INCIDENT 2026-09-02 02:29:41 trigger: php_rss=2235MB ================================================================== load: 1.81 1.07 0.92 9/697 673512 ncpu:10 mem_avail: 6037MB/13777MB (43.8%) swap_used:2313MB swapout:297/s blocked(D):0 running:15 iowait:0.0% steal:0.0% php: 12 procs / 2235MB heaviest user: madalice (10 procs, 2198MB) apache: 77 procs tcp_estab: 122 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3327 madalice 10 1918 nobody 76 1305 root 244 713 mailman 20 403 netdata 7 203 wp-toolkit 3 63 dovenull 6 46 infinium 3 42 kurri 3 41 lowrange 2 29 evolution 7 25 cpanellogin 1 21 dovecot 3 19 mailnull 2 18 zabbix 1 17 candyfabcom 1 14 aaa 1 14 named 1 12 polkitd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1926 root 1 28 evolution 1 8 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5177 MB Active(file): 4282 MB Inactive(file): 1266 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 676 MB CommitLimit: 10984 MB Committed_AS: 8866 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 636174 root 13:27 59700 /opt/imunify360/venv/bin/python3 -m imav.run 3926885 root 1-00:07:13 3380 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3407408 10.5 Ssl 5-00:10:33 /usr/sbin/mariadbd 673447 3929444 madalice 252664 75.5 R 00:02 php-fpm: pool madalice_com_au 673450 3929444 madalice 247304 142 R 00:01 php-fpm: pool madalice_com_au 673409 3929444 madalice 206284 65.0 R 00:06 php-fpm: pool madalice_com_au 673411 3929444 madalice 193448 61.0 R 00:06 php-fpm: pool madalice_com_au 508924 1 netdata 182612 1.9 Ssl 5-00:10:02 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 673407 3929444 madalice 171172 57.6 R 00:06 php-fpm: pool madalice_com_au 673012 3929444 madalice 160764 12.9 S 00:58 php-fpm: pool madalice_com_au 673408 3929444 madalice 160076 64.6 S 00:06 php-fpm: pool madalice_com_au 673448 3929444 madalice 137360 74.0 S 00:02 php-fpm: pool madalice_com_au 673449 3929444 madalice 137360 74.0 S 00:02 php-fpm: pool madalice_com_au 673451 3929444 madalice 137240 148 S 00:01 php-fpm: pool madalice_com_au 509266 1 root 134168 0.0 Ss 5-00:09:59 /usr/lib/systemd/systemd-journald 509640 508992 root 77276 0.0 Sl 5-00:09:57 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 636174 1 root 59700 0.2 Ssl 13:27 /opt/imunify360/venv/bin/python3 -m imav.run 509236 509098 root 44280 0.0 Sl 5-00:09:59 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 41688 0.1 Ss 64-16:19:54 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 41580 0.1 Ss 41-23:48:25 cpsrvd (SSL) - waiting for connections 3929420 1 wp-toolkit 38016 0.0 Ss 1-00:07:04 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 654927 1 root 37244 0.0 Ss 06:50 lfd - sleeping 3929444 1 root 29136 0.0 Ss 1-00:07:04 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 655662 506832 nobody 25876 0.0 S 06:09 /usr/sbin/httpd -k start 656124 506832 nobody 25716 0.0 S 05:25 /usr/sbin/httpd -k start 656332 506832 nobody 25520 0.0 S 05:15 /usr/sbin/httpd -k start 656318 506832 nobody 25444 0.0 S 05:16 /usr/sbin/httpd -k start 656333 506832 nobody 25428 0.0 S 05:15 /usr/sbin/httpd -k start 671837 506832 nobody 24616 0.0 S 03:04 /usr/sbin/httpd -k start 671825 506832 nobody 24612 0.0 S 03:06 /usr/sbin/httpd -k start 672786 506832 nobody 24308 0.0 S 01:37 /usr/sbin/httpd -k start 3929564 1 wp-toolkit 24276 0.0 Ss 1-00:07:03 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1463 1 root 24248 0.0 Ss 64-16:19:54 tailwatchd 673416 506832 nobody 23664 0.0 S 00:04 /usr/sbin/httpd -k start 671163 506832 nobody 23532 0.1 S 04:14 /usr/sbin/httpd -k start 671162 506832 nobody 23344 0.1 S 04:14 /usr/sbin/httpd -k start 673436 506832 nobody 23124 0.5 S 00:02 /usr/sbin/httpd -k start 673415 506832 nobody 23116 0.2 S 00:04 /usr/sbin/httpd -k start 673431 506832 nobody 23112 0.5 S 00:02 /usr/sbin/httpd -k start 673433 506832 nobody 23112 0.5 S 00:02 /usr/sbin/httpd -k start 673438 506832 nobody 23112 0.5 S 00:02 /usr/sbin/httpd -k start 673410 506832 nobody 23108 0.1 S 00:06 /usr/sbin/httpd -k start 673426 506832 nobody 23104 0.3 S 00:03 /usr/sbin/httpd -k start 673432 506832 nobody 23092 0.5 S 00:02 /usr/sbin/httpd -k start 673420 506832 nobody 22840 0.0 S 00:03 /usr/sbin/httpd -k start 673443 506832 nobody 22836 0.5 S 00:02 /usr/sbin/httpd -k start 673412 506832 nobody 22796 0.0 S 00:05 /usr/sbin/httpd -k start 673200 506832 nobody 21832 0.0 S 00:35 /usr/sbin/httpd -k start 654699 654679 mailman 21752 0.0 S 06:59 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 654985 1353308 cpanellogin 21732 0.0 S 06:47 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 654686 654679 mailman 21720 0.0 S 06:59 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 654700 654679 mailman 21692 0.0 S 06:59 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 654684 654679 mailman 21676 0.0 S 06:59 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 654688 654679 mailman 21624 0.0 S 06:59 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 654695 654679 mailman 21620 0.0 S 06:59 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 654690 654679 mailman 21592 0.0 S 06:59 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 654693 654679 mailman 21540 0.0 S 06:59 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 654687 654679 mailman 21504 0.0 S 06:59 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 654692 654679 mailman 21468 0.0 S 06:59 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 654689 654679 mailman 21460 0.0 S 06:59 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 654696 654679 mailman 21452 0.0 S 06:59 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 654683 654679 mailman 21436 0.0 S 06:59 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:0:2 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 15523568 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 125 evolution/evolutionerp.com.au-ssl_log 26 evolution/portal.evolutionerp.com.au-ssl_log 20 madalice/madalice.com.au-ssl_log 7 evolution/my.evolutionerp.com.au-ssl_log 4 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 125 40.115.94.245 26 20.48.250.41 20 203.54.180.238 2 52.167.144.213 2 114.119.140.234 2 114.119.130.40 1 52.167.144.237 1 40.77.167.2 1 2a03:2880:f802:: 1 114.119.143.14 1 114.119.137.101 --- top request paths across all vhosts (last 3 min) --- 63 GET /api/getItem/LWFBW2001KG 62 GET /api/getItem/LWHG2001KG 20 GET /heartbeat.php 4 GET /index.php 3 GET /store/custom-brisbane-lions-kids/ 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /XrdbXydefault.php 1 GET /xmini4.php 1 GET /wp-trackback.php 1 GET /w1px.php 1 GET /tag/school/ 1 GET /store/custom-bulldogs-nrl-shoes/ 1 GET /store/custom-brisbane-lions-shoes/ 1 GET /store/custom-brisbane-broncos-shoes/ 1 GET /simple.php 1 GET /pqfpcelx.php 1 GET /ot.php 1 GET /ilex.php 1 GET /hywzd.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 63 GET /api/getItem/LWFBW2001KG 62 GET /api/getItem/LWHG2001KG -- last 10 requests -- 40.115.94.245 - - [02/Sep/2026:02:29:08 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:02:29:08 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:02:29:08 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:02:29:08 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:02:29:08 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:02:29:09 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:02:29:09 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:02:29:09 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:02:29:09 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:02:29:09 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /XrdbXydefault.php 1 GET /xmini4.php 1 GET /wp-trackback.php 1 GET /w1px.php 1 GET /simple.php 1 GET /pqfpcelx.php 1 GET /ot.php 1 GET /ilex.php 1 GET /hywzd.php 1 GET /ho.php -- last 10 requests -- 20.48.250.41 - - [02/Sep/2026:02:27:07 +1000] "GET /zoo1.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [02/Sep/2026:02:27:07 +1000] "GET /ot.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [02/Sep/2026:02:27:08 +1000] "GET /edorxrr.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [02/Sep/2026:02:27:08 +1000] "GET /zoo2.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [02/Sep/2026:02:27:09 +1000] "GET /hywzd.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [02/Sep/2026:02:27:09 +1000] "GET /simple.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [02/Sep/2026:02:27:10 +1000] "GET /acf1ced8aec2.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [02/Sep/2026:02:27:10 +1000] "GET /wp-trackback.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [02/Sep/2026:02:27:10 +1000] "GET /coffe.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [02/Sep/2026:02:27:11 +1000] "GET /goods.php HTTP/1.1" 401 36 "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 20 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [02/Sep/2026:02:27:52 +1000] "GET /heartbeat.php?sentAt=1788280073&bytes=106,150,253,9&_=1788238873259 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [02/Sep/2026:02:27:54 +1000] "GET /heartbeat.php?sentAt=1788280075&bytes=106,150,253,11&_=1788267562578 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [02/Sep/2026:02:28:02 +1000] "GET /heartbeat.php?sentAt=1788280083&bytes=106,150,253,19&_=1788238873260 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [02/Sep/2026:02:28:04 +1000] "GET /heartbeat.php?sentAt=1788280085&bytes=106,150,253,21&_=1788267562579 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [02/Sep/2026:02:28:12 +1000] "GET /heartbeat.php?sentAt=1788280093&bytes=106,150,253,29&_=1788238873261 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [02/Sep/2026:02:28:14 +1000] "GET /heartbeat.php?sentAt=1788280095&bytes=106,150,253,31&_=1788267562580 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [02/Sep/2026:02:28:22 +1000] "GET /heartbeat.php?sentAt=1788280103&bytes=106,150,253,39&_=1788238873262 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [02/Sep/2026:02:28:24 +1000] "GET /heartbeat.php?sentAt=1788280105&bytes=106,150,253,41&_=1788267562581 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [02/Sep/2026:02:28:32 +1000] "GET /heartbeat.php?sentAt=1788280113&bytes=106,150,253,49&_=1788238873263 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [02/Sep/2026:02:28:34 +1000] "GET /heartbeat.php?sentAt=1788280115&bytes=106,150,253,51&_=1788267562582 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-09-02 02:27:11 L1=0.55 run=1 blk=0 avail=8108 (58.9%) swpO=0 conn=1 myRSS=3336 php=3 phpRSS=194 ap=16 tcp=28 topuser=madalice 2026-09-02 02:27:21 L1=0.47 run=2 blk=0 avail=8249 (59.9%) swpO=0 conn=1 myRSS=3336 php=2 phpRSS=36 ap=16 tcp=26 topuser=root 2026-09-02 02:27:21 L1=0.47 run=1 blk=0 avail=8255 (59.9%) swpO=0 conn=1 myRSS=3336 php=2 phpRSS=36 ap=16 tcp=26 topuser=root 2026-09-02 02:27:31 L1=0.39 run=2 blk=0 avail=8174 (59.3%) swpO=0 conn=1 myRSS=3336 php=3 phpRSS=174 ap=15 tcp=26 topuser=madalice 2026-09-02 02:27:31 L1=0.39 run=1 blk=0 avail=8170 (59.3%) swpO=0 conn=1 myRSS=3336 php=3 phpRSS=174 ap=14 tcp=26 topuser=madalice 2026-09-02 02:27:41 L1=0.41 run=2 blk=0 avail=8172 (59.3%) swpO=0 conn=1 myRSS=3336 php=3 phpRSS=174 ap=14 tcp=26 topuser=madalice 2026-09-02 02:27:42 L1=0.41 run=1 blk=0 avail=8167 (59.3%) swpO=0 conn=1 myRSS=3336 php=3 phpRSS=174 ap=14 tcp=26 topuser=madalice 2026-09-02 02:27:51 L1=0.42 run=1 blk=0 avail=8279 (60.1%) swpO=0 conn=1 myRSS=3336 php=3 phpRSS=53 ap=14 tcp=29 topuser=root 2026-09-02 02:27:52 L1=0.42 run=3 blk=0 avail=8184 (59.4%) swpO=0 conn=1 myRSS=3336 php=3 phpRSS=71 ap=14 tcp=29 topuser=evolution 2026-09-02 02:28:01 L1=0.43 run=2 blk=0 avail=8164 (59.3%) swpO=0 conn=1 myRSS=3336 php=3 phpRSS=170 ap=14 tcp=28 topuser=madalice 2026-09-02 02:28:02 L1=0.43 run=2 blk=0 avail=8165 (59.3%) swpO=0 conn=1 myRSS=3336 php=4 phpRSS=210 ap=14 tcp=28 topuser=madalice 2026-09-02 02:28:11 L1=0.61 run=5 blk=0 avail=7952 (57.7%) swpO=0 conn=1 myRSS=3336 php=5 phpRSS=440 ap=15 tcp=28 topuser=tubesupplies 2026-09-02 02:28:12 L1=0.61 run=2 blk=0 avail=8126 (59.0%) swpO=0 conn=1 myRSS=3336 php=4 phpRSS=231 ap=15 tcp=28 topuser=madalice 2026-09-02 02:28:21 L1=0.51 run=2 blk=0 avail=8138 (59.1%) swpO=0 conn=1 myRSS=3336 php=3 phpRSS=193 ap=15 tcp=26 topuser=madalice 2026-09-02 02:28:22 L1=0.51 run=1 blk=0 avail=8124 (59.0%) swpO=0 conn=2 myRSS=3336 php=4 phpRSS=232 ap=15 tcp=26 topuser=madalice 2026-09-02 02:28:31 L1=0.43 run=1 blk=0 avail=8145 (59.1%) swpO=0 conn=1 myRSS=3336 php=3 phpRSS=193 ap=14 tcp=25 topuser=madalice 2026-09-02 02:28:32 L1=0.43 run=1 blk=0 avail=8133 (59.0%) swpO=0 conn=2 myRSS=3336 php=4 phpRSS=232 ap=14 tcp=26 topuser=madalice 2026-09-02 02:28:41 L1=0.37 run=1 blk=0 avail=8280 (60.1%) swpO=0 conn=1 myRSS=3336 php=2 phpRSS=36 ap=14 tcp=25 topuser=root 2026-09-02 02:28:42 L1=0.37 run=1 blk=0 avail=8268 (60.0%) swpO=0 conn=2 myRSS=3336 php=3 phpRSS=76 ap=14 tcp=26 topuser=evolution 2026-09-02 02:28:51 L1=0.31 run=1 blk=0 avail=8159 (59.2%) swpO=0 conn=1 myRSS=3336 php=3 phpRSS=170 ap=14 tcp=31 topuser=madalice 2026-09-02 02:28:52 L1=0.31 run=2 blk=0 avail=8145 (59.1%) swpO=0 conn=2 myRSS=3336 php=4 phpRSS=210 ap=14 tcp=31 topuser=madalice 2026-09-02 02:29:01 L1=0.26 run=2 blk=0 avail=8155 (59.2%) swpO=0 conn=1 myRSS=3336 php=5 phpRSS=239 ap=14 tcp=32 topuser=madalice 2026-09-02 02:29:02 L1=0.26 run=2 blk=0 avail=8144 (59.1%) swpO=0 conn=2 myRSS=3336 php=6 phpRSS=268 ap=14 tcp=32 topuser=madalice 2026-09-02 02:29:11 L1=0.45 run=1 blk=0 avail=8112 (58.9%) swpO=0 conn=1 myRSS=3336 php=3 phpRSS=193 ap=17 tcp=32 topuser=madalice 2026-09-02 02:29:12 L1=0.45 run=1 blk=0 avail=8105 (58.8%) swpO=0 conn=2 myRSS=3336 php=4 phpRSS=232 ap=17 tcp=33 topuser=madalice 2026-09-02 02:29:21 L1=0.38 run=1 blk=0 avail=8145 (59.1%) swpO=0 conn=1 myRSS=3336 php=3 phpRSS=193 ap=15 tcp=29 topuser=madalice 2026-09-02 02:29:22 L1=0.38 run=2 blk=0 avail=8133 (59.0%) swpO=0 conn=2 myRSS=3336 php=4 phpRSS=232 ap=14 tcp=30 topuser=madalice 2026-09-02 02:29:31 L1=0.47 run=1 blk=0 avail=8132 (59.0%) swpO=0 conn=1 myRSS=3336 php=3 phpRSS=193 ap=14 tcp=32 topuser=madalice 2026-09-02 02:29:32 L1=0.47 run=2 blk=0 avail=8119 (58.9%) swpO=0 conn=2 myRSS=3336 php=4 phpRSS=232 ap=14 tcp=33 topuser=madalice 2026-09-02 02:29:41 L1=1.81 run=15 blk=0 avail=6037 (43.8%) swpO=297 conn=8 myRSS=3327 php=12 phpRSS=2235 ap=77 tcp=122 topuser=madalice