INCIDENT 2026-09-02 07:08:32 trigger: php_rss=1618MB ================================================================== load: 2.00 1.47 1.49 9/664 1657781 ncpu:10 mem_avail: 6442MB/13777MB (46.8%) swap_used:2292MB swapout:0/s blocked(D):0 running:8 iowait:0.1% steal:0.0% php: 19 procs / 1618MB heaviest user: madalice (10 procs, 1100MB) apache: 34 procs tcp_estab: 46 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3323 root 261 1328 madalice 10 1110 nobody 33 607 evolution 13 586 mailman 20 354 cpanellogin 1 239 netdata 7 204 dovenull 6 67 wp-toolkit 3 59 kurri 2 29 dovecot 3 28 mailnull 3 24 zabbix 1 21 lowrange 1 14 named 1 12 nscd 1 4 cpanelconnecttrack 1 4 polkitd 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 10 1112 evolution 7 583 root 1 25 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4692 MB Active(file): 4164 MB Inactive(file): 824 MB Dirty: 3 MB Writeback: 0 MB SReclaimable: 489 MB CommitLimit: 10984 MB Committed_AS: 8836 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1621640 root 08:31 1256 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 1-04:46:04 4736 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3402980 10.4 Ssl 5-04:49:24 /usr/sbin/mariadbd 704828 1353308 cpanellogin 244964 0.1 S 04:32:38 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 706070 655564 root 189668 0.0 S 04:30:34 spamd child 508924 1 netdata 182728 2.0 Ssl 5-04:48:53 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 706071 655564 root 181664 0.0 S 04:30:34 spamd child 1635856 3929444 madalice 174564 4.2 S 08:03 php-fpm: pool madalice_com_au 655564 1 root 174396 0.0 Ss 04:45:10 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1635808 3929444 madalice 162792 3.0 S 08:04 php-fpm: pool madalice_com_au 1566821 3929444 madalice 150420 4.6 S 24:19 php-fpm: pool madalice_com_au 1635875 3929444 madalice 128016 4.4 S 07:58 php-fpm: pool madalice_com_au 1635880 3929444 madalice 122460 4.1 S 07:57 php-fpm: pool madalice_com_au 1657742 1654738 evolution 115376 39.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1657737 1655131 evolution 114608 41.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1657733 1657713 evolution 114036 40.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1657741 1656703 evolution 107096 40.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1657743 1656925 evolution 107096 38.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1657745 1655175 evolution 100804 36.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1637876 3929444 madalice 100264 2.8 S 05:40 php-fpm: pool madalice_com_au 1638804 3929444 madalice 83264 6.1 S 04:13 php-fpm: pool madalice_com_au 1635978 3929444 madalice 77216 3.1 S 07:44 php-fpm: pool madalice_com_au 1635858 3929444 madalice 76320 3.6 S 08:02 php-fpm: pool madalice_com_au 1546591 3929444 madalice 74264 5.2 S 31:24 php-fpm: pool madalice_com_au 509236 509098 root 47852 0.0 Sl 5-04:48:50 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 37724 0.1 Ss 42-04:27:16 cpsrvd (SSL) - waiting for connections 3929420 1 wp-toolkit 37420 0.0 Ss 1-04:45:55 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1657734 1469 root 35108 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1657739 1469 root 35040 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1657738 1469 root 34900 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1657768 1469 root 34900 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1657746 1469 root 34896 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1657735 1469 root 34824 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1657744 1469 root 34824 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1657732 1469 root 34764 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1657740 1469 root 34764 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1657736 1469 root 34760 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 654927 1 root 33244 0.0 Ss 04:45:41 lfd - sleeping 1469 1 root 33192 0.1 Ss 64-20:58:45 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3929444 1 root 26148 0.0 Ss 1-04:45:55 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1463 1 root 24012 0.0 Ss 64-20:58:45 tailwatchd 1654381 506832 nobody 22588 0.0 S 02:32 /usr/sbin/httpd -k start 1656703 506832 nobody 22472 0.2 S 00:55 /usr/sbin/httpd -k start 1656734 506832 nobody 22364 0.2 S 00:54 /usr/sbin/httpd -k start 1656985 506832 nobody 22344 0.2 S 00:42 /usr/sbin/httpd -k start 1654738 506832 nobody 22336 0.1 S 02:08 /usr/sbin/httpd -k start 1638145 506832 nobody 22004 0.1 S 05:08 /usr/sbin/httpd -k start 1656776 506832 nobody 21748 0.1 S 00:52 /usr/sbin/httpd -k start 483898 1 zabbix 21736 0.2 Ssl 5-04:50:07 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1655173 506832 nobody 21668 0.1 S 01:43 /usr/sbin/httpd -k start 1655171 506832 nobody 21608 0.1 S 01:43 /usr/sbin/httpd -k start 1655131 506832 nobody 21592 0.1 S 01:46 /usr/sbin/httpd -k start 1654754 506832 nobody 21588 0.3 S 02:07 /usr/sbin/httpd -k start 1655985 506832 nobody 21544 0.1 S 01:06 /usr/sbin/httpd -k start 3929564 1 wp-toolkit 20888 0.0 Ss 1-04:45:54 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1656925 506832 nobody 20876 0.1 S 00:44 /usr/sbin/httpd -k start 1655175 506832 nobody 20004 0.1 S 01:43 /usr/sbin/httpd -k start 1655690 506832 nobody 19816 0.1 S 01:21 /usr/sbin/httpd -k start 1656895 506832 nobody 19816 0.1 S 00:46 /usr/sbin/httpd -k start 1656986 506832 nobody 19800 0.1 S 00:42 /usr/sbin/httpd -k start 654684 654679 mailman 19380 0.0 S 04:45:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 654690 654679 mailman 19368 0.0 S 04:45:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 15888552 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 366 customc/customcentral.com.au-ssl_log 297 coscom/coscom.com.au-ssl_log 268 aaa/aaadownunder.com.au-ssl_log 244 cosgrovecreative/cosgrovecreative.com.au-ssl_log 211 candyfabcom/candyfab.com.au-ssl_log 209 alison/alisonarts.com.au-ssl_log 200 evolution/app.evolutionerp.com.au-ssl_log 165 madalice/madalice.com.au-ssl_log 158 olytis/tis.com.au-ssl_log 122 evolution/portal.evolutionerp.com.au-ssl_log 51 kurri/kurrimotorinn.com.au-ssl_log 1 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 497 91.148.245.81 337 81.171.72.135 205 81.171.72.93 197 203.54.180.238 165 40.115.94.245 139 81.171.74.60 134 149.88.19.85 122 4.205.62.107 97 20.48.160.90 90 150.228.151.47 85 91.148.244.131 58 158.23.184.117 47 182.239.240.254 37 180.181.236.49 33 103.104.164.114 --- top request paths across all vhosts (last 3 min) --- 99 GET /app/ajax.php 93 GET /api/getItem/LWFB2001KG 90 POST /functions.php 72 GET /api/getItem/LWPG2001KG 53 GET / 48 GET /index.php 45 GET /wp-admin/setup-config.php 45 GET /_vti_pvt/service.pwd 45 GET /storage/logs/laravel.log 44 HEAD / 44 GET /wp-config.php 44 GET /.env 44 GET /config.xml 43 GET /.ssh/id_rsa 43 GET /phpinfo.php 43 GET /.git/HEAD 43 GET /config.php 42 GET /user_secrets.yml 42 GET /.svn/wc.db 42 GET /.ssh/id_ed25519 --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 99 GET /app/ajax.php 90 POST /functions.php 43 GET /index.php 22 POST /clienteditsave.php 18 POST /app/ajax/selectFilterSingle.php 18 POST /app/ajax.php 15 POST /app/ajax/selectFilter.php 11 POST /jobeditsave.php 8 POST /plugins/csvexporter/plugin.php 6 GET / 5 POST /purchaseaddsave.php 5 POST /mfreqsave.php -- last 10 requests -- 150.228.151.47 - - [02/Sep/2026:07:08:15 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=4462" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 150.228.151.47 - - [02/Sep/2026:07:08:15 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=inveditman&id=4462&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 150.228.151.47 - - [02/Sep/2026:07:08:16 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinveditman%26id%3D4462%26string%3D&call=getUserSetting&caller=ajaxSubmitLocal&seq=15506389748 HTTP/1.1" 200 108 "https://my.evol 150.228.151.47 - - [02/Sep/2026:07:08:17 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=inveditman&id=4462&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 203.54.180.238 - - [02/Sep/2026:07:08:22 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 233 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 203.54.180.238 - - [02/Sep/2026:07:08:22 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29330&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 103.104.164.114 - - [02/Sep/2026:07:08:24 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 203.54.180.238 - - [02/Sep/2026:07:08:25 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:07:08:25 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 203.54.180.238 - - [02/Sep/2026:07:08:25 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 238 "https://my.evolutionerp.com.au/index.php?page=purchasereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 == customc/customcentral.com.au-ssl_log == -- top paths -- 8 HEAD / 8 GET /wp-config.php 8 GET /_vti_pvt/service.pwd 8 GET /storage/logs/laravel.log 8 GET / 7 GET /wp-admin/setup-config.php 7 GET /.svn/wc.db 7 GET /.ssh/id_rsa 7 GET /.ssh/id_ed25519 7 GET /phpinfo.php 7 GET /.env 7 GET /dump.sql -- last 10 requests -- 91.148.245.81 - - [02/Sep/2026:07:08:24 +1000] "GET /storage/logs/laravel.log HTTP/1.1" 200 910 "-" "Go-http-client/1.1" 91.148.244.131 - - [02/Sep/2026:07:08:22 +1000] "GET /server.key HTTP/1.1" 404 73280 "-" "Go-http-client/1.1" 91.148.244.131 - - [02/Sep/2026:07:08:24 +1000] "GET /.ssh/id_ed25519 HTTP/1.1" 403 13 "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:08:24 +1000] "GET /.git/HEAD HTTP/1.1" 403 13 "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:08:24 +1000] "GET /storage/logs/zzcanary-2bc6f76e5b5331e1 HTTP/1.1" 200 910 "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:08:24 +1000] "GET /.env HTTP/1.1" 403 12 "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:08:25 +1000] "GET /api/.env HTTP/1.1" 403 12 "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:08:25 +1000] "GET /phpinfo.php HTTP/1.1" 403 12 "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:08:25 +1000] "GET /docker-compose.yml HTTP/1.1" 200 910 "-" "Go-http-client/1.1" 91.148.244.131 - - [02/Sep/2026:07:08:25 +1000] "GET /phpinfo.php HTTP/1.1" 403 12 "-" "Go-http-client/1.1" == coscom/coscom.com.au-ssl_log == -- top paths -- 9 GET / 8 HEAD / 8 GET /wp-admin/setup-config.php 8 GET /_vti_pvt/service.pwd 8 GET /user_secrets.yml 8 GET /storage/logs/laravel.log 8 GET /config.xml 7 GET /wp-config.php 7 GET /server.key 7 GET /phpinfo.php 7 GET /.npmrc 7 GET /.git/HEAD -- last 10 requests -- 81.171.72.135 - - [02/Sep/2026:07:07:53 +1000] "GET /.bash_history HTTP/1.1" 403 13 "-" "Go-http-client/1.1" 81.171.72.93 - - [02/Sep/2026:07:07:53 +1000] "GET /docker-compose.yml HTTP/1.1" 200 868 "-" "Go-http-client/1.1" 81.171.72.93 - - [02/Sep/2026:07:07:53 +1000] "GET /user_secrets.yml HTTP/1.1" 200 868 "-" "Go-http-client/1.1" 81.171.72.93 - - [02/Sep/2026:07:07:53 +1000] "GET /zzcanary-14b36168f5441a9f.xml HTTP/1.1" 200 868 "-" "Go-http-client/1.1" 81.171.72.93 - - [02/Sep/2026:07:07:53 +1000] "GET /zzcanary-e51acaa46074493.yml HTTP/1.1" 200 868 "-" "Go-http-client/1.1" 81.171.72.93 - - [02/Sep/2026:07:07:53 +1000] "GET /.env.production HTTP/1.1" 403 12 "-" "Go-http-client/1.1" 81.171.72.93 - - [02/Sep/2026:07:07:53 +1000] "GET /server.key HTTP/1.1" 200 868 "-" "Go-http-client/1.1" 81.171.72.93 - - [02/Sep/2026:07:07:54 +1000] "GET /.npmrc HTTP/1.1" 403 13 "-" "Go-http-client/1.1" 81.171.72.93 - - [02/Sep/2026:07:07:54 +1000] "GET /.bash_history HTTP/1.1" 403 13 "-" "Go-http-client/1.1" 81.171.72.93 - - [02/Sep/2026:07:07:54 +1000] "GET /zzcanary-44735ea25f1bacec HTTP/1.1" 200 868 "-" "Go-http-client/1.1" --- last 30 samples (run-up to this incident) --- 2026-09-02 07:06:11 L1=1.32 run=1 blk=0 avail=6522 (47.3%) swpO=0 conn=1 myRSS=3322 php=12 phpRSS=1461 ap=25 tcp=36 topuser=madalice 2026-09-02 07:06:11 L1=1.32 run=2 blk=0 avail=6521 (47.3%) swpO=0 conn=1 myRSS=3322 php=12 phpRSS=1461 ap=25 tcp=36 topuser=madalice 2026-09-02 07:06:21 L1=1.27 run=2 blk=0 avail=6781 (49.2%) swpO=0 conn=1 myRSS=3323 php=12 phpRSS=1211 ap=25 tcp=32 topuser=madalice 2026-09-02 07:06:21 L1=1.27 run=3 blk=0 avail=6766 (49.1%) swpO=0 conn=1 myRSS=3323 php=12 phpRSS=1221 ap=25 tcp=32 topuser=madalice 2026-09-02 07:06:31 L1=1.30 run=3 blk=0 avail=6599 (47.9%) swpO=0 conn=1 myRSS=3323 php=13 phpRSS=1331 ap=35 tcp=35 topuser=madalice 2026-09-02 07:06:31 L1=1.30 run=5 blk=0 avail=6600 (47.9%) swpO=0 conn=1 myRSS=3323 php=14 phpRSS=1356 ap=35 tcp=35 topuser=madalice 2026-09-02 07:06:41 L1=1.18 run=1 blk=0 avail=6552 (47.6%) swpO=0 conn=2 myRSS=3323 php=13 phpRSS=1392 ap=32 tcp=43 topuser=madalice 2026-09-02 07:06:41 L1=1.18 run=1 blk=0 avail=6551 (47.6%) swpO=0 conn=1 myRSS=3323 php=13 phpRSS=1392 ap=32 tcp=42 topuser=madalice 2026-09-02 07:06:51 L1=1.22 run=3 blk=0 avail=6390 (46.4%) swpO=0 conn=2 myRSS=3323 php=12 phpRSS=1299 ap=66 tcp=59 topuser=madalice 2026-09-02 07:06:51 L1=1.22 run=1 blk=0 avail=6388 (46.4%) swpO=0 conn=1 myRSS=3323 php=12 phpRSS=1299 ap=66 tcp=59 topuser=madalice 2026-09-02 07:07:01 L1=1.19 run=3 blk=0 avail=6543 (47.5%) swpO=1 conn=2 myRSS=3322 php=14 phpRSS=1284 ap=56 tcp=44 topuser=madalice 2026-09-02 07:07:01 L1=1.19 run=6 blk=0 avail=6526 (47.4%) swpO=1 conn=1 myRSS=3322 php=13 phpRSS=1251 ap=56 tcp=44 topuser=madalice 2026-09-02 07:07:11 L1=1.40 run=3 blk=0 avail=6335 (46.0%) swpO=1 conn=2 myRSS=3322 php=14 phpRSS=1485 ap=49 tcp=60 topuser=madalice 2026-09-02 07:07:11 L1=1.40 run=5 blk=0 avail=6317 (45.9%) swpO=1 conn=4 myRSS=3322 php=14 phpRSS=1491 ap=49 tcp=61 topuser=madalice 2026-09-02 07:07:21 L1=1.18 run=2 blk=0 avail=6614 (48.0%) swpO=0 conn=2 myRSS=3322 php=13 phpRSS=1277 ap=42 tcp=30 topuser=madalice 2026-09-02 07:07:21 L1=1.18 run=2 blk=0 avail=6610 (48.0%) swpO=0 conn=4 myRSS=3322 php=13 phpRSS=1281 ap=42 tcp=30 topuser=madalice 2026-09-02 07:07:31 L1=1.76 run=5 blk=0 avail=6443 (46.8%) swpO=0 conn=3 myRSS=3323 php=15 phpRSS=1516 ap=41 tcp=43 topuser=madalice 2026-09-02 07:07:31 L1=1.76 run=9 blk=0 avail=6433 (46.7%) swpO=0 conn=4 myRSS=3323 php=15 phpRSS=1530 ap=40 tcp=45 topuser=madalice 2026-09-02 07:07:41 L1=1.80 run=2 blk=0 avail=6772 (49.2%) swpO=0 conn=4 myRSS=3323 php=13 phpRSS=1110 ap=44 tcp=37 topuser=madalice 2026-09-02 07:07:42 L1=1.80 run=5 blk=0 avail=6714 (48.7%) swpO=0 conn=2 myRSS=3323 php=14 phpRSS=1214 ap=44 tcp=33 topuser=madalice 2026-09-02 07:07:51 L1=1.68 run=4 blk=0 avail=6660 (48.3%) swpO=0 conn=4 myRSS=3323 php=15 phpRSS=1275 ap=46 tcp=45 topuser=madalice 2026-09-02 07:07:52 L1=1.68 run=5 blk=0 avail=6830 (49.6%) swpO=0 conn=2 myRSS=3323 php=14 phpRSS=1079 ap=46 tcp=52 topuser=madalice 2026-09-02 07:08:01 L1=1.79 run=2 blk=0 avail=6464 (46.9%) swpO=0 conn=4 myRSS=3323 php=12 phpRSS=1446 ap=36 tcp=29 topuser=madalice 2026-09-02 07:08:02 L1=1.79 run=1 blk=0 avail=6515 (47.3%) swpO=0 conn=2 myRSS=3323 php=12 phpRSS=1399 ap=36 tcp=29 topuser=madalice 2026-09-02 07:08:12 L1=1.75 run=2 blk=0 avail=6617 (48.0%) swpO=0 conn=2 myRSS=3323 php=12 phpRSS=1313 ap=36 tcp=29 topuser=madalice 2026-09-02 07:08:12 L1=1.75 run=1 blk=0 avail=6702 (48.6%) swpO=0 conn=2 myRSS=3323 php=12 phpRSS=1224 ap=36 tcp=31 topuser=madalice 2026-09-02 07:08:22 L1=1.70 run=5 blk=0 avail=6745 (49.0%) swpO=0 conn=2 myRSS=3323 php=13 phpRSS=1231 ap=31 tcp=34 topuser=madalice 2026-09-02 07:08:22 L1=1.70 run=2 blk=0 avail=6826 (49.5%) swpO=0 conn=2 myRSS=3323 php=13 phpRSS=1155 ap=31 tcp=36 topuser=madalice 2026-09-02 07:08:32 L1=2.00 run=8 blk=0 avail=6442 (46.8%) swpO=0 conn=9 myRSS=3323 php=19 phpRSS=1618 ap=34 tcp=46 topuser=madalice 2026-09-02 07:08:32 L1=2.00 run=10 blk=0 avail=5994 (43.5%) swpO=0 conn=7 myRSS=3323 php=18 phpRSS=2143 ap=34 tcp=36 topuser=madalice