INCIDENT 2026-09-05 03:17:06 trigger: php_rss=2190MB mysql_conn=15 ================================================================== load: 2.83 1.82 1.69 15/809 3814451 ncpu:10 mem_avail: 5343MB/13777MB (38.8%) swap_used:1757MB swapout:184/s blocked(D):1 running:14 iowait:1.1% steal:0.0% php: 16 procs / 2190MB heaviest user: madalice (10 procs, 1768MB) apache: 116 procs tcp_estab: 108 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3295 nobody 115 1964 madalice 10 1894 root 256 1306 corpkicks 2 294 netdata 8 259 evolution 11 143 dovenull 6 66 cpanellogin 1 64 wp-toolkit 3 55 kurri 3 42 infinium 3 42 mailnull 5 32 lowrange 2 30 dovecot 3 28 mailman 20 26 zabbix 1 11 polkitd 1 7 named 1 6 nscd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1921 corpkicks 2 299 evolution 3 120 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3320 MB Active(file): 3130 MB Inactive(file): 1047 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 1024 MB CommitLimit: 10984 MB Committed_AS: 11391 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3798280 root 02:33 61320 /opt/imunify360/venv/bin/python3 -m imav.run 3798406 root 02:30 10152 /usr/sbin/imunify-notifier 3814309 root 00:09 6912 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 3814331 root 00:08 170240 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress 3926885 root 4-00:54:40 3960 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3374528 12.4 Ssl 2-13:02:55 /usr/sbin/mariadbd 3814328 2601907 madalice 252912 81.2 S 00:08 php-fpm: pool madalice_com_au 3814418 3814276 corpkicks 247200 50.6 S 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3814195 2601907 madalice 240240 69.0 R 00:11 php-fpm: pool madalice_com_au 3814318 2601907 madalice 223688 77.8 R 00:08 php-fpm: pool madalice_com_au 3813416 2601907 madalice 216968 17.7 R 01:13 php-fpm: pool madalice_com_au 3814194 2601907 madalice 213768 68.1 R 00:11 php-fpm: pool madalice_com_au 3814264 2601907 madalice 207840 63.9 R 00:10 php-fpm: pool madalice_com_au 3814317 2601907 madalice 203644 77.6 R 00:08 php-fpm: pool madalice_com_au 1542443 1 netdata 192528 2.6 Ssl 2-00:54:45 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3643624 3626973 root 183104 0.0 S 50:17 spamd child 3626973 1 root 175672 0.1 Ss 53:52 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3814331 3814309 root 170212 13.0 Sl 00:08 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 3643625 3626973 root 167912 0.0 S 50:17 spamd child 3814266 2601907 madalice 167304 71.7 S 00:10 php-fpm: pool madalice_com_au 3814267 2601907 madalice 164460 71.3 R 00:10 php-fpm: pool madalice_com_au 3814326 2601907 madalice 159948 67.5 R 00:08 php-fpm: pool madalice_com_au 3814433 3814288 corpkicks 81464 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3814268 1 root 67572 20.3 RNs 00:09 /usr/libexec/platform-python /usr/bin/dnf makecache --timer 3454439 1353308 cpanellogin 65880 0.0 S 01:45:46 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 3127357 3127312 evolution 63156 0.0 Ss 03:17:06 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3798280 1 root 61312 1.4 Ssl 02:33 /opt/imunify360/venv/bin/python3 -m imav.run 3127358 3127320 evolution 60488 0.0 Ss 03:17:06 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509236 509098 root 42600 0.0 Sl 8-00:57:26 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41276 0.1 Ss 45-00:35:52 cpsrvd (SSL) - waiting for connections 1469 1 root 40976 0.1 Ss 67-17:07:21 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542981 1542551 netdata 40900 0.1 Sl 2-00:54:41 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3626082 1 root 36180 0.0 Ss 54:52 lfd - sleeping 509266 1 root 31684 0.0 Ss 8-00:57:26 /usr/lib/systemd/systemd-journald 1542487 1 wp-toolkit 30352 0.0 Ss 2-00:54:45 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28864 0.0 Ss 1-00:53:41 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1463 1 root 26432 0.0 Ss 67-17:07:21 tailwatchd 3797965 506832 nobody 22496 0.0 S 03:06 /usr/sbin/httpd -k start 3796263 506832 nobody 22184 0.0 S 06:02 /usr/sbin/httpd -k start 2602226 1 root 22084 0.1 Ssl 1-00:53:26 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 3796553 506832 nobody 21876 0.0 S 05:32 /usr/sbin/httpd -k start 3797963 506832 nobody 21600 0.0 S 03:06 /usr/sbin/httpd -k start 3797955 506832 nobody 21536 0.0 S 03:07 /usr/sbin/httpd -k start 3797946 506832 nobody 21336 0.0 S 03:09 /usr/sbin/httpd -k start 3797970 506832 nobody 20488 0.0 S 03:06 /usr/sbin/httpd -k start 3813664 506832 nobody 20464 0.0 S 00:52 /usr/sbin/httpd -k start 3813480 506832 nobody 20448 0.0 S 01:08 /usr/sbin/httpd -k start 1542531 1 wp-toolkit 20388 0.0 Ss 2-00:54:44 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3814307 506832 nobody 19928 0.3 S 00:09 /usr/sbin/httpd -k start 3814190 506832 nobody 19912 0.1 S 00:11 /usr/sbin/httpd -k start 3797954 506832 nobody 19616 0.0 S 03:07 /usr/sbin/httpd -k start 3814179 506832 nobody 19204 0.0 S 00:12 /usr/sbin/httpd -k start 3814180 506832 nobody 19144 0.0 S 00:12 /usr/sbin/httpd -k start 3814182 506832 nobody 19104 0.0 S 00:12 /usr/sbin/httpd -k start 3814176 506832 nobody 19076 0.1 S 00:13 /usr/sbin/httpd -k start 3814177 506832 nobody 19072 0.0 S 00:13 /usr/sbin/httpd -k start 3814189 506832 nobody 19044 0.0 S 00:11 /usr/sbin/httpd -k start 3813661 506832 nobody 19032 0.0 S 00:53 /usr/sbin/httpd -k start 3814186 506832 nobody 19008 0.1 S 00:11 /usr/sbin/httpd -k start 3814362 506832 nobody 19000 0.1 S 00:08 /usr/sbin/httpd -k start 3814181 506832 nobody 18960 0.0 S 00:12 /usr/sbin/httpd -k start 3814354 506832 nobody 18940 0.1 S 00:08 /usr/sbin/httpd -k start 3814373 506832 nobody 18932 0.3 S 00:06 /usr/sbin/httpd -k start 3814188 506832 nobody 18904 0.1 S 00:11 /usr/sbin/httpd -k start 3814302 506832 nobody 18872 0.1 S 00:09 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10633413 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 10633403 | madalice_wp | madalice_wp | Query | 0 | Sending data | SELECT option_value FROM AMuqf6qZ_options WHERE option_name LIKE 'wc_square_background_sync_job_%' AND ( option_value LIKE '%\"status\":\"queued\"%' OR option_value LIKE '%\"status\":\"processing\"%' ) ORDER BY option_id ASC LIMIT 1 | +----------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 96 coscom/coscom.com.au-ssl_log 62 evolution/portal.evolutionerp.com.au-ssl_log 7 madalice/madalice.com.au-ssl_log 7 corpkicks/corporatekicks.com.au-ssl_log 4 infinium/infinium.net.au-ssl_log 4 alison/alisonarts.com.au-ssl_log 3 evolution/my.evolutionerp.com.au-ssl_log 3 otterfencing/otterfencing.com.au-ssl_log 2 otter2/otterfencing.net.au-ssl_log 1 vinesit/vinesit.com.au-ssl_log 1 (total vhosts taking traffic: 11) --- top client IPs across all vhosts (last 3 min) --- 96 40.115.94.245 62 34.165.188.235 7 203.54.180.238 3 213.209.159.84 3 118.127.40.55 2 4.148.8.97 2 40.77.167.1 2 195.178.110.48 1 43.153.96.79 1 34.196.51.17 1 34.142.119.251 1 3.230.224.6 1 216.244.66.236 1 207.46.13.7 1 205.210.31.173 --- top request paths across all vhosts (last 3 min) --- 36 GET /api/getItem/LWPB2001KG 26 GET /api/getItem/LWFBW2001KG 12 GET /api/getItem/LWHG2001KG 8 GET / 7 GET /heartbeat.php 4 POST / 3 POST /wp-cron.php 3 GET /index.php 2 GET /store/crease-guards/ 2 GET /api/session/properties 2 GET /api/getItem/H4020 1 HEAD / 1 GET /web/.env 1 GET /var/www/html/.env 1 GET /var/www/.env 1 GET /store/hand-painted-nike-af1-pink-pastel-flower/ 1 GET /store/custom-af1-drippy-swoosh/ 1 GET /store/cross-hatch-sketchy-af1/ 1 GET /storage/.env 1 GET /src/.env --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 36 GET /api/getItem/LWPB2001KG 26 GET /api/getItem/LWFBW2001KG 12 GET /api/getItem/LWHG2001KG 2 GET /api/getItem/H4020 1 GET /api/getItem/S5 1 GET /api/getItem/S4 1 GET /api/getItem/S3 1 GET /api/getItem/S2 1 GET /api/getItem/S1 1 GET /api/getItem/H8040 1 GET /api/getItem/H8032D 1 GET /api/getItem/H8025D -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:03:16:28 +1000] "GET /api/getItem/S1 HTTP/1.1" 200 1423 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:16:28 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:16:29 +1000] "GET /api/getItem/S2 HTTP/1.1" 200 1431 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:16:29 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:16:29 +1000] "GET /api/getItem/S3 HTTP/1.1" 200 1428 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:16:29 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:16:29 +1000] "GET /api/getItem/S4 HTTP/1.1" 200 1426 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:16:29 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:16:30 +1000] "GET /api/getItem/S5 HTTP/1.1" 200 1426 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:16:30 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" == coscom/coscom.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /web/.env 1 GET /var/www/html/.env 1 GET /var/www/.env 1 GET /storage/.env 1 GET /src/.env 1 GET /site/.env 1 GET /shared/.env 1 GET /server/.env 1 GET /releases/.env 1 GET /release/.env 1 GET /public/.env -- last 10 requests -- 34.165.188.235 - - [05/Sep/2026:03:17:02 +1000] "GET /bootstrap/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.188.235 - - [05/Sep/2026:03:17:03 +1000] "GET /database/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.188.235 - - [05/Sep/2026:03:17:03 +1000] "GET /storage/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.188.235 - - [05/Sep/2026:03:17:03 +1000] "GET /var/www/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.188.235 - - [05/Sep/2026:03:17:04 +1000] "GET /var/www/html/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.188.235 - - [05/Sep/2026:03:17:04 +1000] "GET /current/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.188.235 - - [05/Sep/2026:03:17:04 +1000] "GET /release/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.188.235 - - [05/Sep/2026:03:17:05 +1000] "GET /releases/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.188.235 - - [05/Sep/2026:03:17:05 +1000] "GET /shared/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.188.235 - - [05/Sep/2026:03:17:05 +1000] "GET /deploy/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 7 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [05/Sep/2026:03:15:07 +1000] "GET /heartbeat.php?sentAt=1788542107&bytes=106,154,252,155&_=1788436623777 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [05/Sep/2026:03:15:17 +1000] "GET /heartbeat.php?sentAt=1788542117&bytes=106,154,252,165&_=1788436623778 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [05/Sep/2026:03:15:27 +1000] "GET /heartbeat.php?sentAt=1788542127&bytes=106,154,252,175&_=1788436623779 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [05/Sep/2026:03:15:37 +1000] "GET /heartbeat.php?sentAt=1788542137&bytes=106,154,252,185&_=1788436623780 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [05/Sep/2026:03:15:47 +1000] "GET /heartbeat.php?sentAt=1788542147&bytes=106,154,252,195&_=1788436623781 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [05/Sep/2026:03:15:57 +1000] "GET /heartbeat.php?sentAt=1788542157&bytes=106,154,252,205&_=1788436623782 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [05/Sep/2026:03:16:07 +1000] "GET /heartbeat.php?sentAt=1788542167&bytes=106,154,252,215&_=1788436623783 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 --- last 30 samples (run-up to this incident) --- 2026-09-05 03:14:45 L1=1.58 run=2 blk=1 avail=7685 (55.8%) swpO=0 conn=4 myRSS=3301 php=6 phpRSS=308 ap=16 tcp=31 topuser=madalice 2026-09-05 03:14:46 L1=1.58 run=3 blk=1 avail=7690 (55.8%) swpO=0 conn=3 myRSS=3301 php=6 phpRSS=309 ap=16 tcp=31 topuser=madalice 2026-09-05 03:14:55 L1=1.57 run=1 blk=0 avail=7700 (55.9%) swpO=0 conn=4 myRSS=3301 php=5 phpRSS=305 ap=14 tcp=31 topuser=madalice 2026-09-05 03:14:56 L1=1.52 run=1 blk=0 avail=7692 (55.8%) swpO=0 conn=3 myRSS=3301 php=5 phpRSS=305 ap=14 tcp=31 topuser=madalice 2026-09-05 03:15:06 L1=2.04 run=3 blk=0 avail=7155 (51.9%) swpO=0 conn=4 myRSS=3301 php=8 phpRSS=732 ap=13 tcp=32 topuser=corpkicks 2026-09-05 03:15:06 L1=2.20 run=4 blk=0 avail=7043 (51.1%) swpO=0 conn=3 myRSS=3301 php=8 phpRSS=790 ap=13 tcp=30 topuser=corpkicks 2026-09-05 03:15:16 L1=2.34 run=1 blk=0 avail=7613 (55.3%) swpO=0 conn=4 myRSS=3301 php=6 phpRSS=332 ap=13 tcp=32 topuser=evolution 2026-09-05 03:15:16 L1=2.15 run=1 blk=0 avail=7615 (55.3%) swpO=0 conn=3 myRSS=3301 php=6 phpRSS=332 ap=13 tcp=32 topuser=evolution 2026-09-05 03:15:26 L1=2.22 run=1 blk=0 avail=7505 (54.5%) swpO=0 conn=3 myRSS=3301 php=5 phpRSS=273 ap=13 tcp=29 topuser=madalice 2026-09-05 03:15:26 L1=2.04 run=1 blk=0 avail=7503 (54.5%) swpO=0 conn=3 myRSS=3301 php=5 phpRSS=273 ap=13 tcp=30 topuser=madalice 2026-09-05 03:15:36 L1=1.88 run=1 blk=0 avail=7693 (55.8%) swpO=2 conn=3 myRSS=3301 php=5 phpRSS=282 ap=13 tcp=29 topuser=madalice 2026-09-05 03:15:36 L1=1.73 run=2 blk=0 avail=7680 (55.7%) swpO=2 conn=3 myRSS=3301 php=5 phpRSS=282 ap=13 tcp=29 topuser=madalice 2026-09-05 03:15:46 L1=1.59 run=1 blk=0 avail=7546 (54.8%) swpO=2 conn=3 myRSS=3301 php=5 phpRSS=282 ap=13 tcp=27 topuser=madalice 2026-09-05 03:15:46 L1=1.46 run=1 blk=0 avail=7511 (54.5%) swpO=2 conn=3 myRSS=3301 php=5 phpRSS=282 ap=13 tcp=28 topuser=madalice 2026-09-05 03:15:56 L1=1.35 run=3 blk=0 avail=7646 (55.5%) swpO=0 conn=3 myRSS=3301 php=5 phpRSS=282 ap=13 tcp=32 topuser=madalice 2026-09-05 03:15:56 L1=1.24 run=2 blk=0 avail=7617 (55.3%) swpO=0 conn=3 myRSS=3301 php=5 phpRSS=282 ap=13 tcp=32 topuser=madalice 2026-09-05 03:16:06 L1=1.14 run=2 blk=0 avail=7689 (55.8%) swpO=0 conn=3 myRSS=3301 php=6 phpRSS=332 ap=14 tcp=30 topuser=madalice 2026-09-05 03:16:06 L1=1.13 run=2 blk=0 avail=7662 (55.6%) swpO=0 conn=3 myRSS=3301 php=6 phpRSS=376 ap=14 tcp=29 topuser=madalice 2026-09-05 03:16:16 L1=1.04 run=2 blk=0 avail=7586 (55.1%) swpO=0 conn=3 myRSS=3301 php=5 phpRSS=305 ap=17 tcp=35 topuser=madalice 2026-09-05 03:16:16 L1=1.03 run=3 blk=1 avail=7535 (54.7%) swpO=0 conn=3 myRSS=3301 php=5 phpRSS=305 ap=17 tcp=34 topuser=madalice 2026-09-05 03:16:26 L1=0.95 run=4 blk=0 avail=7454 (54.1%) swpO=0 conn=3 myRSS=3301 php=6 phpRSS=345 ap=17 tcp=31 topuser=evolution 2026-09-05 03:16:26 L1=0.87 run=2 blk=0 avail=7431 (53.9%) swpO=0 conn=3 myRSS=3301 php=6 phpRSS=340 ap=17 tcp=29 topuser=madalice 2026-09-05 03:16:36 L1=0.80 run=4 blk=0 avail=7338 (53.3%) swpO=0 conn=3 myRSS=3301 php=7 phpRSS=621 ap=16 tcp=33 topuser=evolution 2026-09-05 03:16:36 L1=0.82 run=2 blk=0 avail=7583 (55.0%) swpO=0 conn=3 myRSS=3301 php=5 phpRSS=305 ap=16 tcp=32 topuser=madalice 2026-09-05 03:16:46 L1=0.75 run=3 blk=0 avail=7505 (54.5%) swpO=0 conn=3 myRSS=3301 php=7 phpRSS=522 ap=16 tcp=35 topuser=evolution 2026-09-05 03:16:47 L1=0.85 run=4 blk=0 avail=7350 (53.4%) swpO=0 conn=3 myRSS=3301 php=7 phpRSS=650 ap=16 tcp=35 topuser=evolution 2026-09-05 03:16:56 L1=0.96 run=6 blk=0 avail=7336 (53.2%) swpO=3 conn=3 myRSS=3301 php=7 phpRSS=430 ap=31 tcp=124 topuser=madalice 2026-09-05 03:16:57 L1=0.96 run=6 blk=0 avail=7066 (51.3%) swpO=3 conn=3 myRSS=3301 php=7 phpRSS=665 ap=31 tcp=132 topuser=madalice 2026-09-05 03:17:06 L1=2.83 run=14 blk=1 avail=5343 (38.8%) swpO=184 conn=15 myRSS=3295 php=16 phpRSS=2190 ap=116 tcp=108 topuser=madalice 2026-09-05 03:17:07 L1=2.83 run=16 blk=0 avail=5084 (36.9%) swpO=184 conn=15 myRSS=3295 php=16 phpRSS=2452 ap=116 tcp=105 topuser=madalice