INCIDENT 2026-09-01 03:23:42 trigger: php_rss=1539MB ================================================================== load: 6.75 3.29 1.80 11/671 4135018 ncpu:10 mem_avail: 6733MB/13777MB (48.9%) swap_used:2238MB swapout:15/s blocked(D):0 running:9 iowait:0.1% steal:0.0% php: 11 procs / 1539MB heaviest user: madalice (7 procs, 1283MB) apache: 30 procs tcp_estab: 44 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3346 madalice 7 1311 root 252 1210 nobody 30 545 netdata 7 211 wp-toolkit 3 131 customc 1 119 alison 1 102 cpanellogin 1 72 mailnull 6 69 mailman 20 67 dovenull 6 46 lowrange 2 29 evolution 7 29 kurri 2 26 zabbix 1 19 dovecot 3 18 aaa 1 15 infinium 1 14 candyfabcom 1 14 --- php workers by user --- USER PROCS RSS_MB madalice 7 1323 customc 1 123 alison 1 104 root 1 34 evolution 1 10 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5732 MB Active(file): 4299 MB Inactive(file): 1680 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 684 MB CommitLimit: 10984 MB Committed_AS: 8499 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 01:01:13 6768 /usr/bin/imunify-agent-proxy 4134319 root 00:48 58620 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3427272 9.1 Ssl 4-01:04:33 /usr/sbin/mariadbd 4126134 3929444 madalice 257408 54.7 S 03:35 php-fpm: pool madalice_com_au 4133397 3929444 madalice 228592 54.0 R 01:56 php-fpm: pool madalice_com_au 4118098 3929444 madalice 207664 48.0 R 04:14 php-fpm: pool madalice_com_au 4133012 3929444 madalice 205740 56.7 R 02:26 php-fpm: pool madalice_com_au 508924 1 netdata 190448 1.9 Ssl 4-01:04:02 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3963221 3930335 root 185592 0.0 S 53:25 spamd child 3930335 1 root 175620 0.1 Ss 01:00:31 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4132418 3929444 madalice 175600 54.3 R 03:19 php-fpm: pool madalice_com_au 3963222 3930335 root 168164 0.0 S 53:25 spamd child 4133880 3929444 madalice 159700 50.8 S 01:05 php-fpm: pool madalice_com_au 4133019 3929444 madalice 159680 56.8 S 02:25 php-fpm: pool madalice_com_au 4134982 4133014 customc 136676 53.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4134980 4118170 alison 111976 76.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509266 1 root 94700 0.0 Ss 4-01:03:59 /usr/lib/systemd/systemd-journald 3929420 1 wp-toolkit 75924 0.0 Ss 01:01:04 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 509640 508992 root 75568 0.0 Sl 4-01:03:57 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 3501614 1353308 cpanellogin 74280 0.0 S 03:05:46 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 509236 509098 root 60660 0.0 Sl 4-01:03:59 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4134319 1 root 58620 3.2 Ssl 00:48 /opt/imunify360/venv/bin/python3 -m imav.run 3929564 1 wp-toolkit 49312 0.0 Ss 01:01:03 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1353308 1 root 41780 0.1 Ss 41-00:42:25 cpsrvd (SSL) - waiting for connections 3929469 1 root 38340 0.0 Ss 01:01:04 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 3929532 1 root 35812 0.0 Ss 01:01:03 lfd - sleeping 3929444 1 root 35156 0.0 Ss 01:01:04 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 4134984 1469 root 29064 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4111236 506832 nobody 23400 0.2 S 08:34 /usr/sbin/httpd -k start 4117076 506832 nobody 23100 0.1 S 06:06 /usr/sbin/httpd -k start 4109632 506832 nobody 22536 0.2 S 08:35 /usr/sbin/httpd -k start 4118169 506832 nobody 22444 0.4 S 04:03 /usr/sbin/httpd -k start 4112854 506832 nobody 22240 0.2 S 08:33 /usr/sbin/httpd -k start 1469 1 root 22104 0.1 Ss 63-17:13:54 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4133414 506832 nobody 21932 0.0 S 01:53 /usr/sbin/httpd -k start 4133885 506832 nobody 21560 0.4 S 01:04 /usr/sbin/httpd -k start 4118170 506832 nobody 20816 0.0 S 04:03 /usr/sbin/httpd -k start 4133024 506832 nobody 20696 0.0 S 02:25 /usr/sbin/httpd -k start 4133889 506832 nobody 20608 0.1 S 01:03 /usr/sbin/httpd -k start 4133025 506832 nobody 20580 0.2 S 02:25 /usr/sbin/httpd -k start 483898 1 zabbix 20408 0.2 Ssl 4-01:05:16 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 4132464 506832 nobody 20368 0.5 S 03:12 /usr/sbin/httpd -k start 4134538 506832 nobody 20208 0.1 S 00:37 /usr/sbin/httpd -k start 4133014 506832 nobody 19788 0.1 S 02:26 /usr/sbin/httpd -k start 4133890 506832 nobody 19660 0.1 S 01:03 /usr/sbin/httpd -k start 4133067 506832 nobody 19656 0.1 S 02:22 /usr/sbin/httpd -k start 1463 1 root 19648 0.0 Ss 63-17:13:54 tailwatchd 4133068 506832 nobody 19516 0.0 S 02:22 /usr/sbin/httpd -k start 4133037 506832 nobody 18824 0.1 S 02:23 /usr/sbin/httpd -k start 4132495 506832 nobody 18672 0.1 S 03:10 /usr/sbin/httpd -k start 4132497 506832 nobody 18312 0.0 S 03:10 /usr/sbin/httpd -k start 4134529 506832 nobody 18140 0.0 S 00:38 /usr/sbin/httpd -k start 4134564 506832 nobody 18052 0.0 S 00:33 /usr/sbin/httpd -k start 4134573 506832 nobody 17316 0.0 S 00:32 /usr/sbin/httpd -k start 4134934 506832 nobody 16576 0.0 S 00:06 /usr/sbin/httpd -k start 4083104 1471 root 16552 0.0 S 17:00 cPhulkd - dbprocessor 509671 508992 netdata 16364 2.1 Sl 4-01:03:57 /usr/libexec/netdata/plugins.d/apps.plugin 1 4134948 506832 nobody 16360 0.2 S 00:05 /usr/sbin/httpd -k start 4134965 506832 nobody 16104 0.0 S 00:02 /usr/sbin/httpd -k start 3252945 508511 aaa 15872 0.0 S 04:18:53 dovecot/imap 4134947 506832 nobody 15840 0.0 S 00:05 /usr/sbin/httpd -k start 1471 1 root 15500 0.0 Ss 63-17:13:54 cPhulkd - processor --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+-------------+-------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+-------------+-------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10087135 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 10087128 | madalice_wp | madalice_wp | Query | 0 | Waiting for table level lock | SELECT option_value FROM AMuqf6qZ_options WHERE option_name = 'woocommerce_ppcp-pay-upon-invoice-gateway_settings' LIMIT 1 | | 10087127 | madalice_wp | madalice_wp | Query | 0 | closing tables | UPDATE `AMuqf6qZ_options` SET `option_value` = 'a:530:{s:24:\"^wc-auth/v([1]{1})/(.*)?\";s:63:\"index.php?wc-auth-version=$matches[1]&wc-auth-route=$matches[2]\";s:21:\"^wc/file/transient/?$\";s:33:\"index.php?wc-transient-file-name=\";s:24:\"^wc/file/transient/(.+)$\";s:44:\"index.php?wc-transient- | +----------+-------------+-------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 460 evolution/app.evolutionerp.com.au-ssl_log 135 kamcool/kamcool.com.au 93 cosgrovecreative/cosgrovecreative.com.au 90 customc/customcentral.com.au 87 customc/customcentral.com.au-ssl_log 77 kamcool/kamcool.com.au-ssl_log 76 evolution/evolutionerp.com.au-ssl_log 49 olytis/tis.com.au-ssl_log 33 evolution/portal.evolutionerp.com.au-ssl_log 28 infinium/infinium.net.au-ssl_log 10 evolution/my.evolutionerp.com.au-ssl_log 6 corpkicks/corporatekicks.com.au-ssl_log 2 (total vhosts taking traffic: 13) --- top client IPs across all vhosts (last 3 min) --- 450 4.204.224.164 183 20.220.227.7 157 68.155.159.216 135 40.115.94.245 109 158.23.18.78 44 20.151.200.44 28 203.54.180.238 10 118.127.40.55 3 40.77.167.14 3 114.119.140.234 2 65.55.210.221 2 50.6.109.131 2 2a10:3c0:100:0:1:36:0:5 2 203.55.131.3 2 114.119.143.14 --- top request paths across all vhosts (last 3 min) --- 79 GET /api/getItem/LWFB2001KG 76 GET /autodiscover/autodiscover.xml 56 GET /api/getItem/LWPG2001KG 28 GET /heartbeat.php 13 GET /wp-login.php 13 GET /1.php 12 GET /m.php 12 GET /k.php 10 GET /zoo1.php 10 GET /fling.php 9 POST /wp-cron.php 8 GET /wp-content/plugins/hellopress/wp_filemanager.php 8 GET /this_is_a_new_hello_world.php 8 GET /simple.php 7 GET /wp.php 7 GET /classwithtostring.php 7 GET /chosen.php 7 GET /adminfuns.php 7 GET /abcd.php 7 GET /222.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 10 GET /zoo1.php 10 GET /m.php 10 GET /k.php 10 GET /fling.php 10 GET /1.php 6 GET /moon.php 5 GET /wsd.php 5 GET /wp.php 5 GET /wander.php 5 GET /simple.php 5 GET /sallu.php 5 GET /radio.php -- last 10 requests -- 4.204.224.164 - - [01/Sep/2026:03:23:32 +1000] "GET /rxr.php HTTP/1.1" 404 36640 "-" "-" 4.204.224.164 - - [01/Sep/2026:03:23:33 +1000] "GET /nofile.php HTTP/1.1" 404 36638 "-" "-" 4.204.224.164 - - [01/Sep/2026:03:23:34 +1000] "GET /botwdhur.php HTTP/1.1" 404 36640 "-" "-" 4.204.224.164 - - [01/Sep/2026:03:23:34 +1000] "GET /run.php HTTP/1.1" 404 36637 "-" "-" 4.204.224.164 - - [01/Sep/2026:03:23:34 +1000] "GET /abcd.php HTTP/1.1" 404 36637 "-" "-" 4.204.224.164 - - [01/Sep/2026:03:23:35 +1000] "GET /new.php HTTP/1.1" 403 13 "-" "-" 4.204.224.164 - - [01/Sep/2026:03:23:34 +1000] "GET /reviall.php HTTP/1.1" 404 36639 "-" "-" 4.204.224.164 - - [01/Sep/2026:03:23:35 +1000] "GET /run.php HTTP/1.1" 404 36638 "-" "-" 4.204.224.164 - - [01/Sep/2026:03:23:37 +1000] "GET /new.php HTTP/1.1" 403 13 "-" "-" 4.204.224.164 - - [01/Sep/2026:03:23:35 +1000] "GET /dnjyoumb.php HTTP/1.1" 404 36643 "-" "-" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 79 GET /api/getItem/LWFB2001KG 56 GET /api/getItem/LWPG2001KG -- last 10 requests -- 40.115.94.245 - - [01/Sep/2026:03:23:12 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:03:23:13 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:03:23:13 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:03:23:14 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:03:23:14 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:03:23:14 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:03:23:15 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:03:23:15 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:03:23:16 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:03:23:16 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" == kamcool/kamcool.com.au == -- top paths -- 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET //un.php 1 GET /this_is_a_new_hello_world.php 1 GET /tesla1.php 1 GET /t7cyZd.php 1 GET /swm.php 1 GET /ss.php 1 GET /sid3.php 1 GET /shop.php 1 GET /shiny.php 1 GET /send.php 1 GET /search.php -- last 10 requests -- 20.220.227.7 - - [01/Sep/2026:03:22:05 +1000] "GET /alfanew2.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [01/Sep/2026:03:22:05 +1000] "GET /ss.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [01/Sep/2026:03:22:06 +1000] "GET /mariju.php HTTP/1.1" 403 13 "-" "-" 20.220.227.7 - - [01/Sep/2026:03:22:06 +1000] "GET /metamers.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [01/Sep/2026:03:22:06 +1000] "GET //11.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [01/Sep/2026:03:22:06 +1000] "GET /kct403.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [01/Sep/2026:03:22:06 +1000] "GET /fox.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [01/Sep/2026:03:22:07 +1000] "GET /f7.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [01/Sep/2026:03:22:07 +1000] "GET /bypass.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [01/Sep/2026:03:22:07 +1000] "GET /nti.php HTTP/1.1" 404 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-09-01 03:21:13 L1=1.73 run=3 blk=0 avail=7522 (54.6%) swpO=0 conn=2 myRSS=3360 php=7 phpRSS=799 ap=17 tcp=31 topuser=madalice 2026-09-01 03:21:20 L1=2.23 run=6 blk=0 avail=7326 (53.2%) swpO=0 conn=4 myRSS=3360 php=7 phpRSS=942 ap=21 tcp=36 topuser=madalice 2026-09-01 03:21:23 L1=2.23 run=5 blk=0 avail=7250 (52.6%) swpO=0 conn=5 myRSS=3360 php=8 phpRSS=1041 ap=23 tcp=38 topuser=madalice 2026-09-01 03:21:31 L1=3.03 run=6 blk=0 avail=7282 (52.9%) swpO=0 conn=4 myRSS=3360 php=7 phpRSS=984 ap=23 tcp=36 topuser=madalice 2026-09-01 03:21:33 L1=3.03 run=5 blk=0 avail=7318 (53.1%) swpO=0 conn=5 myRSS=3360 php=8 phpRSS=974 ap=23 tcp=38 topuser=madalice 2026-09-01 03:21:41 L1=3.56 run=6 blk=0 avail=7180 (52.1%) swpO=0 conn=6 myRSS=3360 php=10 phpRSS=1151 ap=24 tcp=38 topuser=madalice 2026-09-01 03:21:43 L1=3.56 run=9 blk=0 avail=7138 (51.8%) swpO=0 conn=5 myRSS=3360 php=10 phpRSS=1209 ap=24 tcp=39 topuser=madalice 2026-09-01 03:21:51 L1=4.24 run=9 blk=0 avail=6905 (50.1%) swpO=0 conn=6 myRSS=3360 php=11 phpRSS=1450 ap=26 tcp=43 topuser=madalice 2026-09-01 03:21:53 L1=4.24 run=5 blk=0 avail=7171 (52.1%) swpO=0 conn=5 myRSS=3360 php=8 phpRSS=986 ap=28 tcp=34 topuser=madalice 2026-09-01 03:22:01 L1=4.74 run=5 blk=0 avail=7130 (51.8%) swpO=0 conn=6 myRSS=3360 php=9 phpRSS=1167 ap=25 tcp=33 topuser=madalice 2026-09-01 03:22:03 L1=4.74 run=5 blk=0 avail=7239 (52.5%) swpO=0 conn=5 myRSS=3360 php=8 phpRSS=1029 ap=25 tcp=33 topuser=madalice 2026-09-01 03:22:11 L1=4.93 run=11 blk=0 avail=6991 (50.7%) swpO=2 conn=6 myRSS=3360 php=10 phpRSS=1299 ap=25 tcp=34 topuser=madalice 2026-09-01 03:22:13 L1=4.93 run=8 blk=0 avail=6989 (50.7%) swpO=2 conn=5 myRSS=3360 php=9 phpRSS=1266 ap=25 tcp=32 topuser=madalice 2026-09-01 03:22:21 L1=5.02 run=6 blk=0 avail=7160 (52.0%) swpO=0 conn=6 myRSS=3360 php=9 phpRSS=1163 ap=22 tcp=30 topuser=madalice 2026-09-01 03:22:23 L1=5.02 run=5 blk=0 avail=7207 (52.3%) swpO=0 conn=5 myRSS=3360 php=8 phpRSS=1076 ap=22 tcp=29 topuser=madalice 2026-09-01 03:22:31 L1=5.26 run=9 blk=0 avail=7115 (51.6%) swpO=0 conn=6 myRSS=3360 php=9 phpRSS=1236 ap=21 tcp=33 topuser=madalice 2026-09-01 03:22:33 L1=5.26 run=3 blk=0 avail=7155 (51.9%) swpO=0 conn=5 myRSS=3360 php=9 phpRSS=1169 ap=21 tcp=31 topuser=madalice 2026-09-01 03:22:41 L1=5.29 run=11 blk=0 avail=6776 (49.2%) swpO=0 conn=8 myRSS=3360 php=11 phpRSS=1588 ap=24 tcp=36 topuser=madalice 2026-09-01 03:22:43 L1=5.29 run=8 blk=0 avail=7005 (50.8%) swpO=0 conn=5 myRSS=3360 php=10 phpRSS=1322 ap=24 tcp=34 topuser=madalice 2026-09-01 03:22:51 L1=5.32 run=6 blk=0 avail=6961 (50.5%) swpO=0 conn=8 myRSS=3360 php=9 phpRSS=1338 ap=24 tcp=33 topuser=madalice 2026-09-01 03:22:53 L1=5.32 run=7 blk=0 avail=6961 (50.5%) swpO=0 conn=5 myRSS=3360 php=9 phpRSS=1327 ap=24 tcp=32 topuser=madalice 2026-09-01 03:23:02 L1=5.35 run=5 blk=0 avail=6908 (50.1%) swpO=0 conn=8 myRSS=3360 php=10 phpRSS=1376 ap=22 tcp=35 topuser=madalice 2026-09-01 03:23:03 L1=5.35 run=4 blk=0 avail=7027 (51.0%) swpO=0 conn=5 myRSS=3360 php=9 phpRSS=1185 ap=22 tcp=33 topuser=madalice 2026-09-01 03:23:12 L1=5.97 run=9 blk=0 avail=6626 (48.1%) swpO=362 conn=6 myRSS=3347 php=12 phpRSS=1678 ap=28 tcp=37 topuser=madalice 2026-09-01 03:23:13 L1=5.97 run=5 blk=0 avail=6965 (50.6%) swpO=362 conn=5 myRSS=3347 php=9 phpRSS=1251 ap=28 tcp=33 topuser=madalice 2026-09-01 03:23:22 L1=6.21 run=7 blk=0 avail=6894 (50.0%) swpO=0 conn=6 myRSS=3347 php=11 phpRSS=1401 ap=26 tcp=35 topuser=madalice 2026-09-01 03:23:23 L1=6.21 run=12 blk=0 avail=6759 (49.1%) swpO=0 conn=9 myRSS=3347 php=12 phpRSS=1562 ap=26 tcp=35 topuser=madalice 2026-09-01 03:23:32 L1=6.44 run=4 blk=0 avail=6905 (50.1%) swpO=0 conn=6 myRSS=3347 php=10 phpRSS=1341 ap=26 tcp=41 topuser=madalice 2026-09-01 03:23:34 L1=6.44 run=6 blk=0 avail=6860 (49.8%) swpO=0 conn=9 myRSS=3347 php=10 phpRSS=1381 ap=26 tcp=39 topuser=madalice 2026-09-01 03:23:42 L1=6.75 run=9 blk=0 avail=6733 (48.9%) swpO=15 conn=8 myRSS=3346 php=11 phpRSS=1539 ap=30 tcp=44 topuser=madalice