INCIDENT 2026-08-31 21:40:30 trigger: php_rss=1511MB ================================================================== load: 2.25 1.39 1.00 5/673 2976296 ncpu:10 mem_avail: 6576MB/13777MB (47.7%) swap_used:2195MB swapout:0/s blocked(D):0 running:7 iowait:0.1% steal:0.0% php: 15 procs / 1511MB heaviest user: madalice (7 procs, 1063MB) apache: 42 procs tcp_estab: 57 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3444 madalice 7 1063 root 249 985 nobody 41 697 infinium 2 240 netdata 7 209 evolution 10 162 cpanellogin 1 82 mailman 20 72 dovenull 6 46 mailnull 2 27 zabbix 1 19 wp-toolkit 3 19 dovecot 3 18 alison 1 15 aaa 1 15 candyfabcom 1 14 lowrange 1 13 kurri 1 12 named 1 11 --- php workers by user --- USER PROCS RSS_MB madalice 7 1063 infinium 2 243 evolution 4 150 root 1 21 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5448 MB Active(file): 4835 MB Inactive(file): 934 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 577 MB CommitLimit: 10984 MB Committed_AS: 8760 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-19:21:51 4160 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3527648 9.4 Ssl 3-19:21:20 /usr/sbin/mariadbd 1247229 3002570 root 194724 0.1 S 08:10:21 spamd child 508924 1 netdata 189764 1.9 Ssl 3-19:20:49 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2959710 510022 madalice 163756 33.4 S 04:15 php-fpm: pool madalice_com_au 2959885 510022 madalice 163276 29.8 S 03:52 php-fpm: pool madalice_com_au 2960132 510022 madalice 161096 27.6 S 03:27 php-fpm: pool madalice_com_au 3036528 3002570 root 160688 0.0 S 19:08:48 spamd child 2976165 510022 madalice 159012 32.5 S 00:08 php-fpm: pool madalice_com_au 2976164 510022 madalice 157608 29.6 S 00:08 php-fpm: pool madalice_com_au 2976163 510022 madalice 157592 28.5 S 00:08 php-fpm: pool madalice_com_au 2976191 510022 madalice 129168 20.5 R 00:07 php-fpm: pool madalice_com_au 2976257 2976161 infinium 125720 0.0 S 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3002570 1 root 96976 0.0 Ss 19:17:44 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2197517 1353308 cpanellogin 84476 0.0 S 03:47:40 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 509266 1 root 83160 0.0 Ss 3-19:20:46 /usr/lib/systemd/systemd-journald 509640 508992 root 71868 0.0 Sl 3-19:20:44 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509236 509098 root 69716 0.0 Sl 3-19:20:46 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 2976245 2976158 evolution 66592 13.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 42720 0.1 Ss 40-18:59:12 cpsrvd (SSL) - waiting for connections 2976266 2961089 evolution 40296 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2976265 2961827 evolution 39288 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3001917 1 root 34024 0.0 Ss 19:18:16 lfd - sleeping 2976264 1469 root 28572 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 22380 0.0 Ss 3-19:20:42 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 2960358 506832 nobody 22148 0.0 S 02:54 /usr/sbin/httpd -k start 1463 1 root 22112 0.0 Ss 63-11:30:41 tailwatchd 2960975 506832 nobody 21936 0.0 S 02:09 /usr/sbin/httpd -k start 2942068 506832 nobody 21508 0.0 S 08:25 /usr/sbin/httpd -k start 1469 1 root 21432 0.1 Ss 63-11:30:41 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2943540 506832 nobody 21396 0.0 S 06:57 /usr/sbin/httpd -k start 2959614 506832 nobody 21148 0.0 S 04:22 /usr/sbin/httpd -k start 2961085 506832 nobody 20668 0.0 S 01:54 /usr/sbin/httpd -k start 2961827 506832 nobody 20164 0.0 S 00:56 /usr/sbin/httpd -k start 2961847 506832 nobody 19924 0.0 S 00:54 /usr/sbin/httpd -k start 483898 1 zabbix 19864 0.2 Ssl 3-19:22:03 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2976160 506832 nobody 19760 0.3 S 00:08 /usr/sbin/httpd -k start 2961788 506832 nobody 19716 0.0 S 00:58 /usr/sbin/httpd -k start 2976198 506832 nobody 19640 0.1 S 00:07 /usr/sbin/httpd -k start 2961078 506832 nobody 19524 0.1 S 01:55 /usr/sbin/httpd -k start 2961079 506832 nobody 18916 0.0 S 01:55 /usr/sbin/httpd -k start 2976159 506832 nobody 18888 0.1 S 00:08 /usr/sbin/httpd -k start 2976158 506832 nobody 18744 0.1 S 00:08 /usr/sbin/httpd -k start 2976195 506832 nobody 18712 0.1 S 00:07 /usr/sbin/httpd -k start 2961073 506832 nobody 18636 0.0 S 01:56 /usr/sbin/httpd -k start 2961089 506832 nobody 18604 0.0 S 01:53 /usr/sbin/httpd -k start 2976161 506832 nobody 18504 0.1 S 00:08 /usr/sbin/httpd -k start 2961093 506832 nobody 18412 0.1 S 01:53 /usr/sbin/httpd -k start 2961849 506832 nobody 17892 0.0 S 00:54 /usr/sbin/httpd -k start 2976146 506832 nobody 17432 0.1 S 00:09 /usr/sbin/httpd -k start 2976107 506832 nobody 17300 0.0 S 00:10 /usr/sbin/httpd -k start 2961846 506832 nobody 17296 0.1 S 00:54 /usr/sbin/httpd -k start 2976196 506832 nobody 17208 0.0 S 00:07 /usr/sbin/httpd -k start 2976080 506832 nobody 17080 0.0 S 00:13 /usr/sbin/httpd -k start 2976147 506832 nobody 16840 0.0 S 00:09 /usr/sbin/httpd -k start 2976087 506832 nobody 16820 0.0 S 00:12 /usr/sbin/httpd -k start 2976086 506832 nobody 16792 0.1 S 00:12 /usr/sbin/httpd -k start 509671 508992 netdata 16728 2.1 Sl 3-19:20:44 /usr/libexec/netdata/plugins.d/apps.plugin 1 2976259 506832 nobody 16212 0.0 S 00:00 /usr/sbin/httpd -k start 2976250 506832 nobody 16208 0.0 S 00:01 /usr/sbin/httpd -k start 2976202 506832 nobody 16180 0.0 S 00:07 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9935887 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min coscom/coscom.com.au 132 madalice/madalice.com.au-ssl_log 132 evolution/my.evolutionerp.com.au-ssl_log 93 whiz/whizengineering.com.au-ssl_log 89 candyfabcom/candyfab.com.au-ssl_log 45 evolution/portal.evolutionerp.com.au-ssl_log 20 infinium/infinium.net.au-ssl_log 14 olympic/olympicfencing.com.au-ssl_log 9 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 130 158.23.18.78 116 52.139.37.240 89 20.48.250.41 58 1.159.0.233 45 20.104.49.130 20 203.54.180.238 19 101.119.138.142 12 147.161.213.78 10 20.48.179.39 5 118.127.40.55 2 66.29.153.148 2 40.77.167.46 2 192.64.117.37 2 192.185.4.25 2 178.128.127.233 --- top request paths across all vhosts (last 3 min) --- 34 POST /functions.php 20 GET /heartbeat.php 12 GET /index.php 10 POST /app/ajax/selectFilter.php 8 POST /itemModify.php 8 GET /app/ajax.php 7 GET /wp-login.php 5 POST /wp-login.php 5 POST /testTagSave.php 5 GET /store/graffiti-airmax-90-custom-shoes/ 4 POST /quoteditsave.php 4 POST /plugins/csvexporter/plugin.php 4 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 POST /wp-cron.php 3 POST /inveditsave.php 3 GET /wp.php 3 GET /this_is_a_new_hello_world.php 3 GET /shiny.php 3 GET /abcd.php 2 POST /wp-admin/admin-ajax.php --- busiest 3 vhosts: top paths + last 10 requests --- == coscom/coscom.com.au == -- top paths -- 2 GET /wp-content/themes/index.php 1 GET /yj09.php 1 GET /xnm-apc.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp-temp.php 1 GET /wp.php 1 GET /wp-manager.php 1 GET /wp-mails.php 1 GET /wp-includes/Text/Diff/Engine/about.php 1 GET //wp-includes/Requests/ 1 GET //wp-includes/l10n/ -- last 10 requests -- 158.23.18.78 - - [31/Aug/2026:21:39:32 +1000] "GET /wp-admin/css/colors/sunrise/ HTTP/1.1" 404 - "-" "-" 158.23.18.78 - - [31/Aug/2026:21:39:32 +1000] "GET /wp-admin/network/plugins.php HTTP/1.1" 404 - "-" "-" 158.23.18.78 - - [31/Aug/2026:21:39:32 +1000] "GET /wp-admin/maint/index.php HTTP/1.1" 404 - "-" "-" 158.23.18.78 - - [31/Aug/2026:21:39:32 +1000] "GET /wp-includes/blocks/post-comments-form/ HTTP/1.1" 404 - "-" "-" 158.23.18.78 - - [31/Aug/2026:21:39:33 +1000] "GET /qazwsx.php HTTP/1.1" 404 - "-" "-" 158.23.18.78 - - [31/Aug/2026:21:39:33 +1000] "GET //elp.php?p= HTTP/1.1" 403 13 "-" "-" 158.23.18.78 - - [31/Aug/2026:21:39:33 +1000] "GET /wp-content/uploads/ HTTP/1.1" 404 - "-" "-" 158.23.18.78 - - [31/Aug/2026:21:39:33 +1000] "GET /wp_blog_footer.php HTTP/1.1" 404 - "-" "-" 158.23.18.78 - - [31/Aug/2026:21:39:33 +1000] "GET /billzgs.php HTTP/1.1" 404 - "-" "-" 158.23.18.78 - - [31/Aug/2026:21:39:33 +1000] "GET /tmp.php HTTP/1.1" 404 - "-" "-" == madalice/madalice.com.au-ssl_log == -- top paths -- 5 GET /store/graffiti-airmax-90-custom-shoes/ 2 POST /wp-admin/admin-ajax.php 2 GET /robots.txt 2 GET / 1 POST /graphql 1 GET /zwso.php 1 GET /wp-seo.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-load.php 1 GET /wp-includes/SimplePie/admin.php -- last 10 requests -- 185.16.60.92 - - [31/Aug/2026:21:40:17 +1000] "GET /robots.txt HTTP/1.1" 304 - "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)" 52.139.37.240 - - [31/Aug/2026:21:40:16 +1000] "GET /templates/beez3/index.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:21:40:18 +1000] "GET /wp-content/plugins/simple/simple.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537. 52.139.37.240 - - [31/Aug/2026:21:40:19 +1000] "GET /wp2.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:21:40:20 +1000] "GET /help.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:21:40:21 +1000] "GET /wp-content/plugins/pwnd/1.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:21:40:23 +1000] "GET /admin/upload/css.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:21:40:25 +1000] "GET /wp-admin/images/about.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [31/Aug/2026:21:40:26 +1000] "GET /wp-admin/x.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 3.238.192.159 - - [31/Aug/2026:21:40:26 +1000] "POST /graphql HTTP/1.1" 404 36642 "https://madalice.com.au" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 34 POST /functions.php 12 GET /index.php 10 POST /app/ajax/selectFilter.php 8 POST /itemModify.php 8 GET /app/ajax.php 5 POST /testTagSave.php 4 POST /quoteditsave.php 4 POST /plugins/csvexporter/plugin.php 3 POST /inveditsave.php 2 POST /logsave.php 2 POST /clienteditsave.php 1 POST /app/ajax/selectFilterSingle.php -- last 10 requests -- 1.159.0.233 - - [31/Aug/2026:21:40:21 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobedit%26id%3D28288&call=getUserSetting&caller=ajaxSubmitLocal&seq=17772793285 HTTP/1.1" 200 160 "https://my.evolutionerp.com.au/i 1.159.0.233 - - [31/Aug/2026:21:40:21 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=18806079502 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index.ph 40.77.167.46 - - [31/Aug/2026:21:40:21 +1000] "GET /index.php?page=activities&keyword=Nittaku+Violin HTTP/1.1" 200 5267 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.co 1.159.0.233 - - [31/Aug/2026:21:40:21 +1000] "POST /app/ajax/selectFilter.php?call=filtersite&filter=BURWOOD%20EAST%20RESERVE HTTP/1.1" 200 437 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=28288" "Mozilla/5. 1.159.0.233 - - [31/Aug/2026:21:40:21 +1000] "GET /index.php?page=invedit&id=6588&tab=generaltab HTTP/1.1" 200 36794 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Ap 1.159.0.233 - - [31/Aug/2026:21:40:22 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invedit&id=6588&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 1.159.0.233 - - [31/Aug/2026:21:40:22 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvedit%26id%3D6588%26tab%3Dgeneraltab&call=getUserSetting&caller=ajaxSubmitLocal&seq=13972628910 HTTP/1.1" 200 110 "https://my.evo 1.159.0.233 - - [31/Aug/2026:21:40:23 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=invedit&id=6588&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 1.159.0.233 - - [31/Aug/2026:21:40:26 +1000] "GET /index.php?page=jobedit&id=28921 HTTP/1.1" 200 229461 "https://my.evolutionerp.com.au/index.php?page=invedit&id=6588&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; 1.159.0.233 - - [31/Aug/2026:21:40:28 +1000] "POST /logsave.php?call=getHistory&id=28921&module=job HTTP/1.1" 200 3350 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=28921" "Mozilla/5.0 (Windows NT 10.0; Win64 --- last 30 samples (run-up to this incident) --- 2026-08-31 21:38:02 L1=1.32 run=3 blk=0 avail=7436 (54.0%) swpO=0 conn=1 myRSS=3444 php=5 phpRSS=507 ap=24 tcp=35 topuser=madalice 2026-08-31 21:38:10 L1=1.38 run=2 blk=0 avail=7350 (53.3%) swpO=0 conn=2 myRSS=3444 php=5 phpRSS=588 ap=22 tcp=36 topuser=madalice 2026-08-31 21:38:12 L1=1.35 run=2 blk=0 avail=7268 (52.8%) swpO=0 conn=1 myRSS=3444 php=5 phpRSS=629 ap=22 tcp=32 topuser=madalice 2026-08-31 21:38:20 L1=1.24 run=7 blk=0 avail=7304 (53.0%) swpO=0 conn=2 myRSS=3444 php=6 phpRSS=669 ap=22 tcp=39 topuser=madalice 2026-08-31 21:38:22 L1=1.46 run=2 blk=0 avail=7382 (53.6%) swpO=0 conn=1 myRSS=3444 php=5 phpRSS=548 ap=23 tcp=34 topuser=madalice 2026-08-31 21:38:30 L1=1.42 run=2 blk=0 avail=7424 (53.9%) swpO=0 conn=2 myRSS=3444 php=5 phpRSS=517 ap=23 tcp=31 topuser=madalice 2026-08-31 21:38:32 L1=1.47 run=4 blk=0 avail=7440 (54.0%) swpO=0 conn=1 myRSS=3444 php=5 phpRSS=506 ap=21 tcp=30 topuser=madalice 2026-08-31 21:38:40 L1=1.43 run=2 blk=0 avail=7332 (53.2%) swpO=0 conn=2 myRSS=3444 php=5 phpRSS=511 ap=36 tcp=42 topuser=madalice 2026-08-31 21:38:42 L1=1.56 run=2 blk=0 avail=7338 (53.3%) swpO=0 conn=2 myRSS=3444 php=5 phpRSS=507 ap=34 tcp=37 topuser=madalice 2026-08-31 21:38:50 L1=1.51 run=3 blk=0 avail=7369 (53.5%) swpO=0 conn=2 myRSS=3444 php=6 phpRSS=567 ap=28 tcp=38 topuser=madalice 2026-08-31 21:38:52 L1=1.63 run=4 blk=0 avail=7300 (53.0%) swpO=1 conn=2 myRSS=3444 php=7 phpRSS=662 ap=27 tcp=39 topuser=madalice 2026-08-31 21:39:00 L1=1.66 run=3 blk=0 avail=7414 (53.8%) swpO=1 conn=2 myRSS=3444 php=5 phpRSS=508 ap=24 tcp=34 topuser=madalice 2026-08-31 21:39:02 L1=1.85 run=3 blk=0 avail=7283 (52.9%) swpO=0 conn=2 myRSS=3444 php=5 phpRSS=553 ap=23 tcp=28 topuser=madalice 2026-08-31 21:39:10 L1=1.78 run=2 blk=0 avail=7477 (54.3%) swpO=0 conn=2 myRSS=3444 php=5 phpRSS=514 ap=22 tcp=32 topuser=madalice 2026-08-31 21:39:12 L1=1.64 run=2 blk=0 avail=7429 (53.9%) swpO=0 conn=2 myRSS=3444 php=5 phpRSS=505 ap=22 tcp=33 topuser=madalice 2026-08-31 21:39:20 L1=1.59 run=2 blk=0 avail=7490 (54.4%) swpO=0 conn=2 myRSS=3444 php=5 phpRSS=512 ap=22 tcp=33 topuser=madalice 2026-08-31 21:39:22 L1=1.70 run=1 blk=0 avail=7496 (54.4%) swpO=0 conn=2 myRSS=3444 php=5 phpRSS=506 ap=22 tcp=30 topuser=madalice 2026-08-31 21:39:30 L1=1.64 run=2 blk=0 avail=7494 (54.4%) swpO=0 conn=2 myRSS=3444 php=5 phpRSS=509 ap=22 tcp=32 topuser=madalice 2026-08-31 21:39:32 L1=1.67 run=1 blk=0 avail=7492 (54.4%) swpO=0 conn=2 myRSS=3444 php=5 phpRSS=506 ap=23 tcp=33 topuser=madalice 2026-08-31 21:39:40 L1=1.70 run=1 blk=0 avail=7444 (54.0%) swpO=0 conn=2 myRSS=3444 php=5 phpRSS=506 ap=30 tcp=30 topuser=madalice 2026-08-31 21:39:42 L1=1.64 run=2 blk=0 avail=7435 (54.0%) swpO=0 conn=2 myRSS=3444 php=5 phpRSS=533 ap=29 tcp=30 topuser=madalice 2026-08-31 21:39:50 L1=1.59 run=2 blk=0 avail=7479 (54.3%) swpO=0 conn=2 myRSS=3444 php=5 phpRSS=506 ap=26 tcp=32 topuser=madalice 2026-08-31 21:39:52 L1=1.62 run=1 blk=0 avail=7391 (53.7%) swpO=0 conn=2 myRSS=3444 php=5 phpRSS=596 ap=26 tcp=29 topuser=madalice 2026-08-31 21:40:00 L1=1.65 run=2 blk=0 avail=7479 (54.3%) swpO=0 conn=2 myRSS=3444 php=5 phpRSS=507 ap=25 tcp=32 topuser=madalice 2026-08-31 21:40:02 L1=1.92 run=4 blk=0 avail=7422 (53.9%) swpO=0 conn=2 myRSS=3444 php=5 phpRSS=552 ap=25 tcp=31 topuser=madalice 2026-08-31 21:40:10 L1=2.01 run=3 blk=0 avail=7471 (54.2%) swpO=0 conn=2 myRSS=3444 php=5 phpRSS=514 ap=24 tcp=29 topuser=madalice 2026-08-31 21:40:12 L1=2.01 run=1 blk=0 avail=7491 (54.4%) swpO=0 conn=2 myRSS=3444 php=5 phpRSS=508 ap=23 tcp=27 topuser=madalice 2026-08-31 21:40:20 L1=1.93 run=7 blk=0 avail=7365 (53.5%) swpO=0 conn=2 myRSS=3444 php=9 phpRSS=696 ap=25 tcp=40 topuser=madalice 2026-08-31 21:40:22 L1=2.09 run=9 blk=0 avail=7205 (52.3%) swpO=0 conn=2 myRSS=3444 php=8 phpRSS=736 ap=31 tcp=42 topuser=madalice 2026-08-31 21:40:30 L1=2.25 run=7 blk=0 avail=6576 (47.7%) swpO=0 conn=4 myRSS=3444 php=15 phpRSS=1511 ap=42 tcp=57 topuser=madalice