INCIDENT 2026-09-01 00:41:14 trigger: php_rss=1664MB ================================================================== load: 2.07 1.27 1.05 2/656 3585154 ncpu:10 mem_avail: 6652MB/13777MB (48.3%) swap_used:2335MB swapout:40/s blocked(D):0 running:2 iowait:0.0% steal:0.0% php: 13 procs / 1664MB heaviest user: madalice (10 procs, 1592MB) apache: 24 procs tcp_estab: 38 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3390 madalice 10 1598 root 248 950 nobody 23 386 netdata 7 209 evolution 8 69 mailman 20 65 cpanellogin 1 63 dovenull 6 46 mailnull 3 38 lowrange 2 29 infinium 2 28 kurri 2 26 zabbix 1 20 wp-toolkit 3 19 dovecot 3 18 aaa 1 15 named 1 10 nscd 1 4 polkitd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1601 evolution 2 50 root 1 21 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5479 MB Active(file): 3392 MB Inactive(file): 2292 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 488 MB CommitLimit: 10984 MB Committed_AS: 8434 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-22:22:35 3912 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3471540 9.2 Ssl 3-22:22:04 /usr/sbin/mariadbd 508924 1 netdata 190772 1.9 Ssl 3-22:21:33 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3584905 510022 madalice 189816 23.1 R 00:26 php-fpm: pool madalice_com_au 1247229 3002570 root 189792 0.1 S 11:11:05 spamd child 3570723 510022 madalice 164340 17.1 S 01:18 php-fpm: pool madalice_com_au 3584862 510022 madalice 163804 24.6 S 00:28 php-fpm: pool madalice_com_au 3584863 510022 madalice 163376 24.0 S 00:28 php-fpm: pool madalice_com_au 3584896 510022 madalice 162812 26.2 S 00:27 php-fpm: pool madalice_com_au 3584894 510022 madalice 162796 25.4 S 00:27 php-fpm: pool madalice_com_au 3584864 510022 madalice 162696 32.2 S 00:28 php-fpm: pool madalice_com_au 3036528 3002570 root 160172 0.0 S 22:09:32 spamd child 3585115 510022 madalice 159096 50.8 S 00:06 php-fpm: pool madalice_com_au 3585114 510022 madalice 159088 51.5 S 00:06 php-fpm: pool madalice_com_au 3585113 510022 madalice 159052 46.5 S 00:06 php-fpm: pool madalice_com_au 509266 1 root 86396 0.0 Ss 3-22:21:30 /usr/lib/systemd/systemd-journald 3002570 1 root 86096 0.0 Ss 22:18:28 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509640 508992 root 73708 0.0 Sl 3-22:21:28 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 3501614 1353308 cpanellogin 65348 0.1 S 23:17 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 509236 509098 root 64288 0.0 Sl 3-22:21:30 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42060 0.1 Ss 40-21:59:56 cpsrvd (SSL) - waiting for connections 3585125 3585120 evolution 40920 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3436579 1 root 36368 0.0 Ss 41:12 lfd - sleeping 3552202 506832 nobody 22816 0.0 S 08:09 /usr/sbin/httpd -k start 3567921 506832 nobody 22452 0.0 S 05:14 /usr/sbin/httpd -k start 1469 1 root 22232 0.1 Ss 63-14:31:25 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 22104 0.0 Ss 3-22:21:26 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3568522 506832 nobody 21800 0.0 S 04:42 /usr/sbin/httpd -k start 3568277 506832 nobody 21764 0.0 S 05:11 /usr/sbin/httpd -k start 483898 1 zabbix 20920 0.2 Ssl 3-22:22:47 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3584910 506832 nobody 20316 0.2 S 00:25 /usr/sbin/httpd -k start 1463 1 root 20052 0.0 Ss 63-14:31:25 tailwatchd 3584867 506832 nobody 19864 0.1 S 00:27 /usr/sbin/httpd -k start 3584900 506832 nobody 19776 0.1 S 00:26 /usr/sbin/httpd -k start 3584866 506832 nobody 19684 0.2 S 00:27 /usr/sbin/httpd -k start 3584917 506832 nobody 19600 0.1 S 00:25 /usr/sbin/httpd -k start 3584915 506832 nobody 19560 0.1 S 00:25 /usr/sbin/httpd -k start 3584850 506832 nobody 19556 0.2 S 00:28 /usr/sbin/httpd -k start 3585118 506832 nobody 19028 0.0 S 00:04 /usr/sbin/httpd -k start 3584914 506832 nobody 18936 0.0 S 00:25 /usr/sbin/httpd -k start 3585116 506832 nobody 18532 0.2 S 00:05 /usr/sbin/httpd -k start 3585117 506832 nobody 18472 0.0 S 00:04 /usr/sbin/httpd -k start 3584902 506832 nobody 18188 0.1 S 00:26 /usr/sbin/httpd -k start 3584903 506832 nobody 16788 0.0 S 00:26 /usr/sbin/httpd -k start 509671 508992 netdata 16420 2.1 Sl 3-22:21:28 /usr/libexec/netdata/plugins.d/apps.plugin 1 3585120 506832 nobody 15980 0.0 S 00:03 /usr/sbin/httpd -k start 3252945 508511 aaa 15852 0.0 S 01:36:24 dovecot/imap 508720 1 mailnull 15364 0.0 Ss 3-22:21:37 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3098283 508511 lowrange 15356 0.0 S 02:24:16 dovecot/imap 3550912 1471 root 15304 0.0 S 10:26 cPhulkd - processor - http socket 2977131 508511 lowrange 15156 0.0 S 03:00:03 dovecot/imap 3568499 508511 infinium 14692 0.0 S 04:48 dovecot/imap 3500834 508511 infinium 14636 0.0 S 24:50 dovecot/imap 32289 1471 root 14408 0.0 S 16:27:29 cPhulkd - dbprocessor 1471 1 root 14400 0.0 Ss 63-14:31:25 cPhulkd - processor 3585119 508511 kurri 14388 0.0 S 00:04 dovecot/imap 3568503 508511 root 12768 0.0 S 04:46 dovecot/auth -w 3570838 508720 mailnull 12480 0.0 S 01:13 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3883280 508511 kurri 12348 0.0 S 2-10:39:25 dovecot/imap 3570144 508720 mailnull 12012 0.0 S 02:14 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3585121 506832 nobody 11984 0.0 S 00:03 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10020120 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/evolutionerp.com.au-ssl_log 261 customc/customcentral.com.au-ssl_log 42 madalice/madalice.com.au-ssl_log 42 evolution/portal.evolutionerp.com.au-ssl_log 17 corpkicks/corporatekicks.com.au 13 infinium/infinium.net.au-ssl_log 9 aaa/aaadownunder.com.au-ssl_log 2 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 261 34.92.103.222 42 158.23.184.117 36 3.231.214.44 17 203.54.180.238 13 68.155.159.216 5 118.127.40.55 2 50.6.152.190 2 173.254.28.219 2 114.119.143.14 1 50.6.200.195 1 2a03:2880:f802:2d:: 1 209.42.18.204 1 114.119.159.70 1 114.119.143.104 1 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 17 GET /heartbeat.php 5 POST / 4 POST /wp-cron.php 4 GET /wp-login.php 3 GET /store/blue-butterfly-premium-pack-limited/ 3 GET / 2 POST /wp-login.php 2 GET /.git/config 2 GET /.env.production 2 GET /.env.old 2 GET /.env.local 2 GET /.env.example 2 GET /.env.bak 2 GET /.env.backup 2 GET /.env 2 GET /config/.env 2 GET /backend/.env 2 GET /api/.env 2 GET /admin/.env 1 POST /v1/graphql --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env -- last 10 requests -- 34.92.103.222 - - [01/Sep/2026:00:40:47 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.103.222 - - [01/Sep/2026:00:40:48 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.103.222 - - [01/Sep/2026:00:40:48 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.103.222 - - [01/Sep/2026:00:40:48 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.103.222 - - [01/Sep/2026:00:40:48 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.103.222 - - [01/Sep/2026:00:40:48 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.103.222 - - [01/Sep/2026:00:40:48 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.103.222 - - [01/Sep/2026:00:40:48 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.103.222 - - [01/Sep/2026:00:40:48 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.103.222 - - [01/Sep/2026:00:40:49 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == customc/customcentral.com.au-ssl_log == -- top paths -- 1 GET /zwso.php 1 GET /xwpg.php 1 GET /xmr.php 1 GET /xleet.php 1 GET /wp-themes.php 1 GET /wp-includes/test.php 1 GET /wp-includes/sitemaps/wp-conflg.php 1 GET /wp-includes/SimplePie/wp-login.php 1 GET /wp-includes/SimplePie/chosen.php 1 GET /wp-includes/js/codemirror/ 1 GET /wp-includes/IXR/chosen.php 1 GET /wp-includes/images/crystal.php -- last 10 requests -- 158.23.184.117 - - [01/Sep/2026:00:40:51 +1000] "GET /.well-known/sc.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [01/Sep/2026:00:40:51 +1000] "GET /wp-includes/IXR/chosen.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [01/Sep/2026:00:40:51 +1000] "GET /template/wp-index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [01/Sep/2026:00:40:51 +1000] "GET /wp-content/item.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [01/Sep/2026:00:40:52 +1000] "GET /wp-includes/test.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [01/Sep/2026:00:40:52 +1000] "GET /wp-content/plugins/updraftplus/templates/wp-admin/users.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) C 158.23.184.117 - - [01/Sep/2026:00:40:52 +1000] "GET /wp-content/themes/pridmag/aaa.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537 158.23.184.117 - - [01/Sep/2026:00:40:52 +1000] "GET /wp-content/listener.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [01/Sep/2026:00:40:52 +1000] "GET /zwso.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [01/Sep/2026:00:40:53 +1000] "GET /wp-includes/js/codemirror/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET /store/blue-butterfly-premium-pack-limited/ 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /z9x8c7v6b5-debug-trigger-mail.madalice.com.au 1 GET /wp-json 1 GET /users/login 1 GET /tag/yellow/ 1 GET /store/blue-wildflowers-custom-af1-shoes/ 1 GET /store/blue-ninja-custom-af1-shoes/ 1 GET /signup 1 GET /signin -- last 10 requests -- 3.231.214.44 - - [01/Sep/2026:00:41:08 +1000] "GET /account/login HTTP/1.1" 404 36632 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 3.231.214.44 - - [01/Sep/2026:00:41:08 +1000] "GET /sign-in HTTP/1.1" 404 36630 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 3.231.214.44 - - [01/Sep/2026:00:41:08 +1000] "GET /auth/login HTTP/1.1" 404 36632 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 3.231.214.44 - - [01/Sep/2026:00:41:08 +1000] "GET /users/login HTTP/1.1" 404 36636 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 3.231.214.44 - - [01/Sep/2026:00:41:08 +1000] "GET /reset-password HTTP/1.1" 404 36632 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 3.231.214.44 - - [01/Sep/2026:00:41:08 +1000] "GET /signin HTTP/1.1" 404 36628 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 3.231.214.44 - - [01/Sep/2026:00:41:08 +1000] "GET /signup HTTP/1.1" 404 36627 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 3.231.214.44 - - [01/Sep/2026:00:41:08 +1000] "GET /register HTTP/1.1" 404 36627 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 3.231.214.44 - - [01/Sep/2026:00:41:08 +1000] "GET /forgot-password HTTP/1.1" 404 36630 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 3.231.214.44 - - [01/Sep/2026:00:41:10 +1000] "GET /auth HTTP/1.1" 404 36627 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-01 00:38:46 L1=1.33 run=1 blk=0 avail=7880 (57.2%) swpO=0 conn=3 myRSS=3391 php=4 phpRSS=205 ap=17 tcp=31 topuser=madalice 2026-09-01 00:38:53 L1=1.30 run=3 blk=0 avail=7683 (55.8%) swpO=0 conn=3 myRSS=3391 php=6 phpRSS=469 ap=17 tcp=28 topuser=infinium 2026-09-01 00:38:56 L1=1.52 run=1 blk=0 avail=7886 (57.2%) swpO=0 conn=3 myRSS=3391 php=4 phpRSS=205 ap=16 tcp=27 topuser=madalice 2026-09-01 00:39:04 L1=1.75 run=4 blk=1 avail=7696 (55.9%) swpO=0 conn=3 myRSS=3391 php=6 phpRSS=441 ap=16 tcp=31 topuser=aaa 2026-09-01 00:39:07 L1=1.75 run=2 blk=0 avail=7860 (57.1%) swpO=0 conn=3 myRSS=3391 php=4 phpRSS=231 ap=16 tcp=30 topuser=madalice 2026-09-01 00:39:14 L1=1.56 run=2 blk=0 avail=7711 (56.0%) swpO=0 conn=3 myRSS=3391 php=4 phpRSS=332 ap=16 tcp=27 topuser=madalice 2026-09-01 00:39:17 L1=1.56 run=4 blk=0 avail=7707 (55.9%) swpO=0 conn=3 myRSS=3391 php=6 phpRSS=397 ap=16 tcp=31 topuser=madalice 2026-09-01 00:39:24 L1=1.54 run=2 blk=0 avail=7869 (57.1%) swpO=0 conn=3 myRSS=3391 php=3 phpRSS=191 ap=16 tcp=26 topuser=madalice 2026-09-01 00:39:27 L1=1.54 run=2 blk=0 avail=7894 (57.3%) swpO=0 conn=3 myRSS=3391 php=3 phpRSS=154 ap=16 tcp=30 topuser=infinium 2026-09-01 00:39:34 L1=1.31 run=1 blk=0 avail=7897 (57.3%) swpO=0 conn=3 myRSS=3391 php=3 phpRSS=165 ap=16 tcp=25 topuser=madalice 2026-09-01 00:39:37 L1=1.31 run=1 blk=0 avail=7898 (57.3%) swpO=0 conn=1 myRSS=3391 php=3 phpRSS=165 ap=15 tcp=26 topuser=madalice 2026-09-01 00:39:44 L1=1.10 run=1 blk=0 avail=7911 (57.4%) swpO=0 conn=3 myRSS=3391 php=3 phpRSS=165 ap=15 tcp=23 topuser=madalice 2026-09-01 00:39:47 L1=1.10 run=2 blk=0 avail=7910 (57.4%) swpO=0 conn=1 myRSS=3391 php=3 phpRSS=165 ap=14 tcp=26 topuser=madalice 2026-09-01 00:39:54 L1=1.01 run=2 blk=0 avail=7917 (57.5%) swpO=0 conn=2 myRSS=3391 php=3 phpRSS=170 ap=14 tcp=24 topuser=speedlin 2026-09-01 00:39:57 L1=1.01 run=4 blk=0 avail=7942 (57.7%) swpO=0 conn=1 myRSS=3391 php=3 phpRSS=127 ap=15 tcp=31 topuser=madalice 2026-09-01 00:40:04 L1=0.86 run=2 blk=0 avail=7897 (57.3%) swpO=3 conn=2 myRSS=3391 php=3 phpRSS=165 ap=15 tcp=25 topuser=madalice 2026-09-01 00:40:07 L1=0.86 run=3 blk=0 avail=7899 (57.3%) swpO=3 conn=1 myRSS=3391 php=4 phpRSS=210 ap=14 tcp=27 topuser=madalice 2026-09-01 00:40:14 L1=0.80 run=1 blk=0 avail=7919 (57.5%) swpO=0 conn=2 myRSS=3391 php=3 phpRSS=165 ap=14 tcp=26 topuser=madalice 2026-09-01 00:40:17 L1=0.80 run=1 blk=0 avail=7918 (57.5%) swpO=0 conn=1 myRSS=3391 php=3 phpRSS=165 ap=13 tcp=29 topuser=madalice 2026-09-01 00:40:24 L1=0.83 run=4 blk=0 avail=7819 (56.8%) swpO=0 conn=2 myRSS=3391 php=4 phpRSS=296 ap=13 tcp=31 topuser=madalice 2026-09-01 00:40:27 L1=0.83 run=1 blk=0 avail=7894 (57.3%) swpO=0 conn=1 myRSS=3391 php=3 phpRSS=188 ap=13 tcp=31 topuser=madalice 2026-09-01 00:40:34 L1=0.70 run=1 blk=0 avail=7895 (57.3%) swpO=0 conn=2 myRSS=3391 php=3 phpRSS=188 ap=13 tcp=28 topuser=madalice 2026-09-01 00:40:37 L1=0.70 run=1 blk=0 avail=7894 (57.3%) swpO=0 conn=1 myRSS=3391 php=3 phpRSS=188 ap=13 tcp=31 topuser=madalice 2026-09-01 00:40:44 L1=0.74 run=1 blk=0 avail=7895 (57.3%) swpO=0 conn=2 myRSS=3391 php=3 phpRSS=188 ap=13 tcp=26 topuser=madalice 2026-09-01 00:40:47 L1=0.74 run=5 blk=0 avail=7560 (54.9%) swpO=0 conn=1 myRSS=3391 php=6 phpRSS=551 ap=16 tcp=41 topuser=madalice 2026-09-01 00:40:54 L1=1.46 run=4 blk=0 avail=6910 (50.2%) swpO=0 conn=5 myRSS=3391 php=9 phpRSS=1206 ap=28 tcp=36 topuser=madalice 2026-09-01 00:40:57 L1=1.46 run=3 blk=0 avail=6812 (49.4%) swpO=0 conn=1 myRSS=3391 php=9 phpRSS=1322 ap=26 tcp=31 topuser=madalice 2026-09-01 00:41:04 L1=1.31 run=3 blk=0 avail=6928 (50.3%) swpO=0 conn=5 myRSS=3391 php=11 phpRSS=1330 ap=19 tcp=28 topuser=madalice 2026-09-01 00:41:07 L1=1.31 run=1 blk=0 avail=7055 (51.2%) swpO=0 conn=1 myRSS=3391 php=9 phpRSS=1147 ap=17 tcp=27 topuser=madalice 2026-09-01 00:41:14 L1=2.07 run=2 blk=0 avail=6652 (48.3%) swpO=40 conn=3 myRSS=3390 php=13 phpRSS=1664 ap=24 tcp=38 topuser=madalice