 78 alison 1 66 root 1 21 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5607 MB Active(file): 4854 MB Inactive(file): 968 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 541 MB CommitLimit: 10984 MB Committed_AS: 8704 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-13:53:28 3980 /usr/bin/imunify-agent-proxy 1835069 root 04:18 58996 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3468752 9.6 Ssl 3-13:52:57 /usr/sbin/mariadbd 1852338 510022 madalice 221052 58.6 R 00:06 php-fpm: pool madalice_com_au 508924 1 netdata 184800 1.9 Ssl 3-13:52:26 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1247229 3002570 root 177440 0.1 S 02:41:58 spamd child 1836938 510022 madalice 159200 38.8 S 02:20 php-fpm: pool madalice_com_au 1836616 510022 madalice 158848 35.5 S 02:44 php-fpm: pool madalice_com_au 1852421 510022 madalice 142272 66.0 R 00:01 php-fpm: pool madalice_com_au 1852418 510022 madalice 136504 67.5 S 00:02 php-fpm: pool madalice_com_au 1852417 510022 madalice 136500 67.0 S 00:02 php-fpm: pool madalice_com_au 1852419 510022 madalice 136500 66.5 S 00:02 php-fpm: pool madalice_com_au 3002570 1 root 109108 0.0 Ss 13:49:21 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3036528 3002570 root 107204 0.0 S 13:40:25 spamd child 873062 1353308 cpanellogin 78312 0.0 S 04:20:49 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 1852426 1836575 alison 73160 33.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509266 1 root 70716 0.0 Ss 3-13:52:23 /usr/lib/systemd/systemd-journald 509640 508992 root 68436 0.0 Sl 3-13:52:21 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1835069 1 root 58996 0.6 Ssl 04:18 /opt/imunify360/venv/bin/python3 -m imav.run 1852423 1835580 evolution 56720 17.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1851577 1353308 infinium 54200 0.1 S 01:04 webmaild - serving 1.41.252.211 509236 509098 root 47604 0.0 Sl 3-13:52:23 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 39648 0.1 Ss 40-13:30:49 cpsrvd (SSL) - waiting for connections 3001917 1 root 33824 0.0 Ss 13:49:53 lfd - sleeping 1852438 1469 root 28800 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1837176 938407 infinium 28784 0.2 S 02:06 php-fpm: pool user_infinium 1817247 506832 nobody 22588 0.0 S 08:51 /usr/sbin/httpd -k start 510022 1 root 22400 0.0 Ss 3-13:52:19 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1817971 506832 nobody 22356 0.1 S 07:50 /usr/sbin/httpd -k start 1463 1 root 22324 0.0 Ss 63-06:02:18 tailwatchd 1835578 506832 nobody 22084 0.1 S 03:57 /usr/sbin/httpd -k start 483898 1 zabbix 21624 0.2 Ssl 3-13:53:40 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1836593 506832 nobody 21368 0.5 S 02:47 /usr/sbin/httpd -k start 1469 1 root 21160 0.1 Ss 63-06:02:18 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1835580 506832 nobody 20644 0.0 S 03:57 /usr/sbin/httpd -k start 1851950 506832 nobody 20588 0.3 S 00:33 /usr/sbin/httpd -k start 1851301 506832 nobody 20372 0.0 S 01:22 /usr/sbin/httpd -k start 1836575 506832 nobody 20328 0.1 S 02:49 /usr/sbin/httpd -k start 1836770 506832 nobody 20276 0.0 S 02:35 /usr/sbin/httpd -k start 1835601 506832 nobody 19820 0.0 S 03:56 /usr/sbin/httpd -k start 1851592 506832 nobody 19752 0.0 S 01:02 /usr/sbin/httpd -k start 1851044 506832 nobody 19312 0.1 S 01:52 /usr/sbin/httpd -k start 1852201 506832 nobody 19200 0.1 S 00:07 /usr/sbin/httpd -k start 1851042 506832 nobody 19168 0.0 S 01:52 /usr/sbin/httpd -k start 1836381 506832 nobody 18980 0.0 S 03:02 /usr/sbin/httpd -k start 1852260 506832 nobody 18948 0.1 S 00:06 /usr/sbin/httpd -k start 1852261 506832 nobody 18856 0.3 S 00:06 /usr/sbin/httpd -k start 1852373 506832 nobody 18692 0.4 S 00:05 /usr/sbin/httpd -k start 1851624 506832 nobody 18652 0.0 S 01:01 /usr/sbin/httpd -k start 1852192 506832 nobody 18616 0.1 S 00:08 /usr/sbin/httpd -k start 1852366 506832 nobody 18428 0.0 S 00:05 /usr/sbin/httpd -k start 1851957 506832 nobody 17256 0.0 S 00:32 /usr/sbin/httpd -k start 1852369 506832 nobody 17204 0.0 S 00:05 /usr/sbin/httpd -k start 1852371 506832 nobody 17116 0.0 S 00:05 /usr/sbin/httpd -k start 509671 508992 netdata 17056 2.1 Sl 3-13:52:21 /usr/libexec/netdata/plugins.d/apps.plugin 1 1851325 506832 nobody 16984 0.1 S 01:21 /usr/sbin/httpd -k start 1851958 506832 nobody 16936 0.0 S 00:32 /usr/sbin/httpd -k start 1852370 506832 nobody 16592 0.0 S 00:05 /usr/sbin/httpd -k start 1852259 506832 nobody 16348 0.1 S 00:06 /usr/sbin/httpd -k start 1852262 506832 nobody 16348 0.0 S 00:06 /usr/sbin/httpd -k start 1852202 506832 nobody 16344 0.1 S 00:07 /usr/sbin/httpd -k start 508720 1 mailnull 16140 0.0 Ss 3-13:52:30 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9539246 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 155 aaa/aaadownunder.com.au-ssl_log 103 lecsafec/portal.lecsafe.com.au 101 lecsafec/portal.lecsafe.com.au-ssl_log 100 aaa/aaadownunder.com.au 93 madalice/madalice.com.au-ssl_log 86 alison/alisonarts.com.au-ssl_log 85 candyfabcom/candyfab.com.au-ssl_log 27 evolution/portal.evolutionerp.com.au-ssl_log 24 olympic/olympicfencing.com.au-ssl_log 16 olympic/olympicfencing.com.au 7 customc/customcentral.com.au-ssl_log 1 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 201 4.205.62.107 186 103.59.160.220 157 20.104.18.15 114 203.54.180.238 27 34.91.154.109 21 150.228.243.152 20 141.98.11.42 14 103.104.164.114 10 182.239.240.254 10 103.104.165.99 8 74.248.24.12 6 118.127.40.55 4 52.167.144.176 4 147.161.213.78 2 91.92.243.234 --- top request paths across all vhosts (last 3 min) --- 65 POST /functions.php 32 GET /app/ajax.php 24 GET /heartbeat.php 19 GET /index.php 8 POST /plugins/csvexporter/plugin.php 7 POST /dispatchsave.php 6 POST /wp-cron.php 6 POST /clienteditsave.php 4 POST /jobeditsave.php 4 POST /app/ajax.php 4 POST / 4 GET /wp-login.php 4 GET /wp-content/uploads/ 4 GET /wp-admin/maint/ 4 GET /wp-admin/includes/ 4 GET /goods.php 4 GET /chosen.php 4 GET /8.php 3 POST /wp-login.php 3 POST /app/ajax/selectFilterSingle.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 65 POST /functions.php 32 GET /app/ajax.php 19 GET /index.php 8 POST /plugins/csvexporter/plugin.php 7 POST /dispatchsave.php 6 POST /clienteditsave.php 4 POST /jobeditsave.php 4 POST /app/ajax.php 3 POST /app/ajax/selectFilterSingle.php 3 POST /app/ajax/selectFilter.php 2 POST /quoteditsave.php 2 POST /logsave.php -- last 10 requests -- 150.228.243.152 - - [31/Aug/2026:16:11:59 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dinvoiceadd%26invoiceid%3D2080%26tab%3Dmaintab&call=getUserSetting&caller=ajaxSubmitLocal&seq=16468380321 HTTP 203.54.180.238 - - [31/Aug/2026:16:11:59 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities&date=04-09-2026&company=p%20&%20t" "Mozilla/5.0 (Windows NT 150.228.243.152 - - [31/Aug/2026:16:11:59 +1000] "POST /clienteditsave.php?clientid=2758&call=getCategoryDiscounts HTTP/1.1" 200 25 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=2080&tab=maintab" "M 150.228.243.152 - - [31/Aug/2026:16:11:59 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 63 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=2080&tab=maintab" "Mozilla/5.0 (Windows NT 150.228.243.152 - - [31/Aug/2026:16:11:59 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvoiceadd%26invoiceid%3D2080%26tab%3Dmaintab&call=getUserSetting&caller=ajaxSubmitLocal&seq=12972803173 HTTP/1.1" 200 172 "htt 103.104.164.114 - - [31/Aug/2026:16:11:59 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 150.228.243.152 - - [31/Aug/2026:16:11:59 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=2080&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; 150.228.243.152 - - [31/Aug/2026:16:12:00 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 12700 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=2080&tab=maintab" "Mozilla/5.0 (Windows NT 1 103.104.164.114 - - [31/Aug/2026:16:12:01 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=65393" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 182.239.240.254 - - [31/Aug/2026:16:12:01 +1000] "GET /index.php HTTP/1.1" 200 25654 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152 == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 3 POST /wp-login.php 2 POST /wp-cron.php 1 GET /wp-includes/widgets.php 1 GET /wp-includes/view-transitions.php 1 GET /wp-includes/version.php 1 GET /wp-includes/vars.php 1 GET /wp-includes/template-canvas.php 1 GET /wp-includes/taxonomy.php 1 GET /wp-includes/spl-autoload-compat.php 1 GET /wp-includes/script-loader.php 1 GET /wp-includes/rss.php 1 GET /wp-includes/revision.php -- last 10 requests -- 103.59.160.220 - - [31/Aug/2026:16:11:48 +1000] "GET /wp-includes/class-phpass.php HTTP/1.1" 200 - "-" "Mozilla/5.0 (compatible; WP-Safe-Scanner/1.0)" 74.248.24.12 - - [31/Aug/2026:16:11:48 +1000] "-" 408 - "-" "-" 103.59.160.220 - - [31/Aug/2026:16:11:48 +1000] "GET /wp-includes/class-wp-block-patterns-registry.php HTTP/1.1" 200 - "-" "Mozilla/5.0 (compatible; WP-Safe-Scanner/1.0)" 103.59.160.220 - - [31/Aug/2026:16:11:50 +1000] "GET /wp-includes/class-avif-info.php HTTP/1.1" 200 - "-" "Mozilla/5.0 (compatible; WP-Safe-Scanner/1.0)" 103.59.160.220 - - [31/Aug/2026:16:11:51 +1000] "GET /wp-includes/class-wp-block-bindings-source.php HTTP/1.1" 200 - "-" "Mozilla/5.0 (compatible; WP-Safe-Scanner/1.0)" 103.59.160.220 - - [31/Aug/2026:16:11:51 +1000] "GET /wp-includes/l10n.php HTTP/1.1" 200 - "-" "Mozilla/5.0 (compatible; WP-Safe-Scanner/1.0)" 103.59.160.220 - - [31/Aug/2026:16:11:53 +1000] "GET /wp-includes/ms-site.php HTTP/1.1" 200 - "-" "Mozilla/5.0 (compatible; WP-Safe-Scanner/1.0)" 103.59.160.220 - - [31/Aug/2026:16:11:53 +1000] "GET /wp-includes/script-loader.php HTTP/1.1" 500 - "-" "Mozilla/5.0 (compatible; WP-Safe-Scanner/1.0)" 103.59.160.220 - - [31/Aug/2026:16:11:55 +1000] "GET /wp-includes/version.php HTTP/1.1" 200 - "-" "Mozilla/5.0 (compatible; WP-Safe-Scanner/1.0)" 103.59.160.220 - - [31/Aug/2026:16:11:56 +1000] "GET /wp-includes/class-wp-metadata-lazyloader.php HTTP/1.1" 200 - "-" "Mozilla/5.0 (compatible; WP-Safe-Scanner/1.0)" == lecsafec/portal.lecsafe.com.au == -- top paths -- 1 GET /zz.php 1 GET /zaza.php 1 GET /ws79.php 1 GET /ws62.php 1 GET //wp-includes/js/tinymce/themes/inlite 1 GET /wp-config.backup.php 1 GET /wp-class.php 1 GET /wp-blog.php 1 GET /wp-admin/sc.php 1 GET /wp-admin/css/bolt.php 1 GET /wp-access.php 1 GET /vx.php -- last 10 requests -- 4.205.62.107 - - [31/Aug/2026:16:11:51 +1000] "GET /test.php HTTP/1.1" 301 286 "-" "-" 4.205.62.107 - - [31/Aug/2026:16:11:52 +1000] "GET /cloud.php HTTP/1.1" 301 287 "-" "-" 4.205.62.107 - - [31/Aug/2026:16:11:52 +1000] "GET /asdf.php HTTP/1.1" 301 286 "-" "-" 4.205.62.107 - - [31/Aug/2026:16:11:53 +1000] "GET /app/Helpers/bladeHelpers.php HTTP/1.1" 301 306 "-" "-" 4.205.62.107 - - [31/Aug/2026:16:11:54 +1000] "GET /hochladen.form.php HTTP/1.1" 301 296 "-" "-" 4.205.62.107 - - [31/Aug/2026:16:11:55 +1000] "GET /debuggen.php HTTP/1.1" 301 290 "-" "-" 4.205.62.107 - - [31/Aug/2026:16:11:55 +1000] "GET /pouhg.php HTTP/1.1" 301 287 "-" "-" 4.205.62.107 - - [31/Aug/2026:16:11:56 +1000] "GET /phpversion.php HTTP/1.1" 301 292 "-" "-" 4.205.62.107 - - [31/Aug/2026:16:11:56 +1000] "GET /adminfus.php HTTP/1.1" 301 290 "-" "-" 4.205.62.107 - - [31/Aug/2026:16:11:57 +1000] "GET /avim.php HTTP/1.1" 301 286 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-31 16:09:44 L1=1.31 run=2 blk=0 avail=7746 (56.2%) swpO=0 conn=5 myRSS=3387 php=5 phpRSS=359 ap=27 tcp=34 topuser=madalice 2026-08-31 16:09:46 L1=1.31 run=2 blk=0 avail=7801 (56.6%) swpO=0 conn=4 myRSS=3387 php=3 phpRSS=248 ap=26 tcp=35 topuser=madalice 2026-08-31 16:09:54 L1=1.34 run=1 blk=0 avail=7690 (55.8%) swpO=0 conn=5 myRSS=3387 php=6 phpRSS=426 ap=26 tcp=34 topuser=madalice 2026-08-31 16:09:56 L1=1.34 run=2 blk=0 avail=7652 (55.5%) swpO=0 conn=4 myRSS=3387 php=4 phpRSS=414 ap=26 tcp=32 topuser=madalice 2026-08-31 16:10:04 L1=1.52 run=3 blk=0 avail=7613 (55.3%) swpO=0 conn=5 myRSS=3387 php=7 phpRSS=478 ap=24 tcp=38 topuser=madalice 2026-08-31 16:10:06 L1=1.52 run=4 blk=0 avail=7547 (54.8%) swpO=0 conn=2 myRSS=3387 php=5 phpRSS=496 ap=24 tcp=36 topuser=madalice 2026-08-31 16:10:15 L1=1.90 run=6 blk=0 avail=7595 (55.1%) swpO=0 conn=5 myRSS=3387 php=8 phpRSS=553 ap=25 tcp=43 topuser=madalice 2026-08-31 16:10:16 L1=1.90 run=5 blk=0 avail=7513 (54.5%) swpO=0 conn=2 myRSS=3387 php=6 phpRSS=544 ap=31 tcp=45 topuser=madalice 2026-08-31 16:10:25 L1=1.92 run=3 blk=0 avail=7613 (55.3%) swpO=0 conn=4 myRSS=3387 php=7 phpRSS=444 ap=31 tcp=41 topuser=madalice 2026-08-31 16:10:26 L1=1.92 run=2 blk=0 avail=7637 (55.4%) swpO=0 conn=2 myRSS=3387 php=4 phpRSS=346 ap=30 tcp=42 topuser=madalice 2026-08-31 16:10:35 L1=1.86 run=4 blk=0 avail=7598 (55.1%) swpO=0 conn=4 myRSS=3387 php=7 phpRSS=538 ap=25 tcp=35 topuser=madalice 2026-08-31 16:10:36 L1=1.86 run=6 blk=0 avail=7651 (55.5%) swpO=0 conn=2 myRSS=3387 php=5 phpRSS=399 ap=24 tcp=33 topuser=madalice 2026-08-31 16:10:45 L1=2.04 run=7 blk=0 avail=7593 (55.1%) swpO=0 conn=4 myRSS=3387 php=7 phpRSS=506 ap=25 tcp=42 topuser=madalice 2026-08-31 16:10:46 L1=2.04 run=4 blk=0 avail=7384 (53.6%) swpO=0 conn=2 myRSS=3387 php=7 phpRSS=721 ap=27 tcp=40 topuser=madalice 2026-08-31 16:10:55 L1=1.95 run=2 blk=0 avail=7630 (55.4%) swpO=0 conn=4 myRSS=3387 php=6 phpRSS=428 ap=27 tcp=37 topuser=madalice 2026-08-31 16:10:56 L1=1.95 run=2 blk=0 avail=7656 (55.6%) swpO=0 conn=2 myRSS=3387 php=4 phpRSS=346 ap=27 tcp=39 topuser=madalice 2026-08-31 16:11:05 L1=2.12 run=7 blk=0 avail=7596 (55.1%) swpO=0 conn=4 myRSS=3387 php=8 phpRSS=527 ap=28 tcp=43 topuser=madalice 2026-08-31 16:11:06 L1=2.12 run=4 blk=0 avail=7557 (54.9%) swpO=0 conn=2 myRSS=3387 php=6 phpRSS=451 ap=30 tcp=45 topuser=madalice 2026-08-31 16:11:15 L1=1.94 run=4 blk=0 avail=7578 (55.0%) swpO=0 conn=4 myRSS=3387 php=7 phpRSS=515 ap=29 tcp=36 topuser=madalice 2026-08-31 16:11:16 L1=1.94 run=3 blk=0 avail=7420 (53.9%) swpO=0 conn=2 myRSS=3387 php=7 phpRSS=677 ap=28 tcp=40 topuser=madalice 2026-08-31 16:11:25 L1=1.87 run=1 blk=0 avail=7663 (55.6%) swpO=0 conn=2 myRSS=3387 php=6 phpRSS=425 ap=25 tcp=41 topuser=madalice 2026-08-31 16:11:26 L1=1.87 run=4 blk=0 avail=7540 (54.7%) swpO=0 conn=2 myRSS=3387 php=5 phpRSS=437 ap=25 tcp=39 topuser=madalice 2026-08-31 16:11:35 L1=1.74 run=5 blk=0 avail=7587 (55.1%) swpO=0 conn=2 myRSS=3387 php=6 phpRSS=498 ap=29 tcp=40 topuser=madalice 2026-08-31 16:11:36 L1=1.74 run=2 blk=0 avail=7601 (55.2%) swpO=0 conn=2 myRSS=3387 php=5 phpRSS=452 ap=29 tcp=36 topuser=madalice 2026-08-31 16:11:45 L1=1.86 run=5 blk=0 avail=7653 (55.5%) swpO=0 conn=2 myRSS=3387 php=7 phpRSS=490 ap=24 tcp=37 topuser=madalice 2026-08-31 16:11:46 L1=1.86 run=2 blk=0 avail=7706 (55.9%) swpO=0 conn=2 myRSS=3387 php=4 phpRSS=350 ap=24 tcp=37 topuser=madalice 2026-08-31 16:11:55 L1=1.87 run=3 blk=0 avail=7618 (55.3%) swpO=0 conn=2 myRSS=3387 php=6 phpRSS=512 ap=22 tcp=34 topuser=madalice 2026-08-31 16:11:56 L1=1.87 run=3 blk=0 avail=7674 (55.7%) swpO=0 conn=2 myRSS=3387 php=5 phpRSS=425 ap=22 tcp=34 topuser=madalice 2026-08-31 16:12:05 L1=2.05 run=5 blk=0 avail=7375 (53.5%) swpO=0 conn=2 myRSS=3387 php=9 phpRSS=750 ap=35 tcp=43 topuser=madalice 2026-08-31 16:12:07 L1=2.05 run=10 blk=0 avail=6534 (47.4%) swpO=0 conn=7 myRSS=3387 php=11 phpRSS=1652 ap=34 tcp=49 topuser=madalice