INCIDENT 2026-09-01 21:56:42 trigger: php_rss=1518MB ================================================================== load: 2.07 1.41 1.38 2/659 3943866 ncpu:10 mem_avail: 6649MB/13777MB (48.3%) swap_used:2477MB swapout:0/s blocked(D):0 running:1 iowait:0.1% steal:0.0% php: 13 procs / 1518MB heaviest user: madalice (10 procs, 1442MB) apache: 33 procs tcp_estab: 47 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3428 madalice 10 1442 root 246 964 nobody 32 575 netdata 7 200 cpanellogin 1 113 infinium 2 86 mailman 20 84 wp-toolkit 3 81 dovenull 6 46 kurri 2 28 evolution 7 26 zabbix 1 18 dovecot 3 18 aaa 1 15 lowrange 1 14 alison 1 14 named 1 12 mailnull 1 11 polkitd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1442 root 1 32 evolution 1 8 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5393 MB Active(file): 4995 MB Inactive(file): 719 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 490 MB CommitLimit: 10984 MB Committed_AS: 8383 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 19:34:13 5496 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3510628 10.8 Ssl 4-19:37:33 /usr/sbin/mariadbd 508924 1 netdata 181044 1.9 Ssl 4-19:37:02 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2001035 3930335 root 172268 0.1 S 09:01:26 spamd child 3942946 3929444 madalice 161972 19.4 S 01:22 php-fpm: pool madalice_com_au 3943764 3929444 madalice 160272 23.7 S 00:10 php-fpm: pool madalice_com_au 3943795 3929444 madalice 160268 26.3 S 00:09 php-fpm: pool madalice_com_au 3943629 3929444 madalice 159792 27.2 S 00:24 php-fpm: pool madalice_com_au 3943722 3929444 madalice 159496 24.8 S 00:15 php-fpm: pool madalice_com_au 3963222 3930335 root 150248 0.0 S 19:26:25 spamd child 3943794 3929444 madalice 139480 17.0 S 00:09 php-fpm: pool madalice_com_au 3943796 3929444 madalice 139472 17.4 S 00:09 php-fpm: pool madalice_com_au 3943793 3929444 madalice 137468 15.5 S 00:09 php-fpm: pool madalice_com_au 3943791 3929444 madalice 137372 15.5 S 00:09 php-fpm: pool madalice_com_au 509266 1 root 127756 0.0 Ss 4-19:36:59 /usr/lib/systemd/systemd-journald 3943797 3929444 madalice 121604 13.8 S 00:09 php-fpm: pool madalice_com_au 3326203 1353308 cpanellogin 115992 0.0 S 02:47:15 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 3930335 1 root 85360 0.0 Ss 19:33:31 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509640 508992 root 61412 0.0 Sl 4-19:36:57 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 3943638 1353308 infinium 55296 0.6 S 00:21 webmaild - serving 1.41.252.211 509236 509098 root 51068 0.0 Sl 4-19:36:59 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3929420 1 wp-toolkit 45452 0.0 Ss 19:34:04 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1353308 1 root 42536 0.1 Ss 41-19:15:25 cpsrvd (SSL) - waiting for connections 3929444 1 root 33636 0.0 Ss 19:34:04 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3816336 3929397 infinium 33368 0.0 S 35:54 php-fpm: pool user_infinium 3929564 1 wp-toolkit 33304 0.0 Ss 19:34:03 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3929532 1 root 23740 0.0 Ss 19:34:03 lfd - sleeping 3927566 506832 nobody 22560 0.1 S 03:37 /usr/sbin/httpd -k start 3926925 506832 nobody 22548 0.1 S 04:37 /usr/sbin/httpd -k start 3925899 506832 nobody 22152 0.1 S 05:53 /usr/sbin/httpd -k start 3926927 506832 nobody 22128 0.1 S 04:36 /usr/sbin/httpd -k start 3927974 506832 nobody 22072 0.2 S 02:58 /usr/sbin/httpd -k start 3925894 506832 nobody 22044 0.1 S 05:53 /usr/sbin/httpd -k start 3926948 506832 nobody 21300 0.1 S 04:35 /usr/sbin/httpd -k start 1469 1 root 21120 0.1 Ss 64-11:46:54 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3927719 506832 nobody 20992 0.1 S 03:22 /usr/sbin/httpd -k start 3926953 506832 nobody 20984 0.1 S 04:35 /usr/sbin/httpd -k start 3928089 506832 nobody 20904 0.0 S 02:46 /usr/sbin/httpd -k start 3926928 506832 nobody 20900 0.1 S 04:36 /usr/sbin/httpd -k start 3928087 506832 nobody 20876 0.1 S 02:46 /usr/sbin/httpd -k start 3926920 506832 nobody 20812 0.2 S 04:38 /usr/sbin/httpd -k start 1463 1 root 20672 0.0 Ss 64-11:46:54 tailwatchd 3943709 506832 nobody 19756 0.1 S 00:18 /usr/sbin/httpd -k start 3943730 506832 nobody 19220 0.0 S 00:14 /usr/sbin/httpd -k start 483898 1 zabbix 19120 0.2 Ssl 4-19:38:16 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3943633 506832 nobody 18984 0.0 S 00:23 /usr/sbin/httpd -k start 3943674 506832 nobody 18700 0.1 S 00:20 /usr/sbin/httpd -k start 3943706 506832 nobody 18640 0.1 S 00:18 /usr/sbin/httpd -k start 3943708 506832 nobody 18588 0.1 S 00:18 /usr/sbin/httpd -k start 3943731 506832 nobody 18536 0.1 S 00:14 /usr/sbin/httpd -k start 3943812 506832 nobody 18280 0.0 S 00:04 /usr/sbin/httpd -k start 3943803 506832 nobody 18032 0.0 S 00:07 /usr/sbin/httpd -k start 3943707 506832 nobody 17572 0.0 S 00:18 /usr/sbin/httpd -k start 3929469 1 root 17528 0.0 Ss 19:34:04 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 3943723 506832 nobody 17028 0.2 S 00:15 /usr/sbin/httpd -k start 3943724 506832 nobody 16992 0.0 S 00:15 /usr/sbin/httpd -k start 3943703 506832 nobody 16736 0.0 S 00:19 /usr/sbin/httpd -k start 3943808 506832 nobody 16716 0.0 S 00:05 /usr/sbin/httpd -k start 3943729 506832 nobody 16544 0.0 S 00:14 /usr/sbin/httpd -k start 509671 508992 netdata 16532 2.1 Sl 4-19:36:57 /usr/libexec/netdata/plugins.d/apps.plugin 1 3943728 506832 nobody 16412 0.0 S 00:14 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 15382221 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min aaa/aaadownunder.com.au-ssl_log 467 bigdeals/bigdeals.com.au-ssl_log 189 evolution/app.evolutionerp.com.au-ssl_log 128 coscom/swms.coscom.com.au 122 vinesit/vinesit.com.au-ssl_log 120 bigdeals/bigdeals.com.au 106 madalice/madalice.com.au-ssl_log 101 tubesupplies/tubesupplies.com.au-ssl_log 47 evolution/portal.evolutionerp.com.au-ssl_log 24 nrg/nrgservices.net.au-ssl_log 5 infinium/infinium.net.au-ssl_log 3 speedlin/speedlinefencing.com.au-ssl_log 3 customc/customcentral.com.au-ssl_log 2 evolution/my.evolutionerp.com.au-ssl_log 2 evolution/evolutionerp.com.au-ssl_log 1 (total vhosts taking traffic: 15) --- top client IPs across all vhosts (last 3 min) --- 405 185.177.72.22 189 185.177.72.54 128 40.115.94.245 122 4.205.62.107 113 185.177.72.13 106 20.220.204.93 106 158.23.184.117 53 20.48.250.41 24 203.54.180.238 11 34.138.74.246 9 20.48.251.3 7 52.26.129.107 6 118.127.40.55 3 2a02:26f7:fc10:4000:e000::1b 2 52.167.144.193 --- top request paths across all vhosts (last 3 min) --- 53 GET /cgi-sys/suspendedpage.cgi 43 GET /api/getItem/LWHG2001KG 35 GET /api/getItem/LWPG2001KG 30 GET /api/getItem/LWFBW2001KG 24 GET /heartbeat.php 19 GET / 6 POST /wp-cron.php 5 POST / 4 GET /api/getItem/PWFBW3151KG 3 GET /robots.txt 3 GET /radio.php 3 GET /public/vx.php 2 GET /zwso.php 2 GET /zoo2.php 2 GET /zoo1.php 2 GET /xrp.php 2 GET /XrdbXydefault.php 2 GET /xmini4.php 2 GET /wp-trackback.php 2 GET /wp-logs.php --- busiest 3 vhosts: top paths + last 10 requests --- == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 8 GET / 2 POST /wp-cron.php 2 GET /tools/fetch 2 GET /login 2 GET /admin/webhook-test 1 GET /zzadmin/ 1 GET /.zshrc 1 GET /.zsh_aliases 1 GET /zoho/billing.yaml 1 GET /zimbra/jetty/etc/jetty.xml 1 GET /zabbix/conf/zabbix.conf 1 GET /xkeysib.yml -- last 10 requests -- 185.177.72.22 - - [01/Sep/2026:21:56:29 +1000] "GET /.npmrc HTTP/1.1" 403 13 "-" "curl/8.7.1" 185.177.72.22 - - [01/Sep/2026:21:56:29 +1000] "GET /etc/dovecot/conf.d/10-mail.conf HTTP/1.1" 404 - "-" "curl/8.7.1" 185.177.72.22 - - [01/Sep/2026:21:56:30 +1000] "GET /site.zip HTTP/1.1" 404 - "-" "curl/8.7.1" 185.177.72.22 - - [01/Sep/2026:21:56:30 +1000] "GET /~/.pinerc HTTP/1.1" 404 - "-" "curl/8.7.1" 185.177.72.22 - - [01/Sep/2026:21:56:30 +1000] "GET /payments/multi_currency_rules.ini HTTP/1.1" 404 - "-" "curl/8.7.1" 185.177.72.22 - - [01/Sep/2026:21:56:31 +1000] "GET /template?code={%%20raw%20%}{{%20self%20}}{%%20endraw%20%} HTTP/1.1" 404 - "-" "curl/8.7.1" 185.177.72.22 - - [01/Sep/2026:21:56:31 +1000] "GET /pgsql.dump HTTP/1.1" 404 - "-" "curl/8.7.1" 185.177.72.22 - - [01/Sep/2026:21:56:31 +1000] "GET /~admin/ HTTP/1.1" 404 - "-" "curl/8.7.1" 185.177.72.22 - - [01/Sep/2026:21:56:32 +1000] "GET /selenium/ HTTP/1.1" 404 - "-" "curl/8.7.1" 185.177.72.22 - - [01/Sep/2026:21:56:32 +1000] "GET /oauth/authorize?scope=openid+offline_access HTTP/1.1" 404 - "-" "curl/8.7.1" == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 1 GET /.well-known/smtp 1 GET /.well-known/sendgrid 1 GET /.well-known/mail 1 GET /.well-known/email 1 GET /v3/whitelabel/domains 1 GET /v3/user/webhooks/parse/stats 1 GET /v3/user/webhooks/parse/settings 1 GET /v3/user/webhooks/event/test 1 GET /v3/user/username 1 GET /v3/user/profile 1 GET /v3/user/password 1 GET /v3/user/email -- last 10 requests -- 185.177.72.54 - - [01/Sep/2026:21:56:31 +1000] "GET /v3/user/webhooks/parse/settings HTTP/1.1" 400 52 "-" "curl/8.7.1" 185.177.72.54 - - [01/Sep/2026:21:56:32 +1000] "GET /v3/user/webhooks/parse/stats HTTP/1.1" 400 52 "-" "curl/8.7.1" 185.177.72.54 - - [01/Sep/2026:21:56:33 +1000] "GET /v3/api_keys HTTP/1.1" 400 52 "-" "curl/8.7.1" 185.177.72.54 - - [01/Sep/2026:21:56:34 +1000] "GET /v3/api_keys/api_key_id HTTP/1.1" 400 52 "-" "curl/8.7.1" 185.177.72.54 - - [01/Sep/2026:21:56:34 +1000] "GET /v3/scopes HTTP/1.1" 400 52 "-" "curl/8.7.1" 185.177.72.54 - - [01/Sep/2026:21:56:35 +1000] "GET /v3/scopes/requests HTTP/1.1" 400 52 "-" "curl/8.7.1" 185.177.72.54 - - [01/Sep/2026:21:56:36 +1000] "GET /v3/subusers HTTP/1.1" 400 52 "-" "curl/8.7.1" 185.177.72.54 - - [01/Sep/2026:21:56:37 +1000] "GET /v3/subusers/reputations HTTP/1.1" 400 52 "-" "curl/8.7.1" 185.177.72.54 - - [01/Sep/2026:21:56:38 +1000] "GET /v3/subusers/stats HTTP/1.1" 400 52 "-" "curl/8.7.1" 185.177.72.54 - - [01/Sep/2026:21:56:39 +1000] "GET /v3/whitelabel/domains HTTP/1.1" 400 52 "-" "curl/8.7.1" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 43 GET /api/getItem/LWHG2001KG 35 GET /api/getItem/LWPG2001KG 30 GET /api/getItem/LWFBW2001KG 4 GET /api/getItem/PWFBW3151KG 1 GET /api/getItem/CLSGNSTD32350KK 1 GET /api/getItem/CLPGNSTD50315KK 1 GET /api/getItem/CLPGNSTD50250KK 1 GET /api/getItem/CLPGNSTD45315KK 1 GET /api/getItem/CLPGNSTD45250KK 1 GET /api/getItem/CLPGNSTD40315KK 1 GET /api/getItem/CLPGNSTD40250KK 1 GET /api/getItem/CLPGNSTD32315KK -- last 10 requests -- 40.115.94.245 - - [01/Sep/2026:21:55:39 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:21:55:39 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:21:55:39 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:21:55:39 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:21:55:39 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:21:55:40 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:21:56:40 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:21:56:40 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:21:56:40 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:21:56:40 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-01 21:54:12 L1=1.29 run=3 blk=0 avail=7584 (55.0%) swpO=0 conn=2 myRSS=3428 php=6 phpRSS=520 ap=22 tcp=37 topuser=madalice 2026-09-01 21:54:21 L1=1.40 run=2 blk=0 avail=7718 (56.0%) swpO=0 conn=2 myRSS=3428 php=4 phpRSS=316 ap=22 tcp=32 topuser=madalice 2026-09-01 21:54:22 L1=1.40 run=3 blk=0 avail=7772 (56.4%) swpO=0 conn=2 myRSS=3428 php=4 phpRSS=269 ap=22 tcp=34 topuser=madalice 2026-09-01 21:54:31 L1=1.41 run=4 blk=0 avail=7797 (56.6%) swpO=0 conn=2 myRSS=3428 php=4 phpRSS=257 ap=21 tcp=31 topuser=tubesupplies 2026-09-01 21:54:32 L1=1.41 run=4 blk=0 avail=7713 (56.0%) swpO=0 conn=2 myRSS=3428 php=5 phpRSS=357 ap=21 tcp=30 topuser=madalice 2026-09-01 21:54:41 L1=1.43 run=5 blk=0 avail=7696 (55.9%) swpO=0 conn=2 myRSS=3428 php=6 phpRSS=402 ap=21 tcp=32 topuser=aaa 2026-09-01 21:54:42 L1=1.43 run=3 blk=0 avail=7727 (56.1%) swpO=0 conn=2 myRSS=3428 php=5 phpRSS=337 ap=21 tcp=31 topuser=madalice 2026-09-01 21:54:51 L1=1.28 run=2 blk=0 avail=7616 (55.3%) swpO=0 conn=2 myRSS=3428 php=4 phpRSS=310 ap=20 tcp=30 topuser=madalice 2026-09-01 21:54:52 L1=1.28 run=2 blk=0 avail=7748 (56.2%) swpO=0 conn=2 myRSS=3428 php=4 phpRSS=299 ap=19 tcp=29 topuser=madalice 2026-09-01 21:55:01 L1=1.32 run=3 blk=0 avail=7703 (55.9%) swpO=0 conn=2 myRSS=3428 php=5 phpRSS=379 ap=19 tcp=29 topuser=madalice 2026-09-01 21:55:02 L1=1.32 run=5 blk=0 avail=7607 (55.2%) swpO=0 conn=5 myRSS=3428 php=7 phpRSS=499 ap=19 tcp=30 topuser=madalice 2026-09-01 21:55:11 L1=1.33 run=3 blk=0 avail=7757 (56.3%) swpO=0 conn=2 myRSS=3428 php=3 phpRSS=198 ap=19 tcp=28 topuser=madalice 2026-09-01 21:55:12 L1=1.33 run=2 blk=0 avail=7698 (55.9%) swpO=0 conn=5 myRSS=3428 php=5 phpRSS=320 ap=19 tcp=29 topuser=madalice 2026-09-01 21:55:21 L1=1.28 run=3 blk=1 avail=7762 (56.3%) swpO=0 conn=2 myRSS=3428 php=4 phpRSS=268 ap=19 tcp=28 topuser=madalice 2026-09-01 21:55:23 L1=1.28 run=3 blk=0 avail=7768 (56.4%) swpO=0 conn=5 myRSS=3428 php=5 phpRSS=307 ap=19 tcp=30 topuser=madalice 2026-09-01 21:55:31 L1=1.24 run=3 blk=0 avail=7784 (56.5%) swpO=0 conn=2 myRSS=3428 php=4 phpRSS=240 ap=18 tcp=30 topuser=madalice 2026-09-01 21:55:33 L1=1.24 run=2 blk=0 avail=7799 (56.6%) swpO=0 conn=5 myRSS=3428 php=5 phpRSS=278 ap=18 tcp=31 topuser=madalice 2026-09-01 21:55:41 L1=1.28 run=1 blk=0 avail=7822 (56.8%) swpO=0 conn=2 myRSS=3428 php=3 phpRSS=199 ap=18 tcp=30 topuser=madalice 2026-09-01 21:55:43 L1=1.28 run=2 blk=0 avail=7756 (56.3%) swpO=0 conn=5 myRSS=3428 php=5 phpRSS=322 ap=18 tcp=31 topuser=madalice 2026-09-01 21:55:52 L1=1.24 run=1 blk=0 avail=7841 (56.9%) swpO=0 conn=2 myRSS=3428 php=3 phpRSS=199 ap=18 tcp=28 topuser=madalice 2026-09-01 21:55:53 L1=1.24 run=4 blk=0 avail=7707 (55.9%) swpO=0 conn=5 myRSS=3428 php=4 phpRSS=301 ap=17 tcp=29 topuser=madalice 2026-09-01 21:56:02 L1=1.13 run=2 blk=0 avail=7800 (56.6%) swpO=0 conn=2 myRSS=3428 php=4 phpRSS=267 ap=17 tcp=26 topuser=madalice 2026-09-01 21:56:03 L1=1.13 run=9 blk=0 avail=7782 (56.5%) swpO=0 conn=5 myRSS=3428 php=6 phpRSS=346 ap=17 tcp=30 topuser=madalice 2026-09-01 21:56:12 L1=1.33 run=3 blk=0 avail=7773 (56.4%) swpO=0 conn=2 myRSS=3428 php=4 phpRSS=287 ap=17 tcp=29 topuser=madalice 2026-09-01 21:56:13 L1=1.33 run=3 blk=0 avail=7704 (55.9%) swpO=0 conn=5 myRSS=3428 php=6 phpRSS=414 ap=17 tcp=30 topuser=madalice 2026-09-01 21:56:22 L1=1.37 run=6 blk=0 avail=7528 (54.6%) swpO=0 conn=4 myRSS=3428 php=6 phpRSS=584 ap=18 tcp=31 topuser=madalice 2026-09-01 21:56:23 L1=1.37 run=3 blk=0 avail=7647 (55.5%) swpO=0 conn=5 myRSS=3428 php=8 phpRSS=516 ap=19 tcp=37 topuser=madalice 2026-09-01 21:56:32 L1=1.38 run=2 blk=0 avail=7460 (54.1%) swpO=0 conn=4 myRSS=3428 php=6 phpRSS=534 ap=32 tcp=32 topuser=madalice 2026-09-01 21:56:33 L1=1.38 run=9 blk=0 avail=7344 (53.3%) swpO=0 conn=5 myRSS=3428 php=9 phpRSS=741 ap=31 tcp=41 topuser=madalice 2026-09-01 21:56:42 L1=2.07 run=1 blk=0 avail=6649 (48.3%) swpO=0 conn=1 myRSS=3428 php=13 phpRSS=1518 ap=33 tcp=47 topuser=madalice