INCIDENT 2026-09-02 07:15:05 trigger: php_rss=1750MB ================================================================== load: 2.67 2.22 1.90 6/654 1684458 ncpu:10 mem_avail: 6284MB/13777MB (45.6%) swap_used:2290MB swapout:0/s blocked(D):0 running:4 iowait:0.2% steal:0.0% php: 17 procs / 1750MB heaviest user: madalice (10 procs, 1370MB) apache: 25 procs tcp_estab: 34 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3325 madalice 10 1382 root 251 1069 nobody 24 450 mailman 20 354 cpanellogin 1 240 tubesupplies 2 232 netdata 7 205 evolution 12 181 dovenull 6 67 wp-toolkit 3 59 lowrange 4 58 kurri 2 29 dovecot 3 28 zabbix 1 20 mailnull 2 17 vinesit 1 14 named 1 12 nscd 1 4 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1382 tubesupplies 2 233 evolution 4 165 root 1 25 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4789 MB Active(file): 4223 MB Inactive(file): 725 MB Dirty: 160 MB Writeback: 0 MB SReclaimable: 489 MB CommitLimit: 10984 MB Committed_AS: 9014 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1675064 root 04:31 58084 /opt/imunify360/venv/bin/python3 -m imav.run 1679016 root 00:05 1352 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : 3926885 root 1-04:52:37 4736 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3404800 10.4 Ssl 5-04:55:57 /usr/sbin/mariadbd 704828 1353308 cpanellogin 246104 0.1 S 04:39:11 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 706070 655564 root 189668 0.0 S 04:37:07 spamd child 508924 1 netdata 184548 2.0 Ssl 5-04:55:26 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 706071 655564 root 181664 0.0 S 04:37:07 spamd child 655564 1 root 174396 0.0 Ss 04:51:43 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1637876 3929444 madalice 164140 5.0 S 12:13 php-fpm: pool madalice_com_au 1635808 3929444 madalice 163348 4.7 S 14:37 php-fpm: pool madalice_com_au 1658344 3929444 madalice 162292 7.2 S 06:31 php-fpm: pool madalice_com_au 1635978 3929444 madalice 160588 4.9 S 14:17 php-fpm: pool madalice_com_au 1638804 3929444 madalice 152516 6.2 S 10:46 php-fpm: pool madalice_com_au 1635880 3929444 madalice 151084 4.4 S 14:30 php-fpm: pool madalice_com_au 1635856 3929444 madalice 148668 5.5 S 14:36 php-fpm: pool madalice_com_au 1681392 1678312 tubesupplies 136648 55.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1635858 3929444 madalice 136472 4.4 S 14:35 php-fpm: pool madalice_com_au 1677864 3929444 madalice 128648 4.0 R 01:47 php-fpm: pool madalice_com_au 1683269 1675593 tubesupplies 108016 80.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1679040 1679015 evolution 70716 4.0 Ss 00:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 1684366 1678310 evolution 69332 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1635875 3929444 madalice 60228 5.3 S 14:31 php-fpm: pool madalice_com_au 1675064 1 root 58084 0.5 Ssl 04:31 /opt/imunify360/venv/bin/python3 -m imav.run 509236 509098 root 47852 0.0 Sl 5-04:55:23 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1684133 1670321 evolution 40544 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 37724 0.1 Ss 42-04:33:49 cpsrvd (SSL) - waiting for connections 3929420 1 wp-toolkit 37420 0.0 Ss 1-04:52:28 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 654927 1 root 33244 0.0 Ss 04:52:14 lfd - sleeping 1469 1 root 33196 0.1 Ss 64-21:05:18 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3929444 1 root 26148 0.0 Ss 1-04:52:28 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1675593 506832 nobody 24156 0.1 S 04:05 /usr/sbin/httpd -k start 1463 1 root 24012 0.0 Ss 64-21:05:18 tailwatchd 1671304 506832 nobody 23932 0.1 S 04:56 /usr/sbin/httpd -k start 1659448 506832 nobody 23928 0.1 S 05:40 /usr/sbin/httpd -k start 1659125 506832 nobody 23908 0.1 S 05:50 /usr/sbin/httpd -k start 1670321 506832 nobody 23148 0.0 S 04:57 /usr/sbin/httpd -k start 1676552 506832 nobody 23024 0.0 S 03:13 /usr/sbin/httpd -k start 1678302 506832 nobody 21500 0.0 S 00:59 /usr/sbin/httpd -k start 1678312 506832 nobody 21440 0.0 S 00:58 /usr/sbin/httpd -k start 1677930 506832 nobody 21332 0.0 S 01:36 /usr/sbin/httpd -k start 1677932 506832 nobody 21312 0.0 S 01:36 /usr/sbin/httpd -k start 1678310 506832 nobody 21208 0.1 S 00:58 /usr/sbin/httpd -k start 1677300 506832 nobody 21172 0.0 S 02:14 /usr/sbin/httpd -k start 3929564 1 wp-toolkit 20888 0.0 Ss 1-04:52:27 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 483898 1 zabbix 20800 0.2 Ssl 5-04:56:40 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1678599 506832 nobody 20452 0.0 S 00:40 /usr/sbin/httpd -k start 1677190 506832 nobody 20416 0.0 S 02:24 /usr/sbin/httpd -k start 1678311 506832 nobody 20268 0.1 S 00:58 /usr/sbin/httpd -k start 1678282 506832 nobody 19484 0.1 S 01:00 /usr/sbin/httpd -k start 654684 654679 mailman 19380 0.0 S 04:52:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 654690 654679 mailman 19368 0.0 S 04:52:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 654699 654679 mailman 19348 0.0 S 04:52:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 654685 654679 mailman 19320 0.0 S 04:52:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s 654693 654679 mailman 19200 0.0 S 04:52:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 654687 654679 mailman 19176 0.0 S 04:52:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 1678313 506832 nobody 19168 0.0 S 00:58 /usr/sbin/httpd -k start 654692 654679 mailman 19092 0.0 S 04:52:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 654689 654679 mailman 19048 0.0 S 04:52:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 654686 654679 mailman 19032 0.0 S 04:52:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 654698 654679 mailman 19016 0.0 S 04:52:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 1678519 506832 nobody 18960 0.0 S 00:45 /usr/sbin/httpd -k start 654696 654679 mailman 18948 0.0 S 04:52:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 15912269 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 15912268 | root | 108-1481181613 | Execute | 0 | Sending data | SELECT * FROM notifications WHERE staffid='278' ORDER by ID DESC LIMIT 20 | +----------+------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min bigdeals/bigdeals.com.au-ssl_log 207 madalice/madalice.com.au-ssl_log 144 evolution/my.evolutionerp.com.au-ssl_log 143 olympic/olympicfencing.com.au-ssl_log 124 evolution/app.evolutionerp.com.au-ssl_log 97 evolution/portal.evolutionerp.com.au-ssl_log 40 aaa/aaadownunder.com.au-ssl_log 4 corpkicks/corporatekicks.com.au-ssl_log 4 tubesupplies/tubesupplies.com.au-ssl_log 3 infinium/infinium.net.au-ssl_log 2 kurri/kurrimotorinn.com.au-ssl_log 1 olympic/olympicfencing.com.au 1 otterfencing/otterfencing.com.au-ssl_log 1 (total vhosts taking traffic: 13) --- top client IPs across all vhosts (last 3 min) --- 207 34.17.115.140 123 149.88.19.85 115 4.204.224.164 97 40.115.94.245 94 203.54.180.238 53 150.228.151.47 17 103.104.164.114 15 13.221.213.225 12 103.104.165.99 8 118.127.40.55 6 136.111.191.51 3 40.77.167.41 2 91.92.243.249 2 209.141.33.142 2 1.145.118.159 --- top request paths across all vhosts (last 3 min) --- 52 POST /functions.php 30 GET /heartbeat.php 20 GET /app/ajax.php 17 GET /index.php 9 POST /plugins/csvexporter/plugin.php 8 POST /wp-cron.php 7 POST /app/ajax/selectFilterSingle.php 7 POST /app/ajax/selectFilter.php 6 POST /clienteditsave.php 6 GET / 5 POST /inveditsave.php 5 POST /app/ajax.php 5 GET /store/af1-richmond9/ 4 POST /wp-login.php 4 POST /portal/register 4 POST /jobeditsave.php 4 POST / 4 GET /robots.txt 3 POST /inveditsubsave.php 3 GET /products/security-and-industrial-fencing --- busiest 3 vhosts: top paths + last 10 requests --- == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/.env 1 GET /wp/.env 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /web/.env 1 GET /vue/.env 1 GET /vite/.env 1 GET /vendor/.env 1 GET /var/www/html/.env -- last 10 requests -- 34.17.115.140 - - [02/Sep/2026:07:15:02 +1000] "GET /rabbitmq/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.115.140 - - [02/Sep/2026:07:15:02 +1000] "GET /kafka/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.115.140 - - [02/Sep/2026:07:15:02 +1000] "GET /queue/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.115.140 - - [02/Sep/2026:07:15:02 +1000] "GET /worker/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.115.140 - - [02/Sep/2026:07:15:03 +1000] "GET /job/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.115.140 - - [02/Sep/2026:07:15:04 +1000] "GET /test/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.115.140 - - [02/Sep/2026:07:15:04 +1000] "GET /qa/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.115.140 - - [02/Sep/2026:07:15:04 +1000] "GET /preview/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.115.140 - - [02/Sep/2026:07:15:04 +1000] "GET /beta/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.115.140 - - [02/Sep/2026:07:15:05 +1000] "GET /uat/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 5 GET /store/af1-richmond9/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/wp-content/plugins/woocommerce/packages/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor//wp-content/plugins/woocommerce/packages/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src/wp-content/plugins/woocommerce/packages/email-editor/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src//wp-content/plugins/woocommerce/packages/email-editor/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/wp-content/plugins/woocommerce/packages/email-editor/src/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations//wp-content/plugins/woocommerce/packages/email-editor/src/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core//wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer//wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/ -- last 10 requests -- 149.88.19.85 - - [02/Sep/2026:07:14:46 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/class-quote.php HTTP/1.1" 500 1 "-" "-" 149.88.19.85 - - [02/Sep/2026:07:14:47 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/class-social-link.php HTTP/1.1" 500 1 "-" "-" 149.88.19.85 - - [02/Sep/2026:07:14:48 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/class-social-links.php HTTP/1.1" 500 1 "-" "-" 149.88.19.85 - - [02/Sep/2026:07:14:49 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/class-table.php HTTP/1.1" 500 1 "-" "-" 149.88.19.85 - - [02/Sep/2026:07:14:50 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/class-text.php HTTP/1.1" 500 1 "-" "-" 114.119.140.234 - - [02/Sep/2026:07:14:48 +1000] "GET /store/af1-richmond9/?rating=2&verified=1&wcpr_rating=2 HTTP/1.1" 200 50011 "https://madalice.com.au/store/af1-richmond9/?rating=2&verified=1&wcpr_rating=2" "Mozilla/ 149.88.19.85 - - [02/Sep/2026:07:14:51 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/class-video.php HTTP/1.1" 500 1 "-" "-" 149.88.19.85 - - [02/Sep/2026:07:14:52 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/icons/ HTTP/1.1" 200 644 "-" "-" 149.88.19.85 - - [02/Sep/2026:07:14:52 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/icons//wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/ 149.88.19.85 - - [02/Sep/2026:07:14:53 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/icons/wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/C == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 52 POST /functions.php 20 GET /app/ajax.php 13 GET /index.php 9 POST /plugins/csvexporter/plugin.php 7 POST /app/ajax/selectFilterSingle.php 7 POST /app/ajax/selectFilter.php 6 POST /clienteditsave.php 5 POST /inveditsave.php 5 POST /app/ajax.php 4 POST /jobeditsave.php 4 GET / 3 POST /inveditsubsave.php -- last 10 requests -- 203.54.180.238 - - [02/Sep/2026:07:14:55 +1000] "GET /index.php?page=jobedit&id=29280 HTTP/1.1" 200 187234 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 203.54.180.238 - - [02/Sep/2026:07:14:58 +1000] "POST /clienteditsave.php?clientid=18343&call=getCategoryDiscounts HTTP/1.1" 200 201 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29280" "Mozilla/5.0 (Windows 203.54.180.238 - - [02/Sep/2026:07:14:58 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29280" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 203.54.180.238 - - [02/Sep/2026:07:14:58 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29280" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 203.54.180.238 - - [02/Sep/2026:07:14:57 +1000] "POST /logsave.php?call=getHistory&id=29280&module=job HTTP/1.1" 200 842 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29280" "Mozilla/5.0 (Windows NT 10.0; Win 203.54.180.238 - - [02/Sep/2026:07:14:58 +1000] "GET /app/ajax.php?cn=&furi=true&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=15646646460 HTTP/1.1" 200 202 "https://my.evolutionerp.com.au/index.php?page=jobedit&id 203.54.180.238 - - [02/Sep/2026:07:14:58 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Djobedit%26id%3D29280&call=getUserSetting&caller=ajaxSubmitLocal&seq=13389339081 HTTP/1.1" 200 111 "https://my. 203.54.180.238 - - [02/Sep/2026:07:14:58 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=17706198185 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 203.54.180.238 - - [02/Sep/2026:07:14:58 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=15576360522 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 203.54.180.238 - - [02/Sep/2026:07:14:58 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobedit%26id%3D29280&call=getUserSetting&caller=ajaxSubmitLocal&seq=15379919188 HTTP/1.1" 200 160 "https://my.evolutionerp.com.a --- last 30 samples (run-up to this incident) --- 2026-09-02 07:12:44 L1=1.69 run=1 blk=0 avail=6858 (49.8%) swpO=0 conn=2 myRSS=3324 php=13 phpRSS=1056 ap=24 tcp=39 topuser=madalice 2026-09-02 07:12:44 L1=1.69 run=1 blk=0 avail=6875 (49.9%) swpO=0 conn=2 myRSS=3324 php=13 phpRSS=1056 ap=24 tcp=38 topuser=madalice 2026-09-02 07:12:54 L1=1.51 run=2 blk=0 avail=6845 (49.7%) swpO=0 conn=2 myRSS=3324 php=14 phpRSS=1105 ap=27 tcp=39 topuser=madalice 2026-09-02 07:12:55 L1=1.51 run=3 blk=0 avail=6843 (49.7%) swpO=0 conn=2 myRSS=3324 php=14 phpRSS=1108 ap=27 tcp=39 topuser=madalice 2026-09-02 07:13:04 L1=1.50 run=4 blk=0 avail=6502 (47.2%) swpO=1 conn=4 myRSS=3324 php=17 phpRSS=1532 ap=26 tcp=40 topuser=madalice 2026-09-02 07:13:05 L1=1.50 run=6 blk=0 avail=6496 (47.2%) swpO=1 conn=4 myRSS=3324 php=17 phpRSS=1536 ap=26 tcp=39 topuser=madalice 2026-09-02 07:13:15 L1=1.57 run=1 blk=0 avail=6438 (46.7%) swpO=1 conn=2 myRSS=3324 php=13 phpRSS=1528 ap=23 tcp=28 topuser=madalice 2026-09-02 07:13:15 L1=1.57 run=1 blk=0 avail=6435 (46.7%) swpO=0 conn=2 myRSS=3324 php=13 phpRSS=1528 ap=23 tcp=28 topuser=madalice 2026-09-02 07:13:25 L1=1.48 run=2 blk=0 avail=6604 (47.9%) swpO=0 conn=2 myRSS=3324 php=13 phpRSS=1377 ap=18 tcp=28 topuser=madalice 2026-09-02 07:13:25 L1=1.48 run=2 blk=0 avail=6601 (47.9%) swpO=0 conn=2 myRSS=3324 php=14 phpRSS=1410 ap=18 tcp=30 topuser=madalice 2026-09-02 07:13:35 L1=1.48 run=1 blk=0 avail=6461 (46.9%) swpO=0 conn=2 myRSS=3324 php=13 phpRSS=1512 ap=21 tcp=31 topuser=madalice 2026-09-02 07:13:35 L1=1.48 run=3 blk=0 avail=6459 (46.9%) swpO=0 conn=3 myRSS=3324 php=13 phpRSS=1512 ap=21 tcp=31 topuser=madalice 2026-09-02 07:13:45 L1=1.49 run=2 blk=0 avail=6275 (45.6%) swpO=0 conn=3 myRSS=3324 php=13 phpRSS=1695 ap=21 tcp=30 topuser=madalice 2026-09-02 07:13:45 L1=1.49 run=2 blk=0 avail=6257 (45.4%) swpO=0 conn=3 myRSS=3324 php=13 phpRSS=1715 ap=21 tcp=30 topuser=madalice 2026-09-02 07:13:55 L1=1.41 run=3 blk=0 avail=6528 (47.4%) swpO=0 conn=3 myRSS=3324 php=14 phpRSS=1451 ap=22 tcp=28 topuser=madalice 2026-09-02 07:13:55 L1=1.41 run=1 blk=0 avail=6555 (47.6%) swpO=0 conn=3 myRSS=3324 php=13 phpRSS=1411 ap=22 tcp=28 topuser=madalice 2026-09-02 07:14:05 L1=1.35 run=4 blk=0 avail=6922 (50.2%) swpO=0 conn=3 myRSS=3324 php=15 phpRSS=1109 ap=21 tcp=34 topuser=madalice 2026-09-02 07:14:05 L1=1.35 run=5 blk=0 avail=6896 (50.1%) swpO=0 conn=3 myRSS=3324 php=15 phpRSS=1132 ap=22 tcp=35 topuser=madalice 2026-09-02 07:14:15 L1=1.45 run=3 blk=0 avail=7115 (51.6%) swpO=0 conn=2 myRSS=3324 php=13 phpRSS=787 ap=27 tcp=35 topuser=madalice 2026-09-02 07:14:15 L1=1.45 run=2 blk=0 avail=7132 (51.8%) swpO=0 conn=3 myRSS=3324 php=13 phpRSS=787 ap=27 tcp=35 topuser=madalice 2026-09-02 07:14:25 L1=1.54 run=4 blk=0 avail=6590 (47.8%) swpO=0 conn=2 myRSS=3324 php=15 phpRSS=1343 ap=32 tcp=55 topuser=madalice 2026-09-02 07:14:25 L1=1.54 run=4 blk=0 avail=6570 (47.7%) swpO=0 conn=3 myRSS=3324 php=15 phpRSS=1358 ap=33 tcp=55 topuser=madalice 2026-09-02 07:14:35 L1=1.61 run=3 blk=0 avail=6627 (48.1%) swpO=0 conn=2 myRSS=3324 php=13 phpRSS=1276 ap=29 tcp=34 topuser=madalice 2026-09-02 07:14:35 L1=1.61 run=1 blk=0 avail=6629 (48.1%) swpO=0 conn=3 myRSS=3324 php=13 phpRSS=1276 ap=29 tcp=34 topuser=madalice 2026-09-02 07:14:45 L1=1.66 run=1 blk=0 avail=7038 (51.1%) swpO=0 conn=2 myRSS=3324 php=13 phpRSS=907 ap=23 tcp=38 topuser=madalice 2026-09-02 07:14:45 L1=1.66 run=4 blk=0 avail=7018 (50.9%) swpO=0 conn=2 myRSS=3324 php=13 phpRSS=907 ap=23 tcp=38 topuser=madalice 2026-09-02 07:14:55 L1=1.86 run=3 blk=0 avail=6903 (50.1%) swpO=0 conn=2 myRSS=3324 php=15 phpRSS=1113 ap=22 tcp=33 topuser=madalice 2026-09-02 07:14:55 L1=1.86 run=5 blk=0 avail=6865 (49.8%) swpO=0 conn=2 myRSS=3324 php=15 phpRSS=1138 ap=22 tcp=33 topuser=madalice 2026-09-02 07:15:05 L1=2.67 run=4 blk=0 avail=6284 (45.6%) swpO=0 conn=6 myRSS=3325 php=17 phpRSS=1750 ap=25 tcp=34 topuser=madalice 2026-09-02 07:15:05 L1=2.67 run=6 blk=0 avail=6226 (45.2%) swpO=0 conn=6 myRSS=3325 php=17 phpRSS=1836 ap=25 tcp=34 topuser=madalice