INCIDENT 2026-09-01 18:50:46 trigger: php_rss=1857MB ================================================================== load: 1.51 1.30 1.13 11/678 3272428 ncpu:10 mem_avail: 6202MB/13777MB (45.0%) swap_used:2487MB swapout:414/s blocked(D):0 running:13 iowait:0.1% steal:0.0% php: 13 procs / 1857MB heaviest user: madalice (10 procs, 1775MB) apache: 53 procs tcp_estab: 65 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3342 madalice 10 1692 root 245 968 nobody 52 857 netdata 7 205 cpanellogin 1 113 mailman 20 84 wp-toolkit 3 81 dovenull 6 46 lowrange 2 29 infinium 2 27 evolution 7 26 zabbix 1 19 dovecot 3 18 kurri 1 13 candyfabcom 1 13 named 1 12 mailnull 1 11 polkitd 1 4 nscd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1696 root 1 32 evolution 1 8 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5312 MB Active(file): 4314 MB Inactive(file): 1259 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 479 MB CommitLimit: 10984 MB Committed_AS: 8819 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 16:28:17 4836 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3423044 11.0 Ssl 4-16:31:37 /usr/sbin/mariadbd 3272177 3929444 madalice 210140 28.2 R 00:20 php-fpm: pool madalice_com_au 3272340 3929444 madalice 208052 47.4 S 00:05 php-fpm: pool madalice_com_au 508924 1 netdata 185052 1.9 Ssl 4-16:31:06 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2001035 3930335 root 171660 0.1 S 05:55:30 spamd child 3272336 3929444 madalice 166852 57.6 R 00:05 php-fpm: pool madalice_com_au 3272339 3929444 madalice 165776 57.2 R 00:05 php-fpm: pool madalice_com_au 3272335 3929444 madalice 163064 56.2 R 00:05 php-fpm: pool madalice_com_au 3272344 3929444 madalice 160000 56.2 R 00:05 php-fpm: pool madalice_com_au 3963222 3930335 root 150248 0.0 S 16:20:29 spamd child 3272338 3929444 madalice 144940 43.2 R 00:05 php-fpm: pool madalice_com_au 3272337 3929444 madalice 144788 35.8 R 00:05 php-fpm: pool madalice_com_au 3272334 3929444 madalice 144528 36.0 R 00:05 php-fpm: pool madalice_com_au 3272341 3929444 madalice 142284 38.4 R 00:05 php-fpm: pool madalice_com_au 509266 1 root 121552 0.0 Ss 4-16:31:03 /usr/lib/systemd/systemd-journald 2552785 1353308 cpanellogin 116288 0.0 S 03:21:37 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 3930335 1 root 85360 0.0 Ss 16:27:35 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509640 508992 root 61148 0.0 Sl 4-16:31:01 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509236 509098 root 51772 0.0 Sl 4-16:31:03 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3929420 1 wp-toolkit 45484 0.0 Ss 16:28:08 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1353308 1 root 42104 0.1 Ss 41-16:09:29 cpsrvd (SSL) - waiting for connections 3929444 1 root 33692 0.0 Ss 16:28:08 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3929564 1 wp-toolkit 33336 0.0 Ss 16:28:07 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3929532 1 root 23628 0.0 Ss 16:28:07 lfd - sleeping 3240277 506832 nobody 23228 0.1 S 06:08 /usr/sbin/httpd -k start 3256218 506832 nobody 21440 0.1 S 03:13 /usr/sbin/httpd -k start 3256203 506832 nobody 21012 0.1 S 03:16 /usr/sbin/httpd -k start 1469 1 root 20776 0.1 Ss 64-08:40:58 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3257148 506832 nobody 20652 0.0 S 02:00 /usr/sbin/httpd -k start 1463 1 root 20644 0.0 Ss 64-08:40:58 tailwatchd 3272115 506832 nobody 19700 0.1 S 00:23 /usr/sbin/httpd -k start 3264939 506832 nobody 19668 0.0 S 00:39 /usr/sbin/httpd -k start 483898 1 zabbix 19544 0.2 Ssl 4-16:32:20 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3257157 506832 nobody 19540 0.1 S 01:59 /usr/sbin/httpd -k start 3264937 506832 nobody 19404 0.4 S 00:39 /usr/sbin/httpd -k start 3263229 506832 nobody 19364 0.0 S 00:40 /usr/sbin/httpd -k start 3272133 506832 nobody 19172 0.4 S 00:22 /usr/sbin/httpd -k start 3263230 506832 nobody 19156 0.0 S 00:40 /usr/sbin/httpd -k start 3257113 506832 nobody 19004 0.1 S 02:01 /usr/sbin/httpd -k start 3272135 506832 nobody 18944 0.0 S 00:22 /usr/sbin/httpd -k start 3261533 506832 nobody 18872 0.0 S 00:41 /usr/sbin/httpd -k start 3257161 506832 nobody 18868 0.0 S 01:59 /usr/sbin/httpd -k start 3264934 506832 nobody 18856 0.0 S 00:39 /usr/sbin/httpd -k start 3272098 506832 nobody 18840 0.0 S 00:25 /usr/sbin/httpd -k start 3272138 506832 nobody 18796 0.0 S 00:22 /usr/sbin/httpd -k start 3255531 506832 nobody 18776 0.0 S 04:00 /usr/sbin/httpd -k start 3272137 506832 nobody 18776 0.0 S 00:22 /usr/sbin/httpd -k start 3272109 506832 nobody 18720 0.1 S 00:23 /usr/sbin/httpd -k start 3272132 506832 nobody 18620 0.0 S 00:22 /usr/sbin/httpd -k start 3257163 506832 nobody 18492 0.1 S 01:59 /usr/sbin/httpd -k start 3256605 506832 nobody 18360 0.0 S 02:38 /usr/sbin/httpd -k start 3272114 506832 nobody 17808 0.0 S 00:23 /usr/sbin/httpd -k start 3272128 506832 nobody 17672 0.0 S 00:22 /usr/sbin/httpd -k start 3272099 506832 nobody 17648 0.0 S 00:25 /usr/sbin/httpd -k start 3929469 1 root 17532 0.0 Ss 16:28:08 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 3272112 506832 nobody 17140 0.3 S 00:23 /usr/sbin/httpd -k start 3272103 506832 nobody 17084 0.0 S 00:24 /usr/sbin/httpd -k start 3272111 506832 nobody 17084 0.3 S 00:23 /usr/sbin/httpd -k start 3272373 506832 nobody 16856 0.0 S 00:02 /usr/sbin/httpd -k start 3272140 506832 nobody 16712 0.0 S 00:22 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 15194366 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 15194356 | madalice_wp | madalice_wp | Query | 0 | | SELECT option_value FROM AMuqf6qZ_options WHERE option_name = 'cfturnstile_woo_account' LIMIT 1 | +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min bigdeals/bigdeals.com.au 576 evolution/app.evolutionerp.com.au-ssl_log 172 aaa/aaadownunder.com.au-ssl_log 123 evolution/my.evolutionerp.com.au-ssl_log 104 otterfencing/otterfencing.com.au 38 madalice/madalice.com.au-ssl_log 23 evolution/portal.evolutionerp.com.au-ssl_log 21 alison/alisonarts.com.au-ssl_log 2 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 576 185.177.72.24 172 40.115.94.245 159 20.48.251.3 87 147.161.213.78 26 203.54.180.238 10 136.108.89.82 8 101.182.108.127 2 118.127.40.55 2 114.119.143.14 2 114.119.130.40 1 69.57.172.119 1 66.116.251.167 1 51.81.163.68 1 40.77.167.74 1 40.77.167.38 --- top request paths across all vhosts (last 3 min) --- 288 GET /cgi-sys/suspendedpage.cgi 54 GET /api/getItem/LWFB2001KG 32 GET /api/getItem/LWPG2001KG 31 GET /app/ajax.php 30 POST /functions.php 21 GET /heartbeat.php 13 GET /index.php 6 POST /clienteditsave.php 6 POST /app/ajax/selectFilterSingle.php 6 POST /app/ajax.php 3 POST /logsave.php 3 GET /ms-edit.php 3 GET /api/getItem/19R-7320 2 POST /wp-cron.php 2 POST /fsinstructionsave.php 2 GET /xve22.php 2 GET /xp.php 2 GET /ws62.php 2 GET /tax.php 2 GET /store/hand-painted-nike-af1-wildflower/ --- busiest 3 vhosts: top paths + last 10 requests --- == bigdeals/bigdeals.com.au == -- top paths -- 288 GET /cgi-sys/suspendedpage.cgi 1 GET /.well-known/smtp 1 GET /.well-known/sendgrid 1 GET /.well-known/mail 1 GET /.well-known/email 1 GET /v3/mail/settings/footer 1 GET /v3/mail/settings/bypass_unsubscribe_management 1 GET /v3/mail/settings/bypass_spam_management 1 GET /v3/mail/settings/bypass_bounce_management 1 GET /v3/mail/settings/bounce_purge 1 GET /v3/mail/settings/address_whitelist 1 GET /v3/mail/settings -- last 10 requests -- 185.177.72.24 - - [01/Sep/2026:18:50:38 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "curl/8.7.1" 185.177.72.24 - - [01/Sep/2026:18:50:39 +1000] "GET /v3/mail/settings/bounce_purge HTTP/1.1" 302 250 "-" "curl/8.7.1" 185.177.72.24 - - [01/Sep/2026:18:50:39 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "curl/8.7.1" 185.177.72.24 - - [01/Sep/2026:18:50:39 +1000] "GET /v3/mail/settings/bypass_bounce_management HTTP/1.1" 302 250 "-" "curl/8.7.1" 185.177.72.24 - - [01/Sep/2026:18:50:40 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "curl/8.7.1" 185.177.72.24 - - [01/Sep/2026:18:50:40 +1000] "GET /v3/mail/settings/bypass_spam_management HTTP/1.1" 302 250 "-" "curl/8.7.1" 185.177.72.24 - - [01/Sep/2026:18:50:40 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "curl/8.7.1" 185.177.72.24 - - [01/Sep/2026:18:50:41 +1000] "GET /v3/mail/settings/bypass_unsubscribe_management HTTP/1.1" 302 250 "-" "curl/8.7.1" 185.177.72.24 - - [01/Sep/2026:18:50:41 +1000] "GET /cgi-sys/suspendedpage.cgi HTTP/1.1" 200 7771 "-" "curl/8.7.1" 185.177.72.24 - - [01/Sep/2026:18:50:41 +1000] "GET /v3/mail/settings/footer HTTP/1.1" 302 250 "-" "curl/8.7.1" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 54 GET /api/getItem/LWFB2001KG 32 GET /api/getItem/LWPG2001KG 3 GET /api/getItem/19R-7320 2 GET /api/getItem/SHSG252516-8 2 GET /api/getItem/SHSG252516-6.5 2 GET /api/getItem/RHSG65161255 2 GET /api/getItem/RHSG15050308 2 GET /api/getItem/RHSG15050208 2 GET /api/getItem/RHSG150100408 2 GET /api/getItem/RHSG12575408 2 GET /api/getItem/RHSG12575308 2 GET /api/getItem/19R-8000 -- last 10 requests -- 40.115.94.245 - - [01/Sep/2026:18:50:41 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:18:50:42 +1000] "GET /api/getItem/SHSG15015040-8 HTTP/1.1" 200 1459 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:18:50:42 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:18:50:42 +1000] "GET /api/getItem/SHSG202012-8 HTTP/1.1" 200 1352 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:18:50:43 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:18:50:43 +1000] "GET /api/getItem/SHSG202016-8 HTTP/1.1" 200 1476 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:18:50:43 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:18:50:43 +1000] "GET /api/getItem/SHSG252516--6.5 HTTP/1.1" 404 117 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:18:50:44 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:18:50:44 +1000] "GET /api/getItem/SHSG252516--8 HTTP/1.1" 404 115 "-" "RestSharp/106.13.0.0" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 1 GET /xve22.php 1 GET /xp.php 1 GET /xmy.php 1 GET /xin1.php 1 GET /xda.php 1 GET /X57.php 1 GET /wsws.php 1 GET /ws79.php 1 GET /ws62.php 1 GET /ws61.php 1 GET /wp-includes/js/tinymce/themes/inlite 1 GET /wp-act.php -- last 10 requests -- 20.48.251.3 - - [01/Sep/2026:18:49:02 +1000] "GET /nzv.php HTTP/1.1" 404 5749 "-" "-" 20.48.251.3 - - [01/Sep/2026:18:49:02 +1000] "GET /4563.php HTTP/1.1" 404 5749 "-" "-" 20.48.251.3 - - [01/Sep/2026:18:49:03 +1000] "GET /debug.php HTTP/1.1" 404 5749 "-" "-" 20.48.251.3 - - [01/Sep/2026:18:49:03 +1000] "GET /lm15.php HTTP/1.1" 404 5749 "-" "-" 20.48.251.3 - - [01/Sep/2026:18:49:04 +1000] "GET /cache-compat.php HTTP/1.1" 404 5749 "-" "-" 20.48.251.3 - - [01/Sep/2026:18:49:04 +1000] "GET /app_dev.php HTTP/1.1" 404 5749 "-" "-" 20.48.251.3 - - [01/Sep/2026:18:49:05 +1000] "GET /plss3.php HTTP/1.1" 404 5749 "-" "-" 20.48.251.3 - - [01/Sep/2026:18:49:05 +1000] "GET /gecko-litespeed.php HTTP/1.1" 404 5749 "-" "-" 20.48.251.3 - - [01/Sep/2026:18:49:06 +1000] "GET /env.php HTTP/1.1" 404 5749 "-" "-" 20.48.251.3 - - [01/Sep/2026:18:49:06 +1000] "GET /8.php HTTP/1.1" 404 5749 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-09-01 18:48:18 L1=1.45 run=5 blk=0 avail=7804 (56.6%) swpO=0 conn=3 myRSS=3349 php=4 phpRSS=324 ap=30 tcp=32 topuser=madalice 2026-09-01 18:48:25 L1=1.41 run=1 blk=0 avail=7947 (57.7%) swpO=0 conn=1 myRSS=3349 php=3 phpRSS=199 ap=23 tcp=32 topuser=madalice 2026-09-01 18:48:28 L1=1.38 run=2 blk=0 avail=7906 (57.4%) swpO=0 conn=3 myRSS=3349 php=4 phpRSS=265 ap=22 tcp=30 topuser=madalice 2026-09-01 18:48:35 L1=1.35 run=4 blk=0 avail=7860 (57.1%) swpO=0 conn=1 myRSS=3349 php=5 phpRSS=359 ap=20 tcp=34 topuser=madalice 2026-09-01 18:48:38 L1=1.40 run=2 blk=0 avail=7830 (56.8%) swpO=0 conn=3 myRSS=3349 php=4 phpRSS=349 ap=21 tcp=37 topuser=madalice 2026-09-01 18:48:45 L1=1.29 run=2 blk=0 avail=8059 (58.5%) swpO=0 conn=1 myRSS=3349 php=2 phpRSS=41 ap=24 tcp=46 topuser=root 2026-09-01 18:48:48 L1=1.26 run=2 blk=0 avail=7867 (57.1%) swpO=0 conn=3 myRSS=3349 php=4 phpRSS=211 ap=36 tcp=50 topuser=madalice 2026-09-01 18:48:55 L1=1.24 run=2 blk=0 avail=7851 (57.0%) swpO=0 conn=1 myRSS=3349 php=4 phpRSS=240 ap=35 tcp=39 topuser=madalice 2026-09-01 18:48:58 L1=1.22 run=3 blk=0 avail=7833 (56.9%) swpO=0 conn=3 myRSS=3349 php=4 phpRSS=274 ap=33 tcp=38 topuser=madalice 2026-09-01 18:49:05 L1=1.29 run=2 blk=0 avail=7877 (57.2%) swpO=0 conn=1 myRSS=3349 php=4 phpRSS=253 ap=29 tcp=35 topuser=madalice 2026-09-01 18:49:08 L1=1.42 run=2 blk=0 avail=7858 (57.0%) swpO=0 conn=2 myRSS=3349 php=4 phpRSS=285 ap=27 tcp=32 topuser=madalice 2026-09-01 18:49:16 L1=1.47 run=4 blk=0 avail=7470 (54.2%) swpO=0 conn=1 myRSS=3349 php=6 phpRSS=757 ap=21 tcp=42 topuser=corpkicks 2026-09-01 18:49:18 L1=1.43 run=2 blk=0 avail=7877 (57.2%) swpO=0 conn=2 myRSS=3349 php=4 phpRSS=290 ap=20 tcp=38 topuser=madalice 2026-09-01 18:49:26 L1=1.40 run=1 blk=0 avail=7829 (56.8%) swpO=0 conn=1 myRSS=3349 php=4 phpRSS=330 ap=21 tcp=33 topuser=madalice 2026-09-01 18:49:28 L1=1.28 run=4 blk=0 avail=7806 (56.7%) swpO=0 conn=2 myRSS=3349 php=5 phpRSS=373 ap=20 tcp=36 topuser=madalice 2026-09-01 18:49:36 L1=1.34 run=2 blk=0 avail=7735 (56.1%) swpO=0 conn=1 myRSS=3349 php=5 phpRSS=456 ap=20 tcp=33 topuser=madalice 2026-09-01 18:49:38 L1=1.31 run=2 blk=0 avail=7804 (56.6%) swpO=0 conn=2 myRSS=3349 php=4 phpRSS=373 ap=19 tcp=34 topuser=madalice 2026-09-01 18:49:46 L1=1.21 run=3 blk=0 avail=7753 (56.3%) swpO=0 conn=1 myRSS=3349 php=5 phpRSS=405 ap=19 tcp=29 topuser=madalice 2026-09-01 18:49:48 L1=1.19 run=4 blk=0 avail=7615 (55.3%) swpO=0 conn=2 myRSS=3349 php=6 phpRSS=576 ap=19 tcp=31 topuser=madalice 2026-09-01 18:49:56 L1=1.18 run=2 blk=0 avail=7847 (57.0%) swpO=0 conn=1 myRSS=3349 php=4 phpRSS=333 ap=19 tcp=31 topuser=madalice 2026-09-01 18:49:58 L1=1.08 run=2 blk=0 avail=7807 (56.7%) swpO=0 conn=2 myRSS=3349 php=5 phpRSS=400 ap=19 tcp=32 topuser=madalice 2026-09-01 18:50:06 L1=1.08 run=4 blk=0 avail=7916 (57.5%) swpO=0 conn=1 myRSS=3349 php=4 phpRSS=255 ap=20 tcp=40 topuser=madalice 2026-09-01 18:50:08 L1=1.15 run=3 blk=0 avail=7839 (56.9%) swpO=0 conn=2 myRSS=3349 php=4 phpRSS=296 ap=26 tcp=39 topuser=madalice 2026-09-01 18:50:16 L1=1.14 run=2 blk=0 avail=7821 (56.8%) swpO=0 conn=1 myRSS=3349 php=4 phpRSS=347 ap=22 tcp=36 topuser=madalice 2026-09-01 18:50:18 L1=1.21 run=2 blk=0 avail=7936 (57.6%) swpO=0 conn=2 myRSS=3349 php=3 phpRSS=201 ap=22 tcp=33 topuser=madalice 2026-09-01 18:50:26 L1=1.02 run=2 blk=0 avail=7776 (56.4%) swpO=0 conn=2 myRSS=3349 php=3 phpRSS=177 ap=53 tcp=41 topuser=otterfencing 2026-09-01 18:50:28 L1=1.02 run=1 blk=0 avail=7785 (56.5%) swpO=0 conn=2 myRSS=3349 php=4 phpRSS=195 ap=50 tcp=41 topuser=madalice 2026-09-01 18:50:36 L1=0.94 run=3 blk=0 avail=7735 (56.1%) swpO=0 conn=2 myRSS=3349 php=5 phpRSS=332 ap=43 tcp=48 topuser=madalice 2026-09-01 18:50:39 L1=0.94 run=4 blk=0 avail=7686 (55.8%) swpO=0 conn=2 myRSS=3349 php=5 phpRSS=392 ap=41 tcp=41 topuser=madalice 2026-09-01 18:50:46 L1=1.51 run=13 blk=0 avail=6202 (45.0%) swpO=414 conn=10 myRSS=3342 php=13 phpRSS=1857 ap=53 tcp=65 topuser=madalice