INCIDENT 2026-09-05 03:26:00 trigger: php_rss=1652MB mysql_conn=17 ================================================================== load: 2.49 1.68 1.68 23/731 3848545 ncpu:10 mem_avail: 6418MB/13777MB (46.6%) swap_used:1764MB swapout:0/s blocked(D):1 running:17 iowait:4.8% steal:0.0% php: 17 procs / 1652MB heaviest user: tubesupplies (13 procs, 1503MB) apache: 52 procs tcp_estab: 73 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3290 tubesupplies 13 1664 root 246 1412 nobody 51 808 netdata 8 257 evolution 12 183 dovenull 6 66 cpanellogin 1 64 wp-toolkit 3 55 kurri 3 42 lowrange 2 30 infinium 2 28 dovecot 3 28 mailman 20 26 zabbix 1 11 mailnull 2 8 polkitd 1 7 named 1 6 nscd 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB tubesupplies 12 1566 evolution 3 120 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5172 MB Active(file): 4371 MB Inactive(file): 813 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 950 MB CommitLimit: 10984 MB Committed_AS: 9396 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3814865 root 08:47 6820 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 3814884 root 08:45 414860 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress 3926885 root 4-01:03:34 3960 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3368988 12.4 Ssl 2-13:11:49 /usr/sbin/mariadbd 3814884 3814865 root 414860 6.0 Sl 08:45 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1542443 1 netdata 190328 2.6 Ssl 2-01:03:39 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3643624 3626973 root 183096 0.0 S 59:11 spamd child 3626973 1 root 175620 0.1 Ss 01:02:46 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3643625 3626973 root 167912 0.0 S 59:11 spamd child 3848493 3848135 tubesupplies 153316 45.0 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3848486 3848095 tubesupplies 150152 32.7 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3848507 3848138 tubesupplies 148668 42.0 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3848509 3848477 tubesupplies 145108 60.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3848511 3848478 tubesupplies 139944 60.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3848494 3848111 tubesupplies 129540 36.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3848483 3848469 tubesupplies 127060 28.5 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3848491 3848479 tubesupplies 116776 34.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3454439 1353308 cpanellogin 66112 0.0 S 01:54:40 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 3127357 3127312 evolution 63156 0.0 Ss 03:26:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3127358 3127320 evolution 60344 0.0 Ss 03:26:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509236 509098 root 42600 0.0 Sl 8-01:06:20 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 40924 0.1 Ss 45-00:44:46 cpsrvd (SSL) - waiting for connections 1542981 1542551 netdata 40900 0.1 Sl 2-01:03:35 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 40428 0.1 Ss 67-17:16:15 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3626082 1 root 36064 0.0 Ss 01:03:46 lfd - sleeping 509266 1 root 33572 0.0 Ss 8-01:06:20 /usr/lib/systemd/systemd-journald 1542487 1 wp-toolkit 30312 0.0 Ss 2-01:03:39 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28912 0.0 Ss 1-01:02:35 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1463 1 root 26076 0.0 Ss 67-17:16:15 tailwatchd 3797963 506832 nobody 24376 0.0 S 12:00 /usr/sbin/httpd -k start 3814187 506832 nobody 23064 0.0 S 09:05 /usr/sbin/httpd -k start 3816727 506832 nobody 22336 0.0 S 06:01 /usr/sbin/httpd -k start 2602226 1 root 22084 0.1 Ssl 1-01:02:20 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 3814415 506832 nobody 21528 0.0 S 08:58 /usr/sbin/httpd -k start 3814349 506832 nobody 21416 0.1 S 09:02 /usr/sbin/httpd -k start 3832928 506832 nobody 21336 0.0 S 02:33 /usr/sbin/httpd -k start 1542531 1 wp-toolkit 20384 0.0 Ss 2-01:03:38 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3848122 506832 nobody 19592 0.0 S 00:46 /usr/sbin/httpd -k start 3848136 506832 nobody 18980 0.0 S 00:46 /usr/sbin/httpd -k start 1542982 1542551 netdata 18808 2.1 Sl 2-01:03:35 /usr/libexec/netdata/plugins.d/apps.plugin 1 3833670 506832 nobody 18292 0.0 S 01:12 /usr/sbin/httpd -k start 3848095 506832 nobody 18064 0.0 S 00:48 /usr/sbin/httpd -k start 3848149 506832 nobody 18004 0.0 S 00:46 /usr/sbin/httpd -k start 3848124 506832 nobody 17704 0.0 S 00:46 /usr/sbin/httpd -k start 3848135 506832 nobody 17612 0.0 R 00:46 /usr/sbin/httpd -k start 3848112 506832 nobody 17284 0.0 S 00:47 /usr/sbin/httpd -k start 3848113 506832 nobody 17232 0.0 S 00:47 /usr/sbin/httpd -k start 3848110 506832 nobody 17192 0.0 S 00:47 /usr/sbin/httpd -k start 3848106 506832 nobody 17152 0.0 S 00:47 /usr/sbin/httpd -k start 3848104 506832 nobody 17148 0.0 S 00:47 /usr/sbin/httpd -k start 3848081 506832 nobody 17128 0.0 S 00:49 /usr/sbin/httpd -k start 3848107 506832 nobody 17116 0.0 S 00:47 /usr/sbin/httpd -k start 3848108 506832 nobody 17088 0.0 S 00:47 /usr/sbin/httpd -k start 3848111 506832 nobody 17088 0.0 S 00:47 /usr/sbin/httpd -k start 3848121 506832 nobody 17080 0.0 S 00:46 /usr/sbin/httpd -k start 3848109 506832 nobody 17072 0.0 S 00:47 /usr/sbin/httpd -k start 3848080 506832 nobody 17060 0.0 S 00:49 /usr/sbin/httpd -k start 3848114 506832 nobody 17060 0.0 S 00:47 /usr/sbin/httpd -k start 3848119 506832 nobody 17060 0.0 S 00:46 /usr/sbin/httpd -k start 3848103 506832 nobody 17044 0.0 S 00:47 /usr/sbin/httpd -k start 3848470 506832 nobody 16964 0.0 S 00:05 /usr/sbin/httpd -k start 3848091 506832 nobody 16960 0.2 S 00:48 /usr/sbin/httpd -k start 3848478 506832 nobody 16960 0.0 S 00:04 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10637294 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 75 otter2/otterfencing.net.au-ssl_log 60 madalice/madalice.com.au-ssl_log 6 evolution/portal.evolutionerp.com.au-ssl_log 4 alison/alisonarts.com.au-ssl_log 3 customc/customcentral.com.au-ssl_log 3 tubesupplies/tubesupplies.com.au-ssl_log 2 evolution/my.evolutionerp.com.au-ssl_log 1 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 75 40.115.94.245 60 34.40.79.89 4 203.54.180.238 2 91.92.243.249 2 85.206.128.219 2 216.244.66.243 2 118.127.40.55 1 57.141.16.53 1 40.77.167.76 1 196.251.121.150 1 114.119.143.14 1 114.119.140.234 1 114.119.131.88 1 114.119.130.40 --- top request paths across all vhosts (last 3 min) --- 75 GET /api/getItem/LWPG2001KG 5 POST / 4 GET /store/black-nike-air-forces-drippy-custom-shoes/ 4 GET /heartbeat.php 3 POST /wp-login.php 2 GET / 1 POST /wp-cron.php 1 GET /web/.env 1 GET /var/www/html/.env 1 GET /var/www/.env 1 GET /store/design-your-own-kids-kicks 1 GET /storage/.env 1 GET /src/.env 1 GET /site/.env 1 GET /server/.env 1 GET /releases/.env 1 GET /release/.env 1 GET /public/.env 1 GET /private/.env 1 GET /index.php/product/nourished-neighborhood/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 75 GET /api/getItem/LWPG2001KG -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:03:25:47 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:25:47 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:25:48 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:25:48 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:25:48 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:25:49 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:25:49 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:25:50 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:25:50 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:03:25:50 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" == otter2/otterfencing.net.au-ssl_log == -- top paths -- 4 POST / 1 GET /web/.env 1 GET /var/www/html/.env 1 GET /var/www/.env 1 GET /storage/.env 1 GET /src/.env 1 GET /site/.env 1 GET /server/.env 1 GET /releases/.env 1 GET /release/.env 1 GET /public/.env 1 GET /private/.env -- last 10 requests -- 34.40.79.89 - - [05/Sep/2026:03:25:49 +1000] "GET /private/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.40.79.89 - - [05/Sep/2026:03:25:50 +1000] "GET /application/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.40.79.89 - - [05/Sep/2026:03:25:50 +1000] "GET /bootstrap/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.40.79.89 - - [05/Sep/2026:03:25:50 +1000] "GET /database/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.40.79.89 - - [05/Sep/2026:03:25:51 +1000] "GET /storage/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.40.79.89 - - [05/Sep/2026:03:25:51 +1000] "GET /var/www/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.40.79.89 - - [05/Sep/2026:03:25:52 +1000] "GET /var/www/html/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.40.79.89 - - [05/Sep/2026:03:25:52 +1000] "GET /current/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.40.79.89 - - [05/Sep/2026:03:25:52 +1000] "GET /release/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.40.79.89 - - [05/Sep/2026:03:25:53 +1000] "GET /releases/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 4 GET /store/black-nike-air-forces-drippy-custom-shoes/ 1 GET /store/design-your-own-kids-kicks 1 GET / -- last 10 requests -- 114.119.143.14 - - [05/Sep/2026:03:24:01 +1000] "GET /store/black-nike-air-forces-drippy-custom-shoes/?wcpr_rating=2&rating=5&wcpr_page=4 HTTP/1.1" 200 55170 "https://madalice.com.au/store/black-nike-air-forces-drippy-cu 114.119.140.234 - - [05/Sep/2026:03:24:24 +1000] "GET /store/black-nike-air-forces-drippy-custom-shoes/?verified=1&rating=3&image=1&wcpr_verified=1 HTTP/1.1" 200 55037 "https://madalice.com.au/store/black-nike-air-forces 114.119.131.88 - - [05/Sep/2026:03:24:47 +1000] "GET /store/black-nike-air-forces-drippy-custom-shoes/?verified=1&rating=3 HTTP/1.1" 200 55208 "https://madalice.com.au/store/black-nike-air-forces-drippy-custom-shoes/?ver 114.119.130.40 - - [05/Sep/2026:03:25:06 +1000] "GET /store/black-nike-air-forces-drippy-custom-shoes/?rating=2&verified=1&wcpr_rating=2 HTTP/1.1" 200 55140 "https://madalice.com.au/store/black-nike-air-forces-drippy-cus 85.206.128.219 - - [05/Sep/2026:03:25:07 +1000] "GET /store/design-your-own-kids-kicks HTTP/1.1" 301 1 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/94.0.4606.61 Safari/537.36 85.206.128.219 - - [05/Sep/2026:03:25:15 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/store/design-your-own-kids-shoes/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537. --- last 30 samples (run-up to this incident) --- 2026-09-05 03:23:31 L1=1.35 run=2 blk=1 avail=7450 (54.1%) swpO=0 conn=4 myRSS=3290 php=7 phpRSS=490 ap=14 tcp=32 topuser=olympic 2026-09-05 03:23:39 L1=1.44 run=2 blk=1 avail=7626 (55.4%) swpO=0 conn=4 myRSS=3290 php=5 phpRSS=283 ap=14 tcp=32 topuser=madalice 2026-09-05 03:23:41 L1=1.44 run=1 blk=1 avail=7600 (55.2%) swpO=0 conn=4 myRSS=3290 php=5 phpRSS=304 ap=14 tcp=30 topuser=madalice 2026-09-05 03:23:49 L1=1.37 run=1 blk=1 avail=7599 (55.2%) swpO=0 conn=4 myRSS=3290 php=5 phpRSS=304 ap=14 tcp=33 topuser=madalice 2026-09-05 03:23:51 L1=1.37 run=1 blk=1 avail=7599 (55.2%) swpO=0 conn=4 myRSS=3290 php=5 phpRSS=304 ap=14 tcp=32 topuser=madalice 2026-09-05 03:23:59 L1=1.40 run=1 blk=1 avail=7610 (55.2%) swpO=0 conn=4 myRSS=3290 php=5 phpRSS=304 ap=13 tcp=32 topuser=madalice 2026-09-05 03:24:01 L1=1.44 run=2 blk=1 avail=7604 (55.2%) swpO=0 conn=4 myRSS=3290 php=5 phpRSS=312 ap=13 tcp=32 topuser=madalice 2026-09-05 03:24:09 L1=1.41 run=2 blk=1 avail=7553 (54.8%) swpO=0 conn=4 myRSS=3290 php=6 phpRSS=391 ap=13 tcp=29 topuser=madalice 2026-09-05 03:24:11 L1=1.38 run=1 blk=1 avail=7625 (55.3%) swpO=3 conn=4 myRSS=3290 php=5 phpRSS=304 ap=13 tcp=29 topuser=madalice 2026-09-05 03:24:19 L1=1.43 run=1 blk=1 avail=7612 (55.3%) swpO=3 conn=4 myRSS=3290 php=5 phpRSS=304 ap=13 tcp=29 topuser=madalice 2026-09-05 03:24:21 L1=1.39 run=1 blk=1 avail=7611 (55.2%) swpO=0 conn=4 myRSS=3290 php=5 phpRSS=304 ap=13 tcp=29 topuser=madalice 2026-09-05 03:24:29 L1=1.28 run=2 blk=0 avail=7624 (55.3%) swpO=0 conn=4 myRSS=3290 php=5 phpRSS=282 ap=13 tcp=33 topuser=madalice 2026-09-05 03:24:31 L1=1.18 run=2 blk=0 avail=7626 (55.4%) swpO=0 conn=3 myRSS=3290 php=5 phpRSS=282 ap=13 tcp=30 topuser=madalice 2026-09-05 03:24:39 L1=1.08 run=2 blk=0 avail=7614 (55.3%) swpO=0 conn=3 myRSS=3290 php=6 phpRSS=322 ap=13 tcp=29 topuser=evolution 2026-09-05 03:24:41 L1=1.00 run=2 blk=0 avail=7625 (55.3%) swpO=0 conn=3 myRSS=3290 php=5 phpRSS=282 ap=13 tcp=29 topuser=madalice 2026-09-05 03:24:49 L1=1.08 run=4 blk=0 avail=7514 (54.5%) swpO=0 conn=3 myRSS=3290 php=6 phpRSS=305 ap=14 tcp=32 topuser=madalice 2026-09-05 03:24:51 L1=0.99 run=3 blk=0 avail=7583 (55.0%) swpO=0 conn=3 myRSS=3290 php=6 phpRSS=345 ap=14 tcp=30 topuser=madalice 2026-09-05 03:24:59 L1=0.91 run=1 blk=0 avail=7619 (55.3%) swpO=0 conn=3 myRSS=3290 php=5 phpRSS=282 ap=13 tcp=27 topuser=madalice 2026-09-05 03:25:01 L1=0.92 run=2 blk=0 avail=7580 (55.0%) swpO=0 conn=3 myRSS=3290 php=5 phpRSS=282 ap=13 tcp=27 topuser=madalice 2026-09-05 03:25:09 L1=1.00 run=2 blk=0 avail=7484 (54.3%) swpO=0 conn=3 myRSS=3290 php=6 phpRSS=428 ap=13 tcp=38 topuser=madalice 2026-09-05 03:25:11 L1=0.92 run=3 blk=0 avail=7469 (54.2%) swpO=0 conn=3 myRSS=3290 php=6 phpRSS=428 ap=16 tcp=42 topuser=madalice 2026-09-05 03:25:19 L1=0.93 run=3 blk=0 avail=7063 (51.3%) swpO=0 conn=3 myRSS=3290 php=6 phpRSS=457 ap=73 tcp=39 topuser=madalice 2026-09-05 03:25:21 L1=0.86 run=1 blk=0 avail=7075 (51.4%) swpO=0 conn=3 myRSS=3290 php=6 phpRSS=457 ap=71 tcp=29 topuser=madalice 2026-09-05 03:25:30 L1=0.79 run=1 blk=0 avail=7132 (51.8%) swpO=1 conn=3 myRSS=3290 php=6 phpRSS=458 ap=63 tcp=30 topuser=madalice 2026-09-05 03:25:32 L1=0.72 run=1 blk=0 avail=7137 (51.8%) swpO=1 conn=3 myRSS=3290 php=6 phpRSS=458 ap=61 tcp=30 topuser=madalice 2026-09-05 03:25:40 L1=0.75 run=1 blk=1 avail=7202 (52.3%) swpO=1 conn=3 myRSS=3290 php=6 phpRSS=458 ap=52 tcp=30 topuser=madalice 2026-09-05 03:25:42 L1=0.77 run=1 blk=1 avail=7219 (52.4%) swpO=1 conn=3 myRSS=3290 php=6 phpRSS=458 ap=50 tcp=30 topuser=madalice 2026-09-05 03:25:50 L1=0.79 run=1 blk=1 avail=7411 (53.8%) swpO=0 conn=3 myRSS=3290 php=5 phpRSS=302 ap=42 tcp=30 topuser=madalice 2026-09-05 03:25:52 L1=0.88 run=1 blk=1 avail=7552 (54.8%) swpO=0 conn=3 myRSS=3290 php=4 phpRSS=148 ap=40 tcp=31 topuser=evolution 2026-09-05 03:26:00 L1=2.49 run=17 blk=1 avail=6418 (46.6%) swpO=0 conn=17 myRSS=3290 php=17 phpRSS=1652 ap=52 tcp=73 topuser=tubesupplies