INCIDENT 2026-09-02 14:51:03 trigger: php_rss=1734MB ================================================================== load: 2.22 2.06 3.20 6/618 3385133 ncpu:10 mem_avail: 8524MB/13777MB (61.9%) swap_used:1375MB swapout:0/s blocked(D):0 running:2 iowait:0.3% steal:0.0% php: 14 procs / 1734MB heaviest user: madalice (10 procs, 1684MB) apache: 39 procs tcp_estab: 39 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1893 madalice 10 1686 nobody 38 671 root 243 407 netdata 7 196 evolution 11 116 cpanellogin 1 47 mailman 20 36 aaa 2 23 dovenull 6 19 zabbix 1 18 wp-toolkit 3 18 dovecot 3 9 kurri 1 4 polkitd 1 3 nscd 1 3 dbus 1 3 cpanelconnecttrack 1 3 named 1 2 mailnull 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 10 1687 evolution 4 122 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5661 MB Active(file): 4139 MB Inactive(file): 1888 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 282 MB CommitLimit: 10984 MB Committed_AS: 8948 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 1-12:28:35 4596 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 1939440 36.7 Ssl 36:50 /usr/sbin/mariadbd 3292380 3929444 madalice 257216 10.6 R 23:46 php-fpm: pool madalice_com_au 508924 1 netdata 180396 2.0 Ssl 5-12:31:24 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3369924 3929444 madalice 164200 11.8 S 01:10 php-fpm: pool madalice_com_au 3369926 3929444 madalice 164116 10.1 S 01:10 php-fpm: pool madalice_com_au 3369921 3929444 madalice 164088 10.0 S 01:10 php-fpm: pool madalice_com_au 3369272 3929444 madalice 163984 19.5 S 02:04 php-fpm: pool madalice_com_au 3369920 3929444 madalice 163936 10.4 S 01:10 php-fpm: pool madalice_com_au 3369922 3929444 madalice 163516 11.7 S 01:10 php-fpm: pool madalice_com_au 3369923 3929444 madalice 162980 11.3 S 01:10 php-fpm: pool madalice_com_au 3369925 3929444 madalice 162928 11.8 S 01:10 php-fpm: pool madalice_com_au 3367548 3929444 madalice 162852 20.2 S 04:24 php-fpm: pool madalice_com_au 706071 655564 root 152800 0.0 S 12:13:05 spamd child 3385119 3369251 evolution 73244 12.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3239542 1353308 cpanellogin 48948 0.0 S 36:36 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 2900038 655564 root 43520 0.0 S 02:09:01 spamd child 1353308 1 root 42036 0.1 Ss 42-12:09:47 cpsrvd (SSL) - waiting for connections 3385101 3367130 evolution 40368 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3385128 3369695 evolution 39444 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3385166 3368097 evolution 30920 0.0 S 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509236 509098 root 27080 0.0 Sl 5-12:31:21 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3367325 506832 nobody 22424 0.0 S 04:49 /usr/sbin/httpd -k start 3368444 506832 nobody 21924 0.0 S 03:04 /usr/sbin/httpd -k start 3350957 506832 nobody 21836 0.0 S 07:04 /usr/sbin/httpd -k start 3367130 506832 nobody 21572 0.0 S 05:05 /usr/sbin/httpd -k start 3368432 506832 nobody 21224 0.0 S 03:04 /usr/sbin/httpd -k start 3367451 506832 nobody 20888 0.0 S 04:36 /usr/sbin/httpd -k start 3368213 506832 nobody 20764 0.0 S 03:29 /usr/sbin/httpd -k start 3369244 506832 nobody 20644 0.0 S 02:10 /usr/sbin/httpd -k start 3368965 506832 nobody 20368 0.1 S 02:38 /usr/sbin/httpd -k start 3367440 506832 nobody 20028 0.0 S 04:37 /usr/sbin/httpd -k start 3369694 506832 nobody 20008 0.0 S 01:23 /usr/sbin/httpd -k start 3368097 506832 nobody 19824 0.1 S 03:37 /usr/sbin/httpd -k start 3369998 506832 nobody 19684 0.0 S 01:02 /usr/sbin/httpd -k start 3370013 506832 nobody 19584 0.1 S 01:02 /usr/sbin/httpd -k start 3369469 506832 nobody 19412 0.2 S 01:50 /usr/sbin/httpd -k start 3369251 506832 nobody 19336 0.0 S 02:09 /usr/sbin/httpd -k start 3369723 506832 nobody 19220 0.0 S 01:21 /usr/sbin/httpd -k start 3370003 506832 nobody 19220 0.1 S 01:02 /usr/sbin/httpd -k start 3369712 506832 nobody 19052 0.0 S 01:22 /usr/sbin/httpd -k start 483898 1 zabbix 18904 0.2 Ssl 5-12:32:38 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3369476 506832 nobody 18896 0.0 S 01:49 /usr/sbin/httpd -k start 3370008 506832 nobody 18640 0.0 S 01:02 /usr/sbin/httpd -k start 3369713 506832 nobody 18628 0.0 S 01:22 /usr/sbin/httpd -k start 3384708 506832 nobody 18600 0.0 S 00:21 /usr/sbin/httpd -k start 3369985 506832 nobody 18416 0.0 S 01:03 /usr/sbin/httpd -k start 3369986 506832 nobody 18360 0.0 S 01:03 /usr/sbin/httpd -k start 509671 508992 netdata 18068 2.1 Sl 5-12:31:19 /usr/libexec/netdata/plugins.d/apps.plugin 1 3369972 506832 nobody 17920 0.0 S 01:05 /usr/sbin/httpd -k start 3384791 506832 nobody 17836 0.0 S 00:14 /usr/sbin/httpd -k start 3369981 506832 nobody 17792 0.0 S 01:04 /usr/sbin/httpd -k start 3369973 506832 nobody 17680 0.0 S 01:05 /usr/sbin/httpd -k start 3369958 506832 nobody 17584 0.0 S 01:06 /usr/sbin/httpd -k start 3384893 506832 nobody 17520 0.1 S 00:08 /usr/sbin/httpd -k start 3369695 506832 nobody 17436 0.0 S 01:23 /usr/sbin/httpd -k start 3369980 506832 nobody 15636 0.0 S 01:04 /usr/sbin/httpd -k start 3384957 506832 nobody 15556 0.0 S 00:07 /usr/sbin/httpd -k start 3384956 506832 nobody 15160 0.0 S 00:07 /usr/sbin/httpd -k start 3385047 506832 nobody 15120 0.0 S 00:05 /usr/sbin/httpd -k start 509266 1 root 13076 0.0 Ss 5-12:31:21 /usr/lib/systemd/systemd-journald --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 303404 | root | 108-1481181613 | Execute | 0 | Sending data | SELECT mf_inv_meta.*, (SELECT cost from mfprocesses where id = mf_inv_meta.processid ) as unitcost FROM `mf_inv_meta` WHERE itemid = ? | | 303403 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 358 kurri/kurrimotorinn.com.au-ssl_log 257 madalice/madalice.com.au-ssl_log 92 evolution/app.evolutionerp.com.au-ssl_log 90 coscom/swms.coscom.com.au 89 evolution/portal.evolutionerp.com.au-ssl_log 84 vinesit/vinesit.com.au-ssl_log 8 aaa/aaadownunder.com.au-ssl_log 2 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 257 34.92.80.41 147 203.54.180.238 105 103.104.165.99 90 40.115.94.245 89 20.48.179.39 59 20.48.251.3 34 103.104.164.114 29 120.154.88.130 28 150.228.151.47 28 101.182.108.127 15 180.181.236.49 14 182.239.240.254 13 124.168.5.234 12 34.97.86.181 10 1.144.107.82 --- top request paths across all vhosts (last 3 min) --- 134 POST /functions.php 70 GET /app/ajax.php 29 GET /index.php 28 GET /factory_session_checker.php 25 GET /heartbeat.php 16 POST /plugins/csvexporter/plugin.php 14 GET /factory_session_processed_qty.php 14 GET /factory_session_joiner.php 12 POST /app/ajax.php 11 GET //app/ajax.php 10 POST /wp-admin/admin-ajax.php 10 POST /app/ajax/selectFilter.php 10 HEAD /index.php 9 POST /plugins/fencecosting/plugin.php 8 POST /clienteditsave.php 8 POST /app/ajax/selectFilterSingle.php 5 POST /quoteditsave.php 5 POST /purchaseaddsave.php 5 POST //functions.php 5 POST / --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 134 POST /functions.php 70 GET /app/ajax.php 28 GET /index.php 16 POST /plugins/csvexporter/plugin.php 12 POST /app/ajax.php 11 GET //app/ajax.php 10 POST /app/ajax/selectFilter.php 10 HEAD /index.php 9 POST /plugins/fencecosting/plugin.php 8 POST /clienteditsave.php 8 POST /app/ajax/selectFilterSingle.php 5 POST /quoteditsave.php -- last 10 requests -- 124.168.5.234 - - [02/Sep/2026:14:50:57 +1000] "POST /plugins/fencecosting/plugin.php HTTP/1.1" 200 3913 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36199" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) A 103.104.165.99 - - [02/Sep/2026:14:50:57 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 233 "https://my.evolutionerp.com.au/index.php?page=dispatchedit&dispatchid=16289" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 103.104.165.99 - - [02/Sep/2026:14:50:57 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Ch 124.168.5.234 - - [02/Sep/2026:14:50:57 +1000] "POST /plugins/fencecosting/plugin.php HTTP/1.1" 200 93 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36199" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) App 124.168.5.234 - - [02/Sep/2026:14:50:57 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=14169220050 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index. 124.168.5.234 - - [02/Sep/2026:14:50:57 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=16983756110 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/index 124.168.5.234 - - [02/Sep/2026:14:50:57 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dquotedit%26quoteid%3D36199&call=getUserSetting&caller=ajaxSubmitLocal&seq=15513265990 HTTP/1.1" 200 112 "https: 124.168.5.234 - - [02/Sep/2026:14:50:57 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotedit%26quoteid36199&call=getUserSetting&caller=ajaxSubmitLocal&seq=15911290634 HTTP/1.1" 200 100 "https://my.evolutionerp.com 124.168.5.234 - - [02/Sep/2026:14:50:58 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotedit%26quoteid%3D36199&call=getUserSetting&caller=ajaxSubmitLocal&seq=15387436991 HTTP/1.1" 200 163 "https://my.evolutionerp. 203.54.180.238 - - [02/Sep/2026:14:50:58 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 == kurri/kurrimotorinn.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env 1 GET /vue/.env -- last 10 requests -- 34.92.80.41 - - [02/Sep/2026:14:49:44 +1000] "GET /staging/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.80.41 - - [02/Sep/2026:14:49:44 +1000] "GET /beta/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.80.41 - - [02/Sep/2026:14:49:44 +1000] "GET /uat/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.80.41 - - [02/Sep/2026:14:49:45 +1000] "GET /qa/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.80.41 - - [02/Sep/2026:14:49:45 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.80.41 - - [02/Sep/2026:14:49:45 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.80.41 - - [02/Sep/2026:14:49:45 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.80.41 - - [02/Sep/2026:14:49:45 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.80.41 - - [02/Sep/2026:14:49:45 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.80.41 - - [02/Sep/2026:14:49:45 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 10 POST /wp-admin/admin-ajax.php 1 POST / 1 GET /zz.php 1 GET /zaza.php 1 GET /xza.php 1 GET //xza.php 1 GET /xqq.php 1 GET /xa.php 1 GET /www/.git/config 1 GET /wpver.php 1 GET /wp-tem.php 1 GET /wp-konfig.php -- last 10 requests -- 20.48.251.3 - - [02/Sep/2026:14:50:20 +1000] "GET /wp-tem.php HTTP/1.1" 404 36645 "-" "-" 66.249.68.66 - - [02/Sep/2026:14:50:21 +1000] "GET /media/mp4/e600afcd7d18bb39.mp4?view=player&v=30093520&rel=0 HTTP/1.1" 404 36665 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML 20.48.251.3 - - [02/Sep/2026:14:50:22 +1000] "GET /app/Models/Hrm/Employee.php HTTP/1.1" 404 36658 "-" "-" 20.48.251.3 - - [02/Sep/2026:14:50:24 +1000] "GET /zaza.php HTTP/1.1" 404 36644 "-" "-" 20.48.251.3 - - [02/Sep/2026:14:50:26 +1000] "GET /php_info.php HTTP/1.1" 403 12 "-" "-" 20.48.251.3 - - [02/Sep/2026:14:50:26 +1000] "GET /g3.php HTTP/1.1" 404 36643 "-" "-" 20.48.251.3 - - [02/Sep/2026:14:50:28 +1000] "GET /zz.php HTTP/1.1" 404 36643 "-" "-" 2001:8004:14b3:854f:95d1:bdfe:1050:32b5 - - [02/Sep/2026:14:50:28 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 77 "https://madalice.com.au/wp-admin/post.php?post=34699&action=edit" "Mozilla/5.0 (Windows NT 10.0; W 20.48.251.3 - - [02/Sep/2026:14:50:29 +1000] "GET /xa.php HTTP/1.1" 404 36641 "-" "-" 47.128.32.233 - - [02/Sep/2026:14:50:31 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/collab/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mob --- last 30 samples (run-up to this incident) --- 2026-09-02 14:48:32 L1=2.34 run=3 blk=0 avail=9429 (68.4%) swpO=0 conn=2 myRSS=1885 php=8 phpRSS=525 ap=56 tcp=43 topuser=madalice 2026-09-02 14:48:42 L1=2.51 run=3 blk=0 avail=9590 (69.6%) swpO=0 conn=2 myRSS=1885 php=4 phpRSS=326 ap=47 tcp=44 topuser=madalice 2026-09-02 14:48:42 L1=2.51 run=2 blk=0 avail=9596 (69.7%) swpO=0 conn=2 myRSS=1885 php=4 phpRSS=328 ap=46 tcp=40 topuser=madalice 2026-09-02 14:48:52 L1=2.36 run=4 blk=0 avail=9587 (69.6%) swpO=0 conn=2 myRSS=1885 php=6 phpRSS=399 ap=45 tcp=58 topuser=madalice 2026-09-02 14:48:52 L1=2.36 run=3 blk=0 avail=9561 (69.4%) swpO=0 conn=2 myRSS=1885 php=5 phpRSS=391 ap=45 tcp=58 topuser=madalice 2026-09-02 14:49:02 L1=2.31 run=3 blk=0 avail=9293 (67.5%) swpO=0 conn=3 myRSS=1886 php=6 phpRSS=681 ap=46 tcp=38 topuser=madalice 2026-09-02 14:49:02 L1=2.31 run=1 blk=0 avail=9372 (68.0%) swpO=0 conn=2 myRSS=1886 php=5 phpRSS=562 ap=46 tcp=38 topuser=madalice 2026-09-02 14:49:12 L1=2.35 run=4 blk=0 avail=9466 (68.7%) swpO=0 conn=3 myRSS=1886 php=7 phpRSS=584 ap=38 tcp=47 topuser=madalice 2026-09-02 14:49:12 L1=2.35 run=3 blk=0 avail=9441 (68.5%) swpO=0 conn=2 myRSS=1886 php=6 phpRSS=566 ap=38 tcp=50 topuser=madalice 2026-09-02 14:49:22 L1=2.21 run=1 blk=0 avail=9494 (68.9%) swpO=0 conn=3 myRSS=1886 php=5 phpRSS=481 ap=41 tcp=41 topuser=madalice 2026-09-02 14:49:22 L1=2.21 run=5 blk=0 avail=9492 (68.9%) swpO=0 conn=2 myRSS=1886 php=5 phpRSS=481 ap=41 tcp=41 topuser=madalice 2026-09-02 14:49:32 L1=2.09 run=4 blk=0 avail=9544 (69.3%) swpO=0 conn=3 myRSS=1886 php=6 phpRSS=523 ap=33 tcp=39 topuser=madalice 2026-09-02 14:49:32 L1=2.09 run=4 blk=0 avail=9547 (69.3%) swpO=0 conn=2 myRSS=1886 php=5 phpRSS=484 ap=33 tcp=39 topuser=madalice 2026-09-02 14:49:42 L1=2.08 run=5 blk=0 avail=9401 (68.2%) swpO=0 conn=3 myRSS=1887 php=6 phpRSS=553 ap=48 tcp=51 topuser=madalice 2026-09-02 14:49:42 L1=2.08 run=4 blk=0 avail=9383 (68.1%) swpO=0 conn=2 myRSS=1887 php=7 phpRSS=575 ap=48 tcp=52 topuser=madalice 2026-09-02 14:49:52 L1=1.99 run=2 blk=0 avail=9395 (68.2%) swpO=0 conn=3 myRSS=1887 php=5 phpRSS=555 ap=44 tcp=47 topuser=madalice 2026-09-02 14:49:52 L1=1.99 run=5 blk=0 avail=9354 (67.9%) swpO=0 conn=2 myRSS=1887 php=6 phpRSS=544 ap=44 tcp=47 topuser=madalice 2026-09-02 14:50:02 L1=2.87 run=2 blk=1 avail=8303 (60.3%) swpO=0 conn=2 myRSS=1889 php=12 phpRSS=1663 ap=73 tcp=60 topuser=madalice 2026-09-02 14:50:02 L1=2.87 run=9 blk=0 avail=8270 (60.0%) swpO=0 conn=3 myRSS=1889 php=13 phpRSS=1726 ap=73 tcp=57 topuser=madalice 2026-09-02 14:50:12 L1=2.82 run=2 blk=0 avail=8431 (61.2%) swpO=0 conn=2 myRSS=1891 php=12 phpRSS=1637 ap=63 tcp=55 topuser=madalice 2026-09-02 14:50:13 L1=2.82 run=1 blk=0 avail=8459 (61.4%) swpO=0 conn=2 myRSS=1891 php=13 phpRSS=1639 ap=62 tcp=55 topuser=madalice 2026-09-02 14:50:23 L1=2.70 run=3 blk=0 avail=8523 (61.9%) swpO=0 conn=3 myRSS=1891 php=13 phpRSS=1637 ap=53 tcp=48 topuser=madalice 2026-09-02 14:50:23 L1=2.70 run=2 blk=0 avail=8490 (61.6%) swpO=0 conn=3 myRSS=1891 php=13 phpRSS=1680 ap=52 tcp=46 topuser=madalice 2026-09-02 14:50:33 L1=2.44 run=1 blk=0 avail=8590 (62.3%) swpO=0 conn=2 myRSS=1891 php=13 phpRSS=1638 ap=43 tcp=49 topuser=madalice 2026-09-02 14:50:33 L1=2.44 run=2 blk=0 avail=8583 (62.3%) swpO=0 conn=3 myRSS=1891 php=13 phpRSS=1642 ap=42 tcp=49 topuser=madalice 2026-09-02 14:50:43 L1=2.30 run=5 blk=0 avail=8563 (62.2%) swpO=0 conn=3 myRSS=1891 php=14 phpRSS=1706 ap=37 tcp=45 topuser=madalice 2026-09-02 14:50:43 L1=2.30 run=1 blk=0 avail=8624 (62.6%) swpO=0 conn=2 myRSS=1892 php=13 phpRSS=1637 ap=37 tcp=46 topuser=madalice 2026-09-02 14:50:53 L1=2.26 run=2 blk=0 avail=8629 (62.6%) swpO=0 conn=3 myRSS=1893 php=13 phpRSS=1645 ap=35 tcp=42 topuser=madalice 2026-09-02 14:50:53 L1=2.26 run=5 blk=0 avail=8535 (62.0%) swpO=0 conn=4 myRSS=1893 php=14 phpRSS=1758 ap=35 tcp=43 topuser=madalice 2026-09-02 14:51:03 L1=2.22 run=2 blk=0 avail=8524 (61.9%) swpO=0 conn=3 myRSS=1893 php=14 phpRSS=1734 ap=39 tcp=39 topuser=madalice