INCIDENT 2026-09-02 06:35:34 trigger: php_rss=1523MB ================================================================== load: 1.47 1.47 1.40 2/654 1544522 ncpu:10 mem_avail: 6478MB/13777MB (47.0%) swap_used:2305MB swapout:0/s blocked(D):0 running:2 iowait:0.1% steal:0.0% php: 14 procs / 1523MB heaviest user: madalice (10 procs, 1384MB) apache: 31 procs tcp_estab: 45 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3308 madalice 10 1385 root 243 999 nobody 30 543 mailman 20 355 cpanellogin 1 236 netdata 7 203 evolution 12 168 dovenull 6 67 wp-toolkit 3 59 infinium 3 42 lowrange 2 29 kurri 2 29 dovecot 3 28 mailnull 3 25 zabbix 1 18 cpanelphpmyadmin 1 14 named 1 12 nscd 1 4 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1385 evolution 3 112 root 1 25 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4629 MB Active(file): 4105 MB Inactive(file): 804 MB Dirty: 7 MB Writeback: 0 MB SReclaimable: 481 MB CommitLimit: 10984 MB Committed_AS: 8607 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 1-04:13:06 4736 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3387948 10.3 Ssl 5-04:16:26 /usr/sbin/mariadbd 704828 1353308 cpanellogin 242376 0.1 S 03:59:40 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 706070 655564 root 189516 0.0 S 03:57:36 spamd child 508924 1 netdata 182700 2.0 Ssl 5-04:15:55 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 706071 655564 root 181648 0.0 S 03:57:36 spamd child 655564 1 root 174396 0.0 Ss 04:12:12 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1508612 3929444 madalice 168592 5.1 R 08:34 php-fpm: pool madalice_com_au 1508606 3929444 madalice 164636 5.2 S 08:34 php-fpm: pool madalice_com_au 1459487 3929444 madalice 162312 9.0 S 20:47 php-fpm: pool madalice_com_au 1508608 3929444 madalice 161844 5.5 S 08:34 php-fpm: pool madalice_com_au 1508610 3929444 madalice 160796 5.0 S 08:34 php-fpm: pool madalice_com_au 1525403 3929444 madalice 160756 5.8 S 04:15 php-fpm: pool madalice_com_au 1510435 3929444 madalice 160116 6.3 S 06:02 php-fpm: pool madalice_com_au 1508613 3929444 madalice 141524 5.2 S 08:33 php-fpm: pool madalice_com_au 1474876 3929444 madalice 72108 9.2 S 18:17 php-fpm: pool madalice_com_au 1544475 1529782 evolution 67804 4.3 S 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1508607 3929444 madalice 67380 4.1 S 08:34 php-fpm: pool madalice_com_au 509236 509098 root 47852 0.0 Sl 5-04:15:52 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1544486 1529757 evolution 39112 0.6 S 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 37668 0.1 Ss 42-03:54:18 cpsrvd (SSL) - waiting for connections 3929420 1 wp-toolkit 37420 0.0 Ss 1-04:12:57 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1544480 1544479 evolution 36912 2.0 Sl 00:03 /usr/local/bin/wkhtmltopdf --enable-local-file-access --encoding utf-8 --title TAX INVOICE --header-html /home/evolution/my.evolutioner 654927 1 root 33220 0.0 Ss 04:12:43 lfd - sleeping 1469 1 root 33180 0.1 Ss 64-20:25:47 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3929444 1 root 26140 0.0 Ss 1-04:12:57 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1466 1 root 25612 0.0 Ss 64-20:25:47 dnsadmin - server mode 1508643 506832 nobody 25020 0.0 S 08:32 /usr/sbin/httpd -k start 1463 1 root 24008 0.0 Ss 64-20:25:47 tailwatchd 1525000 506832 nobody 23464 0.3 S 04:52 /usr/sbin/httpd -k start 1529008 506832 nobody 23044 0.3 S 01:07 /usr/sbin/httpd -k start 1525164 506832 nobody 23004 0.1 S 04:36 /usr/sbin/httpd -k start 1526681 506832 nobody 22516 0.2 S 02:57 /usr/sbin/httpd -k start 1526696 506832 nobody 22168 0.0 S 02:56 /usr/sbin/httpd -k start 1524946 506832 nobody 22000 0.1 S 04:56 /usr/sbin/httpd -k start 1529007 506832 nobody 21928 0.0 S 01:07 /usr/sbin/httpd -k start 1529757 506832 nobody 21736 0.1 S 01:00 /usr/sbin/httpd -k start 1528644 506832 nobody 21500 0.1 S 01:37 /usr/sbin/httpd -k start 1528932 506832 nobody 21080 0.0 S 01:13 /usr/sbin/httpd -k start 3929564 1 wp-toolkit 20888 0.0 Ss 1-04:12:56 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1529804 506832 nobody 20692 0.0 S 00:57 /usr/sbin/httpd -k start 1528653 506832 nobody 20448 0.0 S 01:36 /usr/sbin/httpd -k start 1529001 506832 nobody 20384 0.1 S 01:08 /usr/sbin/httpd -k start 1529780 506832 nobody 20372 0.0 S 00:58 /usr/sbin/httpd -k start 1529768 506832 nobody 20172 0.0 S 00:59 /usr/sbin/httpd -k start 1537753 506832 nobody 19504 0.0 S 00:27 /usr/sbin/httpd -k start 483898 1 zabbix 19388 0.2 Ssl 5-04:17:09 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 654684 654679 mailman 19380 0.0 S 04:12:52 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 654690 654679 mailman 19368 0.0 S 04:12:52 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 1539416 506832 nobody 19352 0.0 S 00:26 /usr/sbin/httpd -k start 654699 654679 mailman 19348 0.0 S 04:12:52 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 654685 654679 mailman 19320 0.0 S 04:12:52 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s 654689 654679 mailman 19240 0.0 S 04:12:52 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 654693 654679 mailman 19216 0.0 S 04:12:52 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 654687 654679 mailman 19176 0.0 S 04:12:52 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 654692 654679 mailman 19092 0.0 S 04:12:52 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 654694 654679 mailman 19036 0.0 S 04:12:52 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 654686 654679 mailman 19032 0.0 S 04:12:52 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 654698 654679 mailman 19016 0.0 S 04:12:52 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 654691 654679 mailman 18960 0.0 S 04:12:52 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s 654700 654679 mailman 18960 0.0 S 04:12:52 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 15763951 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 361 tubesupplies/tubesupplies.com.au-ssl_log 148 madalice/madalice.com.au-ssl_log 134 nrg/nrgservices.net.au-ssl_log 105 evolution/app.evolutionerp.com.au-ssl_log 100 customkidscom/customkids.com.au-ssl_log 72 evolution/portal.evolutionerp.com.au-ssl_log 64 evolution/evolutionerp.com.au 44 evolution/evolutionerp.com.au-ssl_log 41 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 162 203.54.180.238 127 149.88.19.85 105 34.165.65.20 100 40.115.94.245 97 158.23.18.78 96 182.239.240.254 87 103.104.164.114 84 20.104.49.130 77 103.104.165.99 72 20.63.81.20 48 158.23.184.117 2 52.167.144.173 2 216.73.217.2 2 118.127.40.55 2 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 88 POST /functions.php 85 GET /app/ajax.php 72 GET /autodiscover/autodiscover.xml 62 GET /index.php 45 GET /heartbeat.php 29 POST /mfreqsave.php 22 POST /app/ajax/selectFilterSingle.php 17 POST /app/ajax/selectFilter.php 12 POST /plugins/csvexporter/plugin.php 12 POST /app/ajax.php 11 POST /jobeditsave.php 10 POST /quoteditsave.php 8 POST /clienteditsave.php 6 GET /store/af1-richmond9/ 5 POST /opportunityeditsave.php 5 POST /dispatchsave.php 3 GET /php.php 3 GET /BDKR28WP.php 3 GET /133.php 2 POST /wp-cron.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 88 POST /functions.php 85 GET /app/ajax.php 47 GET /index.php 29 POST /mfreqsave.php 22 POST /app/ajax/selectFilterSingle.php 17 POST /app/ajax/selectFilter.php 12 POST /plugins/csvexporter/plugin.php 12 POST /app/ajax.php 11 POST /jobeditsave.php 10 POST /quoteditsave.php 8 POST /clienteditsave.php 5 POST /opportunityeditsave.php -- last 10 requests -- 103.104.164.114 - - [02/Sep/2026:06:35:28 +1000] "POST /invoiceaddsave.php?save=1 HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4812&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; Win6 103.104.164.114 - - [02/Sep/2026:06:35:28 +1000] "GET /index.php?page=invoiceadd&invoiceid=4812/index.php?page=invoiceadd&invoiceid=4812 HTTP/1.1" 200 53195 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoi 103.104.164.114 - - [02/Sep/2026:06:35:28 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=12236319674 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/inde 103.104.164.114 - - [02/Sep/2026:06:35:28 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=14892272680 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/ind 103.104.164.114 - - [02/Sep/2026:06:35:28 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dinvoiceadd%26invoiceid%3D4812%252Findex.php%253Fpage%253Dinvoiceadd%26invoiceid%3D4812%26tab%3Dmaintab&call=g 103.104.164.114 - - [02/Sep/2026:06:35:28 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvoiceadd%26invoiceid%3D4812%252Findex.php%253Fpage%253Dinvoiceadd%26invoiceid%3D4812%26tab%3Dmaintab&call=getUserSetting&call 103.104.164.114 - - [02/Sep/2026:06:35:28 +1000] "POST /clienteditsave.php?clientid=220&call=getCategoryDiscounts HTTP/1.1" 200 25 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4812%2Findex.php%3Fpa 103.104.164.114 - - [02/Sep/2026:06:35:28 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4812%2Findex.php%3Fpage%3Dinvoiceadd&invoic 103.104.164.114 - - [02/Sep/2026:06:35:30 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4812%2Findex.php%3Fpage%3Dinvoiceadd&invoiceid=48 203.54.180.238 - - [02/Sep/2026:06:35:30 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/ == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 2 GET /wp-content/themes/index.php 2 GET /simple.php 2 GET /1.php 1 POST /wp-cron.php 1 GET /xx.php 1 GET /xmini4.php 1 GET /wp-temp.php 1 GET /wp-sitemap.xml 1 GET /wp-manager.php 1 GET /wp-mail.php 1 GET /wp-logs.php 1 GET /wp-login.php -- last 10 requests -- 158.23.184.117 - - [02/Sep/2026:06:35:29 +1000] "GET /wp-include.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [02/Sep/2026:06:35:29 +1000] "GET /wp-admin/checker.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [02/Sep/2026:06:35:29 +1000] "GET /wp-admin/css/colors/coffee/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [02/Sep/2026:06:35:29 +1000] "GET /wp-logs.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [02/Sep/2026:06:35:29 +1000] "GET /wp-content/themes/file.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [02/Sep/2026:06:35:30 +1000] "GET /.well-known/rk2.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [02/Sep/2026:06:35:30 +1000] "GET /gecko-new.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [02/Sep/2026:06:35:30 +1000] "GET /wp-admin/health.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [02/Sep/2026:06:35:30 +1000] "GET /inc.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [02/Sep/2026:06:35:30 +1000] "GET /s.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 6 GET /store/af1-richmond9/ 1 GET /wp-content/plugins/woocommerce/assets/wp-content/plugins/woocommerce/ 1 GET /wp-content/plugins/woocommerce/assets//wp-content/plugins/woocommerce/ 1 GET /wp-content/plugins/woocommerce/assets/js/zoom/wp-content/plugins/woocommerce/assets/js/ 1 GET /wp-content/plugins/woocommerce/assets/js/zoom//wp-content/plugins/woocommerce/assets/js/ 1 GET /wp-content/plugins/woocommerce/assets/js/zoom/ 1 GET /wp-content/plugins/woocommerce/assets/js/stupidtable/wp-content/plugins/woocommerce/assets/js/ 1 GET /wp-content/plugins/woocommerce/assets/js/stupidtable//wp-content/plugins/woocommerce/assets/js/ 1 GET /wp-content/plugins/woocommerce/assets/js/stupidtable/ 1 GET /wp-content/plugins/woocommerce/assets/js/sourcebuster/wp-content/plugins/woocommerce/assets/js/ 1 GET /wp-content/plugins/woocommerce/assets/js/sourcebuster//wp-content/plugins/woocommerce/assets/js/ 1 GET /wp-content/plugins/woocommerce/assets/js/sourcebuster/LICENSE -- last 10 requests -- 149.88.19.85 - - [02/Sep/2026:06:35:12 +1000] "GET /wp-content/plugins/woocommerce/assets/client/admin/notices/ HTTP/1.1" 200 760 "-" "-" 149.88.19.85 - - [02/Sep/2026:06:35:13 +1000] "GET /wp-content/plugins/woocommerce/assets/client/admin/number/ HTTP/1.1" 200 882 "-" "-" 149.88.19.85 - - [02/Sep/2026:06:35:13 +1000] "GET /wp-content/plugins/woocommerce/assets/client/admin/onboarding/ HTTP/1.1" 200 43359 "-" "-" 149.88.19.85 - - [02/Sep/2026:06:35:14 +1000] "GET /wp-content/plugins/woocommerce/assets/client/admin/payment-method-promotions/ HTTP/1.1" 200 359 "-" "-" 149.88.19.85 - - [02/Sep/2026:06:35:14 +1000] "GET /wp-content/plugins/woocommerce/assets/client/admin/payment-method-promotions//wp-content/plugins/woocommerce/assets/client/admin/ HTTP/1.1" 301 1 "-" "-" 149.88.19.85 - - [02/Sep/2026:06:35:15 +1000] "GET /wp-content/plugins/woocommerce/assets/client/admin/payment-method-promotions/wp-content/plugins/woocommerce/assets/client/admin/ HTTP/1.1" 404 36654 "-" "-" 149.88.19.85 - - [02/Sep/2026:06:35:17 +1000] "GET /wp-content/plugins/woocommerce/assets/client/admin/payment-method-promotions/style.asset.php HTTP/1.1" 200 1 "-" "-" 149.88.19.85 - - [02/Sep/2026:06:35:18 +1000] "GET /wp-content/plugins/woocommerce/assets/client/admin/print-shipping-label-banner/ HTTP/1.1" 200 356 "-" "-" 149.88.19.85 - - [02/Sep/2026:06:35:18 +1000] "GET /wp-content/plugins/woocommerce/assets/client/admin/print-shipping-label-banner//wp-content/plugins/woocommerce/assets/client/admin/ HTTP/1.1" 301 1 "-" "-" 149.88.19.85 - - [02/Sep/2026:06:35:20 +1000] "GET /wp-content/plugins/woocommerce/assets/client/admin/print-shipping-label-banner/wp-content/plugins/woocommerce/assets/client/admin/ HTTP/1.1" 404 36653 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-09-02 06:33:09 L1=1.59 run=5 blk=0 avail=6212 (45.1%) swpO=0 conn=2 myRSS=3308 php=13 phpRSS=1684 ap=31 tcp=41 topuser=madalice 2026-09-02 06:33:12 L1=1.59 run=3 blk=0 avail=6173 (44.8%) swpO=0 conn=1 myRSS=3308 php=12 phpRSS=1700 ap=30 tcp=36 topuser=madalice 2026-09-02 06:33:19 L1=1.58 run=1 blk=0 avail=6239 (45.3%) swpO=0 conn=1 myRSS=3308 php=12 phpRSS=1609 ap=31 tcp=45 topuser=madalice 2026-09-02 06:33:22 L1=1.58 run=3 blk=0 avail=6099 (44.3%) swpO=0 conn=3 myRSS=3308 php=13 phpRSS=1793 ap=31 tcp=44 topuser=madalice 2026-09-02 06:33:29 L1=1.50 run=2 blk=0 avail=6247 (45.3%) swpO=0 conn=2 myRSS=3308 php=12 phpRSS=1608 ap=30 tcp=40 topuser=madalice 2026-09-02 06:33:32 L1=1.50 run=3 blk=0 avail=6221 (45.2%) swpO=0 conn=2 myRSS=3308 php=14 phpRSS=1728 ap=29 tcp=37 topuser=madalice 2026-09-02 06:33:39 L1=1.43 run=3 blk=0 avail=6172 (44.8%) swpO=0 conn=2 myRSS=3308 php=13 phpRSS=1748 ap=28 tcp=45 topuser=madalice 2026-09-02 06:33:43 L1=1.43 run=5 blk=0 avail=6050 (43.9%) swpO=0 conn=5 myRSS=3308 php=16 phpRSS=1968 ap=28 tcp=41 topuser=madalice 2026-09-02 06:33:49 L1=1.59 run=2 blk=0 avail=6270 (45.5%) swpO=0 conn=2 myRSS=3308 php=13 phpRSS=1664 ap=27 tcp=41 topuser=madalice 2026-09-02 06:33:53 L1=1.59 run=1 blk=0 avail=6278 (45.6%) swpO=0 conn=2 myRSS=3308 php=13 phpRSS=1649 ap=27 tcp=37 topuser=madalice 2026-09-02 06:33:59 L1=1.58 run=3 blk=0 avail=6243 (45.3%) swpO=0 conn=2 myRSS=3308 php=12 phpRSS=1611 ap=33 tcp=48 topuser=madalice 2026-09-02 06:34:03 L1=1.53 run=3 blk=0 avail=6244 (45.3%) swpO=0 conn=4 myRSS=3308 php=14 phpRSS=1692 ap=31 tcp=34 topuser=madalice 2026-09-02 06:34:09 L1=1.41 run=2 blk=0 avail=6303 (45.8%) swpO=0 conn=1 myRSS=3308 php=12 phpRSS=1609 ap=26 tcp=35 topuser=madalice 2026-09-02 06:34:13 L1=1.77 run=4 blk=0 avail=5988 (43.5%) swpO=0 conn=4 myRSS=3308 php=15 phpRSS=2010 ap=25 tcp=35 topuser=madalice 2026-09-02 06:34:20 L1=1.87 run=3 blk=0 avail=6228 (45.2%) swpO=0 conn=2 myRSS=3308 php=12 phpRSS=1608 ap=24 tcp=41 topuser=madalice 2026-09-02 06:34:23 L1=2.04 run=3 blk=0 avail=6163 (44.7%) swpO=0 conn=4 myRSS=3308 php=15 phpRSS=1804 ap=25 tcp=42 topuser=madalice 2026-09-02 06:34:30 L1=2.04 run=3 blk=0 avail=6125 (44.5%) swpO=0 conn=2 myRSS=3308 php=13 phpRSS=1785 ap=28 tcp=42 topuser=madalice 2026-09-02 06:34:33 L1=2.04 run=6 blk=0 avail=6134 (44.5%) swpO=0 conn=3 myRSS=3308 php=16 phpRSS=1852 ap=28 tcp=54 topuser=madalice 2026-09-02 06:34:40 L1=2.03 run=5 blk=0 avail=5973 (43.4%) swpO=0 conn=5 myRSS=3308 php=16 phpRSS=1937 ap=42 tcp=52 topuser=madalice 2026-09-02 06:34:44 L1=2.27 run=2 blk=0 avail=6034 (43.8%) swpO=0 conn=1 myRSS=3308 php=13 phpRSS=1631 ap=41 tcp=49 topuser=madalice 2026-09-02 06:34:50 L1=2.17 run=2 blk=0 avail=6079 (44.1%) swpO=0 conn=2 myRSS=3308 php=13 phpRSS=1754 ap=39 tcp=38 topuser=madalice 2026-09-02 06:34:54 L1=2.15 run=1 blk=0 avail=6231 (45.2%) swpO=0 conn=1 myRSS=3308 php=12 phpRSS=1609 ap=34 tcp=34 topuser=madalice 2026-09-02 06:35:00 L1=1.98 run=6 blk=0 avail=6291 (45.7%) swpO=0 conn=2 myRSS=3308 php=12 phpRSS=1606 ap=29 tcp=32 topuser=madalice 2026-09-02 06:35:04 L1=1.90 run=5 blk=0 avail=6286 (45.6%) swpO=0 conn=3 myRSS=3308 php=13 phpRSS=1644 ap=25 tcp=36 topuser=madalice 2026-09-02 06:35:10 L1=1.83 run=5 blk=0 avail=6209 (45.1%) swpO=0 conn=4 myRSS=3308 php=14 phpRSS=1737 ap=28 tcp=43 topuser=madalice 2026-09-02 06:35:14 L1=1.76 run=2 blk=0 avail=6388 (46.4%) swpO=0 conn=2 myRSS=3308 php=12 phpRSS=1510 ap=27 tcp=34 topuser=madalice 2026-09-02 06:35:20 L1=1.78 run=4 blk=0 avail=6428 (46.7%) swpO=0 conn=4 myRSS=3308 php=12 phpRSS=1464 ap=28 tcp=36 topuser=madalice 2026-09-02 06:35:24 L1=1.64 run=3 blk=0 avail=6484 (47.1%) swpO=0 conn=3 myRSS=3308 php=12 phpRSS=1506 ap=26 tcp=37 topuser=madalice 2026-09-02 06:35:30 L1=1.51 run=5 blk=0 avail=6488 (47.1%) swpO=0 conn=4 myRSS=3308 php=13 phpRSS=1479 ap=33 tcp=44 topuser=madalice 2026-09-02 06:35:34 L1=1.47 run=2 blk=0 avail=6478 (47.0%) swpO=0 conn=3 myRSS=3308 php=14 phpRSS=1523 ap=31 tcp=45 topuser=madalice