INCIDENT 2026-09-02 05:24:59 trigger: php_rss=1669MB ================================================================== load: 2.39 1.48 1.32 2/743 1286868 ncpu:10 mem_avail: 5608MB/13777MB (40.7%) swap_used:2316MB swapout:0/s blocked(D):0 running:4 iowait:0.1% steal:0.0% php: 13 procs / 1669MB heaviest user: madalice (10 procs, 1560MB) apache: 121 procs tcp_estab: 56 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3294 nobody 120 2113 madalice 10 1560 root 246 1048 mailman 20 356 cpanellogin 1 226 netdata 7 203 alison 1 79 kurri 5 72 dovenull 6 67 wp-toolkit 3 59 lowrange 3 42 infinium 2 28 dovecot 3 28 evolution 7 24 zabbix 1 18 vinesit 1 14 named 1 12 mailnull 1 9 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1560 alison 1 80 root 1 25 evolution 1 8 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3942 MB Active(file): 3387 MB Inactive(file): 766 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 474 MB CommitLimit: 10984 MB Committed_AS: 10410 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1201899 root 24:57 1368 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 1-03:02:30 3808 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3373732 10.3 Ssl 5-03:05:51 /usr/sbin/mariadbd 704828 1353308 cpanellogin 232292 0.2 S 02:49:05 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 706070 655564 root 189516 0.0 S 02:47:01 spamd child 508924 1 netdata 182444 2.0 Ssl 5-03:05:20 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 706071 655564 root 181648 0.0 S 02:47:01 spamd child 655564 1 root 174396 0.0 Ss 03:01:37 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1286681 3929444 madalice 163428 37.8 S 00:13 php-fpm: pool madalice_com_au 1286682 3929444 madalice 161184 38.5 S 00:13 php-fpm: pool madalice_com_au 1285817 3929444 madalice 161120 20.5 S 01:08 php-fpm: pool madalice_com_au 1286680 3929444 madalice 160912 39.0 S 00:13 php-fpm: pool madalice_com_au 1286668 3929444 madalice 160884 26.0 S 00:15 php-fpm: pool madalice_com_au 1286669 3929444 madalice 160752 46.4 S 00:15 php-fpm: pool madalice_com_au 1286799 3929444 madalice 160704 36.2 S 00:07 php-fpm: pool madalice_com_au 1286670 3929444 madalice 158656 40.8 S 00:15 php-fpm: pool madalice_com_au 1286798 3929444 madalice 158408 52.0 S 00:07 php-fpm: pool madalice_com_au 1286684 3929444 madalice 152268 30.5 S 00:13 php-fpm: pool madalice_com_au 1286839 1286714 alison 89052 47.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509640 508992 root 77936 0.0 Sl 5-03:05:15 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509236 509098 root 47816 0.0 Sl 5-03:05:17 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 37440 0.1 Ss 42-02:43:43 cpsrvd (SSL) - waiting for connections 3929420 1 wp-toolkit 37420 0.0 Ss 1-03:02:22 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 654927 1 root 33196 0.0 Ss 03:02:08 lfd - sleeping 1469 1 root 33156 0.1 Ss 64-19:15:12 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3929444 1 root 26068 0.0 Ss 1-03:02:22 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1284424 506832 nobody 24368 0.1 S 03:28 /usr/sbin/httpd -k start 1285526 506832 nobody 23860 0.0 S 01:40 /usr/sbin/httpd -k start 1463 1 root 23652 0.0 Ss 64-19:15:12 tailwatchd 1285958 506832 nobody 23444 0.1 S 00:56 /usr/sbin/httpd -k start 1286083 506832 nobody 22820 0.0 S 00:47 /usr/sbin/httpd -k start 1285534 506832 nobody 22728 0.0 S 01:39 /usr/sbin/httpd -k start 1267987 506832 nobody 22688 0.0 S 06:52 /usr/sbin/httpd -k start 1285945 506832 nobody 22384 0.1 S 00:57 /usr/sbin/httpd -k start 1285785 506832 nobody 22360 0.1 S 01:09 /usr/sbin/httpd -k start 1286097 506832 nobody 22336 0.0 S 00:46 /usr/sbin/httpd -k start 1285956 506832 nobody 22292 0.1 S 00:56 /usr/sbin/httpd -k start 1285944 506832 nobody 22244 0.0 S 00:57 /usr/sbin/httpd -k start 1285959 506832 nobody 22128 0.0 S 00:56 /usr/sbin/httpd -k start 1286132 506832 nobody 21972 0.1 S 00:44 /usr/sbin/httpd -k start 1286096 506832 nobody 21892 0.1 S 00:46 /usr/sbin/httpd -k start 1285532 506832 nobody 21512 0.0 S 01:39 /usr/sbin/httpd -k start 1286115 506832 nobody 21420 0.0 S 00:45 /usr/sbin/httpd -k start 1286116 506832 nobody 21296 0.0 S 00:45 /usr/sbin/httpd -k start 1286137 506832 nobody 21232 0.0 S 00:44 /usr/sbin/httpd -k start 1286135 506832 nobody 20932 0.0 S 00:44 /usr/sbin/httpd -k start 3929564 1 wp-toolkit 20888 0.0 Ss 1-03:02:21 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1286134 506832 nobody 20816 0.0 S 00:44 /usr/sbin/httpd -k start 1286715 506832 nobody 20664 0.1 S 00:10 /usr/sbin/httpd -k start 1286038 506832 nobody 20648 0.2 S 00:49 /usr/sbin/httpd -k start 1286716 506832 nobody 20544 0.1 S 00:10 /usr/sbin/httpd -k start 1286713 506832 nobody 20496 0.0 S 00:10 /usr/sbin/httpd -k start 1286720 506832 nobody 20488 0.0 S 00:09 /usr/sbin/httpd -k start 1286688 506832 nobody 20452 0.0 S 00:11 /usr/sbin/httpd -k start 1285377 506832 nobody 20396 0.0 S 01:51 /usr/sbin/httpd -k start 1286714 506832 nobody 20396 0.0 S 00:10 /usr/sbin/httpd -k start 1286786 506832 nobody 20324 0.0 S 00:07 /usr/sbin/httpd -k start 1286789 506832 nobody 20208 0.0 S 00:07 /usr/sbin/httpd -k start 1285919 506832 nobody 20124 0.2 S 00:58 /usr/sbin/httpd -k start 1286138 506832 nobody 20056 0.0 S 00:44 /usr/sbin/httpd -k start 1286728 506832 nobody 19940 0.1 S 00:08 /usr/sbin/httpd -k start 1286782 506832 nobody 19904 0.2 S 00:07 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 15618392 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min vinesit/vinesit.com.au-ssl_log 170 evolution/app.evolutionerp.com.au-ssl_log 115 kamcool/kamcool.com.au-ssl_log 88 madalice/madalice.com.au-ssl_log 44 evolution/portal.evolutionerp.com.au-ssl_log 34 alison/alisonarts.com.au-ssl_log 16 infinium/infinium.net.au-ssl_log 5 evolution/my.evolutionerp.com.au-ssl_log 4 evolution/evolutionerp.com.au-ssl_log 2 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 115 40.115.94.245 112 4.204.224.164 91 20.63.81.20 52 20.48.250.41 34 203.54.180.238 29 104.164.173.226 6 35.93.95.31 3 114.119.143.104 2 94.154.43.180 2 94.154.43.129 2 80.240.119.216 2 17.166.237.101 2 114.119.146.16 2 114.119.137.101 1 94.177.55.205 --- top request paths across all vhosts (last 3 min) --- 112 GET /autodiscover/autodiscover.xml 58 GET /api/getItem/LWPG2001KG 32 GET /heartbeat.php 12 GET / 9 GET /robots.txt 6 GET /store/air-force-1-custom-butterfly-swarovski-diamond-sneakers/ 4 GET /index.php 3 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 GET /this_is_a_new_hello_world.php 3 GET /simple.php 3 GET /api/getItem/PWFBW3151KG 2 POST / 2 GET /xmini4.php 2 GET /wp-content/themes/index.php 2 GET /wp-admin/admin-ajax.php 2 GET /ho.php 2 GET /goods.php 2 GET /assets/mp4/v/b284f8438ecacebc.mp4 2 GET /api/getItem/CLPGNSTD40250KK 2 GET /aaa.php --- busiest 3 vhosts: top paths + last 10 requests --- == vinesit/vinesit.com.au-ssl_log == -- top paths -- 112 GET /autodiscover/autodiscover.xml 3 GET /robots.txt 2 GET /ho.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xrp.php 1 GET /XrdbXydefault.php 1 GET /xmini4.php 1 GET /wp-trackback.php 1 GET /wp-sitemap.xml 1 GET /wp-sitemap-posts-post-1.xml 1 GET /wp-sitemap-posts-page-1.xml -- last 10 requests -- 35.93.95.31 - - [02/Sep/2026:05:24:10 +1000] "GET /robots.txt HTTP/1.1" 301 - "-" "SeltzSitemapFetcher/1.0" 4.204.224.164 - - [02/Sep/2026:05:24:10 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 4.204.224.164 - - [02/Sep/2026:05:24:11 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 35.93.95.31 - - [02/Sep/2026:05:24:12 +1000] "GET /robots.txt HTTP/1.1" 200 119 "https://vinesit.com.au/robots.txt" "SeltzSitemapFetcher/1.0" 35.93.95.31 - - [02/Sep/2026:05:24:13 +1000] "GET /robots.txt HTTP/1.1" 200 119 "-" "SeltzSitemapFetcher/1.0" 35.93.95.31 - - [02/Sep/2026:05:24:13 +1000] "GET /wp-sitemap.xml HTTP/1.1" 200 473 "-" "SeltzSitemapFetcher/1.0" 35.93.95.31 - - [02/Sep/2026:05:24:14 +1000] "GET /wp-sitemap-posts-post-1.xml HTTP/1.1" 200 607 "-" "SeltzSitemapFetcher/1.0" 4.204.224.164 - - [02/Sep/2026:05:24:15 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 35.93.95.31 - - [02/Sep/2026:05:24:15 +1000] "GET /wp-sitemap-posts-page-1.xml HTTP/1.1" 200 2085 "-" "SeltzSitemapFetcher/1.0" 4.204.224.164 - - [02/Sep/2026:05:24:16 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 58 GET /api/getItem/LWPG2001KG 3 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/CLPGNSTD40250KK 1 GET /api/getItem/SHSG757520-SP25-8 1 GET /api/getItem/SHSG757520-DP25-8-DI 1 GET /api/getItem/SHSG757520-DP25-8 1 GET /api/getItem/SHSG656520-SP25-8 1 GET /api/getItem/SHSG656520-DP25-8-DI 1 GET /api/getItem/SHSG656520-DP25-8 1 GET /api/getItem/SHSG505016-SP25-8 1 GET /api/getItem/SHSG505016-SP19-8 1 GET /api/getItem/SHSG505016-DP25-8-DI -- last 10 requests -- 40.115.94.245 - - [02/Sep/2026:05:24:16 +1000] "GET /api/getItem/CLHGNSTD50400KK HTTP/1.1" 200 1562 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:05:24:16 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:05:24:17 +1000] "GET /api/getItem/CLSGNSTD32350KK HTTP/1.1" 404 117 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:05:24:17 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:05:24:17 +1000] "GET /api/getItem/PWFBW3151KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:05:24:17 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:05:24:17 +1000] "GET /api/getItem/PWFBW3151KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:05:24:17 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:05:24:18 +1000] "GET /api/getItem/PWFBW3151KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [02/Sep/2026:05:24:18 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" == kamcool/kamcool.com.au-ssl_log == -- top paths -- 2 GET /wp-content/themes/index.php 2 GET /simple.php 1 GET /xx.php 1 GET /xmini4.php 1 GET /wp-temp.php 1 GET /wp-manager.php 1 GET /wp-mail.php 1 GET /wp-includes/Text/Diff/Engine/about.php 1 GET /wp-includes/Requests/ 1 GET /wp-includes/pomo/xxx.php 1 GET /wp-includes/l10n/ 1 GET /wp-includes/js/jquery/ -- last 10 requests -- 20.63.81.20 - - [02/Sep/2026:05:24:36 +1000] "GET /wp-blog.php HTTP/1.1" 404 5750 "-" "-" 20.63.81.20 - - [02/Sep/2026:05:24:36 +1000] "GET /wp-includes/js/jquery/ HTTP/1.1" 404 5750 "-" "-" 20.63.81.20 - - [02/Sep/2026:05:24:37 +1000] "GET /cgi-bin/index.php HTTP/1.1" 404 5750 "-" "-" 20.63.81.20 - - [02/Sep/2026:05:24:37 +1000] "GET /wp-includes/l10n/ HTTP/1.1" 404 5750 "-" "-" 20.63.81.20 - - [02/Sep/2026:05:24:38 +1000] "GET /wp-manager.php HTTP/1.1" 404 5750 "-" "-" 20.63.81.20 - - [02/Sep/2026:05:24:38 +1000] "GET /wp-includes/Text/Diff/Engine/about.php HTTP/1.1" 404 5750 "-" "-" 20.63.81.20 - - [02/Sep/2026:05:24:38 +1000] "GET /cgi-bin/admin.php HTTP/1.1" 404 5750 "-" "-" 20.63.81.20 - - [02/Sep/2026:05:24:39 +1000] "GET /wp-content/ HTTP/1.1" 404 5750 "-" "-" 20.63.81.20 - - [02/Sep/2026:05:24:39 +1000] "GET /wp-admin/css/colors/blue/ HTTP/1.1" 404 5750 "-" "-" 20.63.81.20 - - [02/Sep/2026:05:24:40 +1000] "GET /wp-includes/block-bindings/ HTTP/1.1" 404 5750 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-09-02 05:22:30 L1=0.36 run=2 blk=0 avail=7523 (54.6%) swpO=0 conn=1 myRSS=3294 php=3 phpRSS=235 ap=23 tcp=33 topuser=madalice 2026-09-02 05:22:38 L1=0.38 run=1 blk=0 avail=7601 (55.2%) swpO=0 conn=1 myRSS=3294 php=3 phpRSS=190 ap=19 tcp=29 topuser=madalice 2026-09-02 05:22:40 L1=0.38 run=3 blk=0 avail=7610 (55.2%) swpO=0 conn=1 myRSS=3294 php=3 phpRSS=190 ap=17 tcp=28 topuser=madalice 2026-09-02 05:22:48 L1=0.32 run=2 blk=0 avail=7536 (54.7%) swpO=0 conn=1 myRSS=3294 php=4 phpRSS=295 ap=17 tcp=35 topuser=madalice 2026-09-02 05:22:51 L1=0.32 run=1 blk=0 avail=7588 (55.1%) swpO=0 conn=1 myRSS=3294 php=3 phpRSS=190 ap=19 tcp=33 topuser=madalice 2026-09-02 05:22:58 L1=0.59 run=2 blk=0 avail=7597 (55.1%) swpO=0 conn=1 myRSS=3294 php=3 phpRSS=190 ap=19 tcp=32 topuser=madalice 2026-09-02 05:23:01 L1=0.59 run=3 blk=0 avail=7598 (55.2%) swpO=0 conn=1 myRSS=3294 php=3 phpRSS=190 ap=19 tcp=32 topuser=madalice 2026-09-02 05:23:08 L1=0.72 run=2 blk=0 avail=7544 (54.8%) swpO=0 conn=1 myRSS=3294 php=3 phpRSS=224 ap=21 tcp=39 topuser=madalice 2026-09-02 05:23:11 L1=0.72 run=1 blk=0 avail=7559 (54.9%) swpO=0 conn=1 myRSS=3294 php=3 phpRSS=190 ap=23 tcp=40 topuser=madalice 2026-09-02 05:23:18 L1=0.61 run=1 blk=0 avail=7551 (54.8%) swpO=0 conn=1 myRSS=3294 php=3 phpRSS=190 ap=23 tcp=39 topuser=madalice 2026-09-02 05:23:21 L1=0.61 run=3 blk=0 avail=7533 (54.7%) swpO=0 conn=1 myRSS=3294 php=3 phpRSS=190 ap=29 tcp=40 topuser=madalice 2026-09-02 05:23:28 L1=0.67 run=1 blk=0 avail=7578 (55.0%) swpO=0 conn=1 myRSS=3294 php=3 phpRSS=190 ap=24 tcp=28 topuser=madalice 2026-09-02 05:23:31 L1=0.67 run=2 blk=0 avail=7563 (54.9%) swpO=0 conn=1 myRSS=3294 php=3 phpRSS=190 ap=22 tcp=30 topuser=madalice 2026-09-02 05:23:38 L1=0.57 run=2 blk=0 avail=7603 (55.2%) swpO=0 conn=1 myRSS=3294 php=3 phpRSS=190 ap=19 tcp=30 topuser=madalice 2026-09-02 05:23:41 L1=0.57 run=2 blk=0 avail=7430 (53.9%) swpO=0 conn=1 myRSS=3294 php=5 phpRSS=428 ap=19 tcp=28 topuser=otterfencing 2026-09-02 05:23:48 L1=0.64 run=2 blk=0 avail=7572 (55.0%) swpO=0 conn=1 myRSS=3294 php=4 phpRSS=282 ap=16 tcp=31 topuser=madalice 2026-09-02 05:23:51 L1=0.64 run=1 blk=0 avail=7617 (55.3%) swpO=0 conn=1 myRSS=3294 php=3 phpRSS=190 ap=17 tcp=33 topuser=madalice 2026-09-02 05:23:58 L1=0.77 run=1 blk=0 avail=7509 (54.5%) swpO=0 conn=1 myRSS=3294 php=4 phpRSS=326 ap=18 tcp=31 topuser=madalice 2026-09-02 05:24:01 L1=0.77 run=5 blk=0 avail=7473 (54.2%) swpO=0 conn=2 myRSS=3294 php=5 phpRSS=383 ap=19 tcp=34 topuser=madalice 2026-09-02 05:24:08 L1=0.81 run=1 blk=0 avail=7454 (54.1%) swpO=0 conn=1 myRSS=3294 php=4 phpRSS=326 ap=25 tcp=37 topuser=madalice 2026-09-02 05:24:11 L1=0.81 run=1 blk=0 avail=7445 (54.0%) swpO=0 conn=2 myRSS=3294 php=5 phpRSS=353 ap=26 tcp=40 topuser=madalice 2026-09-02 05:24:18 L1=1.00 run=4 blk=0 avail=7380 (53.6%) swpO=0 conn=1 myRSS=3294 php=4 phpRSS=270 ap=41 tcp=51 topuser=madalice 2026-09-02 05:24:21 L1=1.00 run=4 blk=0 avail=7401 (53.7%) swpO=0 conn=2 myRSS=3294 php=4 phpRSS=268 ap=40 tcp=44 topuser=madalice 2026-09-02 05:24:29 L1=1.08 run=2 blk=0 avail=7439 (54.0%) swpO=0 conn=1 myRSS=3294 php=4 phpRSS=285 ap=33 tcp=40 topuser=madalice 2026-09-02 05:24:31 L1=1.08 run=2 blk=0 avail=7401 (53.7%) swpO=0 conn=2 myRSS=3294 php=4 phpRSS=326 ap=31 tcp=42 topuser=madalice 2026-09-02 05:24:39 L1=1.06 run=1 blk=0 avail=7510 (54.5%) swpO=0 conn=1 myRSS=3294 php=3 phpRSS=190 ap=30 tcp=42 topuser=madalice 2026-09-02 05:24:41 L1=1.06 run=4 blk=0 avail=7393 (53.7%) swpO=0 conn=2 myRSS=3294 php=5 phpRSS=368 ap=30 tcp=41 topuser=madalice 2026-09-02 05:24:49 L1=1.78 run=3 blk=0 avail=6552 (47.6%) swpO=0 conn=1 myRSS=3294 php=11 phpRSS=1216 ap=33 tcp=114 topuser=madalice 2026-09-02 05:24:51 L1=1.78 run=3 blk=0 avail=6383 (46.3%) swpO=0 conn=2 myRSS=3294 php=11 phpRSS=1256 ap=61 tcp=124 topuser=madalice 2026-09-02 05:24:59 L1=2.39 run=4 blk=0 avail=5608 (40.7%) swpO=0 conn=2 myRSS=3294 php=13 phpRSS=1669 ap=121 tcp=56 topuser=madalice