INCIDENT 2026-09-03 21:07:08 trigger: php_rss=1513MB ================================================================== load: 1.84 1.04 0.79 1/699 1462822 ncpu:10 mem_avail: 6943MB/13777MB (50.4%) swap_used:1550MB swapout:0/s blocked(D):0 running:1 iowait:0.1% steal:0.0% php: 12 procs / 1513MB heaviest user: madalice (10 procs, 1483MB) apache: 36 procs tcp_estab: 27 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3053 madalice 10 1483 root 249 1092 nobody 35 588 netdata 8 250 wp-toolkit 3 67 cpanellogin 1 47 mailman 20 27 dovenull 6 27 alison 2 23 evolution 9 18 mailnull 3 16 candyfabcom 1 12 zabbix 1 11 polkitd 1 11 kurri 1 11 dovecot 3 8 named 1 5 nscd 1 4 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 10 1483 root 1 30 evolution 1 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5420 MB Active(file): 4944 MB Inactive(file): 722 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 470 MB CommitLimit: 10984 MB Committed_AS: 8464 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1429849 root 07:07 3040 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 2-18:44:40 4332 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3126860 14.8 Ssl 1-06:52:55 /usr/sbin/mariadbd 509266 1 root 198380 0.0 Ss 6-18:47:26 /usr/lib/systemd/systemd-journald 1542443 1 netdata 183708 2.5 Ssl 18:44:45 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1596048 1543747 root 174564 0.0 S 18:29:20 spamd child 4117331 1543747 root 173604 0.0 S 07:02:23 spamd child 1462349 1542510 madalice 163356 18.9 S 00:41 php-fpm: pool madalice_com_au 1462607 1542510 madalice 159260 21.5 S 00:18 php-fpm: pool madalice_com_au 1462598 1542510 madalice 158868 15.1 S 00:18 php-fpm: pool madalice_com_au 1462597 1542510 madalice 158364 21.7 S 00:18 php-fpm: pool madalice_com_au 1462596 1542510 madalice 158308 25.0 S 00:18 php-fpm: pool madalice_com_au 1462594 1542510 madalice 158172 22.6 S 00:18 php-fpm: pool madalice_com_au 1462573 1542510 madalice 154464 12.8 S 00:20 php-fpm: pool madalice_com_au 1462595 1542510 madalice 152440 20.9 S 00:18 php-fpm: pool madalice_com_au 1462729 1542510 madalice 128984 17.6 S 00:08 php-fpm: pool madalice_com_au 1462728 1542510 madalice 126400 18.5 S 00:08 php-fpm: pool madalice_com_au 1543747 1 root 119460 0.0 Ss 18:44:15 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1308809 1353308 cpanellogin 48408 0.0 S 43:38 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 509236 509098 root 45824 0.0 Sl 6-18:47:26 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42152 0.1 Ss 43-18:25:52 cpsrvd (SSL) - waiting for connections 1469 1 root 41932 0.1 Ss 66-10:57:21 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542981 1542551 netdata 41648 0.1 Sl 18:44:41 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1542487 1 wp-toolkit 37136 0.0 Ss 18:44:45 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1542072 1 root 32508 0.0 Ss 18:44:49 lfd - sleeping 1542510 1 root 31644 0.0 Ss 18:44:44 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1542531 1 wp-toolkit 25132 0.0 Ss 18:44:44 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1463 1 root 25080 0.0 Ss 66-10:57:21 tailwatchd 1444777 506832 nobody 23392 0.0 S 06:07 /usr/sbin/httpd -k start 1542141 1 root 22672 0.0 Ss 18:44:48 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 1542188 1 root 22264 0.1 Ssl 18:44:47 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1461853 506832 nobody 21732 0.0 S 01:21 /usr/sbin/httpd -k start 1446430 506832 nobody 21452 0.0 S 03:25 /usr/sbin/httpd -k start 1446851 506832 nobody 21416 0.0 S 02:40 /usr/sbin/httpd -k start 1461904 506832 nobody 21352 0.0 S 01:20 /usr/sbin/httpd -k start 1446058 506832 nobody 21288 0.0 S 04:05 /usr/sbin/httpd -k start 1446422 506832 nobody 21008 0.0 S 03:26 /usr/sbin/httpd -k start 1461848 506832 nobody 20588 0.0 S 01:22 /usr/sbin/httpd -k start 1461905 506832 nobody 19492 0.0 S 01:20 /usr/sbin/httpd -k start 1462605 506832 nobody 19272 0.2 S 00:18 /usr/sbin/httpd -k start 1462601 506832 nobody 19232 0.0 S 00:18 /usr/sbin/httpd -k start 1462603 506832 nobody 19204 0.1 S 00:18 /usr/sbin/httpd -k start 1462763 506832 nobody 19172 0.3 S 00:06 /usr/sbin/httpd -k start 1462583 506832 nobody 19144 0.0 S 00:19 /usr/sbin/httpd -k start 1462764 506832 nobody 18884 0.0 S 00:06 /usr/sbin/httpd -k start 1462584 506832 nobody 18740 0.0 S 00:19 /usr/sbin/httpd -k start 1462732 506832 nobody 18640 0.1 S 00:07 /usr/sbin/httpd -k start 1462581 506832 nobody 18384 0.0 S 00:19 /usr/sbin/httpd -k start 1462582 506832 nobody 18284 0.0 S 00:19 /usr/sbin/httpd -k start 1462555 506832 nobody 17896 0.0 S 00:20 /usr/sbin/httpd -k start 1462776 506832 nobody 17856 0.0 S 00:05 /usr/sbin/httpd -k start 1542982 1542551 netdata 17780 2.1 Sl 18:44:41 /usr/libexec/netdata/plugins.d/apps.plugin 1 1462731 506832 nobody 17776 0.0 S 00:07 /usr/sbin/httpd -k start 1461917 506832 nobody 17584 0.1 S 01:19 /usr/sbin/httpd -k start 1462556 506832 nobody 17508 0.0 S 00:20 /usr/sbin/httpd -k start 1462762 506832 nobody 17248 0.0 S 00:06 /usr/sbin/httpd -k start 1462773 506832 nobody 17032 0.0 S 00:05 /usr/sbin/httpd -k start 1462725 506832 nobody 16992 0.0 S 00:08 /usr/sbin/httpd -k start 1462770 506832 nobody 16944 0.2 S 00:05 /usr/sbin/httpd -k start 1462765 506832 nobody 16280 0.0 S 00:06 /usr/sbin/httpd -k start 1462769 506832 nobody 14132 0.0 S 00:05 /usr/sbin/httpd -k start 1462772 506832 nobody 14132 0.0 S 00:05 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 6649930 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min candyfabcom/candyfab.com.au-ssl_log 171 evolution/app.evolutionerp.com.au-ssl_log 104 evolution/evolutionerp.com.au-ssl_log 33 madalice/madalice.com.au-ssl_log 26 corpkicks/corporatekicks.com.au-ssl_log 4 evolution/evolutionerp.com.au 3 evolution/portal.evolutionerp.com.au-ssl_log 3 bigdeals/bigdeals.com.au-ssl_log 1 lowrange/lowrange.com.au 1 otter2/otterfencing.net.au 1 otterfencing/otterfencing.com.au 1 otterfencing/otterfencing.com.au-ssl_log 1 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 171 195.178.110.103 104 40.115.94.245 23 136.118.145.217 18 2001:8004:14b3:854f:95d1:bdfe:1050:32b5 12 62.60.130.198 4 118.127.40.55 3 203.54.180.238 2 134.199.213.195 2 114.119.146.16 2 114.119.137.101 1 66.249.68.64 1 54.197.82.195 1 34.74.242.206 1 34.196.51.17 1 2001:8003:622b:9700:cfdd:4f9e:7ccb:5452 --- top request paths across all vhosts (last 3 min) --- 52 GET /api/getItem/LWPG2001KG 42 POST / 23 GET / 14 POST /index.php 10 POST /signin 9 POST /wp-json/batch/v1 9 POST /api/auth/signin 8 POST /signup 7 POST /wp-json/Batch/v1 7 POST /wp-json/batch/v1/ 7 POST //wp-json/batch/v1 7 POST /wordpress/wp-json/batch/v1 7 POST /login 7 POST /blog/wp-json/batch/v1 6 POST /dashboard 5 POST /register 4 POST /wp-admin/admin-ajax.php 4 GET /wp-json/wc-admin/options 4 GET /wp-admin/maint/ 3 POST /wp-cron.php --- busiest 3 vhosts: top paths + last 10 requests --- == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 42 POST / 14 POST /index.php 12 GET / 10 POST /signin 9 POST /wp-json/batch/v1 9 POST /api/auth/signin 8 POST /signup 7 POST /wp-json/Batch/v1 7 POST /wp-json/batch/v1/ 7 POST //wp-json/batch/v1 7 POST /wordpress/wp-json/batch/v1 7 POST /login -- last 10 requests -- 195.178.110.103 - - [03/Sep/2026:21:06:42 +1000] "POST /api/auth/signin HTTP/1.1" 200 880 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0" 195.178.110.103 - - [03/Sep/2026:21:06:42 +1000] "POST /api/auth/signin HTTP/1.1" 200 880 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0" 195.178.110.103 - - [03/Sep/2026:21:06:43 +1000] "POST /api/auth/signin HTTP/1.1" 200 880 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0" 195.178.110.103 - - [03/Sep/2026:21:06:43 +1000] "POST /api/auth/signin HTTP/1.1" 200 880 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0" 195.178.110.103 - - [03/Sep/2026:21:06:47 +1000] "POST /dashboard HTTP/1.1" 200 880 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0" 195.178.110.103 - - [03/Sep/2026:21:06:47 +1000] "POST /dashboard HTTP/1.1" 200 880 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0" 195.178.110.103 - - [03/Sep/2026:21:06:49 +1000] "POST /dashboard HTTP/1.1" 200 880 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0" 195.178.110.103 - - [03/Sep/2026:21:06:49 +1000] "POST /dashboard HTTP/1.1" 200 880 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0" 195.178.110.103 - - [03/Sep/2026:21:06:51 +1000] "POST /dashboard HTTP/1.1" 200 880 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0" 195.178.110.103 - - [03/Sep/2026:21:06:51 +1000] "POST /dashboard HTTP/1.1" 200 880 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 52 GET /api/getItem/LWPG2001KG 2 GET /api/getItem/SHSG505016-8 1 GET /api/getItem/SHSG898950-8 1 GET /api/getItem/SHSG898935-8 1 GET /api/getItem/SHSG898930-8 1 GET /api/getItem/SHSG898920-8 1 GET /api/getItem/SHSG757550-8 1 GET /api/getItem/SHSG757540-8 1 GET /api/getItem/SHSG757530-8 1 GET /api/getItem/SHSG757525-8 1 GET /api/getItem/SHSG757520-9 1 GET /api/getItem/SHSG757520-8 -- last 10 requests -- 40.115.94.245 - - [03/Sep/2026:21:06:52 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:21:06:52 +1000] "GET /api/getItem/SHSG757550-8 HTTP/1.1" 200 1944 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:21:06:52 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:21:06:52 +1000] "GET /api/getItem/SHSG898920-8 HTTP/1.1" 200 1866 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:21:06:52 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:21:06:53 +1000] "GET /api/getItem/SHSG898930-8 HTTP/1.1" 200 1339 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:21:06:53 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:21:06:53 +1000] "GET /api/getItem/SHSG898935-8 HTTP/1.1" 200 1491 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:21:06:53 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:21:06:53 +1000] "GET /api/getItem/SHSG898950-8 HTTP/1.1" 200 1346 "-" "RestSharp/106.13.0.0" == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 6 GET / 2 GET /xmlrpc.php 2 GET /wp-login.php 2 GET /wp-json/oembed/1.0/embed 2 GET /wp-admin/maint/ 2 GET /wp-admin/includes/ 2 GET /terms-of-use/ 2 GET /terms-of-use 1 POST /wp-cron.php 1 GET /wp-json/wp/v2/pages/9 1 GET /wp-json/ 1 GET /wp-admin/user/ -- last 10 requests -- 136.118.145.217 - - [03/Sep/2026:21:05:47 +1000] "GET /blogs/ HTTP/1.1" 200 36347 "-" "Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Mobile Safari/537.36" 136.118.145.217 - - [03/Sep/2026:21:05:48 +1000] "GET /wp-json/oembed/1.0/embed?url=https://evolutionerp.com.au/&format=xml HTTP/1.1" 200 1067 "-" "Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 (KHTML, like 136.118.145.217 - - [03/Sep/2026:21:05:48 +1000] "GET /wp-json/wp/v2/pages/9 HTTP/1.1" 200 6917 "-" "Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Mobile Safari/537.36" 136.118.145.217 - - [03/Sep/2026:21:05:48 +1000] "GET /xmlrpc.php?rsd HTTP/1.1" 404 30363 "-" "Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Mobile Safari/537.36" 136.118.145.217 - - [03/Sep/2026:21:05:48 +1000] "GET /wp-json/oembed/1.0/embed?url=https://evolutionerp.com.au/ HTTP/1.1" 200 1051 "-" "Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 (KHTML, like Gecko) Chr 62.60.130.198 - - [03/Sep/2026:21:05:49 +1000] "GET /wp-admin/network/ HTTP/1.1" 302 - "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" 62.60.130.198 - - [03/Sep/2026:21:05:50 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Fevolutionerp.com.au%2Fwp-admin%2Fnetwork%2F&reauth=1 HTTP/1.1" 200 10438 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 62.60.130.198 - - [03/Sep/2026:21:06:02 +1000] "GET /wp-admin/user/ HTTP/1.1" 302 - "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" 62.60.130.198 - - [03/Sep/2026:21:06:04 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Fevolutionerp.com.au%2Fwp-admin%2Fuser%2F&reauth=1 HTTP/1.1" 200 10432 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) A 62.60.130.198 - - [03/Sep/2026:21:06:25 +1000] "GET /wp-admin/css/ HTTP/1.1" 200 20531 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-03 21:04:47 L1=0.60 run=1 blk=0 avail=8267 (60.0%) swpO=0 conn=3 myRSS=3053 php=4 phpRSS=202 ap=14 tcp=22 topuser=madalice 2026-09-03 21:04:47 L1=0.60 run=1 blk=0 avail=8266 (60.0%) swpO=0 conn=3 myRSS=3053 php=4 phpRSS=202 ap=14 tcp=22 topuser=madalice 2026-09-03 21:04:57 L1=0.51 run=2 blk=0 avail=8310 (60.3%) swpO=0 conn=3 myRSS=3053 php=4 phpRSS=179 ap=13 tcp=23 topuser=alison 2026-09-03 21:04:57 L1=0.51 run=2 blk=0 avail=8279 (60.1%) swpO=0 conn=3 myRSS=3053 php=4 phpRSS=208 ap=13 tcp=23 topuser=alison 2026-09-03 21:05:07 L1=1.18 run=2 blk=0 avail=8268 (60.0%) swpO=0 conn=3 myRSS=3053 php=4 phpRSS=204 ap=13 tcp=23 topuser=madalice 2026-09-03 21:05:07 L1=1.18 run=2 blk=0 avail=8268 (60.0%) swpO=0 conn=3 myRSS=3053 php=4 phpRSS=204 ap=13 tcp=23 topuser=madalice 2026-09-03 21:05:17 L1=1.38 run=2 blk=0 avail=8250 (59.9%) swpO=2 conn=2 myRSS=3053 php=4 phpRSS=227 ap=13 tcp=24 topuser=madalice 2026-09-03 21:05:18 L1=1.38 run=2 blk=0 avail=8248 (59.9%) swpO=1 conn=3 myRSS=3053 php=4 phpRSS=227 ap=13 tcp=24 topuser=madalice 2026-09-03 21:05:27 L1=1.16 run=1 blk=0 avail=8248 (59.9%) swpO=2 conn=2 myRSS=3053 php=4 phpRSS=227 ap=13 tcp=21 topuser=madalice 2026-09-03 21:05:28 L1=1.16 run=1 blk=0 avail=8247 (59.9%) swpO=2 conn=2 myRSS=3053 php=4 phpRSS=227 ap=13 tcp=21 topuser=madalice 2026-09-03 21:05:37 L1=1.22 run=1 blk=0 avail=8225 (59.7%) swpO=0 conn=2 myRSS=3053 php=4 phpRSS=226 ap=17 tcp=24 topuser=madalice 2026-09-03 21:05:38 L1=1.22 run=1 blk=0 avail=8225 (59.7%) swpO=0 conn=2 myRSS=3053 php=5 phpRSS=238 ap=17 tcp=26 topuser=madalice 2026-09-03 21:05:47 L1=1.83 run=4 blk=0 avail=8052 (58.4%) swpO=0 conn=2 myRSS=3053 php=5 phpRSS=378 ap=21 tcp=114 topuser=evolution 2026-09-03 21:05:48 L1=1.83 run=3 blk=0 avail=7951 (57.7%) swpO=0 conn=2 myRSS=3053 php=5 phpRSS=479 ap=21 tcp=114 topuser=evolution 2026-09-03 21:05:57 L1=1.54 run=2 blk=0 avail=8267 (60.0%) swpO=0 conn=2 myRSS=3053 php=3 phpRSS=70 ap=26 tcp=25 topuser=evolution 2026-09-03 21:05:58 L1=1.54 run=2 blk=0 avail=8285 (60.1%) swpO=0 conn=2 myRSS=3053 php=2 phpRSS=30 ap=26 tcp=25 topuser=root 2026-09-03 21:06:07 L1=1.31 run=1 blk=0 avail=8236 (59.8%) swpO=0 conn=2 myRSS=3053 php=4 phpRSS=203 ap=16 tcp=22 topuser=madalice 2026-09-03 21:06:08 L1=1.31 run=2 blk=0 avail=8250 (59.9%) swpO=0 conn=2 myRSS=3053 php=3 phpRSS=163 ap=16 tcp=22 topuser=madalice 2026-09-03 21:06:17 L1=1.10 run=1 blk=0 avail=8247 (59.9%) swpO=0 conn=2 myRSS=3053 php=4 phpRSS=203 ap=15 tcp=20 topuser=madalice 2026-09-03 21:06:18 L1=1.10 run=1 blk=0 avail=8260 (60.0%) swpO=0 conn=2 myRSS=3053 php=3 phpRSS=163 ap=15 tcp=20 topuser=madalice 2026-09-03 21:06:28 L1=1.01 run=2 blk=0 avail=8237 (59.8%) swpO=2 conn=2 myRSS=3053 php=4 phpRSS=225 ap=15 tcp=21 topuser=madalice 2026-09-03 21:06:28 L1=1.01 run=2 blk=0 avail=8196 (59.5%) swpO=2 conn=2 myRSS=3053 php=3 phpRSS=238 ap=15 tcp=21 topuser=madalice 2026-09-03 21:06:38 L1=0.86 run=1 blk=0 avail=8263 (60.0%) swpO=0 conn=2 myRSS=3053 php=4 phpRSS=204 ap=15 tcp=21 topuser=madalice 2026-09-03 21:06:38 L1=0.86 run=1 blk=0 avail=8273 (60.1%) swpO=0 conn=2 myRSS=3053 php=3 phpRSS=164 ap=15 tcp=21 topuser=madalice 2026-09-03 21:06:48 L1=0.73 run=2 blk=0 avail=8127 (59.0%) swpO=0 conn=2 myRSS=3053 php=4 phpRSS=326 ap=16 tcp=30 topuser=madalice 2026-09-03 21:06:48 L1=0.73 run=2 blk=0 avail=8136 (59.1%) swpO=0 conn=2 myRSS=3053 php=3 phpRSS=287 ap=18 tcp=30 topuser=madalice 2026-09-03 21:06:58 L1=1.13 run=1 blk=0 avail=7354 (53.4%) swpO=0 conn=2 myRSS=3053 php=10 phpRSS=1097 ap=27 tcp=31 topuser=madalice 2026-09-03 21:06:58 L1=1.13 run=5 blk=0 avail=7370 (53.5%) swpO=0 conn=2 myRSS=3053 php=10 phpRSS=1100 ap=26 tcp=31 topuser=madalice 2026-09-03 21:07:08 L1=1.84 run=1 blk=0 avail=6943 (50.4%) swpO=0 conn=1 myRSS=3053 php=12 phpRSS=1513 ap=36 tcp=27 topuser=madalice 2026-09-03 21:07:08 L1=1.84 run=2 blk=1 avail=6928 (50.3%) swpO=0 conn=2 myRSS=3053 php=13 phpRSS=1571 ap=35 tcp=28 topuser=madalice