INCIDENT 2026-09-02 07:44:16 trigger: php_rss=1505MB ================================================================== load: 4.33 3.05 2.20 9/664 1787668 ncpu:10 mem_avail: 6362MB/13777MB (46.2%) swap_used:2287MB swapout:0/s blocked(D):1 running:7 iowait:0.1% steal:0.0% php: 16 procs / 1505MB heaviest user: madalice (8 procs, 944MB) apache: 53 procs tcp_estab: 58 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3329 root 246 1025 nobody 52 1022 madalice 8 951 mailman 20 354 evolution 11 247 cpanellogin 1 242 netdata 7 204 olympic 1 130 tubesupplies 1 129 otterfencing 1 102 dovenull 6 67 wp-toolkit 3 59 lowrange 2 29 dovecot 3 28 zabbix 1 20 kurri 1 14 named 1 12 mailnull 1 9 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 8 953 evolution 5 233 tubesupplies 1 130 olympic 1 130 otterfencing 1 102 root 1 25 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4885 MB Active(file): 4268 MB Inactive(file): 728 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 497 MB CommitLimit: 10984 MB Committed_AS: 9309 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 1-05:21:47 4736 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3409432 10.4 Ssl 5-05:25:08 /usr/sbin/mariadbd 704828 1353308 cpanellogin 248476 0.1 S 05:08:22 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 1749961 3929444 madalice 222588 5.7 R 10:26 php-fpm: pool madalice_com_au 706070 655564 root 194944 0.0 S 05:06:18 spamd child 508924 1 netdata 183172 2.0 Ssl 5-05:24:37 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 706071 655564 root 181664 0.0 S 05:06:18 spamd child 655564 1 root 174396 0.0 Ss 05:20:54 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1732381 3929444 madalice 161120 7.1 S 15:19 php-fpm: pool madalice_com_au 1749087 3929444 madalice 155368 6.4 S 12:01 php-fpm: pool madalice_com_au 1732385 3929444 madalice 143896 6.0 S 15:17 php-fpm: pool madalice_com_au 1787600 1785612 olympic 133992 52.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1787605 1785521 otterfencing 110472 92.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1766320 3929444 madalice 107680 8.0 S 07:19 php-fpm: pool madalice_com_au 1787613 1786529 evolution 92480 30.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1732351 3929444 madalice 76160 5.3 S 15:23 php-fpm: pool madalice_com_au 1787660 1786361 evolution 73412 10.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1787601 1786963 evolution 67064 8.0 S 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1733554 3929444 madalice 67036 7.0 S 14:15 php-fpm: pool madalice_com_au 1732529 3929444 madalice 49952 5.4 S 15:09 php-fpm: pool madalice_com_au 509236 509098 root 47860 0.0 Sl 5-05:24:34 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1787607 1786531 evolution 40508 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 37752 0.1 Ss 42-05:03:00 cpsrvd (SSL) - waiting for connections 3929420 1 wp-toolkit 37420 0.0 Ss 1-05:21:39 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1787612 1469 root 34852 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 654927 1 root 33252 0.0 Ss 05:21:25 lfd - sleeping 1469 1 root 33208 0.1 Ss 64-21:34:29 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3929444 1 root 26140 0.0 Ss 1-05:21:39 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1785364 506832 nobody 24308 0.2 S 02:19 /usr/sbin/httpd -k start 1463 1 root 24012 0.0 Ss 64-21:34:29 tailwatchd 1766184 506832 nobody 24004 0.0 S 07:27 /usr/sbin/httpd -k start 1784201 506832 nobody 24004 0.1 S 02:55 /usr/sbin/httpd -k start 1784526 506832 nobody 23548 0.1 S 02:52 /usr/sbin/httpd -k start 1786361 506832 nobody 23360 0.1 S 01:12 /usr/sbin/httpd -k start 1785626 506832 nobody 23352 0.1 S 01:56 /usr/sbin/httpd -k start 1749400 506832 nobody 23304 0.1 S 11:22 /usr/sbin/httpd -k start 1784049 506832 nobody 22840 0.1 S 03:11 /usr/sbin/httpd -k start 1785521 506832 nobody 22828 0.0 S 02:06 /usr/sbin/httpd -k start 1766677 506832 nobody 22780 0.0 S 06:48 /usr/sbin/httpd -k start 1786362 506832 nobody 22692 0.1 S 01:12 /usr/sbin/httpd -k start 1785612 506832 nobody 22620 0.1 S 01:58 /usr/sbin/httpd -k start 1766562 506832 nobody 22564 0.0 S 06:56 /usr/sbin/httpd -k start 1784529 506832 nobody 22240 0.0 S 02:52 /usr/sbin/httpd -k start 1785622 506832 nobody 22100 0.1 S 01:57 /usr/sbin/httpd -k start 1785627 506832 nobody 21884 0.1 S 01:56 /usr/sbin/httpd -k start 1769312 506832 nobody 21740 0.1 S 04:19 /usr/sbin/httpd -k start 1784015 506832 nobody 21656 0.0 S 03:12 /usr/sbin/httpd -k start 1784219 506832 nobody 21596 0.0 S 02:53 /usr/sbin/httpd -k start 1784091 506832 nobody 21584 0.0 S 03:06 /usr/sbin/httpd -k start 1784525 506832 nobody 21548 0.0 S 02:52 /usr/sbin/httpd -k start 1785380 506832 nobody 21516 0.0 S 02:17 /usr/sbin/httpd -k start 1785522 506832 nobody 21504 0.1 S 02:06 /usr/sbin/httpd -k start 1767785 506832 nobody 21264 0.0 S 05:36 /usr/sbin/httpd -k start 1784218 506832 nobody 21088 0.0 S 02:53 /usr/sbin/httpd -k start 1786531 506832 nobody 21052 0.0 S 01:03 /usr/sbin/httpd -k start 1784524 506832 nobody 21024 0.1 S 02:52 /usr/sbin/httpd -k start 483898 1 zabbix 20968 0.2 Ssl 5-05:25:51 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3929564 1 wp-toolkit 20888 0.0 Ss 1-05:21:38 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1786982 506832 nobody 20684 0.0 S 00:34 /usr/sbin/httpd -k start 1786524 506832 nobody 20568 0.2 S 01:03 /usr/sbin/httpd -k start 1787335 506832 nobody 20524 0.0 S 00:16 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 16078796 | root | 85-1559715131 | Prepare | 0 | | SELECT id, status, sectionId, itemid, description, notes, cost, qty, price, adjPrice, discount, taxId, accountid, extra, (select description from quoteitems qi where qi.id = quoteitems.parentid) as pdesc, '0' as duplicate from quoteitems WH | | 16078794 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 392 evolution/portal.evolutionerp.com.au-ssl_log 256 corpkicks/corporatekicks.com.au-ssl_log 176 madalice/madalice.com.au-ssl_log 171 evolution/app.evolutionerp.com.au-ssl_log 106 evolution/evolutionerp.com.au-ssl_log 51 tubesupplies/tubesupplies.com.au-ssl_log 50 coscom/swms.coscom.com.au-ssl_log 38 tubesupplies/tubesupplies.com.au 30 evolution/evolutionerp.com.au 25 otterfencing/otterfencing.com.au-ssl_log 20 alison/alisonarts.com.au-ssl_log 2 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 282 203.54.180.238 173 20.48.251.3 161 149.88.19.85 132 103.104.165.99 106 40.115.94.245 91 124.168.5.234 84 103.104.164.114 72 20.220.211.172 71 20.151.10.161 38 158.23.184.117 19 150.228.151.47 18 216.73.216.220 18 101.166.96.210 10 180.181.236.49 7 118.127.40.55 --- top request paths across all vhosts (last 3 min) --- 106 GET /factory_session_checker.php 78 POST /functions.php 76 GET /app/ajax.php 54 GET /api/getItem/LWFBW2001KG 53 GET /factory_session_processed_qty.php 53 GET /factory_session_joiner.php 52 GET /api/getItem/LWHG2001KG 44 GET /heartbeat.php 27 GET /index.php 25 GET //app/ajax.php 18 POST /quoteditsave.php 14 POST //clienteditsave.php 14 POST /app/ajax.php 13 POST /plugins/fencecosting/plugin.php 13 POST /app/ajax/selectFilterSingle.php 13 GET //index.php 10 POST /plugins/csvexporter/plugin.php 10 POST //functions.php 10 POST /clienteditsave.php 8 POST /wp-login.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 78 POST /functions.php 76 GET /app/ajax.php 27 GET /index.php 25 GET //app/ajax.php 18 POST /quoteditsave.php 14 POST //clienteditsave.php 14 POST /app/ajax.php 13 POST /plugins/fencecosting/plugin.php 13 POST /app/ajax/selectFilterSingle.php 13 GET //index.php 10 POST /plugins/csvexporter/plugin.php 10 POST //functions.php -- last 10 requests -- 103.104.164.114 - - [02/Sep/2026:07:44:13 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4818%2Findex.php%3Fpage%3Dinvoiceadd&invoiceid=48 103.104.164.114 - - [02/Sep/2026:07:44:13 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 15911 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4818%2Findex.php%3Fpage%3Dinvoiceadd&invoice 182.239.240.254 - - [02/Sep/2026:07:44:14 +1000] "GET //index.php?page=purchasereg HTTP/1.1" 200 14749 "https://my.evolutionerp.com.au//index.php?page=mfshoporderdetail&id=5553" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 103.104.165.99 - - [02/Sep/2026:07:44:14 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 182.239.240.254 - - [02/Sep/2026:07:44:14 +1000] "POST //purchaseaddsave.php?call=fetch HTTP/1.1" 200 1986 "https://my.evolutionerp.com.au//index.php?page=purchasereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 182.239.240.254 - - [02/Sep/2026:07:44:14 +1000] "GET //app/ajax.php?cn=&furi=true&uri=page%3Dpurchasereg&call=getUserSetting&caller=ajaxSubmitLocal&seq=10776111106 HTTP/1.1" 200 91 "https://my.evolutionerp.com.au//index 203.54.180.238 - - [02/Sep/2026:07:44:15 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 103.104.164.114 - - [02/Sep/2026:07:44:15 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4818%2Findex.php%3Fpage%3Dinvoiceadd&invoiceid=4818&tab=maintab" " 101.166.96.210 - - [02/Sep/2026:07:44:15 +1000] "POST /quoteditsave.php?call=addLineItem HTTP/1.1" 200 291 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37036§ionid=0" "Mozilla/5.0 (Windows NT 10.0; 203.54.180.238 - - [02/Sep/2026:07:44:15 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 106 GET /factory_session_checker.php 53 GET /factory_session_processed_qty.php 53 GET /factory_session_joiner.php 44 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [02/Sep/2026:07:44:08 +1000] "GET /heartbeat.php?sentAt=1788299048&bytes=106,151,71,40&_=1788297578625 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=19" 203.54.180.238 - - [02/Sep/2026:07:44:10 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:07:44:10 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [02/Sep/2026:07:44:10 +1000] "GET /factory_session_joiner.php?id=35036 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [02/Sep/2026:07:44:11 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:07:44:12 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [02/Sep/2026:07:44:12 +1000] "GET /factory_session_joiner.php?id=35037 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [02/Sep/2026:07:44:13 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:07:44:13 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:07:44:13 +1000] "GET /heartbeat.php?sentAt=1788299053&bytes=106,151,71,45&_=1788238875157 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" == corpkicks/corporatekicks.com.au-ssl_log == -- top paths -- 2 GET /ms-edit.php 2 GET /koiy.php 2 GET /doc.php 1 POST /wp-cron.php 1 HEAD / 1 GET /zz.php 1 GET /zaza.php 1 GET /xza.php 1 GET /xve22.php 1 GET /xqq.php 1 GET /xp.php 1 GET /xmy.php -- last 10 requests -- 20.48.251.3 - - [02/Sep/2026:07:43:52 +1000] "GET /test1.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [02/Sep/2026:07:43:53 +1000] "GET /drykl.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [02/Sep/2026:07:43:53 +1000] "GET /ty.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [02/Sep/2026:07:43:53 +1000] "GET /myfile.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [02/Sep/2026:07:43:54 +1000] "GET /fff.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [02/Sep/2026:07:43:54 +1000] "GET /bootstrap.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [02/Sep/2026:07:43:55 +1000] "GET /server_info.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [02/Sep/2026:07:43:55 +1000] "GET /X57.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [02/Sep/2026:07:43:56 +1000] "GET /temp.php HTTP/1.1" 401 36 "-" "-" 20.48.251.3 - - [02/Sep/2026:07:43:56 +1000] "GET /aws.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-09-02 07:41:55 L1=3.26 run=5 blk=0 avail=6771 (49.1%) swpO=0 conn=5 myRSS=3328 php=12 phpRSS=1060 ap=46 tcp=48 topuser=madalice 2026-09-02 07:41:55 L1=3.26 run=4 blk=0 avail=6769 (49.1%) swpO=0 conn=2 myRSS=3328 php=12 phpRSS=1061 ap=46 tcp=48 topuser=madalice 2026-09-02 07:42:05 L1=3.06 run=6 blk=0 avail=6573 (47.7%) swpO=0 conn=5 myRSS=3328 php=13 phpRSS=1276 ap=46 tcp=49 topuser=madalice 2026-09-02 07:42:05 L1=3.06 run=5 blk=0 avail=6564 (47.6%) swpO=0 conn=2 myRSS=3328 php=14 phpRSS=1300 ap=46 tcp=49 topuser=madalice 2026-09-02 07:42:15 L1=2.89 run=4 blk=0 avail=6492 (47.1%) swpO=0 conn=5 myRSS=3329 php=13 phpRSS=1308 ap=52 tcp=55 topuser=madalice 2026-09-02 07:42:15 L1=2.89 run=5 blk=0 avail=6482 (47.0%) swpO=0 conn=2 myRSS=3329 php=13 phpRSS=1317 ap=52 tcp=57 topuser=madalice 2026-09-02 07:42:25 L1=3.44 run=6 blk=0 avail=6588 (47.8%) swpO=0 conn=3 myRSS=3329 php=12 phpRSS=1122 ap=58 tcp=69 topuser=madalice 2026-09-02 07:42:25 L1=3.44 run=6 blk=0 avail=6583 (47.8%) swpO=0 conn=2 myRSS=3329 php=13 phpRSS=1149 ap=58 tcp=69 topuser=madalice 2026-09-02 07:42:35 L1=3.46 run=4 blk=0 avail=6654 (48.3%) swpO=0 conn=3 myRSS=3329 php=12 phpRSS=1072 ap=54 tcp=52 topuser=madalice 2026-09-02 07:42:35 L1=3.46 run=5 blk=0 avail=6651 (48.3%) swpO=0 conn=2 myRSS=3329 php=12 phpRSS=1073 ap=54 tcp=52 topuser=madalice 2026-09-02 07:42:45 L1=3.37 run=3 blk=0 avail=6612 (48.0%) swpO=0 conn=3 myRSS=3329 php=13 phpRSS=1193 ap=48 tcp=57 topuser=madalice 2026-09-02 07:42:45 L1=3.37 run=5 blk=0 avail=6605 (47.9%) swpO=0 conn=2 myRSS=3329 php=13 phpRSS=1204 ap=48 tcp=57 topuser=madalice 2026-09-02 07:42:55 L1=3.70 run=6 blk=0 avail=6708 (48.7%) swpO=0 conn=3 myRSS=3329 php=17 phpRSS=1241 ap=44 tcp=54 topuser=madalice 2026-09-02 07:42:55 L1=3.70 run=9 blk=0 avail=6688 (48.5%) swpO=0 conn=5 myRSS=3329 php=17 phpRSS=1270 ap=44 tcp=54 topuser=madalice 2026-09-02 07:43:05 L1=4.14 run=4 blk=0 avail=6759 (49.1%) swpO=0 conn=3 myRSS=3329 php=17 phpRSS=1011 ap=49 tcp=59 topuser=madalice 2026-09-02 07:43:05 L1=4.14 run=5 blk=0 avail=6886 (50.0%) swpO=0 conn=5 myRSS=3329 php=16 phpRSS=990 ap=49 tcp=58 topuser=madalice 2026-09-02 07:43:15 L1=4.49 run=6 blk=0 avail=6421 (46.6%) swpO=0 conn=3 myRSS=3329 php=14 phpRSS=1194 ap=65 tcp=50 topuser=madalice 2026-09-02 07:43:15 L1=4.49 run=7 blk=0 avail=6515 (47.3%) swpO=0 conn=5 myRSS=3329 php=14 phpRSS=1213 ap=65 tcp=50 topuser=madalice 2026-09-02 07:43:25 L1=4.34 run=6 blk=0 avail=6521 (47.3%) swpO=0 conn=6 myRSS=3329 php=17 phpRSS=1377 ap=55 tcp=52 topuser=madalice 2026-09-02 07:43:25 L1=4.34 run=11 blk=0 avail=6475 (47.0%) swpO=0 conn=5 myRSS=3329 php=19 phpRSS=1476 ap=55 tcp=52 topuser=madalice 2026-09-02 07:43:35 L1=4.21 run=5 blk=0 avail=6560 (47.6%) swpO=0 conn=6 myRSS=3329 php=17 phpRSS=1361 ap=49 tcp=50 topuser=madalice 2026-09-02 07:43:35 L1=4.21 run=5 blk=0 avail=6558 (47.6%) swpO=0 conn=5 myRSS=3329 php=17 phpRSS=1364 ap=49 tcp=50 topuser=madalice 2026-09-02 07:43:45 L1=4.27 run=4 blk=0 avail=6505 (47.2%) swpO=0 conn=6 myRSS=3329 php=12 phpRSS=1271 ap=49 tcp=58 topuser=madalice 2026-09-02 07:43:45 L1=4.27 run=4 blk=0 avail=6492 (47.1%) swpO=0 conn=5 myRSS=3329 php=13 phpRSS=1314 ap=49 tcp=58 topuser=madalice 2026-09-02 07:43:55 L1=4.16 run=6 blk=0 avail=6661 (48.3%) swpO=0 conn=6 myRSS=3329 php=13 phpRSS=1154 ap=49 tcp=44 topuser=madalice 2026-09-02 07:43:56 L1=4.16 run=7 blk=0 avail=6641 (48.2%) swpO=0 conn=6 myRSS=3329 php=13 phpRSS=1176 ap=49 tcp=44 topuser=madalice 2026-09-02 07:44:06 L1=4.21 run=3 blk=0 avail=6804 (49.4%) swpO=0 conn=6 myRSS=3329 php=12 phpRSS=912 ap=58 tcp=50 topuser=madalice 2026-09-02 07:44:06 L1=4.21 run=4 blk=0 avail=6794 (49.3%) swpO=0 conn=6 myRSS=3329 php=13 phpRSS=943 ap=58 tcp=50 topuser=madalice 2026-09-02 07:44:16 L1=4.33 run=7 blk=0 avail=6395 (46.4%) swpO=0 conn=6 myRSS=3329 php=16 phpRSS=1476 ap=53 tcp=58 topuser=madalice 2026-09-02 07:44:16 L1=4.33 run=7 blk=1 avail=6362 (46.2%) swpO=0 conn=8 myRSS=3329 php=16 phpRSS=1505 ap=53 tcp=58 topuser=madalice