INCIDENT 2026-09-02 00:59:37 trigger: php_rss=1525MB ================================================================== load: 1.49 0.87 0.84 2/653 365036 ncpu:10 mem_avail: 6910MB/13777MB (50.2%) swap_used:2630MB swapout:66/s blocked(D):0 running:2 iowait:0.1% steal:0.0% php: 12 procs / 1525MB heaviest user: madalice (10 procs, 1488MB) apache: 24 procs tcp_estab: 45 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3300 madalice 10 1496 root 245 949 nobody 23 384 netdata 7 201 mailman 20 69 wp-toolkit 3 64 cpanellogin 1 61 kurri 4 55 dovenull 6 46 mailnull 4 42 lowrange 2 29 infinium 2 28 evolution 7 25 dovecot 3 19 zabbix 1 17 aaa 1 15 named 1 12 polkitd 1 4 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1498 root 1 28 evolution 1 8 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5871 MB Active(file): 3251 MB Inactive(file): 2874 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 477 MB CommitLimit: 10984 MB Committed_AS: 8226 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 22:37:07 3412 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3379764 10.6 Ssl 4-22:40:27 /usr/sbin/mariadbd 364989 3929444 madalice 250688 84.3 R 00:03 php-fpm: pool madalice_com_au 508924 1 netdata 181756 1.9 Ssl 4-22:39:56 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 330470 3929444 madalice 165216 10.1 S 12:55 php-fpm: pool madalice_com_au 330471 3929444 madalice 160552 10.4 S 12:54 php-fpm: pool madalice_com_au 282064 3930335 root 150968 0.0 S 25:14 spamd child 3963222 3930335 root 146528 0.0 S 22:29:19 spamd child 364992 3929444 madalice 137680 48.6 S 00:03 php-fpm: pool madalice_com_au 364996 3929444 madalice 137680 72.0 S 00:02 php-fpm: pool madalice_com_au 364997 3929444 madalice 137680 74.0 S 00:02 php-fpm: pool madalice_com_au 364998 3929444 madalice 137680 73.5 S 00:02 php-fpm: pool madalice_com_au 364988 3929444 madalice 137676 46.6 S 00:03 php-fpm: pool madalice_com_au 364991 3929444 madalice 137676 47.6 S 00:03 php-fpm: pool madalice_com_au 364995 3929444 madalice 137660 73.0 S 00:02 php-fpm: pool madalice_com_au 509266 1 root 132124 0.0 Ss 4-22:39:53 /usr/lib/systemd/systemd-journald 3930335 1 root 83076 0.0 Ss 22:36:25 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 348031 1353308 cpanellogin 63180 0.1 S 05:52 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 509640 508992 root 61616 0.0 Sl 4-22:39:51 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509236 509098 root 44984 0.0 Sl 4-22:39:53 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42020 0.1 Ss 41-22:18:19 cpsrvd (SSL) - waiting for connections 3929420 1 wp-toolkit 38408 0.0 Ss 22:36:58 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 162860 1 root 36676 0.0 Ss 59:34 lfd - sleeping 3929444 1 root 29524 0.0 Ss 22:36:58 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3929564 1 wp-toolkit 25680 0.0 Ss 22:36:57 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 329753 506832 nobody 23692 0.0 S 14:17 /usr/sbin/httpd -k start 347681 506832 nobody 22724 0.0 S 06:38 /usr/sbin/httpd -k start 362818 506832 nobody 22508 0.1 S 04:00 /usr/sbin/httpd -k start 362878 506832 nobody 21752 0.0 S 03:48 /usr/sbin/httpd -k start 348143 506832 nobody 21728 0.0 S 05:40 /usr/sbin/httpd -k start 363707 506832 nobody 21352 0.0 S 02:02 /usr/sbin/httpd -k start 363716 506832 nobody 21300 0.0 S 02:01 /usr/sbin/httpd -k start 363763 506832 nobody 21060 0.0 S 02:00 /usr/sbin/httpd -k start 1469 1 root 20476 0.1 Ss 64-14:49:48 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1463 1 root 20420 0.0 Ss 64-14:49:48 tailwatchd 364720 506832 nobody 19684 0.0 S 00:33 /usr/sbin/httpd -k start 364751 506832 nobody 19400 0.0 S 00:31 /usr/sbin/httpd -k start 363714 506832 nobody 19284 0.0 S 02:01 /usr/sbin/httpd -k start 363718 506832 nobody 19236 0.1 S 02:01 /usr/sbin/httpd -k start 364613 506832 nobody 18572 0.0 S 00:39 /usr/sbin/httpd -k start 364994 506832 nobody 18460 0.5 S 00:02 /usr/sbin/httpd -k start 483898 1 zabbix 18100 0.2 Ssl 4-22:41:10 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 365001 506832 nobody 16900 0.0 S 00:01 /usr/sbin/httpd -k start 298998 1471 root 16696 0.0 S 20:07 cPhulkd - dbprocessor 364649 506832 nobody 16564 0.0 S 00:38 /usr/sbin/httpd -k start 509671 508992 netdata 16408 2.1 Sl 4-22:39:51 /usr/libexec/netdata/plugins.d/apps.plugin 1 365000 506832 nobody 15964 0.0 S 00:01 /usr/sbin/httpd -k start 3763593 508511 aaa 15796 0.0 S 03:54:27 dovecot/imap 1471 1 root 15372 0.0 Ss 64-14:49:48 cPhulkd - processor 4034361 508511 lowrange 15356 0.0 S 02:36:57 dovecot/imap 364706 508720 mailnull 14820 0.0 S 00:34 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 364314 508511 kurri 14688 0.0 S 01:08 dovecot/imap 297150 508511 infinium 14684 0.0 S 22:45 dovecot/imap 331391 508511 infinium 14608 0.0 S 11:29 dovecot/imap 364567 508511 kurri 14588 0.0 S 00:43 dovecot/imap 330535 508511 lowrange 14584 0.0 S 12:48 dovecot/imap 3929469 1 root 14544 0.0 Ss 22:36:58 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 299053 508511 kurri 14464 0.0 S 20:02 dovecot/imap 2934220 508511 kurri 13492 0.0 S 07:42:04 dovecot/imap 364990 1471 root 13032 0.0 S 00:03 cPhulkd - processor - http socket 363521 508511 root 12848 0.0 S 02:16 dovecot/auth -w --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 15486563 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 135 otter2/otterfencing.net.au-ssl_log 131 coscom/coscom.com.au-ssl_log 37 madalice/madalice.com.au-ssl_log 36 evolution/portal.evolutionerp.com.au-ssl_log 24 aaa/aaadownunder.com.au-ssl_log 1 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 135 40.115.94.245 131 20.220.211.172 37 158.23.184.117 24 203.54.180.238 16 66.249.68.66 4 114.119.130.40 2 47.128.96.100 2 114.119.159.70 2 114.119.146.16 2 114.119.143.14 2 114.119.140.234 2 114.119.137.101 1 82.156.107.3 1 66.249.68.67 1 52.167.144.176 --- top request paths across all vhosts (last 3 min) --- 68 GET /api/getItem/LWFBW2001KG 67 GET /api/getItem/LWHG2001KG 24 GET /heartbeat.php 9 POST / 9 GET /terms-and-conditions/ 7 GET /store/gift-card-2/ 7 GET /store/gift-card/ 3 GET /admin.php 3 GET / 2 GET /wp-content/themes/index.php 2 GET /ip 2 GET /av.php 1 POST /wp-cron.php 1 GET /y.php 1 GET /xs.php 1 GET /x.php 1 GET /xnm-apc.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp-trackback.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 68 GET /api/getItem/LWFBW2001KG 67 GET /api/getItem/LWHG2001KG -- last 10 requests -- 40.115.94.245 - - [02/Sep/2026:00:59:08 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:00:59:09 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:00:59:09 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:00:59:09 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:00:59:09 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:00:59:09 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:00:59:10 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:00:59:10 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:00:59:10 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:00:59:10 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" == otter2/otterfencing.net.au-ssl_log == -- top paths -- 3 GET /admin.php 2 GET /wp-content/themes/index.php 2 GET /av.php 1 GET /xs.php 1 GET /xnm-apc.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp-temp.php 1 GET /wp.php 1 GET /wp-manager.php 1 GET /wp-mails.php 1 GET /wp-includes/Text/Diff/Engine/about.php -- last 10 requests -- 20.220.211.172 - - [02/Sep/2026:00:58:50 +1000] "GET /qazwsx.php HTTP/1.1" 401 36 "-" "-" 20.220.211.172 - - [02/Sep/2026:00:58:51 +1000] "GET /cae2.2.php HTTP/1.1" 401 36 "-" "-" 20.220.211.172 - - [02/Sep/2026:00:58:51 +1000] "GET /b8.php HTTP/1.1" 401 36 "-" "-" 20.220.211.172 - - [02/Sep/2026:00:58:52 +1000] "GET /xs.php HTTP/1.1" 401 36 "-" "-" 20.220.211.172 - - [02/Sep/2026:00:58:52 +1000] "GET /wp-content/uploads/ HTTP/1.1" 401 36 "-" "-" 20.220.211.172 - - [02/Sep/2026:00:58:53 +1000] "GET /wp_blog_footer.php HTTP/1.1" 401 36 "-" "-" 20.220.211.172 - - [02/Sep/2026:00:58:53 +1000] "GET /billzgs.php HTTP/1.1" 401 36 "-" "-" 20.220.211.172 - - [02/Sep/2026:00:58:54 +1000] "GET /ded.php HTTP/1.1" 401 36 "-" "-" 20.220.211.172 - - [02/Sep/2026:00:58:54 +1000] "GET /CAE-2.5.php HTTP/1.1" 401 36 "-" "-" 20.220.211.172 - - [02/Sep/2026:00:58:54 +1000] "GET /0.php HTTP/1.1" 401 36 "-" "-" == coscom/coscom.com.au-ssl_log == -- top paths -- 1 GET /y.php 1 GET /x.php 1 GET /wp-trackback.php 1 GET /wp-includes/Text/Diff 1 GET /wp-includes/style-engine/autoload_classmap.php 1 GET /wp-includes/SimplePie/Content/Type 1 GET /wp-includes/rest-api/endpoints/ 1 GET /wp-includes/customize/ 1 GET /wp-includes/blocks/search/index.php 1 GET /wp-includes/blocks/nextpage/index.php 1 GET /wp-includes/blocks/media-text/index.php 1 GET /wp-includes/blocks/list-item/index.php -- last 10 requests -- 158.23.184.117 - - [02/Sep/2026:00:59:06 +1000] "GET /wp-trackback.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [02/Sep/2026:00:59:06 +1000] "GET /x.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [02/Sep/2026:00:59:06 +1000] "GET /y.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [02/Sep/2026:00:59:06 +1000] "GET /.well-known/acme-challenge/block-supports/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 S 158.23.184.117 - - [02/Sep/2026:00:59:06 +1000] "GET /asasx.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [02/Sep/2026:00:59:07 +1000] "GET /assets/atomlib.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [02/Sep/2026:00:59:07 +1000] "GET /ava.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [02/Sep/2026:00:59:07 +1000] "GET /axx.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [02/Sep/2026:00:59:07 +1000] "GET /ds.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [02/Sep/2026:00:59:07 +1000] "GET /form.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-02 00:57:07 L1=0.31 run=1 blk=0 avail=7990 (58.0%) swpO=0 conn=1 myRSS=3302 php=4 phpRSS=355 ap=18 tcp=33 topuser=madalice 2026-09-02 00:57:16 L1=0.41 run=1 blk=0 avail=7986 (58.0%) swpO=0 conn=2 myRSS=3302 php=5 phpRSS=396 ap=17 tcp=32 topuser=madalice 2026-09-02 00:57:17 L1=0.41 run=2 blk=0 avail=7996 (58.0%) swpO=0 conn=1 myRSS=3302 php=4 phpRSS=356 ap=17 tcp=32 topuser=madalice 2026-09-02 00:57:26 L1=0.42 run=2 blk=0 avail=7982 (57.9%) swpO=2 conn=2 myRSS=3302 php=5 phpRSS=400 ap=17 tcp=34 topuser=madalice 2026-09-02 00:57:27 L1=0.42 run=1 blk=0 avail=7998 (58.1%) swpO=2 conn=1 myRSS=3302 php=4 phpRSS=354 ap=17 tcp=33 topuser=madalice 2026-09-02 00:57:36 L1=0.43 run=2 blk=0 avail=7785 (56.5%) swpO=1 conn=2 myRSS=3302 php=6 phpRSS=526 ap=32 tcp=58 topuser=madalice 2026-09-02 00:57:37 L1=0.43 run=6 blk=0 avail=7728 (56.1%) swpO=1 conn=1 myRSS=3302 php=6 phpRSS=572 ap=48 tcp=61 topuser=madalice 2026-09-02 00:57:46 L1=0.66 run=1 blk=0 avail=7835 (56.9%) swpO=0 conn=2 myRSS=3302 php=5 phpRSS=396 ap=40 tcp=34 topuser=madalice 2026-09-02 00:57:47 L1=0.66 run=1 blk=0 avail=7856 (57.0%) swpO=0 conn=1 myRSS=3302 php=5 phpRSS=378 ap=39 tcp=33 topuser=madalice 2026-09-02 00:57:56 L1=0.79 run=2 blk=0 avail=7894 (57.3%) swpO=0 conn=2 myRSS=3302 php=5 phpRSS=397 ap=30 tcp=38 topuser=madalice 2026-09-02 00:57:57 L1=0.79 run=6 blk=0 avail=7812 (56.7%) swpO=0 conn=3 myRSS=3302 php=4 phpRSS=461 ap=29 tcp=40 topuser=madalice 2026-09-02 00:58:06 L1=0.75 run=1 blk=0 avail=7944 (57.7%) swpO=0 conn=2 myRSS=3302 php=4 phpRSS=354 ap=24 tcp=37 topuser=madalice 2026-09-02 00:58:07 L1=0.75 run=1 blk=0 avail=7938 (57.6%) swpO=0 conn=3 myRSS=3302 php=4 phpRSS=354 ap=24 tcp=36 topuser=madalice 2026-09-02 00:58:16 L1=0.70 run=2 blk=0 avail=7937 (57.6%) swpO=0 conn=2 myRSS=3302 php=4 phpRSS=407 ap=18 tcp=37 topuser=madalice 2026-09-02 00:58:17 L1=0.70 run=2 blk=0 avail=7960 (57.8%) swpO=0 conn=3 myRSS=3302 php=4 phpRSS=384 ap=18 tcp=37 topuser=madalice 2026-09-02 00:58:26 L1=0.68 run=2 blk=0 avail=7987 (58.0%) swpO=0 conn=2 myRSS=3302 php=4 phpRSS=355 ap=18 tcp=36 topuser=madalice 2026-09-02 00:58:27 L1=0.68 run=3 blk=0 avail=7988 (58.0%) swpO=0 conn=3 myRSS=3302 php=4 phpRSS=355 ap=18 tcp=37 topuser=madalice 2026-09-02 00:58:36 L1=0.57 run=2 blk=0 avail=7985 (58.0%) swpO=0 conn=2 myRSS=3302 php=4 phpRSS=354 ap=18 tcp=38 topuser=madalice 2026-09-02 00:58:37 L1=0.57 run=1 blk=0 avail=7984 (58.0%) swpO=0 conn=3 myRSS=3302 php=4 phpRSS=354 ap=18 tcp=41 topuser=madalice 2026-09-02 00:58:46 L1=0.48 run=1 blk=0 avail=7981 (57.9%) swpO=2 conn=2 myRSS=3302 php=4 phpRSS=356 ap=18 tcp=42 topuser=madalice 2026-09-02 00:58:47 L1=0.48 run=1 blk=0 avail=7981 (57.9%) swpO=2 conn=3 myRSS=3302 php=4 phpRSS=356 ap=18 tcp=41 topuser=madalice 2026-09-02 00:58:56 L1=0.56 run=2 blk=0 avail=7966 (57.8%) swpO=1 conn=2 myRSS=3302 php=5 phpRSS=413 ap=18 tcp=39 topuser=madalice 2026-09-02 00:58:57 L1=0.56 run=2 blk=0 avail=7963 (57.8%) swpO=1 conn=2 myRSS=3302 php=5 phpRSS=413 ap=19 tcp=43 topuser=madalice 2026-09-02 00:59:06 L1=0.87 run=2 blk=0 avail=7899 (57.3%) swpO=0 conn=2 myRSS=3302 php=4 phpRSS=357 ap=23 tcp=45 topuser=madalice 2026-09-02 00:59:07 L1=0.87 run=2 blk=0 avail=7826 (56.8%) swpO=0 conn=2 myRSS=3302 php=4 phpRSS=355 ap=23 tcp=44 topuser=madalice 2026-09-02 00:59:16 L1=0.88 run=1 blk=0 avail=7938 (57.6%) swpO=0 conn=1 myRSS=3302 php=4 phpRSS=354 ap=19 tcp=34 topuser=madalice 2026-09-02 00:59:17 L1=0.88 run=2 blk=0 avail=7927 (57.5%) swpO=0 conn=2 myRSS=3302 php=4 phpRSS=354 ap=19 tcp=40 topuser=madalice 2026-09-02 00:59:27 L1=0.91 run=1 blk=0 avail=7918 (57.5%) swpO=0 conn=1 myRSS=3302 php=4 phpRSS=356 ap=19 tcp=40 topuser=madalice 2026-09-02 00:59:27 L1=0.91 run=2 blk=0 avail=7932 (57.6%) swpO=0 conn=2 myRSS=3302 php=4 phpRSS=356 ap=19 tcp=32 topuser=madalice 2026-09-02 00:59:37 L1=1.49 run=2 blk=0 avail=6910 (50.2%) swpO=66 conn=2 myRSS=3300 php=12 phpRSS=1525 ap=24 tcp=45 topuser=madalice