INCIDENT 2026-09-03 18:20:47 trigger: php_rss=1696MB ================================================================== load: 0.93 0.82 0.68 13/764 893920 ncpu:10 mem_avail: 6619MB/13777MB (48.0%) swap_used:1530MB swapout:0/s blocked(D):0 running:13 iowait:0.1% steal:0.0% php: 13 procs / 1696MB heaviest user: madalice (9 procs, 1490MB) apache: 93 procs tcp_estab: 39 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2926 madalice 9 1574 nobody 91 1532 root 254 1152 netdata 8 254 infinium 3 192 wp-toolkit 3 67 mailman 20 27 dovenull 6 26 mailnull 2 24 evolution 9 18 cpanellogin 1 17 polkitd 1 12 zabbix 1 11 lowrange 1 11 kurri 1 11 aaa 1 10 dovecot 3 8 named 1 5 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 9 1641 infinium 2 190 root 1 30 evolution 1 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5731 MB Active(file): 5048 MB Inactive(file): 926 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 474 MB CommitLimit: 10984 MB Committed_AS: 10056 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 877991 root 02:14 58416 /opt/imunify360/venv/bin/python3 -m imav.run 879155 root 00:46 1312 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : 3926885 root 2-15:58:19 4592 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 2996728 16.0 Ssl 1-04:06:34 /usr/sbin/mariadbd 893500 1542510 madalice 233628 16.0 R 00:30 php-fpm: pool madalice_com_au 893456 1542510 madalice 223624 19.4 R 00:32 php-fpm: pool madalice_com_au 893883 1542510 madalice 206764 101 R 00:01 php-fpm: pool madalice_com_au 893660 1542510 madalice 206492 17.2 R 00:21 php-fpm: pool madalice_com_au 1542443 1 netdata 187708 2.5 Ssl 15:58:24 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1596048 1543747 root 174780 0.0 S 15:42:59 spamd child 4117331 1543747 root 173392 0.0 S 04:16:02 spamd child 893658 1542510 madalice 159680 17.5 S 00:21 php-fpm: pool madalice_com_au 893470 1542510 madalice 155748 15.6 S 00:31 php-fpm: pool madalice_com_au 893663 1542510 madalice 155200 11.8 S 00:21 php-fpm: pool madalice_com_au 509266 1 root 153208 0.0 Ss 6-16:01:05 /usr/lib/systemd/systemd-journald 893664 1542510 madalice 151728 12.6 S 00:21 php-fpm: pool madalice_com_au 893888 1542510 madalice 141296 0.0 R 00:00 php-fpm: pool madalice_com_au 893881 893545 infinium 127660 49.0 S 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1543747 1 root 119476 0.0 Ss 15:57:54 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 893891 893635 infinium 96368 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 877991 1 root 58416 1.2 Ssl 02:14 /opt/imunify360/venv/bin/python3 -m imav.run 509236 509098 root 45584 0.0 Sl 6-16:01:05 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42116 0.1 Ss 43-15:39:31 cpsrvd (SSL) - waiting for connections 1469 1 root 41968 0.1 Ss 66-08:11:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542981 1542551 netdata 41748 0.1 Sl 15:58:20 /usr/libexec/netdata/plugins.d/go.d.plugin 1 893925 1469 root 39124 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542487 1 wp-toolkit 37156 0.0 Ss 15:58:24 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1542072 1 root 32404 0.0 Ss 15:58:28 lfd - sleeping 1542510 1 root 31632 0.0 Ss 15:58:23 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1542531 1 wp-toolkit 25152 0.0 Ss 15:58:23 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1463 1 root 24632 0.0 Ss 66-08:11:00 tailwatchd 893864 1 root 24060 1.4 Ss 00:05 /usr/sbin/exim -Mc 1x22gc-00000003kX8-2Re6 876193 506832 nobody 23328 0.1 S 04:06 /usr/sbin/httpd -k start 1542141 1 root 22844 0.0 Ss 15:58:27 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 860176 506832 nobody 22712 0.0 S 06:43 /usr/sbin/httpd -k start 1542188 1 root 22628 0.1 Ssl 15:58:26 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 893868 893864 mailnull 22496 0.0 S 00:05 /usr/sbin/exim -Mc 1x22gc-00000003kX8-2Re6 878794 506832 nobody 21384 0.0 S 01:21 /usr/sbin/httpd -k start 876184 506832 nobody 21296 0.0 S 04:07 /usr/sbin/httpd -k start 893551 506832 nobody 20756 0.1 S 00:26 /usr/sbin/httpd -k start 878585 506832 nobody 20332 0.0 S 01:43 /usr/sbin/httpd -k start 878342 506832 nobody 20196 0.1 S 02:00 /usr/sbin/httpd -k start 878574 506832 nobody 19956 0.0 S 01:44 /usr/sbin/httpd -k start 893576 506832 nobody 19852 0.0 S 00:24 /usr/sbin/httpd -k start 878586 506832 nobody 19372 0.0 S 01:43 /usr/sbin/httpd -k start 893558 506832 nobody 19312 0.0 S 00:25 /usr/sbin/httpd -k start 893623 506832 nobody 19300 0.0 S 00:22 /usr/sbin/httpd -k start 878770 506832 nobody 18936 0.0 S 01:24 /usr/sbin/httpd -k start 893622 506832 nobody 18828 0.0 S 00:22 /usr/sbin/httpd -k start 893650 506832 nobody 18588 0.0 S 00:22 /usr/sbin/httpd -k start 893628 506832 nobody 18552 0.0 S 00:22 /usr/sbin/httpd -k start 893649 506832 nobody 18488 0.0 S 00:22 /usr/sbin/httpd -k start 859317 1353308 cpanellogin 18420 0.0 S 08:19 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 893652 506832 nobody 18352 0.0 S 00:22 /usr/sbin/httpd -k start 893641 506832 nobody 18196 0.0 S 00:22 /usr/sbin/httpd -k start 893643 506832 nobody 18068 0.0 S 00:22 /usr/sbin/httpd -k start 880208 506832 nobody 17920 0.0 S 00:44 /usr/sbin/httpd -k start 893645 506832 nobody 17912 0.0 S 00:22 /usr/sbin/httpd -k start 893644 506832 nobody 17868 0.0 S 00:22 /usr/sbin/httpd -k start 1542982 1542551 netdata 17820 2.1 Sl 15:58:20 /usr/libexec/netdata/plugins.d/apps.plugin 1 893584 506832 nobody 17724 0.0 S 00:24 /usr/sbin/httpd -k start 893602 506832 nobody 17556 0.0 S 00:23 /usr/sbin/httpd -k start 893598 506832 nobody 17536 0.0 S 00:23 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 6565221 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 6565216 | madalice_wp | madalice_wp | Query | 0 | Sending data | SELECT option_value FROM AMuqf6qZ_options WHERE option_name LIKE 'wc_square_background_sync_job_%' AND ( option_value LIKE '%\"status\":\"queued\"%' OR option_value LIKE '%\"status\":\"processing\"%' ) ORDER BY option_id ASC LIMIT 1 | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min whiz/whizengineering.com.au-ssl_log 204 evolution/app.evolutionerp.com.au-ssl_log 133 kamcool/kamcool.com.au-ssl_log 112 lowrange/lowrange.com.au-ssl_log 92 infinium/infinium.net.au-ssl_log 63 olympic/olympicfencing.com.au-ssl_log 40 madalice/madalice.com.au-ssl_log 33 evolution/portal.evolutionerp.com.au-ssl_log 15 aaa/aaadownunder.com.au-ssl_log 5 coscom/coscom.com.au 5 evolution/my.evolutionerp.com.au-ssl_log 4 corpkicks/corporatekicks.com.au-ssl_log 3 tubesupplies/tubesupplies.com.au-ssl_log 2 alison/alisonarts.com.au-ssl_log 1 kurri/kurrimotorinn.com.au-ssl_log 1 (total vhosts taking traffic: 15) --- top client IPs across all vhosts (last 3 min) --- 267 45.148.10.194 241 195.178.110.108 133 40.115.94.245 23 2001:8004:14b3:854f:95d1:bdfe:1050:32b5 15 203.54.180.238 5 62.60.130.62 5 118.127.40.55 3 147.161.213.78 2 91.92.243.248 2 64.227.168.172 2 209.141.55.190 2 162.243.76.142 1 88.177.158.23 1 57.141.16.36 1 54.85.7.119 --- top request paths across all vhosts (last 3 min) --- 61 POST / 57 GET /api/getItem/LWFB2001KG 42 GET /api/getItem/LWPB2001KG 30 POST /wp/ 21 POST /index.php 20 POST /wp/index.php 19 GET / 18 POST /wordpress/ 16 GET /wp/ 15 POST /wordpress/wp-json/batch/v1 15 POST /auth/callback 15 GET /heartbeat.php 13 POST /login 12 POST /wp-json/batch/v1 12 POST /signup 12 POST /dashboard 12 POST /blog/wp-json/batch/v1 11 POST /wordpress/index.php 11 POST /account 10 POST /wp-json/Batch/v1 --- busiest 3 vhosts: top paths + last 10 requests --- == whiz/whizengineering.com.au-ssl_log == -- top paths -- 39 POST / 15 GET / 14 POST /index.php 9 POST /wp-json/batch/v1 9 POST /wp/ 8 POST /signup 7 POST /wp-json/Batch/v1 7 POST /wp-json/batch/v1/ 7 POST //wp-json/batch/v1 7 POST /wordpress/wp-json/batch/v1 7 POST /login 7 POST /dashboard -- last 10 requests -- 195.178.110.108 - - [03/Sep/2026:18:20:38 +1000] "POST /wp/wp-json/Batch/v1 HTTP/1.1" 401 53 "https://cpcontacts.whizengineering.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 195.178.110.108 - - [03/Sep/2026:18:20:39 +1000] "POST /wp//wp-json/batch/v1 HTTP/1.1" 401 53 "https://cpcontacts.whizengineering.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 195.178.110.108 - - [03/Sep/2026:18:20:39 +1000] "POST /wp/wp-json/batch/v1/ HTTP/1.1" 401 53 "https://cpcontacts.whizengineering.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 195.178.110.108 - - [03/Sep/2026:18:20:39 +1000] "POST /wp/blog/wp-json/batch/v1 HTTP/1.1" 401 53 "https://cpcontacts.whizengineering.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KH 195.178.110.108 - - [03/Sep/2026:18:20:40 +1000] "POST /wp/wordpress/wp-json/batch/v1 HTTP/1.1" 401 53 "https://cpcontacts.whizengineering.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 195.178.110.108 - - [03/Sep/2026:18:20:40 +1000] "POST /wp/index.php?rest_route=/batch/v1 HTTP/1.1" 401 53 "https://cpcontacts.whizengineering.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5 195.178.110.108 - - [03/Sep/2026:18:20:40 +1000] "POST /wp/index.php?rest_route=%2Fbatch%2Fv1 HTTP/1.1" 401 53 "https://cpcontacts.whizengineering.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 195.178.110.108 - - [03/Sep/2026:18:20:41 +1000] "POST /wp/?rest_route=%2Fbatch%2Fv1 HTTP/1.1" 401 53 "https://cpcontacts.whizengineering.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 195.178.110.108 - - [03/Sep/2026:18:20:41 +1000] "POST /wp/?rest_route=/batch%2Fv1 HTTP/1.1" 401 53 "https://cpcontacts.whizengineering.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ( 195.178.110.108 - - [03/Sep/2026:18:20:46 +1000] "POST /wp/?rest_route=/batch/v1 HTTP/1.1" 401 53 "https://cpcontacts.whizengineering.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KH == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 57 GET /api/getItem/LWFB2001KG 42 GET /api/getItem/LWPB2001KG 2 GET /api/getItem/HCR-40 1 GET /api/getItem/SGC-100 1 GET /api/getItem/RGW%2CBM80 1 GET /api/getItem/RGW100T 1 GET /api/getItem/PC7550 1 GET /api/getItem/PC5025BL 1 GET /api/getItem/PC19 1 GET /api/getItem/PC16 1 GET /api/getItem/PC15050 1 GET /api/getItem/PC1212 -- last 10 requests -- 40.115.94.245 - - [03/Sep/2026:18:20:19 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:18:20:19 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:18:20:19 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:18:20:20 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:18:20:20 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:18:20:21 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:18:20:21 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:18:20:21 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:18:20:22 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [03/Sep/2026:18:20:22 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" == kamcool/kamcool.com.au-ssl_log == -- top paths -- 21 POST /wp/ 14 POST /wp/index.php 9 GET /wp/ 7 POST /wp/wp-json/Batch/v1 7 POST /wp/wp-json/batch/v1/ 7 POST /wp/wp-json/batch/v1 7 POST /wp//wp-json/batch/v1 7 POST /wp/wordpress/wp-json/batch/v1 6 POST /wp/blog/wp-json/batch/v1 6 POST /auth/callback 3 POST /wordpress/ 3 POST /account -- last 10 requests -- 45.148.10.194 - - [03/Sep/2026:18:20:15 +1000] "GET /wp/?rest_route=/wp/v2/posts/9999999 HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537. 45.148.10.194 - - [03/Sep/2026:18:20:16 +1000] "GET /wp/wp/v2/users HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.194 - - [03/Sep/2026:18:20:18 +1000] "GET /wp/?rest_route=/wp/v2/users HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.194 - - [03/Sep/2026:18:20:26 +1000] "POST /wordpress/index.php?rest_route=%2Fbatch%2Fv1 HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 S 45.148.10.194 - - [03/Sep/2026:18:20:27 +1000] "POST /wordpress/?rest_route=%2Fbatch%2Fv1 HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537 45.148.10.194 - - [03/Sep/2026:18:20:27 +1000] "POST /wordpress/?rest_route=/batch%2Fv1 HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 45.148.10.194 - - [03/Sep/2026:18:20:29 +1000] "POST /wordpress/?rest_route=/batch/v1 HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.194 - - [03/Sep/2026:18:20:30 +1000] "POST /wordpress/wp-json/batch/v1 HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.194 - - [03/Sep/2026:18:20:31 +1000] "POST /wordpress/wp-json/Batch/v1 HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.194 - - [03/Sep/2026:18:20:32 +1000] "POST /wordpress//wp-json/batch/v1 HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-03 18:18:26 L1=0.88 run=2 blk=0 avail=8434 (61.2%) swpO=0 conn=3 myRSS=2927 php=3 phpRSS=164 ap=19 tcp=25 topuser=madalice 2026-09-03 18:18:27 L1=0.88 run=1 blk=0 avail=8433 (61.2%) swpO=0 conn=1 myRSS=2927 php=3 phpRSS=164 ap=19 tcp=23 topuser=madalice 2026-09-03 18:18:36 L1=0.74 run=2 blk=0 avail=8244 (59.8%) swpO=0 conn=2 myRSS=2927 php=4 phpRSS=259 ap=17 tcp=35 topuser=madalice 2026-09-03 18:18:37 L1=0.74 run=1 blk=0 avail=8301 (60.3%) swpO=0 conn=1 myRSS=2927 php=3 phpRSS=164 ap=18 tcp=31 topuser=madalice 2026-09-03 18:18:46 L1=0.71 run=2 blk=0 avail=8508 (61.8%) swpO=0 conn=2 myRSS=2927 php=2 phpRSS=30 ap=18 tcp=28 topuser=root 2026-09-03 18:18:47 L1=0.71 run=2 blk=0 avail=8504 (61.7%) swpO=0 conn=1 myRSS=2927 php=2 phpRSS=30 ap=19 tcp=27 topuser=root 2026-09-03 18:18:56 L1=0.60 run=1 blk=0 avail=8399 (61.0%) swpO=0 conn=2 myRSS=2927 php=3 phpRSS=164 ap=18 tcp=25 topuser=madalice 2026-09-03 18:18:57 L1=0.60 run=2 blk=0 avail=8384 (60.9%) swpO=0 conn=1 myRSS=2927 php=4 phpRSS=211 ap=18 tcp=26 topuser=madalice 2026-09-03 18:19:07 L1=1.30 run=1 blk=0 avail=7459 (54.1%) swpO=0 conn=2 myRSS=2927 php=10 phpRSS=1185 ap=24 tcp=35 topuser=madalice 2026-09-03 18:19:08 L1=1.30 run=1 blk=0 avail=7478 (54.3%) swpO=0 conn=1 myRSS=2927 php=10 phpRSS=1185 ap=24 tcp=32 topuser=madalice 2026-09-03 18:19:17 L1=1.18 run=2 blk=0 avail=7630 (55.4%) swpO=0 conn=2 myRSS=2927 php=10 phpRSS=1073 ap=18 tcp=26 topuser=madalice 2026-09-03 18:19:18 L1=1.18 run=1 blk=0 avail=7631 (55.4%) swpO=0 conn=1 myRSS=2927 php=10 phpRSS=1073 ap=17 tcp=26 topuser=madalice 2026-09-03 18:19:27 L1=1.16 run=3 blk=0 avail=7486 (54.3%) swpO=0 conn=2 myRSS=2927 php=11 phpRSS=1248 ap=19 tcp=29 topuser=madalice 2026-09-03 18:19:28 L1=1.16 run=1 blk=0 avail=7589 (55.1%) swpO=0 conn=1 myRSS=2927 php=10 phpRSS=1106 ap=19 tcp=29 topuser=madalice 2026-09-03 18:19:37 L1=0.98 run=1 blk=0 avail=7824 (56.8%) swpO=0 conn=1 myRSS=2927 php=8 phpRSS=849 ap=17 tcp=24 topuser=madalice 2026-09-03 18:19:38 L1=0.98 run=3 blk=0 avail=7933 (57.6%) swpO=0 conn=1 myRSS=2927 php=7 phpRSS=723 ap=17 tcp=24 topuser=madalice 2026-09-03 18:19:47 L1=0.83 run=1 blk=0 avail=8289 (60.2%) swpO=0 conn=1 myRSS=2927 php=4 phpRSS=312 ap=16 tcp=26 topuser=madalice 2026-09-03 18:19:48 L1=0.83 run=1 blk=0 avail=8285 (60.1%) swpO=0 conn=1 myRSS=2927 php=4 phpRSS=312 ap=16 tcp=25 topuser=madalice 2026-09-03 18:19:57 L1=0.78 run=1 blk=0 avail=8391 (60.9%) swpO=0 conn=1 myRSS=2927 php=3 phpRSS=186 ap=16 tcp=27 topuser=madalice 2026-09-03 18:19:58 L1=0.78 run=1 blk=0 avail=8391 (60.9%) swpO=0 conn=1 myRSS=2927 php=3 phpRSS=186 ap=16 tcp=29 topuser=madalice 2026-09-03 18:20:07 L1=0.98 run=4 blk=0 avail=8392 (60.9%) swpO=0 conn=1 myRSS=2927 php=3 phpRSS=186 ap=17 tcp=21 topuser=madalice 2026-09-03 18:20:08 L1=0.98 run=2 blk=0 avail=8373 (60.8%) swpO=0 conn=1 myRSS=2927 php=3 phpRSS=186 ap=16 tcp=25 topuser=madalice 2026-09-03 18:20:17 L1=0.98 run=3 blk=0 avail=8171 (59.3%) swpO=0 conn=1 myRSS=2927 php=5 phpRSS=459 ap=16 tcp=30 topuser=madalice 2026-09-03 18:20:18 L1=0.98 run=4 blk=0 avail=8098 (58.8%) swpO=0 conn=1 myRSS=2927 php=5 phpRSS=520 ap=17 tcp=27 topuser=madalice 2026-09-03 18:20:27 L1=0.98 run=5 blk=0 avail=6904 (50.1%) swpO=3 conn=1 myRSS=2927 php=9 phpRSS=1152 ap=112 tcp=118 topuser=madalice 2026-09-03 18:20:28 L1=0.98 run=4 blk=0 avail=7056 (51.2%) swpO=3 conn=1 myRSS=2927 php=9 phpRSS=995 ap=112 tcp=108 topuser=madalice 2026-09-03 18:20:37 L1=0.83 run=2 blk=0 avail=7072 (51.3%) swpO=0 conn=2 myRSS=2927 php=10 phpRSS=1075 ap=103 tcp=25 topuser=madalice 2026-09-03 18:20:38 L1=0.83 run=3 blk=0 avail=7120 (51.7%) swpO=0 conn=1 myRSS=2927 php=9 phpRSS=998 ap=102 tcp=24 topuser=madalice 2026-09-03 18:20:47 L1=0.93 run=13 blk=0 avail=6619 (48.0%) swpO=0 conn=11 myRSS=2927 php=13 phpRSS=1696 ap=93 tcp=39 topuser=madalice 2026-09-03 18:20:48 L1=0.93 run=5 blk=1 avail=6653 (48.3%) swpO=25 conn=3 myRSS=2926 php=12 phpRSS=1576 ap=92 tcp=36 topuser=madalice