INCIDENT 2026-09-01 22:36:05 trigger: php_rss=1533MB ================================================================== load: 0.91 0.69 0.91 2/655 4084883 ncpu:10 mem_avail: 6905MB/13777MB (50.1%) swap_used:2610MB swapout:52/s blocked(D):0 running:2 iowait:0.3% steal:0.0% php: 13 procs / 1533MB heaviest user: madalice (10 procs, 1390MB) apache: 25 procs tcp_estab: 46 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3326 madalice 10 1390 root 247 934 nobody 24 411 netdata 7 202 corpkicks 1 115 cpanellogin 1 98 mailman 20 72 wp-toolkit 3 67 dovenull 6 46 lowrange 2 29 mailnull 3 28 kurri 2 28 evolution 7 25 dovecot 3 19 zabbix 1 17 aaa 1 15 infinium 1 14 named 1 12 cpanelphpmyadmin 1 9 --- php workers by user --- USER PROCS RSS_MB madalice 10 1390 corpkicks 1 118 root 1 28 evolution 1 8 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5530 MB Active(file): 2898 MB Inactive(file): 2881 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 499 MB CommitLimit: 10984 MB Committed_AS: 8237 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 20:13:36 4580 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3406696 10.7 Ssl 4-20:16:56 /usr/sbin/mariadbd 508924 1 netdata 182684 1.9 Ssl 4-20:16:25 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2001035 3930335 root 170592 0.1 S 09:40:49 spamd child 4084418 3929444 madalice 161816 40.7 S 00:18 php-fpm: pool madalice_com_au 4084814 3929444 madalice 160436 63.7 S 00:04 php-fpm: pool madalice_com_au 3963222 3930335 root 148348 0.0 S 20:05:48 spamd child 4084818 3929444 madalice 138036 40.0 S 00:04 php-fpm: pool madalice_com_au 4084816 3929444 madalice 137844 35.5 S 00:04 php-fpm: pool madalice_com_au 4084813 3929444 madalice 137824 37.7 S 00:04 php-fpm: pool madalice_com_au 4084815 3929444 madalice 137824 36.2 S 00:04 php-fpm: pool madalice_com_au 4084817 3929444 madalice 137780 34.0 S 00:04 php-fpm: pool madalice_com_au 4084819 3929444 madalice 137412 37.0 S 00:04 php-fpm: pool madalice_com_au 4084811 3929444 madalice 137292 36.7 S 00:04 php-fpm: pool madalice_com_au 4084812 3929444 madalice 137260 40.2 S 00:04 php-fpm: pool madalice_com_au 4084854 4068243 corpkicks 131724 47.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 509266 1 root 128396 0.0 Ss 4-20:16:22 /usr/lib/systemd/systemd-journald 3326203 1353308 cpanellogin 100784 0.0 S 03:26:38 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 3930335 1 root 83572 0.0 Ss 20:12:54 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509640 508992 root 61360 0.0 Sl 4-20:16:20 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509236 509098 root 45936 0.0 Sl 4-20:16:22 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 40104 0.1 Ss 41-19:54:48 cpsrvd (SSL) - waiting for connections 3929420 1 wp-toolkit 39184 0.0 Ss 20:13:27 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 3929444 1 root 29484 0.0 Ss 20:13:27 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3929564 1 wp-toolkit 27624 0.0 Ss 20:13:26 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 4033797 506832 nobody 23996 0.1 S 14:06 /usr/sbin/httpd -k start 4069502 506832 nobody 23292 0.2 S 01:40 /usr/sbin/httpd -k start 3929532 1 root 22832 0.0 Ss 20:13:26 lfd - sleeping 4067606 506832 nobody 22800 0.1 S 05:18 /usr/sbin/httpd -k start 4052864 506832 nobody 22260 0.1 S 06:36 /usr/sbin/httpd -k start 4068243 506832 nobody 21156 0.1 S 04:06 /usr/sbin/httpd -k start 4068603 506832 nobody 21024 0.1 S 03:31 /usr/sbin/httpd -k start 4071292 506832 nobody 21012 0.2 S 01:02 /usr/sbin/httpd -k start 4059494 506832 nobody 20932 0.1 S 05:58 /usr/sbin/httpd -k start 1469 1 root 20632 0.1 Ss 64-12:26:17 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1463 1 root 20420 0.0 Ss 64-12:26:17 tailwatchd 4084254 506832 nobody 20308 0.1 S 00:29 /usr/sbin/httpd -k start 4069873 506832 nobody 20144 0.1 S 01:05 /usr/sbin/httpd -k start 4068981 506832 nobody 19564 0.1 S 02:41 /usr/sbin/httpd -k start 4069874 506832 nobody 19324 0.1 S 01:05 /usr/sbin/httpd -k start 4084246 506832 nobody 19276 0.1 S 00:30 /usr/sbin/httpd -k start 4069784 506832 nobody 19252 0.1 S 01:12 /usr/sbin/httpd -k start 4068810 506832 nobody 18676 0.1 S 03:00 /usr/sbin/httpd -k start 4084821 506832 nobody 18392 0.3 S 00:03 /usr/sbin/httpd -k start 483898 1 zabbix 17772 0.2 Ssl 4-20:17:39 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 4084823 506832 nobody 16924 0.0 S 00:02 /usr/sbin/httpd -k start 509671 508992 netdata 16532 2.1 Sl 4-20:16:20 /usr/libexec/netdata/plugins.d/apps.plugin 1 4084824 506832 nobody 16464 0.5 S 00:02 /usr/sbin/httpd -k start 4084827 506832 nobody 15948 0.0 S 00:01 /usr/sbin/httpd -k start 3763593 508511 aaa 15864 0.0 S 01:30:56 dovecot/imap 4034361 508511 lowrange 15360 0.0 S 13:26 dovecot/imap 3982632 508511 kurri 15340 0.0 S 26:33 dovecot/imap 4069656 508511 lowrange 14868 0.0 S 01:28 dovecot/imap 3929469 1 root 14848 0.0 Ss 20:13:27 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 4053071 508511 infinium 14656 0.0 S 06:16 dovecot/imap 2934220 508511 kurri 14096 0.0 S 05:18:33 dovecot/imap 4084176 508511 root 12968 0.0 S 00:33 dovecot/auth -w 814129 1471 root 12852 0.0 S 15:00:43 cPhulkd - dbprocessor 1471 1 root 12744 0.0 Ss 64-12:26:17 cPhulkd - processor 508634 1 named 12432 0.0 Ssl 4-20:16:30 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 4084615 1471 root 11936 0.0 S 00:09 cPhulkd - processor - http socket --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 15399687 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min aaa/aaadownunder.com.au-ssl_log 152 evolution/app.evolutionerp.com.au-ssl_log 115 lowrange/lowrange.com.au-ssl_log 84 evolution/my.evolutionerp.com.au-ssl_log 54 alison/alisonarts.com.au-ssl_log 53 bigdeals/bigdeals.com.au-ssl_log 43 evolution/my.evolutionerp.com.au 42 tubesupplies/tubesupplies.com.au-ssl_log 39 infinium/infinium.net.au-ssl_log 29 evolution/portal.evolutionerp.com.au-ssl_log 22 madalice/madalice.com.au-ssl_log 17 (total vhosts taking traffic: 11) --- top client IPs across all vhosts (last 3 min) --- 163 20.48.250.41 152 185.177.72.22 115 40.115.94.245 84 20.63.81.20 48 91.92.42.71 41 195.178.110.22 22 203.54.180.238 12 91.92.43.19 2 118.127.40.55 2 114.119.150.154 1 52.167.144.209 1 192.178.6.98 1 192.178.6.96 1 17.166.153.66 1 114.119.146.16 --- top request paths across all vhosts (last 3 min) --- 48 POST /wp-login.php 30 GET /api/getItem/LWFB2001KG 28 GET /api/getItem/LWPG2001KG 22 GET /heartbeat.php 7 GET /ho.php 5 GET /wp-content/plugins/hellopress/wp_filemanager.php 5 GET /this_is_a_new_hello_world.php 4 GET /zoo1.php 4 GET /xrp.php 4 GET /xmini4.php 4 GET /w1px.php 4 GET /UT6UJndefault.php 4 GET /tvbxn.php 4 GET /samll.php 4 GET /js.php 4 GET /fsfrl.php 4 GET /faiy.php 4 GET /esp.php 4 GET /e219b53abbindex.php 4 GET /curldect.php --- busiest 3 vhosts: top paths + last 10 requests --- == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 1 GET /wp-content/plugins/wpforms-lite/src/Integrations/WPorg/ 1 GET /wp-content/plugins/wpforms-lite/src/Integrations/WPMailSMTP/ 1 GET /wp-content/plugins/wpforms-lite/src/Integrations/WPCode/ 1 GET /wp-content/plugins/wpforms-lite/src/Integrations/WooCommerce/ 1 GET /wp-content/plugins/wpforms-lite/src/Integrations/UsageTracking/ 1 GET /wp-content/plugins/wpforms-lite/src/Integrations/UncannyAutomator/ 1 GET /wp-content/plugins/wpforms-lite/src/Integrations/Stripe/ 1 GET /wp-content/plugins/wpforms-lite/src/Integrations/Square/ 1 GET /wp-content/plugins/wpforms-lite/src/Integrations/SolidCentral/ 1 GET /wp-content/plugins/wpforms-lite/src/Integrations/SMTP/ 1 GET /wp-content/plugins/wpforms-lite/src/Integrations/PayPalCommerce/Api/ 1 GET /wp-content/plugins/wpforms-lite/src/Integrations/PayPalCommerce/Admin/ -- last 10 requests -- 185.177.72.22 - - [01/Sep/2026:22:35:47 +1000] "GET /wp-content/plugins/wpforms-lite/src/Integrations/WPorg/ HTTP/1.1" 200 966 "-" "curl/8.7.1" 185.177.72.22 - - [01/Sep/2026:22:35:48 +1000] "GET /wp-content/plugins/wpforms-lite/src/Integrations/WooCommerce/ HTTP/1.1" 200 979 "-" "curl/8.7.1" 185.177.72.22 - - [01/Sep/2026:22:35:48 +1000] "GET /wp-content/plugins/wpforms-lite/src/Integrations/AI/API/ HTTP/1.1" 200 1849 "-" "curl/8.7.1" 185.177.72.22 - - [01/Sep/2026:22:35:49 +1000] "GET /wp-content/plugins/wpforms-lite/src/Integrations/AI/Admin/ HTTP/1.1" 200 1667 "-" "curl/8.7.1" 185.177.72.22 - - [01/Sep/2026:22:35:50 +1000] "GET /wp-content/plugins/wpforms-lite/src/Integrations/ConstantContact/V3/ HTTP/1.1" 200 2069 "-" "curl/8.7.1" 185.177.72.22 - - [01/Sep/2026:22:35:51 +1000] "GET /wp-content/plugins/wpforms-lite/src/Integrations/Divi/Interfaces/ HTTP/1.1" 200 1201 "-" "curl/8.7.1" 185.177.72.22 - - [01/Sep/2026:22:35:52 +1000] "GET /wp-content/plugins/wpforms-lite/src/Integrations/Divi/Traits/ HTTP/1.1" 200 1179 "-" "curl/8.7.1" 185.177.72.22 - - [01/Sep/2026:22:35:53 +1000] "GET /wp-content/plugins/wpforms-lite/src/Integrations/Elementor/Controls/ HTTP/1.1" 200 1003 "-" "curl/8.7.1" 185.177.72.22 - - [01/Sep/2026:22:35:53 +1000] "GET /wp-content/plugins/wpforms-lite/src/Integrations/PayPalCommerce/Admin/ HTTP/1.1" 200 2445 "-" "curl/8.7.1" 185.177.72.22 - - [01/Sep/2026:22:35:54 +1000] "GET /wp-content/plugins/wpforms-lite/src/Integrations/PayPalCommerce/Api/ HTTP/1.1" 200 1719 "-" "curl/8.7.1" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 30 GET /api/getItem/LWFB2001KG 28 GET /api/getItem/LWPG2001KG 2 GET /api/getItem/SHSG252516-8 2 GET /api/getItem/RHSG502520-8 1 GET /api/getItem/SHSG252520-6.5 1 GET /api/getItem/SHSG252516--8 1 GET /api/getItem/SHSG252516-6.5 1 GET /api/getItem/SHSG252516--6.5 1 GET /api/getItem/SHSG202016-8 1 GET /api/getItem/SHSG202012-8 1 GET /api/getItem/SHSG15015040-8 1 GET /api/getItem/SHSG12512550-8 -- last 10 requests -- 40.115.94.245 - - [01/Sep/2026:22:35:42 +1000] "GET /api/getItem/SHSG202012-8 HTTP/1.1" 200 1352 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:22:35:42 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:22:35:42 +1000] "GET /api/getItem/SHSG202016-8 HTTP/1.1" 200 1476 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:22:35:43 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:22:35:43 +1000] "GET /api/getItem/SHSG252516--6.5 HTTP/1.1" 404 117 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:22:35:43 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:22:35:43 +1000] "GET /api/getItem/SHSG252516--8 HTTP/1.1" 404 115 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:22:35:43 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:22:35:44 +1000] "GET /api/getItem/SHSG252520-6.5 HTTP/1.1" 200 1765 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:22:35:44 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" == lowrange/lowrange.com.au-ssl_log == -- top paths -- 1 GET /zoo1.php 1 GET /xamp.php 1 GET /wsd.php 1 GET /ws55.php 1 GET /wp.php 1 GET /w.php 1 GET /wp-content/uploads/ 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wnnjpsby.php 1 GET /wander.php 1 GET /vpn.php 1 GET /this_is_a_new_hello_world.php -- last 10 requests -- 20.63.81.20 - - [01/Sep/2026:22:35:14 +1000] "GET /goods.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [01/Sep/2026:22:35:15 +1000] "GET /133.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [01/Sep/2026:22:35:15 +1000] "GET /sym.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [01/Sep/2026:22:35:16 +1000] "GET /8.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [01/Sep/2026:22:35:16 +1000] "GET /ws55.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [01/Sep/2026:22:35:16 +1000] "GET /indo.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [01/Sep/2026:22:35:17 +1000] "GET /wnnjpsby.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [01/Sep/2026:22:35:17 +1000] "GET /info.php/new.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [01/Sep/2026:22:35:18 +1000] "GET /wp-content/uploads/ HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [01/Sep/2026:22:35:18 +1000] "GET /w.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-09-01 22:33:44 L1=0.51 run=1 blk=0 avail=8101 (58.8%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=196 ap=15 tcp=29 topuser=madalice 2026-09-01 22:33:44 L1=0.51 run=2 blk=0 avail=8101 (58.8%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=196 ap=15 tcp=32 topuser=madalice 2026-09-01 22:33:54 L1=0.51 run=1 blk=0 avail=8127 (59.0%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=170 ap=14 tcp=36 topuser=madalice 2026-09-01 22:33:54 L1=0.51 run=2 blk=0 avail=8100 (58.8%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=170 ap=14 tcp=34 topuser=madalice 2026-09-01 22:34:04 L1=0.43 run=2 blk=0 avail=8131 (59.0%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=170 ap=14 tcp=32 topuser=madalice 2026-09-01 22:34:04 L1=0.43 run=1 blk=0 avail=8132 (59.0%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=170 ap=14 tcp=33 topuser=madalice 2026-09-01 22:34:14 L1=0.36 run=1 blk=0 avail=8236 (59.8%) swpO=0 conn=1 myRSS=3327 php=2 phpRSS=37 ap=14 tcp=33 topuser=root 2026-09-01 22:34:14 L1=0.36 run=3 blk=0 avail=8212 (59.6%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=96 ap=14 tcp=34 topuser=alison 2026-09-01 22:34:24 L1=0.31 run=1 blk=0 avail=8236 (59.8%) swpO=0 conn=1 myRSS=3327 php=2 phpRSS=37 ap=15 tcp=31 topuser=root 2026-09-01 22:34:25 L1=0.31 run=4 blk=0 avail=8232 (59.8%) swpO=0 conn=1 myRSS=3327 php=2 phpRSS=37 ap=15 tcp=34 topuser=root 2026-09-01 22:34:34 L1=0.34 run=1 blk=0 avail=8098 (58.8%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=170 ap=18 tcp=34 topuser=madalice 2026-09-01 22:34:35 L1=0.34 run=1 blk=1 avail=8107 (58.8%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=170 ap=18 tcp=33 topuser=madalice 2026-09-01 22:34:44 L1=0.37 run=1 blk=0 avail=8093 (58.7%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=170 ap=18 tcp=39 topuser=madalice 2026-09-01 22:34:45 L1=0.37 run=1 blk=0 avail=8091 (58.7%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=170 ap=18 tcp=37 topuser=madalice 2026-09-01 22:34:54 L1=0.39 run=2 blk=0 avail=7916 (57.5%) swpO=0 conn=1 myRSS=3327 php=5 phpRSS=387 ap=18 tcp=39 topuser=infinium 2026-09-01 22:34:55 L1=0.39 run=1 blk=0 avail=8106 (58.8%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=160 ap=18 tcp=37 topuser=madalice 2026-09-01 22:35:04 L1=0.72 run=6 blk=0 avail=7606 (55.2%) swpO=0 conn=1 myRSS=3327 php=5 phpRSS=638 ap=24 tcp=42 topuser=corpkicks 2026-09-01 22:35:05 L1=0.72 run=3 blk=0 avail=7815 (56.7%) swpO=0 conn=1 myRSS=3327 php=4 phpRSS=408 ap=24 tcp=41 topuser=corpkicks 2026-09-01 22:35:14 L1=0.84 run=1 blk=0 avail=8033 (58.3%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=193 ap=21 tcp=34 topuser=madalice 2026-09-01 22:35:15 L1=0.84 run=1 blk=0 avail=8039 (58.4%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=193 ap=20 tcp=36 topuser=madalice 2026-09-01 22:35:24 L1=0.95 run=1 blk=0 avail=8077 (58.6%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=193 ap=16 tcp=33 topuser=madalice 2026-09-01 22:35:25 L1=0.95 run=1 blk=0 avail=8077 (58.6%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=193 ap=16 tcp=31 topuser=madalice 2026-09-01 22:35:34 L1=0.80 run=1 blk=0 avail=8089 (58.7%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=194 ap=16 tcp=36 topuser=madalice 2026-09-01 22:35:35 L1=0.80 run=1 blk=0 avail=8088 (58.7%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=194 ap=16 tcp=36 topuser=madalice 2026-09-01 22:35:44 L1=0.76 run=1 blk=0 avail=8061 (58.5%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=194 ap=19 tcp=37 topuser=madalice 2026-09-01 22:35:45 L1=0.76 run=1 blk=0 avail=8061 (58.5%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=194 ap=19 tcp=35 topuser=madalice 2026-09-01 22:35:54 L1=0.79 run=1 blk=0 avail=8063 (58.5%) swpO=0 conn=1 myRSS=3327 php=3 phpRSS=194 ap=19 tcp=38 topuser=madalice 2026-09-01 22:35:55 L1=0.79 run=2 blk=0 avail=8046 (58.4%) swpO=0 conn=1 myRSS=3327 php=4 phpRSS=253 ap=19 tcp=35 topuser=madalice 2026-09-01 22:36:04 L1=0.91 run=1 blk=0 avail=6980 (50.7%) swpO=52 conn=1 myRSS=3326 php=12 phpRSS=1427 ap=25 tcp=44 topuser=madalice 2026-09-01 22:36:05 L1=0.91 run=2 blk=0 avail=6905 (50.1%) swpO=52 conn=2 myRSS=3326 php=13 phpRSS=1533 ap=25 tcp=46 topuser=madalice