INCIDENT 2026-09-02 14:30:46 trigger: php_rss=1606MB ================================================================== load: 1.97 3.24 6.98 5/626 3310395 ncpu:10 mem_avail: 8864MB/13777MB (64.3%) swap_used:1396MB swapout:0/s blocked(D):0 running:4 iowait:0.2% steal:0.0% php: 16 procs / 1606MB heaviest user: madalice (9 procs, 1417MB) apache: 36 procs tcp_estab: 42 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1691 madalice 9 1417 nobody 35 566 root 249 415 netdata 7 178 evolution 11 126 cpanellogin 1 47 mailman 20 36 dovenull 6 19 zabbix 1 17 mailnull 2 16 wp-toolkit 3 14 candyfabcom 1 12 kamcool 1 11 dovecot 3 9 kurri 1 4 polkitd 1 3 dbus 1 3 cpanelconnecttrack 1 3 nscd 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 9 1417 evolution 4 121 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5064 MB Active(file): 3945 MB Inactive(file): 1445 MB Dirty: 3 MB Writeback: 0 MB SReclaimable: 268 MB CommitLimit: 10984 MB Committed_AS: 8453 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3295721 root 00:44 3344 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : 3926885 root 1-12:08:17 4596 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 1732936 36.4 Ssl 16:32 /usr/sbin/mariadbd 3272326 3929444 madalice 164912 15.3 S 10:06 php-fpm: pool madalice_com_au 3292380 3929444 madalice 163384 7.9 S 03:28 php-fpm: pool madalice_com_au 3292368 3929444 madalice 162696 8.6 S 03:29 php-fpm: pool madalice_com_au 508924 1 netdata 162516 2.0 Ssl 5-12:11:06 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3292379 3929444 madalice 162148 7.8 S 03:28 php-fpm: pool madalice_com_au 3292363 3929444 madalice 161220 7.9 S 03:29 php-fpm: pool madalice_com_au 3273285 3929444 madalice 159920 15.9 S 09:01 php-fpm: pool madalice_com_au 3274009 3929444 madalice 159628 14.4 S 07:57 php-fpm: pool madalice_com_au 3292374 3929444 madalice 159128 7.9 S 03:28 php-fpm: pool madalice_com_au 3292362 3929444 madalice 158632 8.4 S 03:29 php-fpm: pool madalice_com_au 706071 655564 root 149620 0.0 S 11:52:47 spamd child 3239542 1353308 cpanellogin 48744 0.0 S 16:18 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 3310361 3294306 evolution 48440 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2900038 655564 root 43520 0.0 S 01:48:43 spamd child 1353308 1 root 42032 0.1 Ss 42-11:49:29 cpsrvd (SSL) - waiting for connections 3310362 3295700 evolution 41672 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509236 509098 root 27056 0.0 Sl 5-12:11:03 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3274753 506832 nobody 21196 0.0 S 07:06 /usr/sbin/httpd -k start 3291566 506832 nobody 20472 0.0 S 04:21 /usr/sbin/httpd -k start 3292367 506832 nobody 20136 0.0 S 03:29 /usr/sbin/httpd -k start 3286055 506832 nobody 20004 0.1 S 05:36 /usr/sbin/httpd -k start 3292428 506832 nobody 19960 0.0 S 03:26 /usr/sbin/httpd -k start 3294306 506832 nobody 19932 0.1 S 01:53 /usr/sbin/httpd -k start 3295465 506832 nobody 19452 0.2 S 01:02 /usr/sbin/httpd -k start 3294317 506832 nobody 19352 0.0 S 01:52 /usr/sbin/httpd -k start 3295445 506832 nobody 18896 0.1 S 01:04 /usr/sbin/httpd -k start 3290554 506832 nobody 18836 0.0 S 05:25 /usr/sbin/httpd -k start 3294289 506832 nobody 18772 0.0 S 01:54 /usr/sbin/httpd -k start 3294312 506832 nobody 18616 0.1 S 01:53 /usr/sbin/httpd -k start 3295450 506832 nobody 18612 0.0 S 01:03 /usr/sbin/httpd -k start 3295463 506832 nobody 18092 0.1 S 01:02 /usr/sbin/httpd -k start 3294244 506832 nobody 18020 0.0 S 01:56 /usr/sbin/httpd -k start 3302488 506832 nobody 18004 0.0 S 00:38 /usr/sbin/httpd -k start 509671 508992 netdata 18000 2.1 Sl 5-12:11:01 /usr/libexec/netdata/plugins.d/apps.plugin 1 3294316 506832 nobody 17796 0.1 S 01:53 /usr/sbin/httpd -k start 3306865 506832 nobody 17792 0.1 S 00:35 /usr/sbin/httpd -k start 3295464 506832 nobody 17716 0.0 S 01:02 /usr/sbin/httpd -k start 3294319 506832 nobody 17556 0.0 S 01:52 /usr/sbin/httpd -k start 483898 1 zabbix 17436 0.2 Ssl 5-12:12:20 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3295466 506832 nobody 16792 0.0 S 01:02 /usr/sbin/httpd -k start 3305398 506832 nobody 15756 0.0 S 00:36 /usr/sbin/httpd -k start 3295451 506832 nobody 15500 0.0 S 01:03 /usr/sbin/httpd -k start 3295700 506832 nobody 15436 0.0 S 00:45 /usr/sbin/httpd -k start 3310317 506832 nobody 15432 0.2 S 00:04 /usr/sbin/httpd -k start 3308370 506832 nobody 15404 0.0 S 00:34 /usr/sbin/httpd -k start 3310316 506832 nobody 15404 0.2 S 00:04 /usr/sbin/httpd -k start 3308366 506832 nobody 15364 0.0 S 00:34 /usr/sbin/httpd -k start 3310332 506832 nobody 15232 0.3 S 00:03 /usr/sbin/httpd -k start 3310331 506832 nobody 15060 0.0 S 00:03 /usr/sbin/httpd -k start 3310334 506832 nobody 14996 0.0 S 00:03 /usr/sbin/httpd -k start 3297127 508720 mailnull 14360 0.0 S 00:42 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3310308 506832 nobody 13212 0.0 S 00:05 /usr/sbin/httpd -k start 3310333 506832 nobody 13212 0.0 S 00:03 /usr/sbin/httpd -k start 3310296 508511 candyfabcom 12392 0.0 S 00:07 dovecot/imap 3310287 508511 kamcool 11496 0.0 S 00:08 dovecot/quota-status -p postfix 1463 1 root 11224 0.0 Ss 65-04:20:58 tailwatchd 509266 1 root 11128 0.0 Ss 5-12:11:03 /usr/lib/systemd/systemd-journald 654163 1 root 10924 0.0 Ss 12:08:20 queueprocd - waiting up to 60s to process a task 654927 1 root 10872 0.0 Ss 12:07:54 lfd - sleeping --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 116409 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 800 alison/testing.alisonarts.com.au-ssl_log 222 alison/testing.alisonarts.com.au 216 bigdeals/bigdeals.com.au-ssl_log 191 evolution/portal.evolutionerp.com.au-ssl_log 139 evolution/app.evolutionerp.com.au-ssl_log 127 madalice/madalice.com.au-ssl_log 90 madalice/madalice.com.au 52 aaa/aaadownunder.com.au-ssl_log 11 infinium/infinium.net.au-ssl_log 4 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 629 4.205.62.107 436 203.54.180.238 349 103.104.165.99 127 40.115.94.245 116 20.48.251.3 35 182.239.240.254 35 101.182.108.127 22 103.104.164.114 18 120.154.88.130 17 1.144.107.82 14 2001:8004:14b3:854f:95d1:bdfe:1050:32b5 12 150.228.151.47 6 101.166.96.210 4 118.127.40.55 3 40.77.167.67 --- top request paths across all vhosts (last 3 min) --- 250 POST /functions.php 141 GET /app/ajax.php 91 GET /index.php 75 POST /plugins/csvexporter/plugin.php 65 GET /api/getItem/LWFBW2001KG 62 GET /api/getItem/LWHG2001KG 60 GET /factory_session_checker.php 36 POST /app/ajax/selectFilterSingle.php 31 GET /factory_session_processed_qty.php 31 GET /factory_session_joiner.php 29 POST /clienteditsave.php 25 GET //app/ajax.php 18 POST //functions.php 17 POST /quoteditsave.php 16 POST /wp-admin/admin-ajax.php 16 POST /inveditsave.php 15 POST /app/ajax.php 15 GET /heartbeat.php 10 POST /jobeditsave.php 10 POST /app/ajax/selectFilter.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 250 POST /functions.php 141 GET /app/ajax.php 89 GET /index.php 75 POST /plugins/csvexporter/plugin.php 36 POST /app/ajax/selectFilterSingle.php 29 POST /clienteditsave.php 25 GET //app/ajax.php 18 POST //functions.php 17 POST /quoteditsave.php 16 POST /inveditsave.php 15 POST /app/ajax.php 10 POST /jobeditsave.php -- last 10 requests -- 103.104.165.99 - - [02/Sep/2026:14:30:43 +1000] "GET /index.php?page=clientedit&clientid=6433&tab=clienteditgeneral HTTP/1.1" 200 54684 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=6433&tab=cliented 103.104.165.99 - - [02/Sep/2026:14:30:44 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=6433&tab=clienteditgeneral" "Mozilla/5.0 (Windows 103.104.165.99 - - [02/Sep/2026:14:30:44 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dclientedit%26clientid%3D6433%26tab%3Dclienteditgeneral&call=getUserSetting&caller=ajaxSubmitLocal&seq=11798326241 HTTP/1.1" 200 203.54.180.238 - - [02/Sep/2026:14:30:44 +1000] "POST //functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=29550&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64 101.166.96.210 - - [02/Sep/2026:14:30:44 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37051§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 103.104.165.99 - - [02/Sep/2026:14:30:45 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=clienthistory&clientid=743" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 103.104.165.99 - - [02/Sep/2026:14:30:45 +1000] "GET /index.php?page=jobregister HTTP/1.1" 200 16686 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11856" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 103.104.165.99 - - [02/Sep/2026:14:30:45 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11856" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 103.104.165.99 - - [02/Sep/2026:14:30:45 +1000] "HEAD /index.php?page=jobregister HTTP/1.1" 200 - "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 40.77.167.159 - - [02/Sep/2026:14:30:46 +1000] "GET /index.php?page=pickingedit&pickingid=97 HTTP/1.1" 200 5365 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbo == alison/testing.alisonarts.com.au-ssl_log == -- top paths -- 2 GET /thui.php 2 GET /ms-edit.php 2 GET /koiy.php 2 GET /doc.php 1 GET /zz.php 1 GET /zaza.php 1 GET /xza.php 1 GET /xve22.php 1 GET /xqq.php 1 GET /xp.php 1 GET /xmy.php 1 GET /xin1.php -- last 10 requests -- 4.205.62.107 - - [02/Sep/2026:14:29:56 +1000] "GET /public/mah.php.php HTTP/1.1" 404 - "-" "-" 4.205.62.107 - - [02/Sep/2026:14:29:57 +1000] "GET /kedi.php HTTP/1.1" 404 - "-" "-" 4.205.62.107 - - [02/Sep/2026:14:29:57 +1000] "GET /u88.php HTTP/1.1" 404 - "-" "-" 4.205.62.107 - - [02/Sep/2026:14:29:57 +1000] "GET /rum.or.php HTTP/1.1" 404 - "-" "-" 4.205.62.107 - - [02/Sep/2026:14:29:58 +1000] "GET /phpsysinfo.php HTTP/1.1" 404 - "-" "-" 4.205.62.107 - - [02/Sep/2026:14:29:58 +1000] "GET /wdf.php HTTP/1.1" 404 - "-" "-" 4.205.62.107 - - [02/Sep/2026:14:29:59 +1000] "GET /maxro.php HTTP/1.1" 404 - "-" "-" 4.205.62.107 - - [02/Sep/2026:14:29:59 +1000] "GET /loxi-o.php HTTP/1.1" 404 - "-" "-" 4.205.62.107 - - [02/Sep/2026:14:30:00 +1000] "GET /rpk.php HTTP/1.1" 404 - "-" "-" 4.205.62.107 - - [02/Sep/2026:14:30:00 +1000] "GET /sgd.php HTTP/1.1" 404 - "-" "-" == alison/testing.alisonarts.com.au == -- top paths -- 2 GET /ms-edit.php 2 GET /doc.php 1 GET /zz.php 1 GET /zaza.php 1 GET //xza.php 1 GET //xve22.php 1 GET /xqq.php 1 GET /xp.php 1 GET /xmy.php 1 GET /xin1.php 1 GET /xda.php 1 GET /xa.php -- last 10 requests -- 4.205.62.107 - - [02/Sep/2026:14:29:53 +1000] "GET /app_dev.php HTTP/1.1" 301 297 "-" "-" 4.205.62.107 - - [02/Sep/2026:14:29:54 +1000] "GET /plss3.php HTTP/1.1" 301 295 "-" "-" 4.205.62.107 - - [02/Sep/2026:14:29:54 +1000] "GET /gecko-litespeed.php HTTP/1.1" 301 305 "-" "-" 4.205.62.107 - - [02/Sep/2026:14:29:55 +1000] "GET /env.php HTTP/1.1" 301 293 "-" "-" 4.205.62.107 - - [02/Sep/2026:14:29:55 +1000] "GET /8.php HTTP/1.1" 301 291 "-" "-" 4.205.62.107 - - [02/Sep/2026:14:29:56 +1000] "GET //thui.php HTTP/1.1" 301 294 "-" "-" 4.205.62.107 - - [02/Sep/2026:14:29:56 +1000] "GET /public/mah.php.php HTTP/1.1" 301 304 "-" "-" 4.205.62.107 - - [02/Sep/2026:14:29:56 +1000] "GET /kedi.php HTTP/1.1" 301 294 "-" "-" 4.205.62.107 - - [02/Sep/2026:14:29:57 +1000] "GET //u88.php HTTP/1.1" 301 293 "-" "-" 4.205.62.107 - - [02/Sep/2026:14:29:57 +1000] "GET /rum.or.php HTTP/1.1" 301 296 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-09-02 14:28:15 L1=2.25 run=2 blk=0 avail=8703 (63.2%) swpO=0 conn=3 myRSS=1654 php=12 phpRSS=1508 ap=52 tcp=62 topuser=madalice 2026-09-02 14:28:25 L1=1.98 run=3 blk=0 avail=8828 (64.1%) swpO=0 conn=5 myRSS=1660 php=12 phpRSS=1456 ap=43 tcp=52 topuser=madalice 2026-09-02 14:28:25 L1=1.98 run=3 blk=0 avail=8777 (63.7%) swpO=0 conn=3 myRSS=1660 php=13 phpRSS=1538 ap=43 tcp=53 topuser=madalice 2026-09-02 14:28:35 L1=1.67 run=3 blk=0 avail=8863 (64.3%) swpO=0 conn=5 myRSS=1661 php=12 phpRSS=1495 ap=35 tcp=51 topuser=madalice 2026-09-02 14:28:35 L1=1.67 run=3 blk=0 avail=8769 (63.7%) swpO=0 conn=3 myRSS=1661 php=13 phpRSS=1613 ap=35 tcp=52 topuser=madalice 2026-09-02 14:28:45 L1=1.80 run=2 blk=0 avail=8886 (64.5%) swpO=0 conn=5 myRSS=1661 php=13 phpRSS=1485 ap=38 tcp=43 topuser=madalice 2026-09-02 14:28:45 L1=1.80 run=1 blk=0 avail=8892 (64.5%) swpO=0 conn=3 myRSS=1661 php=12 phpRSS=1455 ap=38 tcp=43 topuser=madalice 2026-09-02 14:28:55 L1=2.08 run=1 blk=0 avail=8738 (63.4%) swpO=0 conn=2 myRSS=1662 php=12 phpRSS=1453 ap=65 tcp=65 topuser=madalice 2026-09-02 14:28:55 L1=2.08 run=2 blk=0 avail=8734 (63.4%) swpO=0 conn=2 myRSS=1662 php=13 phpRSS=1490 ap=65 tcp=65 topuser=madalice 2026-09-02 14:29:05 L1=2.29 run=3 blk=0 avail=8804 (63.9%) swpO=0 conn=2 myRSS=1665 php=12 phpRSS=1457 ap=55 tcp=62 topuser=madalice 2026-09-02 14:29:06 L1=2.29 run=2 blk=0 avail=8794 (63.8%) swpO=0 conn=2 myRSS=1665 php=12 phpRSS=1464 ap=55 tcp=62 topuser=madalice 2026-09-02 14:29:15 L1=2.65 run=1 blk=0 avail=8831 (64.1%) swpO=0 conn=2 myRSS=1681 php=12 phpRSS=1456 ap=48 tcp=62 topuser=madalice 2026-09-02 14:29:16 L1=2.65 run=2 blk=0 avail=8831 (64.1%) swpO=0 conn=2 myRSS=1681 php=12 phpRSS=1456 ap=48 tcp=62 topuser=madalice 2026-09-02 14:29:25 L1=2.70 run=3 blk=0 avail=8884 (64.5%) swpO=0 conn=2 myRSS=1682 php=12 phpRSS=1456 ap=43 tcp=52 topuser=madalice 2026-09-02 14:29:26 L1=2.70 run=3 blk=0 avail=8841 (64.2%) swpO=0 conn=3 myRSS=1682 php=12 phpRSS=1500 ap=43 tcp=53 topuser=madalice 2026-09-02 14:29:35 L1=2.52 run=2 blk=0 avail=8927 (64.8%) swpO=0 conn=2 myRSS=1683 php=12 phpRSS=1483 ap=35 tcp=44 topuser=madalice 2026-09-02 14:29:36 L1=2.52 run=1 blk=0 avail=8963 (65.1%) swpO=0 conn=3 myRSS=1683 php=11 phpRSS=1416 ap=34 tcp=45 topuser=madalice 2026-09-02 14:29:45 L1=2.21 run=1 blk=0 avail=8909 (64.7%) swpO=0 conn=2 myRSS=1683 php=12 phpRSS=1454 ap=41 tcp=52 topuser=madalice 2026-09-02 14:29:46 L1=2.21 run=2 blk=0 avail=8919 (64.7%) swpO=0 conn=3 myRSS=1683 php=11 phpRSS=1416 ap=41 tcp=48 topuser=madalice 2026-09-02 14:29:55 L1=2.34 run=5 blk=0 avail=8769 (63.6%) swpO=0 conn=6 myRSS=1684 php=15 phpRSS=1716 ap=37 tcp=41 topuser=madalice 2026-09-02 14:29:56 L1=2.34 run=4 blk=0 avail=8875 (64.4%) swpO=0 conn=2 myRSS=1684 php=15 phpRSS=1606 ap=37 tcp=44 topuser=madalice 2026-09-02 14:30:05 L1=2.13 run=5 blk=0 avail=8709 (63.2%) swpO=0 conn=5 myRSS=1687 php=16 phpRSS=1762 ap=40 tcp=54 topuser=madalice 2026-09-02 14:30:06 L1=2.13 run=2 blk=0 avail=8875 (64.4%) swpO=0 conn=2 myRSS=1687 php=12 phpRSS=1483 ap=40 tcp=54 topuser=madalice 2026-09-02 14:30:15 L1=2.26 run=1 blk=0 avail=8804 (63.9%) swpO=0 conn=3 myRSS=1688 php=14 phpRSS=1543 ap=48 tcp=61 topuser=madalice 2026-09-02 14:30:16 L1=2.26 run=2 blk=0 avail=8782 (63.7%) swpO=0 conn=3 myRSS=1689 php=13 phpRSS=1550 ap=48 tcp=60 topuser=madalice 2026-09-02 14:30:26 L1=2.07 run=1 blk=0 avail=8894 (64.6%) swpO=0 conn=3 myRSS=1690 php=12 phpRSS=1452 ap=42 tcp=45 topuser=madalice 2026-09-02 14:30:26 L1=2.07 run=1 blk=0 avail=8914 (64.7%) swpO=0 conn=3 myRSS=1690 php=11 phpRSS=1413 ap=41 tcp=46 topuser=madalice 2026-09-02 14:30:36 L1=2.06 run=2 blk=0 avail=8973 (65.1%) swpO=0 conn=3 myRSS=1691 php=12 phpRSS=1456 ap=32 tcp=35 topuser=madalice 2026-09-02 14:30:36 L1=2.06 run=1 blk=0 avail=8991 (65.3%) swpO=0 conn=3 myRSS=1691 php=11 phpRSS=1416 ap=31 tcp=34 topuser=madalice 2026-09-02 14:30:46 L1=1.97 run=4 blk=0 avail=8864 (64.3%) swpO=0 conn=3 myRSS=1691 php=16 phpRSS=1606 ap=36 tcp=42 topuser=madalice