INCIDENT 2026-09-05 07:57:10 trigger: php_rss=1582MB ================================================================== load: 3.01 2.56 2.28 3/703 588985 ncpu:10 mem_avail: 6757MB/13777MB (49.0%) swap_used:2285MB swapout:0/s blocked(D):1 running:4 iowait:9.6% steal:0.0% php: 15 procs / 1582MB heaviest user: madalice (9 procs, 1189MB) apache: 26 procs tcp_estab: 43 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2941 root 248 1387 madalice 9 1190 nobody 25 451 corpkicks 3 297 netdata 8 255 evolution 11 121 dovenull 6 65 wp-toolkit 3 53 cpanellogin 1 53 kurri 2 27 dovecot 3 27 mailman 20 26 mailnull 4 19 aaa 1 15 lowrange 1 14 zabbix 1 12 polkitd 1 7 named 1 5 nscd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 9 1190 corpkicks 2 286 evolution 3 100 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5965 MB Active(file): 4517 MB Inactive(file): 1513 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 521 MB CommitLimit: 10984 MB Committed_AS: 9012 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 4-05:34:44 4812 /usr/bin/imunify-agent-proxy 4109079 root 03:12:22 3120 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 03:12:22 530036 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3011804 11.8 Ssl 2-17:42:59 /usr/sbin/mariadbd 4109105 4109079 root 530036 7.8 Sl 03:12:22 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 588950 588354 corpkicks 247216 55.5 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1542443 1 netdata 188908 2.6 Ssl 2-05:34:49 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3643624 3626973 root 167412 0.0 S 05:30:21 spamd child 536397 2601907 madalice 165868 9.2 R 13:03 php-fpm: pool madalice_com_au 536487 2601907 madalice 164552 10.4 S 12:51 php-fpm: pool madalice_com_au 536530 2601907 madalice 164496 10.5 S 12:45 php-fpm: pool madalice_com_au 536420 2601907 madalice 164264 11.7 S 12:59 php-fpm: pool madalice_com_au 515304 2601907 madalice 161752 8.8 S 20:44 php-fpm: pool madalice_com_au 536493 2601907 madalice 161272 10.1 S 12:49 php-fpm: pool madalice_com_au 496129 2601907 madalice 160224 8.6 S 26:32 php-fpm: pool madalice_com_au 3626973 1 root 119140 0.0 Ss 05:33:56 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3643625 3626973 root 84444 0.0 S 05:30:21 spamd child 588965 588663 corpkicks 60716 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 509236 509098 root 60448 0.0 Sl 8-05:37:30 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 498558 1353308 cpanellogin 54320 0.0 S 23:16 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 3127357 3127312 evolution 52988 0.0 Ss 07:57:10 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3127358 3127320 evolution 49980 0.0 Ss 07:57:10 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 536452 2601907 madalice 47808 8.6 S 12:55 php-fpm: pool madalice_com_au 509266 1 root 46016 0.0 Ss 8-05:37:30 /usr/lib/systemd/systemd-journald 1469 1 root 41936 0.1 Ss 67-21:47:25 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 41736 0.1 Ss 45-05:15:56 cpsrvd (SSL) - waiting for connections 1542981 1542551 netdata 41144 0.1 Sl 2-05:34:45 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1542487 1 wp-toolkit 29256 0.0 Ss 2-05:34:49 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 588714 2601907 madalice 29180 1.0 S 00:21 php-fpm: pool madalice_com_au 2601907 1 root 28680 0.0 Ss 1-05:33:45 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3626082 1 root 26928 0.0 Ss 05:34:56 lfd - sleeping 1463 1 root 23328 0.0 Ss 67-21:47:25 tailwatchd 572118 506832 nobody 22688 0.0 S 03:57 /usr/sbin/httpd -k start 573029 506832 nobody 22396 0.0 S 02:11 /usr/sbin/httpd -k start 572986 506832 nobody 22148 0.0 S 02:12 /usr/sbin/httpd -k start 573042 506832 nobody 21968 0.0 S 02:11 /usr/sbin/httpd -k start 572988 506832 nobody 21708 0.0 S 02:12 /usr/sbin/httpd -k start 573040 506832 nobody 21412 0.0 S 02:11 /usr/sbin/httpd -k start 588353 506832 nobody 20928 0.1 S 00:51 /usr/sbin/httpd -k start 573037 506832 nobody 20856 0.0 S 02:11 /usr/sbin/httpd -k start 572962 506832 nobody 20484 0.0 S 02:15 /usr/sbin/httpd -k start 573051 506832 nobody 20176 0.0 S 02:11 /usr/sbin/httpd -k start 588354 506832 nobody 19972 0.0 S 00:51 /usr/sbin/httpd -k start 588583 506832 nobody 19804 0.0 S 00:33 /usr/sbin/httpd -k start 588787 506832 nobody 19724 0.0 S 00:16 /usr/sbin/httpd -k start 572983 506832 nobody 19668 0.0 S 02:13 /usr/sbin/httpd -k start 572980 506832 nobody 19272 0.0 S 02:13 /usr/sbin/httpd -k start 1542531 1 wp-toolkit 19264 0.0 Ss 2-05:34:48 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 572996 506832 nobody 19260 0.0 S 02:12 /usr/sbin/httpd -k start 2602226 1 root 18928 0.1 Ssl 1-05:33:30 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 588672 506832 nobody 18736 0.0 S 00:27 /usr/sbin/httpd -k start 572917 506832 nobody 18704 0.2 S 02:21 /usr/sbin/httpd -k start 1542982 1542551 netdata 18520 2.2 Sl 2-05:34:45 /usr/libexec/netdata/plugins.d/apps.plugin 1 588669 506832 nobody 18252 0.0 S 00:27 /usr/sbin/httpd -k start 588663 506832 nobody 17260 0.0 S 00:28 /usr/sbin/httpd -k start 588671 506832 nobody 17260 0.0 S 00:27 /usr/sbin/httpd -k start 588670 506832 nobody 17248 0.0 S 00:27 /usr/sbin/httpd -k start 588656 506832 nobody 17232 0.0 S 00:29 /usr/sbin/httpd -k start 587402 1471 root 16288 0.0 S 01:55 cPhulkd - processor - http socket 306499 1471 root 16276 0.0 S 01:18:07 cPhulkd - dbprocessor 1471 1 root 16248 0.0 Ss 67-21:47:25 cPhulkd - processor 534505 508511 aaa 15916 0.0 S 15:54 dovecot/imap 1542141 1 root 15420 0.0 Ss 2-05:34:52 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10758013 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 296 customc/customcentral.com.au-ssl_log 84 evolution/app.evolutionerp.com.au-ssl_log 70 evolution/portal.evolutionerp.com.au-ssl_log 4 alison/alisonarts.com.au-ssl_log 2 tubesupplies/tubesupplies.com.au 1 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 190 139.28.219.70 90 20.151.10.161 84 4.204.224.164 70 40.115.94.245 7 34.148.197.168 4 203.54.180.238 2 2607:fb90:1740:c44a:995c:4ba5:d9a5:9260 2 114.119.140.234 1 62.60.130.198 1 52.167.144.166 1 136.114.20.174 1 118.127.40.55 1 114.119.159.70 1 114.119.146.16 1 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 63 GET /api/getItem/LWFBW2001KG 7 GET /api/getItem/LWPG2001KG 6 GET /store/hand-painted-nike-bandana/ 4 GET /heartbeat.php 3 GET /wp-includes/ID3/about.php 3 GET /sm.php 3 GET /site.php 3 GET /shiny.php 3 GET /sb.php 3 GET /or.php 3 GET /nofile.php 3 GET /mails.php 3 GET /kir.php 3 GET /key.php 3 GET /inso.php 3 GET /insc.php 3 GET /fling.php 3 GET /file.php 3 GET /dex.php 3 GET /cabs.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 6 GET /store/hand-painted-nike-bandana/ 2 GET /xs.php 2 GET /wp-temp.php 2 GET /wp-manager.php 2 GET /wp-includes/Text/Diff/Engine/about.php 2 GET /wp-includes/ID3/about.php 2 GET /wp-goods.php 2 GET /wp-content/uploads/ 2 GET /wp-content/admin.php 2 GET /wp_blog_footer.php 2 GET /v4on3fxtoo5z5cq0yCdefault.php 2 GET /sm.php -- last 10 requests -- 139.28.219.70 - - [05/Sep/2026:07:57:02 +1000] "GET /wp-content/plugins/woocommerce/includes/log-handlers/class-wc-log-handler-email.php HTTP/1.1" 200 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:57:02 +1000] "GET /wp-content/plugins/woocommerce/includes/log-handlers/class-wc-log-handler-file.php HTTP/1.1" 200 1 "-" "-" 20.151.10.161 - - [05/Sep/2026:07:57:01 +1000] "GET /8xmlr9ommwdy3ro8dCdefault.php HTTP/1.1" 301 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:57:03 +1000] "GET /wp-content/plugins/woocommerce/includes/payment-tokens/ HTTP/1.1" 200 341 "-" "-" 20.151.10.161 - - [05/Sep/2026:07:57:03 +1000] "GET /8xmlr9ommwdy3ro8dCdefault.php HTTP/1.1" 404 36655 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:57:03 +1000] "GET /wp-content/plugins/woocommerce/includes/payment-tokens//wp-content/plugins/woocommerce/includes/ HTTP/1.1" 301 1 "-" "-" 20.151.10.161 - - [05/Sep/2026:07:57:04 +1000] "GET /fms.php HTTP/1.1" 301 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:57:05 +1000] "GET /wp-content/plugins/woocommerce/includes/payment-tokens/wp-content/plugins/woocommerce/includes/ HTTP/1.1" 404 36656 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:57:06 +1000] "GET /wp-content/plugins/woocommerce/includes/payment-tokens/class-wc-payment-token-cc.php HTTP/1.1" 200 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:57:07 +1000] "GET /wp-content/plugins/woocommerce/includes/payment-tokens/class-wc-payment-token-echeck.php HTTP/1.1" 200 1 "-" "-" == customc/customcentral.com.au-ssl_log == -- top paths -- 3 GET /admin.php 1 GET /xiugai.php 1 GET /wp.php 1 GET /wp-includes/ID3/about.php 1 GET /w.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-content/index.php 1 GET /wp-admin/css/colors/modern/ 1 GET /wp-admin/css/ 1 GET /this_is_a_new_hello_world.php 1 GET /sm.php 1 GET /sky.php -- last 10 requests -- 4.204.224.164 - - [05/Sep/2026:07:56:41 +1000] "GET /or.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [05/Sep/2026:07:56:41 +1000] "GET /mails.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [05/Sep/2026:07:56:42 +1000] "GET /sm.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [05/Sep/2026:07:56:42 +1000] "GET /araso.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [05/Sep/2026:07:56:43 +1000] "GET /a.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [05/Sep/2026:07:56:43 +1000] "GET /sb.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [05/Sep/2026:07:56:43 +1000] "GET /wp-content/index.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [05/Sep/2026:07:56:44 +1000] "GET /wp-includes/ID3/about.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [05/Sep/2026:07:56:44 +1000] "GET /wp-admin/css/ HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [05/Sep/2026:07:56:45 +1000] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 401 36 "-" "-" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 63 GET /api/getItem/LWFBW2001KG 7 GET /api/getItem/LWPG2001KG -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:07:56:08 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:56:09 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:56:09 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:56:09 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:56:10 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:56:10 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:56:10 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:56:11 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:56:11 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:56:12 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-05 07:54:49 L1=2.26 run=3 blk=1 avail=7140 (51.8%) swpO=0 conn=4 myRSS=2966 php=14 phpRSS=1081 ap=32 tcp=51 topuser=madalice 2026-09-05 07:54:50 L1=2.48 run=4 blk=1 avail=6966 (50.6%) swpO=0 conn=4 myRSS=2966 php=16 phpRSS=1304 ap=34 tcp=52 topuser=madalice 2026-09-05 07:54:59 L1=2.44 run=1 blk=1 avail=6931 (50.3%) swpO=0 conn=4 myRSS=2966 php=13 phpRSS=1010 ap=68 tcp=96 topuser=madalice 2026-09-05 07:55:00 L1=2.49 run=5 blk=1 avail=6752 (49.0%) swpO=0 conn=3 myRSS=2966 php=13 phpRSS=1012 ap=100 tcp=93 topuser=madalice 2026-09-05 07:55:09 L1=3.10 run=5 blk=1 avail=6579 (47.8%) swpO=1523 conn=5 myRSS=2941 php=13 phpRSS=1232 ap=92 tcp=49 topuser=madalice 2026-09-05 07:55:10 L1=3.10 run=7 blk=1 avail=6466 (46.9%) swpO=1523 conn=3 myRSS=2941 php=14 phpRSS=1388 ap=91 tcp=52 topuser=madalice 2026-09-05 07:55:19 L1=2.93 run=2 blk=1 avail=6729 (48.8%) swpO=0 conn=5 myRSS=2941 php=13 phpRSS=1157 ap=82 tcp=47 topuser=madalice 2026-09-05 07:55:20 L1=2.93 run=2 blk=1 avail=6755 (49.0%) swpO=0 conn=3 myRSS=2941 php=13 phpRSS=1107 ap=81 tcp=48 topuser=madalice 2026-09-05 07:55:29 L1=2.87 run=3 blk=1 avail=6679 (48.5%) swpO=0 conn=5 myRSS=2941 php=13 phpRSS=1273 ap=72 tcp=42 topuser=madalice 2026-09-05 07:55:30 L1=2.87 run=2 blk=1 avail=6647 (48.3%) swpO=0 conn=3 myRSS=2941 php=13 phpRSS=1311 ap=71 tcp=41 topuser=madalice 2026-09-05 07:55:40 L1=2.90 run=4 blk=1 avail=6938 (50.4%) swpO=0 conn=5 myRSS=2941 php=13 phpRSS=1102 ap=62 tcp=43 topuser=madalice 2026-09-05 07:55:40 L1=2.90 run=3 blk=1 avail=6867 (49.8%) swpO=0 conn=3 myRSS=2941 php=13 phpRSS=1181 ap=61 tcp=42 topuser=madalice 2026-09-05 07:55:50 L1=2.76 run=2 blk=1 avail=6607 (48.0%) swpO=0 conn=4 myRSS=2941 php=13 phpRSS=1512 ap=51 tcp=39 topuser=madalice 2026-09-05 07:55:50 L1=2.76 run=2 blk=1 avail=6543 (47.5%) swpO=0 conn=4 myRSS=2941 php=13 phpRSS=1573 ap=51 tcp=39 topuser=madalice 2026-09-05 07:56:00 L1=2.87 run=5 blk=1 avail=6731 (48.9%) swpO=0 conn=4 myRSS=2941 php=13 phpRSS=1461 ap=41 tcp=40 topuser=madalice 2026-09-05 07:56:00 L1=2.87 run=4 blk=1 avail=6727 (48.8%) swpO=0 conn=6 myRSS=2941 php=13 phpRSS=1465 ap=41 tcp=41 topuser=madalice 2026-09-05 07:56:10 L1=2.89 run=5 blk=1 avail=6606 (48.0%) swpO=0 conn=5 myRSS=2941 php=13 phpRSS=1648 ap=31 tcp=41 topuser=madalice 2026-09-05 07:56:10 L1=2.89 run=4 blk=1 avail=6668 (48.4%) swpO=0 conn=4 myRSS=2941 php=13 phpRSS=1574 ap=31 tcp=41 topuser=madalice 2026-09-05 07:56:20 L1=2.82 run=3 blk=1 avail=6977 (50.6%) swpO=0 conn=5 myRSS=2941 php=13 phpRSS=1278 ap=30 tcp=50 topuser=madalice 2026-09-05 07:56:20 L1=2.82 run=4 blk=1 avail=6944 (50.4%) swpO=0 conn=4 myRSS=2941 php=13 phpRSS=1308 ap=30 tcp=50 topuser=madalice 2026-09-05 07:56:30 L1=3.00 run=4 blk=1 avail=6586 (47.8%) swpO=0 conn=6 myRSS=2941 php=13 phpRSS=1708 ap=26 tcp=40 topuser=madalice 2026-09-05 07:56:30 L1=3.00 run=3 blk=1 avail=6631 (48.1%) swpO=0 conn=5 myRSS=2941 php=13 phpRSS=1660 ap=26 tcp=39 topuser=madalice 2026-09-05 07:56:40 L1=2.99 run=1 blk=1 avail=6891 (50.0%) swpO=0 conn=6 myRSS=2941 php=13 phpRSS=1394 ap=26 tcp=42 topuser=madalice 2026-09-05 07:56:40 L1=2.99 run=1 blk=1 avail=6935 (50.3%) swpO=0 conn=5 myRSS=2941 php=13 phpRSS=1346 ap=26 tcp=44 topuser=madalice 2026-09-05 07:56:50 L1=2.92 run=2 blk=1 avail=7074 (51.3%) swpO=0 conn=6 myRSS=2941 php=13 phpRSS=1163 ap=32 tcp=40 topuser=madalice 2026-09-05 07:56:50 L1=2.92 run=4 blk=1 avail=7071 (51.3%) swpO=0 conn=5 myRSS=2941 php=13 phpRSS=1153 ap=32 tcp=42 topuser=madalice 2026-09-05 07:57:00 L1=3.09 run=3 blk=1 avail=7007 (50.9%) swpO=0 conn=6 myRSS=2941 php=13 phpRSS=1259 ap=28 tcp=40 topuser=madalice 2026-09-05 07:57:00 L1=3.09 run=4 blk=1 avail=7002 (50.8%) swpO=0 conn=5 myRSS=2941 php=13 phpRSS=1264 ap=28 tcp=39 topuser=madalice 2026-09-05 07:57:10 L1=3.01 run=4 blk=1 avail=6757 (49.0%) swpO=0 conn=5 myRSS=2941 php=15 phpRSS=1582 ap=26 tcp=43 topuser=madalice 2026-09-05 07:57:10 L1=3.01 run=4 blk=1 avail=6713 (48.7%) swpO=0 conn=6 myRSS=2941 php=15 phpRSS=1634 ap=26 tcp=43 topuser=madalice