INCIDENT 2026-09-02 07:13:04 trigger: php_rss=1532MB ================================================================== load: 1.50 2.18 1.86 4/653 1677487 ncpu:10 mem_avail: 6502MB/13777MB (47.2%) swap_used:2291MB swapout:1/s blocked(D):0 running:4 iowait:0.2% steal:0.0% php: 17 procs / 1532MB heaviest user: madalice (10 procs, 1273MB) apache: 26 procs tcp_estab: 40 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3324 madalice 10 1273 root 250 1077 nobody 25 469 mailman 20 354 evolution 12 250 cpanellogin 1 240 netdata 7 203 dovenull 6 67 wp-toolkit 3 59 lowrange 4 58 mailnull 5 39 kurri 2 29 dovecot 3 28 zabbix 1 19 kamcool 1 14 corpkicks 1 14 named 1 12 nscd 1 4 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1273 evolution 6 234 root 1 25 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4655 MB Active(file): 4194 MB Inactive(file): 735 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 489 MB CommitLimit: 10984 MB Committed_AS: 8900 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1675064 root 02:30 58084 /opt/imunify360/venv/bin/python3 -m imav.run 3926885 root 1-04:50:36 4736 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3404712 10.4 Ssl 5-04:53:56 /usr/sbin/mariadbd 704828 1353308 cpanellogin 246104 0.1 S 04:37:10 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 706070 655564 root 189668 0.0 S 04:35:06 spamd child 508924 1 netdata 182536 2.0 Ssl 5-04:53:25 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 706071 655564 root 181664 0.0 S 04:35:06 spamd child 655564 1 root 174396 0.0 Ss 04:49:42 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1635978 3929444 madalice 160640 4.9 S 12:16 php-fpm: pool madalice_com_au 1637876 3929444 madalice 159776 4.6 S 10:12 php-fpm: pool madalice_com_au 1566821 3929444 madalice 150564 4.9 S 28:51 php-fpm: pool madalice_com_au 1635858 3929444 madalice 147468 4.4 S 12:34 php-fpm: pool madalice_com_au 1635880 3929444 madalice 136788 4.2 S 12:29 php-fpm: pool madalice_com_au 1638804 3929444 madalice 134220 5.9 R 08:45 php-fpm: pool madalice_com_au 1635856 3929444 madalice 128312 5.4 S 12:35 php-fpm: pool madalice_com_au 1635808 3929444 madalice 128116 4.4 S 12:36 php-fpm: pool madalice_com_au 1635875 3929444 madalice 100812 5.2 S 12:30 php-fpm: pool madalice_com_au 1677426 1676989 evolution 72456 6.6 S 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1675064 1 root 58084 0.9 Ssl 02:30 /opt/imunify360/venv/bin/python3 -m imav.run 1658344 3929444 madalice 57660 7.2 S 04:30 php-fpm: pool madalice_com_au 509236 509098 root 47852 0.0 Sl 5-04:53:22 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1677456 1677190 evolution 40524 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1677450 1677300 evolution 39752 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1677453 1675593 evolution 39636 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1677458 1676097 evolution 39300 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 37724 0.1 Ss 42-04:31:48 cpsrvd (SSL) - waiting for connections 3929420 1 wp-toolkit 37420 0.0 Ss 1-04:50:27 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 654927 1 root 33244 0.0 Ss 04:50:13 lfd - sleeping 1469 1 root 33196 0.1 Ss 64-21:03:17 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3929444 1 root 26148 0.0 Ss 1-04:50:27 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1463 1 root 24012 0.0 Ss 64-21:03:17 tailwatchd 1659448 506832 nobody 23744 0.0 S 03:39 /usr/sbin/httpd -k start 1659125 506832 nobody 23676 0.1 S 03:49 /usr/sbin/httpd -k start 1671304 506832 nobody 23652 0.1 S 02:55 /usr/sbin/httpd -k start 1676097 506832 nobody 23144 0.1 S 01:42 /usr/sbin/httpd -k start 1655985 506832 nobody 23028 0.1 S 05:38 /usr/sbin/httpd -k start 1670321 506832 nobody 23020 0.0 S 02:56 /usr/sbin/httpd -k start 1675520 506832 nobody 22928 0.1 S 02:06 /usr/sbin/httpd -k start 1676338 506832 nobody 22508 0.0 S 01:31 /usr/sbin/httpd -k start 1659148 506832 nobody 22364 0.0 S 03:48 /usr/sbin/httpd -k start 1659162 506832 nobody 22164 0.0 S 03:47 /usr/sbin/httpd -k start 1675593 506832 nobody 21744 0.0 S 02:04 /usr/sbin/httpd -k start 1677306 506832 nobody 21616 0.2 S 00:12 /usr/sbin/httpd -k start 1668711 506832 nobody 21144 0.0 S 02:57 /usr/sbin/httpd -k start 1676552 506832 nobody 21096 0.0 S 01:12 /usr/sbin/httpd -k start 3929564 1 wp-toolkit 20888 0.0 Ss 1-04:50:26 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1671291 506832 nobody 20692 0.0 S 02:55 /usr/sbin/httpd -k start 1659426 506832 nobody 20584 0.0 S 03:39 /usr/sbin/httpd -k start 1659418 506832 nobody 20488 0.0 S 03:39 /usr/sbin/httpd -k start 1677300 506832 nobody 20252 0.1 S 00:13 /usr/sbin/httpd -k start 483898 1 zabbix 19572 0.2 Ssl 5-04:54:39 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1676553 506832 nobody 19384 0.1 S 01:12 /usr/sbin/httpd -k start 654684 654679 mailman 19380 0.0 S 04:50:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 654690 654679 mailman 19368 0.0 S 04:50:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 654699 654679 mailman 19348 0.0 S 04:50:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 654685 654679 mailman 19320 0.0 S 04:50:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s 654693 654679 mailman 19200 0.0 S 04:50:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 654687 654679 mailman 19176 0.0 S 04:50:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 654692 654679 mailman 19092 0.0 S 04:50:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 654689 654679 mailman 19048 0.0 S 04:50:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 654686 654679 mailman 19032 0.0 S 04:50:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 654698 654679 mailman 19016 0.0 S 04:50:22 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+----------------+---------+------+----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+----------------+---------+------+----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 15905486 | root | 108-1481181613 | Execute | 0 | Sending data | SELECT external, workshopnotes, (SELECT cost FROM inventory WHERE id = (SELECT default_cost_item fROM mfprocesses WHERE id = ?)) as cost, itemid as takeup, setupcost, setupTime, leadTime, cost as pcost FROM mfprocesses WHERE id = ? | | 15905485 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+----------------+---------+------+----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min whiz/whizengineering.com.au-ssl_log 208 vinesit/vinesit.com.au-ssl_log 206 evolution/my.evolutionerp.com.au-ssl_log 174 tubesupplies/tubesupplies.com.au-ssl_log 151 madalice/madalice.com.au-ssl_log 134 evolution/app.evolutionerp.com.au-ssl_log 103 kamcool/kamcool.com.au-ssl_log 90 evolution/portal.evolutionerp.com.au-ssl_log 31 alison/alisonarts.com.au-ssl_log 1 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 202 81.171.72.93 181 91.148.245.81 129 149.88.19.85 103 40.115.94.245 90 20.63.81.20 84 91.148.244.131 67 203.54.180.238 58 103.104.165.99 51 81.171.74.60 44 81.171.72.135 37 150.228.151.47 19 1.145.118.159 19 103.104.164.114 2 40.77.167.41 2 27.71.118.28 --- top request paths across all vhosts (last 3 min) --- 103 GET /api/getItem/LWFBW2001KG 66 POST /functions.php 31 GET /heartbeat.php 21 GET /.env 21 GET /config.xml 20 GET /user_secrets.yml 20 GET /.svn/wc.db 20 GET /.ssh/id_rsa 20 GET /.ssh/id_ed25519 20 GET /server.key 20 GET /phpinfo.php 20 GET /.env.production 20 GET /docker-compose.yml 20 GET /database.sql 20 GET /config.php 20 GET /.bash_history 20 GET /app/ajax.php 20 GET /api/.env 19 GET /wp-config.php 19 GET /wp-admin/setup-config.php --- busiest 3 vhosts: top paths + last 10 requests --- == whiz/whizengineering.com.au-ssl_log == -- top paths -- 7 POST / 7 GET /wp-admin/setup-config.php 7 GET /_vti_pvt/service.pwd 7 GET /user_secrets.yml 7 GET /.svn/wc.db 7 GET /storage/logs/laravel.log 7 GET /.ssh/id_rsa 7 GET /.ssh/id_ed25519 7 GET /server.key 7 GET /phpinfo.php 7 GET /.npmrc 7 GET /.git/HEAD -- last 10 requests -- 91.148.245.81 - - [02/Sep/2026:07:11:38 +1000] "GET /server.key HTTP/1.1" 404 - "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:11:38 +1000] "GET /.npmrc HTTP/1.1" 403 13 "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:11:38 +1000] "GET /config.php HTTP/1.1" 404 - "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:11:38 +1000] "GET /.bash_history HTTP/1.1" 403 13 "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:11:38 +1000] "GET /backup.sql HTTP/1.1" 404 - "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:11:38 +1000] "GET /backup.zip HTTP/1.1" 404 - "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:11:38 +1000] "GET /actuator/heapdump HTTP/1.1" 404 - "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:11:38 +1000] "GET /.svn/wc.db HTTP/1.1" 404 - "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:11:38 +1000] "GET /database.sql HTTP/1.1" 404 - "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:11:38 +1000] "GET /database_backup.sql HTTP/1.1" 404 - "-" "Go-http-client/1.1" == vinesit/vinesit.com.au-ssl_log == -- top paths -- 8 HEAD / 7 GET /wp-config.php 7 GET /wp-admin/setup-config.php 7 GET /_vti_pvt/service.pwd 7 GET /user_secrets.yml 7 GET /.svn/wc.db 7 GET /storage/logs/laravel.log 7 GET /.ssh/id_rsa 7 GET /.ssh/id_ed25519 7 GET /server.key 7 GET /phpinfo.php 7 GET /.npmrc -- last 10 requests -- 91.148.245.81 - - [02/Sep/2026:07:11:31 +1000] "GET /phpinfo.php HTTP/1.1" 403 12 "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:11:31 +1000] "GET /config.php HTTP/1.1" 400 52 "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:11:32 +1000] "GET /user_secrets.yml HTTP/1.1" 400 52 "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:11:32 +1000] "GET /server.key HTTP/1.1" 400 52 "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:11:33 +1000] "GET /.env.production HTTP/1.1" 403 12 "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:11:33 +1000] "GET /.bash_history HTTP/1.1" 403 13 "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:11:33 +1000] "GET /.npmrc HTTP/1.1" 403 13 "-" "Go-http-client/1.1" 91.148.245.81 - - [02/Sep/2026:07:11:33 +1000] "GET /dump.sql HTTP/1.1" 400 52 "-" "Go-http-client/1.1" 27.71.118.28 - - [02/Sep/2026:07:11:50 +1000] "HEAD / HTTP/1.1" 200 - "http://cpanel.vinesit.com.au" "go-resty/2.16.5 (https://github.com/go-resty/resty)" 27.71.118.28 - - [02/Sep/2026:07:11:51 +1000] "GET / HTTP/1.1" 200 12485 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 66 POST /functions.php 20 GET /app/ajax.php 18 GET /index.php 14 POST /plugins/csvexporter/plugin.php 12 POST /app/ajax/selectFilter.php 11 POST /jobeditsave.php 5 POST /app/ajax/selectFilterSingle.php 4 POST /quoteditsave.php 4 POST //functions.php 4 POST /clienteditsave.php 3 POST /plugins/fencecosting/plugin.php 2 POST /inveditsubsave.php -- last 10 requests -- 150.228.151.47 - - [02/Sep/2026:07:12:55 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=LOCKBO HTTP/1.1" 200 1582 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=4463" "Mozilla/5.0 (Windows NT 1.145.118.159 - - [02/Sep/2026:07:12:55 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37023§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win64 203.54.180.238 - - [02/Sep/2026:07:12:54 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 10415 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 103.104.165.99 - - [02/Sep/2026:07:12:56 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=activities&date=09-09-2026&staff=10" "Mozilla/5.0 (Windows NT 10.0; Win 103.104.165.99 - - [02/Sep/2026:07:12:57 +1000] "POST //functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au//index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 203.54.180.238 - - [02/Sep/2026:07:12:55 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 10415 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 203.54.180.238 - - [02/Sep/2026:07:12:56 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 4951 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:07:12:56 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 618 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 203.54.180.238 - - [02/Sep/2026:07:12:56 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 955 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 203.54.180.238 - - [02/Sep/2026:07:12:57 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 618 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. --- last 30 samples (run-up to this incident) --- 2026-09-02 07:10:43 L1=3.26 run=13 blk=0 avail=5983 (43.4%) swpO=1 conn=11 myRSS=3324 php=21 phpRSS=1880 ap=61 tcp=63 topuser=madalice 2026-09-02 07:10:44 L1=3.88 run=14 blk=0 avail=5880 (42.7%) swpO=1 conn=9 myRSS=3324 php=21 phpRSS=2003 ap=60 tcp=70 topuser=madalice 2026-09-02 07:10:54 L1=4.05 run=8 blk=0 avail=6413 (46.5%) swpO=0 conn=8 myRSS=3324 php=20 phpRSS=1545 ap=51 tcp=43 topuser=madalice 2026-09-02 07:10:54 L1=4.44 run=8 blk=0 avail=6384 (46.3%) swpO=0 conn=9 myRSS=3324 php=18 phpRSS=1392 ap=50 tcp=42 topuser=madalice 2026-09-02 07:11:04 L1=4.46 run=9 blk=0 avail=6415 (46.6%) swpO=0 conn=8 myRSS=3324 php=17 phpRSS=1436 ap=48 tcp=62 topuser=madalice 2026-09-02 07:11:04 L1=4.46 run=7 blk=0 avail=6478 (47.0%) swpO=0 conn=9 myRSS=3324 php=17 phpRSS=1401 ap=48 tcp=53 topuser=madalice 2026-09-02 07:11:14 L1=4.31 run=11 blk=1 avail=6421 (46.6%) swpO=0 conn=6 myRSS=3324 php=20 phpRSS=1608 ap=39 tcp=51 topuser=madalice 2026-09-02 07:11:14 L1=4.31 run=14 blk=0 avail=6492 (47.1%) swpO=0 conn=5 myRSS=3324 php=17 phpRSS=1413 ap=39 tcp=51 topuser=madalice 2026-09-02 07:11:24 L1=3.88 run=4 blk=0 avail=6682 (48.5%) swpO=0 conn=6 myRSS=3324 php=14 phpRSS=1188 ap=35 tcp=54 topuser=madalice 2026-09-02 07:11:24 L1=3.88 run=4 blk=0 avail=6638 (48.2%) swpO=0 conn=5 myRSS=3324 php=15 phpRSS=1213 ap=35 tcp=53 topuser=madalice 2026-09-02 07:11:34 L1=3.51 run=2 blk=0 avail=6563 (47.6%) swpO=0 conn=6 myRSS=3324 php=13 phpRSS=1252 ap=36 tcp=55 topuser=madalice 2026-09-02 07:11:34 L1=3.51 run=2 blk=0 avail=6570 (47.7%) swpO=0 conn=5 myRSS=3324 php=14 phpRSS=1281 ap=36 tcp=56 topuser=madalice 2026-09-02 07:11:44 L1=3.35 run=3 blk=0 avail=6745 (49.0%) swpO=0 conn=3 myRSS=3324 php=13 phpRSS=1180 ap=27 tcp=35 topuser=madalice 2026-09-02 07:11:44 L1=3.35 run=3 blk=0 avail=6712 (48.7%) swpO=0 conn=5 myRSS=3324 php=13 phpRSS=1104 ap=27 tcp=35 topuser=madalice 2026-09-02 07:11:54 L1=2.91 run=5 blk=0 avail=6567 (47.7%) swpO=0 conn=3 myRSS=3324 php=15 phpRSS=1392 ap=27 tcp=51 topuser=madalice 2026-09-02 07:11:54 L1=2.91 run=1 blk=0 avail=6697 (48.6%) swpO=0 conn=5 myRSS=3324 php=14 phpRSS=1225 ap=27 tcp=51 topuser=madalice 2026-09-02 07:12:04 L1=2.61 run=3 blk=0 avail=6848 (49.7%) swpO=0 conn=3 myRSS=3324 php=13 phpRSS=1092 ap=25 tcp=36 topuser=madalice 2026-09-02 07:12:04 L1=2.61 run=1 blk=0 avail=6853 (49.7%) swpO=0 conn=5 myRSS=3324 php=13 phpRSS=1088 ap=25 tcp=34 topuser=madalice 2026-09-02 07:12:14 L1=2.37 run=2 blk=0 avail=6804 (49.4%) swpO=0 conn=3 myRSS=3324 php=13 phpRSS=1153 ap=22 tcp=39 topuser=madalice 2026-09-02 07:12:14 L1=2.37 run=1 blk=0 avail=6892 (50.0%) swpO=0 conn=2 myRSS=3324 php=13 phpRSS=1060 ap=22 tcp=40 topuser=madalice 2026-09-02 07:12:24 L1=2.16 run=1 blk=0 avail=6938 (50.4%) swpO=0 conn=3 myRSS=3324 php=13 phpRSS=1001 ap=22 tcp=38 topuser=madalice 2026-09-02 07:12:24 L1=2.16 run=1 blk=0 avail=6944 (50.4%) swpO=0 conn=2 myRSS=3324 php=13 phpRSS=1001 ap=22 tcp=38 topuser=madalice 2026-09-02 07:12:34 L1=1.83 run=1 blk=0 avail=6824 (49.5%) swpO=0 conn=3 myRSS=3324 php=13 phpRSS=1114 ap=23 tcp=36 topuser=madalice 2026-09-02 07:12:34 L1=1.83 run=1 blk=0 avail=6836 (49.6%) swpO=0 conn=2 myRSS=3324 php=14 phpRSS=1123 ap=23 tcp=36 topuser=madalice 2026-09-02 07:12:44 L1=1.69 run=1 blk=0 avail=6858 (49.8%) swpO=0 conn=2 myRSS=3324 php=13 phpRSS=1056 ap=24 tcp=39 topuser=madalice 2026-09-02 07:12:44 L1=1.69 run=1 blk=0 avail=6875 (49.9%) swpO=0 conn=2 myRSS=3324 php=13 phpRSS=1056 ap=24 tcp=38 topuser=madalice 2026-09-02 07:12:54 L1=1.51 run=2 blk=0 avail=6845 (49.7%) swpO=0 conn=2 myRSS=3324 php=14 phpRSS=1105 ap=27 tcp=39 topuser=madalice 2026-09-02 07:12:55 L1=1.51 run=3 blk=0 avail=6843 (49.7%) swpO=0 conn=2 myRSS=3324 php=14 phpRSS=1108 ap=27 tcp=39 topuser=madalice 2026-09-02 07:13:04 L1=1.50 run=4 blk=0 avail=6502 (47.2%) swpO=1 conn=4 myRSS=3324 php=17 phpRSS=1532 ap=26 tcp=40 topuser=madalice 2026-09-02 07:13:05 L1=1.50 run=6 blk=0 avail=6496 (47.2%) swpO=1 conn=4 myRSS=3324 php=17 phpRSS=1536 ap=26 tcp=39 topuser=madalice