INCIDENT 2026-09-04 22:09:45 trigger: php_rss=1944MB ================================================================== load: 0.74 0.75 0.74 4/685 2749873 ncpu:10 mem_avail: 6000MB/13777MB (43.6%) swap_used:1530MB swapout:0/s blocked(D):0 running:4 iowait:0.0% steal:0.0% php: 12 procs / 1944MB heaviest user: madalice (10 procs, 1912MB) apache: 24 procs tcp_estab: 28 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3421 madalice 10 1829 root 252 1209 nobody 23 360 netdata 8 255 dovenull 6 68 wp-toolkit 3 61 cpanellogin 1 61 dovecot 3 29 kurri 2 28 mailman 20 26 evolution 9 23 candyfabcom 1 13 zabbix 1 11 polkitd 1 7 named 1 5 nscd 1 4 mailnull 1 2 dbus 1 2 cpanelconnecttrack 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 10 1809 root 1 32 evolution 1 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4926 MB Active(file): 4253 MB Inactive(file): 885 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 531 MB CommitLimit: 10984 MB Committed_AS: 8426 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2715307 root 09:45 1272 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 2747490 root 03:38 60580 /opt/imunify360/venv/bin/python3 -m imav.run 3926885 root 3-19:47:18 4132 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3503280 13.3 Ssl 2-07:55:33 /usr/sbin/mariadbd 2749807 2601907 madalice 255636 46.0 S 00:03 php-fpm: pool madalice_com_au 2749806 2601907 madalice 255524 46.3 S 00:03 php-fpm: pool madalice_com_au 2749809 2601907 madalice 238240 81.3 R 00:03 php-fpm: pool madalice_com_au 1043892 2603077 root 199280 0.1 S 08:04:49 spamd child 1542443 1 netdata 189756 2.6 Ssl 1-19:47:23 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2749313 2601907 madalice 168596 11.2 R 00:41 php-fpm: pool madalice_com_au 2654376 2603077 root 153460 0.0 S 19:30:38 spamd child 509266 1 root 141552 0.0 Ss 7-19:50:04 /usr/lib/systemd/systemd-journald 2749808 2601907 madalice 141316 48.0 S 00:03 php-fpm: pool madalice_com_au 2749816 2601907 madalice 137812 71.5 S 00:02 php-fpm: pool madalice_com_au 2749812 2601907 madalice 137528 71.5 S 00:02 php-fpm: pool madalice_com_au 2749813 2601907 madalice 137436 75.0 R 00:02 php-fpm: pool madalice_com_au 2749819 2601907 madalice 137396 69.0 S 00:02 php-fpm: pool madalice_com_au 2749820 2601907 madalice 137392 67.0 S 00:02 php-fpm: pool madalice_com_au 2603077 1 root 136776 0.0 Ss 19:45:34 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2507165 1353308 cpanellogin 63116 0.0 S 01:10:33 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 2747490 1 root 60580 0.8 Ssl 03:38 /opt/imunify360/venv/bin/python3 -m imav.run 509236 509098 root 44088 0.0 Sl 7-19:50:04 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42324 0.1 Ss 44-19:28:30 cpsrvd (SSL) - waiting for connections 1469 1 root 41864 0.1 Ss 67-11:59:59 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542981 1542551 netdata 40900 0.1 Sl 1-19:47:19 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2749852 1469 root 38840 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2749878 1469 root 38840 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2749836 1469 root 38836 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542487 1 wp-toolkit 34272 0.0 Ss 1-19:47:23 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 32956 0.0 Ss 19:46:19 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 2602226 1 root 27540 0.1 Ssl 19:46:04 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1463 1 root 25912 0.0 Ss 67-11:59:59 tailwatchd 1542531 1 wp-toolkit 22216 0.0 Ss 1-19:47:22 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2732152 506832 nobody 21228 0.0 S 05:08 /usr/sbin/httpd -k start 2747817 506832 nobody 19888 0.0 S 03:14 /usr/sbin/httpd -k start 2747815 506832 nobody 19840 0.0 S 03:14 /usr/sbin/httpd -k start 2749830 506832 nobody 19756 0.0 S 00:01 /usr/sbin/httpd -k start 2749442 506832 nobody 19464 0.0 S 00:34 /usr/sbin/httpd -k start 2749415 506832 nobody 19428 0.0 S 00:35 /usr/sbin/httpd -k start 2732169 506832 nobody 19324 0.0 S 05:06 /usr/sbin/httpd -k start 2749400 506832 nobody 18252 0.0 S 00:36 /usr/sbin/httpd -k start 1542982 1542551 netdata 18244 2.1 Sl 1-19:47:19 /usr/libexec/netdata/plugins.d/apps.plugin 1 2749443 506832 nobody 18112 0.0 S 00:34 /usr/sbin/httpd -k start 2749431 506832 nobody 18076 0.0 S 00:34 /usr/sbin/httpd -k start 2749392 506832 nobody 17496 0.0 S 00:37 /usr/sbin/httpd -k start 2749402 506832 nobody 17468 0.0 S 00:36 /usr/sbin/httpd -k start 2749412 506832 nobody 17416 0.0 S 00:35 /usr/sbin/httpd -k start 690513 508511 root 17288 0.0 S 09:36:55 dovecot/config 2749063 506832 nobody 17220 0.0 S 01:06 /usr/sbin/httpd -k start 1542141 1 root 17108 0.0 Ss 1-19:47:26 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 2749829 506832 nobody 16696 0.0 S 00:01 /usr/sbin/httpd -k start 2749815 506832 nobody 16692 0.0 S 00:02 /usr/sbin/httpd -k start 2749384 506832 nobody 16676 0.0 S 00:38 /usr/sbin/httpd -k start 1471 1 root 14736 0.0 Ss 67-11:59:59 cPhulkd - processor 2748829 508511 kurri 14600 0.0 S 01:34 dovecot/imap 2508826 1471 root 14524 0.0 S 20:12:48 cPhulkd - dbprocessor 706620 508511 kurri 14356 0.0 S 09:34:32 dovecot/imap 2749515 508511 candyfabcom 14312 0.0 S 00:30 dovecot/imap 690514 508511 dovecot 13956 0.0 S 09:36:55 dovecot/auth 506832 1 root 13412 0.0 Ss 7-19:50:37 /usr/sbin/httpd -k start 690509 508511 dovenull 13308 0.0 S 09:36:55 dovecot/imap-login 690505 508511 dovenull 13252 0.0 S 09:36:55 dovecot/imap-login 2748013 508511 root 12816 0.0 S 02:54 dovecot/auth -w --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10510362 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 10510360 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 97 cosgrovecreative/cosgrovecreative.com.au-ssl_log 87 lowrange/lowrange.com.au-ssl_log 58 nrg/nrgservices.net.au-ssl_log 14 evolution/portal.evolutionerp.com.au-ssl_log 12 madalice/madalice.com.au-ssl_log 5 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 97 40.115.94.245 86 158.23.18.78 58 93.123.109.228 12 203.54.180.238 2 114.119.143.14 1 95.27.36.105 1 80.94.92.175 1 74.108.61.23 1 45.235.169.24 1 45.191.13.185 1 41.176.233.45 1 39.34.169.5 1 196.64.4.103 1 196.188.230.75 1 187.243.49.4 --- top request paths across all vhosts (last 3 min) --- 97 GET /api/getItem/LWPG2001KG 12 GET /heartbeat.php 5 GET /store/custom-af1-drippy-swoosh/ 3 GET /admin.php 2 GET /.env 1 GET /xiugai.php 1 GET /wp.php 1 GET /wp-includes/ID3/about.php 1 GET /wp-includes/blocks/details/ 1 GET /wp-includes/blocks/audio/ 1 GET /w.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-content/index.php 1 GET /wp-admin/css/colors/modern/ 1 GET /wp-admin/css/ 1 GET /*update.cgi* 1 GET /this_is_a_new_hello_world.php 1 GET /sm.php 1 GET /*/[slug] 1 GET /sky.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 97 GET /api/getItem/LWPG2001KG -- last 10 requests -- 40.115.94.245 - - [04/Sep/2026:22:08:33 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:22:08:33 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:22:08:34 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:22:08:34 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:22:08:34 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:22:08:35 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:22:08:35 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:22:08:35 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:22:08:36 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [04/Sep/2026:22:08:36 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 3 GET /admin.php 1 GET /xiugai.php 1 GET /wp.php 1 GET /wp-includes/ID3/about.php 1 GET /wp-includes/blocks/details/ 1 GET /wp-includes/blocks/audio/ 1 GET /w.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-content/index.php 1 GET /wp-admin/css/colors/modern/ 1 GET /wp-admin/css/ 1 GET /this_is_a_new_hello_world.php -- last 10 requests -- 158.23.18.78 - - [04/Sep/2026:22:09:27 +1000] "GET /sm.php HTTP/1.1" 401 36 "-" "-" 158.23.18.78 - - [04/Sep/2026:22:09:27 +1000] "GET /araso.php HTTP/1.1" 401 36 "-" "-" 158.23.18.78 - - [04/Sep/2026:22:09:27 +1000] "GET /a.php HTTP/1.1" 401 36 "-" "-" 158.23.18.78 - - [04/Sep/2026:22:09:28 +1000] "GET /sb.php HTTP/1.1" 401 36 "-" "-" 158.23.18.78 - - [04/Sep/2026:22:09:28 +1000] "GET /wp-content/index.php HTTP/1.1" 401 36 "-" "-" 158.23.18.78 - - [04/Sep/2026:22:09:29 +1000] "GET /wp-includes/ID3/about.php HTTP/1.1" 401 36 "-" "-" 158.23.18.78 - - [04/Sep/2026:22:09:29 +1000] "GET /wp-admin/css/ HTTP/1.1" 401 36 "-" "-" 158.23.18.78 - - [04/Sep/2026:22:09:29 +1000] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 401 36 "-" "-" 158.23.18.78 - - [04/Sep/2026:22:09:30 +1000] "GET /wp-includes/blocks/details/ HTTP/1.1" 401 36 "-" "-" 158.23.18.78 - - [04/Sep/2026:22:09:30 +1000] "GET /wp-includes/blocks/audio/ HTTP/1.1" 401 36 "-" "-" == lowrange/lowrange.com.au-ssl_log == -- top paths -- 1 GET /*update.cgi* 1 GET /*/[slug] 1 GET /*/[id] 1 GET /.git/ORIG_HEAD 1 GET /.git/logs/refs/heads/master 1 GET /.git/logs/refs/heads/main 1 GET /.git/info/exclude 1 GET /.git/info 1 GET /.git/HEAD 1 GET /.git/FETCH_HEAD 1 GET /.git/config.old 1 GET /.git/config.bak -- last 10 requests -- 93.123.109.228 - - [04/Sep/2026:22:09:10 +1000] "GET /.git/FETCH_HEAD HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 93.123.109.228 - - [04/Sep/2026:22:09:10 +1000] "GET /.git/HEAD HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 93.123.109.228 - - [04/Sep/2026:22:09:10 +1000] "GET /.git/config~ HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 93.123.109.228 - - [04/Sep/2026:22:09:10 +1000] "GET /.git/config HTTP/1.1" 404 - "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 93.123.109.228 - - [04/Sep/2026:22:09:10 +1000] "GET /.git/config.bak HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 93.123.109.228 - - [04/Sep/2026:22:09:10 +1000] "GET /.git/config.old HTTP/1.1" 404 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 93.123.109.228 - - [04/Sep/2026:22:09:10 +1000] "GET /.git/info HTTP/1.1" 404 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 93.123.109.228 - - [04/Sep/2026:22:09:10 +1000] "GET /.git/info/exclude HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0" 93.123.109.228 - - [04/Sep/2026:22:09:10 +1000] "GET /.git/logs/refs/heads/main HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0" 93.123.109.228 - - [04/Sep/2026:22:09:11 +1000] "GET /.git/logs/refs/heads/master HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0" --- last 30 samples (run-up to this incident) --- 2026-09-04 22:07:25 L1=0.46 run=1 blk=0 avail=7638 (55.4%) swpO=0 conn=1 myRSS=3420 php=3 phpRSS=187 ap=16 tcp=21 topuser=madalice 2026-09-04 22:07:25 L1=0.46 run=1 blk=0 avail=7637 (55.4%) swpO=0 conn=1 myRSS=3420 php=3 phpRSS=187 ap=16 tcp=21 topuser=madalice 2026-09-04 22:07:35 L1=0.47 run=1 blk=0 avail=7642 (55.5%) swpO=0 conn=1 myRSS=3420 php=3 phpRSS=187 ap=15 tcp=19 topuser=madalice 2026-09-04 22:07:35 L1=0.47 run=1 blk=0 avail=7641 (55.5%) swpO=0 conn=1 myRSS=3420 php=3 phpRSS=187 ap=15 tcp=19 topuser=madalice 2026-09-04 22:07:45 L1=0.40 run=1 blk=0 avail=7650 (55.5%) swpO=0 conn=1 myRSS=3420 php=3 phpRSS=187 ap=14 tcp=20 topuser=madalice 2026-09-04 22:07:45 L1=0.40 run=1 blk=0 avail=7648 (55.5%) swpO=0 conn=1 myRSS=3420 php=3 phpRSS=187 ap=14 tcp=20 topuser=madalice 2026-09-04 22:07:55 L1=0.42 run=1 blk=0 avail=7787 (56.5%) swpO=0 conn=1 myRSS=3420 php=2 phpRSS=32 ap=13 tcp=19 topuser=root 2026-09-04 22:07:55 L1=0.42 run=1 blk=0 avail=7787 (56.5%) swpO=0 conn=1 myRSS=3420 php=2 phpRSS=32 ap=13 tcp=19 topuser=root 2026-09-04 22:08:05 L1=0.35 run=2 blk=0 avail=7568 (54.9%) swpO=0 conn=2 myRSS=3420 php=4 phpRSS=296 ap=13 tcp=21 topuser=madalice 2026-09-04 22:08:05 L1=0.35 run=3 blk=0 avail=7566 (54.9%) swpO=0 conn=1 myRSS=3420 php=4 phpRSS=296 ap=13 tcp=21 topuser=madalice 2026-09-04 22:08:15 L1=0.30 run=1 blk=0 avail=7674 (55.7%) swpO=0 conn=2 myRSS=3420 php=3 phpRSS=165 ap=13 tcp=21 topuser=madalice 2026-09-04 22:08:15 L1=0.30 run=4 blk=0 avail=7672 (55.7%) swpO=0 conn=1 myRSS=3420 php=3 phpRSS=165 ap=13 tcp=21 topuser=madalice 2026-09-04 22:08:25 L1=0.25 run=1 blk=0 avail=7649 (55.5%) swpO=0 conn=2 myRSS=3420 php=3 phpRSS=187 ap=13 tcp=22 topuser=madalice 2026-09-04 22:08:25 L1=0.25 run=1 blk=0 avail=7648 (55.5%) swpO=0 conn=1 myRSS=3420 php=3 phpRSS=187 ap=13 tcp=22 topuser=madalice 2026-09-04 22:08:35 L1=0.21 run=1 blk=0 avail=7649 (55.5%) swpO=0 conn=2 myRSS=3420 php=3 phpRSS=187 ap=13 tcp=21 topuser=madalice 2026-09-04 22:08:35 L1=0.21 run=2 blk=0 avail=7648 (55.5%) swpO=0 conn=1 myRSS=3420 php=4 phpRSS=212 ap=13 tcp=21 topuser=madalice 2026-09-04 22:08:45 L1=0.33 run=1 blk=0 avail=7642 (55.5%) swpO=0 conn=2 myRSS=3420 php=3 phpRSS=187 ap=14 tcp=20 topuser=madalice 2026-09-04 22:08:45 L1=0.33 run=1 blk=0 avail=7642 (55.5%) swpO=0 conn=1 myRSS=3420 php=3 phpRSS=187 ap=14 tcp=21 topuser=madalice 2026-09-04 22:08:55 L1=0.28 run=1 blk=0 avail=7636 (55.4%) swpO=0 conn=2 myRSS=3420 php=3 phpRSS=187 ap=14 tcp=22 topuser=madalice 2026-09-04 22:08:55 L1=0.28 run=1 blk=0 avail=7637 (55.4%) swpO=0 conn=1 myRSS=3420 php=3 phpRSS=187 ap=14 tcp=23 topuser=madalice 2026-09-04 22:09:05 L1=0.31 run=3 blk=0 avail=7578 (55.0%) swpO=0 conn=3 myRSS=3420 php=4 phpRSS=278 ap=14 tcp=23 topuser=madalice 2026-09-04 22:09:05 L1=0.31 run=4 blk=0 avail=7537 (54.7%) swpO=0 conn=1 myRSS=3420 php=4 phpRSS=319 ap=14 tcp=23 topuser=madalice 2026-09-04 22:09:15 L1=0.35 run=1 blk=0 avail=7483 (54.3%) swpO=0 conn=3 myRSS=3420 php=3 phpRSS=166 ap=42 tcp=28 topuser=madalice 2026-09-04 22:09:15 L1=0.35 run=1 blk=0 avail=7488 (54.4%) swpO=0 conn=1 myRSS=3420 php=3 phpRSS=166 ap=42 tcp=26 topuser=madalice 2026-09-04 22:09:25 L1=0.29 run=1 blk=0 avail=7547 (54.8%) swpO=0 conn=3 myRSS=3420 php=3 phpRSS=166 ap=32 tcp=24 topuser=madalice 2026-09-04 22:09:25 L1=0.29 run=1 blk=0 avail=7542 (54.7%) swpO=0 conn=1 myRSS=3420 php=3 phpRSS=166 ap=32 tcp=24 topuser=madalice 2026-09-04 22:09:35 L1=0.40 run=1 blk=0 avail=7593 (55.1%) swpO=0 conn=3 myRSS=3420 php=3 phpRSS=187 ap=22 tcp=18 topuser=madalice 2026-09-04 22:09:35 L1=0.40 run=1 blk=0 avail=7590 (55.1%) swpO=0 conn=1 myRSS=3420 php=3 phpRSS=187 ap=22 tcp=18 topuser=madalice 2026-09-04 22:09:45 L1=0.74 run=4 blk=0 avail=6000 (43.6%) swpO=0 conn=5 myRSS=3421 php=12 phpRSS=1944 ap=24 tcp=28 topuser=madalice 2026-09-04 22:09:45 L1=0.74 run=5 blk=0 avail=6197 (45.0%) swpO=0 conn=6 myRSS=3421 php=12 phpRSS=1739 ap=24 tcp=29 topuser=madalice