INCIDENT 2026-09-01 00:42:15 trigger: php_rss=1674MB ================================================================== load: 1.33 1.22 1.04 2/654 3586231 ncpu:10 mem_avail: 6723MB/13777MB (48.8%) swap_used:2338MB swapout:0/s blocked(D):0 running:3 iowait:0.0% steal:0.0% php: 13 procs / 1674MB heaviest user: madalice (10 procs, 1602MB) apache: 17 procs tcp_estab: 31 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3388 madalice 10 1608 root 250 964 nobody 16 273 netdata 7 209 mailnull 5 70 evolution 8 69 mailman 20 65 cpanellogin 1 63 dovenull 6 46 lowrange 2 29 infinium 2 28 kurri 2 26 wp-toolkit 3 19 zabbix 1 18 dovecot 3 18 aaa 1 15 named 1 10 cpanelphpmyadmin 1 8 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1611 evolution 2 50 root 1 21 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5376 MB Active(file): 3372 MB Inactive(file): 2205 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 488 MB CommitLimit: 10984 MB Committed_AS: 8360 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-22:23:36 3904 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3469560 9.2 Ssl 3-22:23:05 /usr/sbin/mariadbd 3584863 510022 madalice 192512 13.8 R 01:29 php-fpm: pool madalice_com_au 508924 1 netdata 190796 1.9 Ssl 3-22:22:34 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1247229 3002570 root 189788 0.1 S 11:12:06 spamd child 3584862 510022 madalice 164584 11.7 S 01:29 php-fpm: pool madalice_com_au 3570723 510022 madalice 164128 12.8 S 02:19 php-fpm: pool madalice_com_au 3584894 510022 madalice 164032 14.5 S 01:28 php-fpm: pool madalice_com_au 3585114 510022 madalice 163820 11.8 S 01:07 php-fpm: pool madalice_com_au 3584896 510022 madalice 163176 12.2 S 01:28 php-fpm: pool madalice_com_au 3584864 510022 madalice 163124 15.4 S 01:29 php-fpm: pool madalice_com_au 3584905 510022 madalice 162816 12.6 S 01:27 php-fpm: pool madalice_com_au 3585113 510022 madalice 160468 11.6 S 01:07 php-fpm: pool madalice_com_au 3585115 510022 madalice 160172 11.4 S 01:07 php-fpm: pool madalice_com_au 3036528 3002570 root 159980 0.0 S 22:10:33 spamd child 509266 1 root 86380 0.0 Ss 3-22:22:31 /usr/lib/systemd/systemd-journald 3002570 1 root 86092 0.0 Ss 22:19:29 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509640 508992 root 73708 0.0 Sl 3-22:22:29 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 3501614 1353308 cpanellogin 65348 0.0 S 24:18 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 509236 509098 root 64276 0.0 Sl 3-22:22:31 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42060 0.1 Ss 40-22:00:57 cpsrvd (SSL) - waiting for connections 3586199 3585120 evolution 40860 2.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3436579 1 root 36336 0.0 Ss 42:13 lfd - sleeping 3586201 1469 root 29204 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3586269 1469 root 27080 0.0 R 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1469 1 root 22224 0.1 Ss 63-14:32:26 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 22104 0.0 Ss 3-22:22:27 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3568277 506832 nobody 21788 0.0 S 06:12 /usr/sbin/httpd -k start 3585421 506832 nobody 20776 0.0 S 00:57 /usr/sbin/httpd -k start 3584914 506832 nobody 20492 0.0 S 01:26 /usr/sbin/httpd -k start 3584900 506832 nobody 20232 0.0 S 01:27 /usr/sbin/httpd -k start 1463 1 root 20040 0.0 Ss 63-14:32:26 tailwatchd 3585120 506832 nobody 19984 0.0 S 01:04 /usr/sbin/httpd -k start 3585434 506832 nobody 19920 0.2 S 00:56 /usr/sbin/httpd -k start 3585422 506832 nobody 19824 0.4 S 00:57 /usr/sbin/httpd -k start 3584903 506832 nobody 19784 0.1 S 01:27 /usr/sbin/httpd -k start 3585419 506832 nobody 19772 0.0 S 00:57 /usr/sbin/httpd -k start 3585420 506832 nobody 19476 0.0 S 00:57 /usr/sbin/httpd -k start 483898 1 zabbix 19176 0.2 Ssl 3-22:23:48 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3585383 506832 nobody 18996 0.0 S 00:59 /usr/sbin/httpd -k start 3585809 508720 mailnull 18844 0.0 S 00:24 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3585122 506832 nobody 17836 0.0 S 01:04 /usr/sbin/httpd -k start 3585437 506832 nobody 17704 0.0 S 00:56 /usr/sbin/httpd -k start 3585426 506832 nobody 16540 0.1 S 00:56 /usr/sbin/httpd -k start 509671 508992 netdata 16400 2.1 Sl 3-22:22:29 /usr/libexec/netdata/plugins.d/apps.plugin 1 3252945 508511 aaa 15852 0.0 S 01:37:25 dovecot/imap 3098283 508511 lowrange 15356 0.0 S 02:25:17 dovecot/imap 508720 1 mailnull 15352 0.0 Ss 3-22:22:38 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2977131 508511 lowrange 15156 0.0 S 03:01:04 dovecot/imap 3568499 508511 infinium 14692 0.0 S 05:49 dovecot/imap 3500834 508511 infinium 14636 0.0 S 25:51 dovecot/imap 3586175 508511 kurri 14440 0.0 S 00:05 dovecot/imap 1471 1 root 14400 0.0 Ss 63-14:32:26 cPhulkd - processor 32289 1471 root 14396 0.0 S 16:28:30 cPhulkd - dbprocessor 3568503 508511 root 12768 0.0 S 05:47 dovecot/auth -w 3570838 508720 mailnull 12468 0.0 S 02:14 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3586165 508720 mailnull 12468 0.0 S 00:07 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3883280 508511 kurri 12348 0.0 S 2-10:40:26 dovecot/imap 508634 1 named 11140 0.0 Ssl 3-22:22:39 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 4180059 4180015 evolution 11116 0.0 Ss 4-00:42:16 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 508514 508511 dovenull 11088 0.0 S 3-22:22:39 dovecot/imap-login --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10020245 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/evolutionerp.com.au-ssl_log 261 customc/customcentral.com.au-ssl_log 158 madalice/madalice.com.au-ssl_log 80 evolution/portal.evolutionerp.com.au-ssl_log 17 infinium/infinium.net.au-ssl_log 5 corpkicks/corporatekicks.com.au-ssl_log 3 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 261 34.92.103.222 103 20.151.10.161 76 158.23.184.117 52 3.231.214.44 17 203.54.180.238 5 118.127.40.55 2 173.254.28.219 1 34.196.51.17 1 2a03:2880:f802:7:: 1 2a03:2880:f802:2d:: 1 207.46.13.14 1 114.119.159.70 1 114.119.143.14 1 114.119.143.104 1 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 17 GET /heartbeat.php 5 POST / 4 GET /wp-login.php 4 GET /store/blue-butterfly-premium-pack-limited/ 3 POST /wp-cron.php 3 GET /admin.php 3 GET / 2 GET /wp-admin/ 2 GET /images.php 2 GET /.git/config 2 GET /.env.production 2 GET /.env.old 2 GET /.env.local 2 GET /.env.example 2 GET /.env.bak 2 GET /.env.backup 2 GET /.env 2 GET /config/.env 2 GET /backend/.env 2 GET /api/.env --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env -- last 10 requests -- 34.92.103.222 - - [01/Sep/2026:00:40:47 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.103.222 - - [01/Sep/2026:00:40:48 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.103.222 - - [01/Sep/2026:00:40:48 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.103.222 - - [01/Sep/2026:00:40:48 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.103.222 - - [01/Sep/2026:00:40:48 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.103.222 - - [01/Sep/2026:00:40:48 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.103.222 - - [01/Sep/2026:00:40:48 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.103.222 - - [01/Sep/2026:00:40:48 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.103.222 - - [01/Sep/2026:00:40:48 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.103.222 - - [01/Sep/2026:00:40:49 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == customc/customcentral.com.au-ssl_log == -- top paths -- 3 GET /admin.php 2 GET /images.php 1 GET /zwso.php 1 GET /yj09.php 1 GET /xwpg.php 1 GET /xnm-apc.php 1 GET /xmr.php 1 GET /xleet.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp-themes.php 1 GET /wp-temp.php -- last 10 requests -- 20.151.10.161 - - [01/Sep/2026:00:42:03 +1000] "GET /adminimagess.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [01/Sep/2026:00:42:03 +1000] "GET /wp-content/index.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [01/Sep/2026:00:42:04 +1000] "GET /wp-includes/ID3/about.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [01/Sep/2026:00:42:04 +1000] "GET /wp-admin/css/ HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [01/Sep/2026:00:42:05 +1000] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [01/Sep/2026:00:42:05 +1000] "GET /wp-includes/blocks/details/ HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [01/Sep/2026:00:42:06 +1000] "GET /wp-includes/blocks/audio/ HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [01/Sep/2026:00:42:06 +1000] "GET /wp-temp.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [01/Sep/2026:00:42:07 +1000] "GET /wp-admin/js/index.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [01/Sep/2026:00:42:07 +1000] "GET /wp-includes/Requests/ HTTP/1.1" 401 36 "-" "-" == madalice/madalice.com.au-ssl_log == -- top paths -- 4 GET /store/blue-butterfly-premium-pack-limited/ 3 GET /wp-login.php 2 GET /wp-admin/ 1 POST /wp-admin/admin-ajax.php 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /z9x8c7v6b5-debug-trigger-mail.madalice.com.au 1 GET /wp-json 1 GET /wp-admin/install.php 1 GET /wp-admin/index.php 1 GET /wp-admin/includes/xmrlpc.php -- last 10 requests -- 158.23.184.117 - - [01/Sep/2026:00:41:39 +1000] "GET /wp-admin/includes/header.php HTTP/1.1" 404 36623 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [01/Sep/2026:00:41:41 +1000] "GET /wp-admin/includes/images/index.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 158.23.184.117 - - [01/Sep/2026:00:41:42 +1000] "GET /wp-admin/includes/index.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 114.119.143.104 - - [01/Sep/2026:00:41:43 +1000] "GET /store/blue-butterfly-premium-pack-limited/?verified=1&rating=3&wcpr_image=1&wcpr_rating=1 HTTP/1.1" 200 51237 "https://madalice.com.au/store/blue-butterfly-premium-p 158.23.184.117 - - [01/Sep/2026:00:41:43 +1000] "GET /wp-admin/includes/min.php HTTP/1.1" 404 36628 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [01/Sep/2026:00:41:45 +1000] "GET /wp-admin/includes/pk.php HTTP/1.1" 404 36624 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [01/Sep/2026:00:41:47 +1000] "GET /wp-admin/includes/users.php HTTP/1.1" 404 36626 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [01/Sep/2026:00:41:49 +1000] "GET /wp-admin/includes/xmrlpc.php HTTP/1.1" 404 36627 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [01/Sep/2026:00:41:50 +1000] "GET /wp-admin/index.php HTTP/1.1" 302 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [01/Sep/2026:00:41:52 +1000] "GET /wp-admin/install.php HTTP/1.1" 403 6221 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-01 00:39:47 L1=1.10 run=2 blk=0 avail=7910 (57.4%) swpO=0 conn=1 myRSS=3391 php=3 phpRSS=165 ap=14 tcp=26 topuser=madalice 2026-09-01 00:39:54 L1=1.01 run=2 blk=0 avail=7917 (57.5%) swpO=0 conn=2 myRSS=3391 php=3 phpRSS=170 ap=14 tcp=24 topuser=speedlin 2026-09-01 00:39:57 L1=1.01 run=4 blk=0 avail=7942 (57.7%) swpO=0 conn=1 myRSS=3391 php=3 phpRSS=127 ap=15 tcp=31 topuser=madalice 2026-09-01 00:40:04 L1=0.86 run=2 blk=0 avail=7897 (57.3%) swpO=3 conn=2 myRSS=3391 php=3 phpRSS=165 ap=15 tcp=25 topuser=madalice 2026-09-01 00:40:07 L1=0.86 run=3 blk=0 avail=7899 (57.3%) swpO=3 conn=1 myRSS=3391 php=4 phpRSS=210 ap=14 tcp=27 topuser=madalice 2026-09-01 00:40:14 L1=0.80 run=1 blk=0 avail=7919 (57.5%) swpO=0 conn=2 myRSS=3391 php=3 phpRSS=165 ap=14 tcp=26 topuser=madalice 2026-09-01 00:40:17 L1=0.80 run=1 blk=0 avail=7918 (57.5%) swpO=0 conn=1 myRSS=3391 php=3 phpRSS=165 ap=13 tcp=29 topuser=madalice 2026-09-01 00:40:24 L1=0.83 run=4 blk=0 avail=7819 (56.8%) swpO=0 conn=2 myRSS=3391 php=4 phpRSS=296 ap=13 tcp=31 topuser=madalice 2026-09-01 00:40:27 L1=0.83 run=1 blk=0 avail=7894 (57.3%) swpO=0 conn=1 myRSS=3391 php=3 phpRSS=188 ap=13 tcp=31 topuser=madalice 2026-09-01 00:40:34 L1=0.70 run=1 blk=0 avail=7895 (57.3%) swpO=0 conn=2 myRSS=3391 php=3 phpRSS=188 ap=13 tcp=28 topuser=madalice 2026-09-01 00:40:37 L1=0.70 run=1 blk=0 avail=7894 (57.3%) swpO=0 conn=1 myRSS=3391 php=3 phpRSS=188 ap=13 tcp=31 topuser=madalice 2026-09-01 00:40:44 L1=0.74 run=1 blk=0 avail=7895 (57.3%) swpO=0 conn=2 myRSS=3391 php=3 phpRSS=188 ap=13 tcp=26 topuser=madalice 2026-09-01 00:40:47 L1=0.74 run=5 blk=0 avail=7560 (54.9%) swpO=0 conn=1 myRSS=3391 php=6 phpRSS=551 ap=16 tcp=41 topuser=madalice 2026-09-01 00:40:54 L1=1.46 run=4 blk=0 avail=6910 (50.2%) swpO=0 conn=5 myRSS=3391 php=9 phpRSS=1206 ap=28 tcp=36 topuser=madalice 2026-09-01 00:40:57 L1=1.46 run=3 blk=0 avail=6812 (49.4%) swpO=0 conn=1 myRSS=3391 php=9 phpRSS=1322 ap=26 tcp=31 topuser=madalice 2026-09-01 00:41:04 L1=1.31 run=3 blk=0 avail=6928 (50.3%) swpO=0 conn=5 myRSS=3391 php=11 phpRSS=1330 ap=19 tcp=28 topuser=madalice 2026-09-01 00:41:07 L1=1.31 run=1 blk=0 avail=7055 (51.2%) swpO=0 conn=1 myRSS=3391 php=9 phpRSS=1147 ap=17 tcp=27 topuser=madalice 2026-09-01 00:41:14 L1=2.07 run=2 blk=0 avail=6652 (48.3%) swpO=40 conn=3 myRSS=3390 php=13 phpRSS=1664 ap=24 tcp=38 topuser=madalice 2026-09-01 00:41:17 L1=2.07 run=2 blk=0 avail=6530 (47.4%) swpO=40 conn=4 myRSS=3390 php=13 phpRSS=1744 ap=31 tcp=59 topuser=madalice 2026-09-01 00:41:24 L1=1.75 run=2 blk=0 avail=6471 (47.0%) swpO=0 conn=3 myRSS=3390 php=13 phpRSS=1662 ap=51 tcp=36 topuser=madalice 2026-09-01 00:41:27 L1=1.75 run=6 blk=0 avail=6120 (44.4%) swpO=64 conn=5 myRSS=3387 php=16 phpRSS=2142 ap=48 tcp=37 topuser=madalice 2026-09-01 00:41:35 L1=1.94 run=3 blk=0 avail=6375 (46.3%) swpO=59 conn=4 myRSS=3387 php=13 phpRSS=1834 ap=41 tcp=32 topuser=madalice 2026-09-01 00:41:37 L1=1.94 run=3 blk=0 avail=6529 (47.4%) swpO=0 conn=3 myRSS=3387 php=14 phpRSS=1731 ap=38 tcp=33 topuser=madalice 2026-09-01 00:41:45 L1=1.88 run=2 blk=0 avail=6544 (47.5%) swpO=0 conn=3 myRSS=3388 php=13 phpRSS=1725 ap=31 tcp=30 topuser=madalice 2026-09-01 00:41:47 L1=1.88 run=2 blk=0 avail=6663 (48.4%) swpO=0 conn=2 myRSS=3388 php=12 phpRSS=1604 ap=28 tcp=30 topuser=madalice 2026-09-01 00:41:55 L1=1.67 run=4 blk=0 avail=6549 (47.5%) swpO=0 conn=5 myRSS=3388 php=15 phpRSS=1874 ap=21 tcp=31 topuser=madalice 2026-09-01 00:41:57 L1=1.67 run=2 blk=0 avail=6687 (48.5%) swpO=0 conn=2 myRSS=3388 php=12 phpRSS=1648 ap=19 tcp=32 topuser=madalice 2026-09-01 00:42:05 L1=1.49 run=2 blk=0 avail=6699 (48.6%) swpO=0 conn=3 myRSS=3388 php=13 phpRSS=1681 ap=18 tcp=30 topuser=madalice 2026-09-01 00:42:07 L1=1.49 run=1 blk=0 avail=6742 (48.9%) swpO=0 conn=1 myRSS=3388 php=12 phpRSS=1604 ap=17 tcp=33 topuser=madalice 2026-09-01 00:42:15 L1=1.33 run=3 blk=0 avail=6723 (48.8%) swpO=0 conn=3 myRSS=3388 php=13 phpRSS=1674 ap=17 tcp=31 topuser=madalice