INCIDENT 2026-09-05 07:16:13 trigger: php_rss=1567MB ================================================================== load: 1.94 1.97 1.85 4/701 441803 ncpu:10 mem_avail: 6677MB/13777MB (48.5%) swap_used:2171MB swapout:0/s blocked(D):1 running:2 iowait:9.6% steal:0.0% php: 13 procs / 1567MB heaviest user: madalice (9 procs, 1435MB) apache: 17 procs tcp_estab: 37 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2997 root 249 1491 madalice 9 1445 nobody 16 287 netdata 8 259 evolution 11 124 dovenull 6 65 cpanellogin 1 55 wp-toolkit 3 53 kurri 3 42 infinium 3 42 lowrange 2 30 dovecot 3 27 mailman 20 26 mailnull 5 21 candyfabcom 1 14 aaa 1 14 zabbix 1 11 polkitd 1 7 named 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 9 1445 evolution 3 104 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5394 MB Active(file): 4034 MB Inactive(file): 1431 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 566 MB CommitLimit: 10984 MB Committed_AS: 8863 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 4-04:53:46 4832 /usr/bin/imunify-agent-proxy 4109079 root 02:31:24 3620 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 02:31:24 547868 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3068940 11.8 Ssl 2-17:02:01 /usr/sbin/mariadbd 4109105 4109079 root 547868 9.8 Sl 02:31:24 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 424513 2601907 madalice 247656 7.2 R 03:56 php-fpm: pool madalice_com_au 1542443 1 netdata 193460 2.6 Ssl 2-04:53:51 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3643624 3626973 root 169004 0.0 S 04:49:23 spamd child 407474 2601907 madalice 164260 17.8 S 09:18 php-fpm: pool madalice_com_au 408460 2601907 madalice 164124 13.6 S 07:19 php-fpm: pool madalice_com_au 424514 2601907 madalice 163784 8.5 S 03:56 php-fpm: pool madalice_com_au 424517 2601907 madalice 160744 8.4 S 03:55 php-fpm: pool madalice_com_au 424518 2601907 madalice 160672 7.9 S 03:55 php-fpm: pool madalice_com_au 424515 2601907 madalice 159444 8.8 S 03:56 php-fpm: pool madalice_com_au 407388 2601907 madalice 151624 18.9 S 09:31 php-fpm: pool madalice_com_au 3626973 1 root 133504 0.0 Ss 04:52:58 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 424516 2601907 madalice 118948 7.5 S 03:56 php-fpm: pool madalice_com_au 3643625 3626973 root 94700 0.0 S 04:49:23 spamd child 509236 509098 root 61240 0.0 Sl 8-04:56:32 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 203496 1353308 cpanellogin 56932 0.0 S 01:09:01 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 3127357 3127312 evolution 54856 0.0 Ss 07:16:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3127358 3127320 evolution 51596 0.0 Ss 07:16:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509266 1 root 43756 0.0 Ss 8-04:56:32 /usr/lib/systemd/systemd-journald 1542981 1542551 netdata 41144 0.1 Sl 2-04:53:47 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1353308 1 root 40756 0.1 Ss 45-04:34:58 cpsrvd (SSL) - waiting for connections 441800 1469 root 36340 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1469 1 root 34916 0.1 Ss 67-21:06:27 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542487 1 wp-toolkit 29352 0.0 Ss 2-04:53:51 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28696 0.0 Ss 1-04:52:47 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3626082 1 root 28116 0.0 Ss 04:53:58 lfd - sleeping 1463 1 root 24200 0.0 Ss 67-21:06:27 tailwatchd 425206 506832 nobody 22512 0.0 S 03:32 /usr/sbin/httpd -k start 425244 506832 nobody 22100 0.0 S 03:31 /usr/sbin/httpd -k start 425177 506832 nobody 21920 0.0 S 03:33 /usr/sbin/httpd -k start 425271 506832 nobody 21872 0.0 S 03:31 /usr/sbin/httpd -k start 425149 506832 nobody 21812 0.0 S 03:34 /usr/sbin/httpd -k start 425252 506832 nobody 21752 0.1 S 03:31 /usr/sbin/httpd -k start 424500 506832 nobody 21688 0.0 S 03:58 /usr/sbin/httpd -k start 425195 506832 nobody 20548 0.0 S 03:32 /usr/sbin/httpd -k start 425263 506832 nobody 20316 0.0 S 03:31 /usr/sbin/httpd -k start 441054 506832 nobody 20172 0.0 S 01:00 /usr/sbin/httpd -k start 426360 506832 nobody 19640 0.0 S 01:44 /usr/sbin/httpd -k start 2602226 1 root 19388 0.1 Ssl 1-04:52:32 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1542531 1 wp-toolkit 19264 0.0 Ss 2-04:53:50 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 441366 506832 nobody 19056 0.0 S 00:37 /usr/sbin/httpd -k start 1542982 1542551 netdata 18548 2.2 Sl 2-04:53:47 /usr/libexec/netdata/plugins.d/apps.plugin 1 441362 506832 nobody 17876 0.0 S 00:38 /usr/sbin/httpd -k start 426700 506832 nobody 17828 0.0 S 01:21 /usr/sbin/httpd -k start 306499 1471 root 16408 0.0 S 37:09 cPhulkd - dbprocessor 4020744 508511 lowrange 15788 0.0 S 03:00:34 dovecot/imap 1542141 1 root 15420 0.0 Ss 2-04:53:54 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 3539428 508511 lowrange 15372 0.0 S 05:20:05 dovecot/imap 4124271 508511 kurri 15320 0.0 S 02:29:32 dovecot/imap 1471 1 root 14900 0.0 Ss 67-21:06:27 cPhulkd - processor 424143 508511 aaa 14784 0.0 S 04:44 dovecot/imap 373493 508511 infinium 14744 0.0 S 19:13 dovecot/imap 441722 508511 kurri 14608 0.0 S 00:04 dovecot/imap 425142 508511 infinium 14596 0.0 S 03:35 dovecot/imap 441721 508511 candyfabcom 14592 0.0 S 00:04 dovecot/imap 289344 508511 infinium 14588 0.0 S 42:29 dovecot/imap 3141944 508511 kurri 13964 0.0 S 07:15:50 dovecot/imap 441374 1471 root 13636 0.0 S 00:34 cPhulkd - processor - http socket 690505 508511 dovenull 13276 0.0 S 18:43:23 dovecot/imap-login --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10739949 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 124 candyfabcom/candyfab.com.au-ssl_log 44 evolution/app.evolutionerp.com.au-ssl_log 37 evolution/portal.evolutionerp.com.au-ssl_log 4 evolution/my.evolutionerp.com.au-ssl_log 1 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 111 139.28.219.70 43 20.151.10.161 37 40.115.94.245 4 34.74.69.34 4 203.54.180.238 2 114.119.137.101 1 52.167.144.233 1 45.141.128.157 1 216.73.216.222 1 17.166.235.244 1 17.166.234.133 1 114.119.159.70 1 114.119.146.16 1 114.119.143.104 1 114.119.140.234 --- top request paths across all vhosts (last 3 min) --- 4 GET /heartbeat.php 3 GET /store/light-blue-butterfly-custom-converse/ 2 GET /store/leopard-print-custom-kids-kicks/ 2 GET /admin.php 2 GET / 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 POST / 1 GET /wp.php 1 GET /wp-includes/php-ai-client/third-party/wp-includes/php-ai-client/ 1 GET /wp-includes/php-ai-client/third-party//wp-includes/php-ai-client/ 1 GET /wp-includes/php-ai-client/third-party/Nyholm/wp-includes/php-ai-client/third-party/ 1 GET /wp-includes/php-ai-client/third-party/Nyholm//wp-includes/php-ai-client/third-party/ 1 GET /wp-includes/php-ai-client/third-party/Nyholm/Psr7//wp-includes/php-ai-client/third-party/Nyholm/ 1 GET /wp-includes/php-ai-client/third-party/Nyholm/Psr7/wp-includes/php-ai-client/third-party/Nyholm/ 1 GET /wp-includes/php-ai-client/third-party/Nyholm/Psr7/Stream.php 1 GET /wp-includes/php-ai-client/third-party/Nyholm/Psr7/ServerRequest.php 1 GET /wp-includes/php-ai-client/third-party/Nyholm/Psr7/Response.php 1 GET /wp-includes/php-ai-client/third-party/Nyholm/Psr7/Request.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET /store/light-blue-butterfly-custom-converse/ 2 GET /store/leopard-print-custom-kids-kicks/ 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 POST / 1 GET /wp-includes/php-ai-client/third-party/wp-includes/php-ai-client/ 1 GET /wp-includes/php-ai-client/third-party//wp-includes/php-ai-client/ 1 GET /wp-includes/php-ai-client/third-party/Nyholm/wp-includes/php-ai-client/third-party/ 1 GET /wp-includes/php-ai-client/third-party/Nyholm//wp-includes/php-ai-client/third-party/ 1 GET /wp-includes/php-ai-client/third-party/Nyholm/Psr7//wp-includes/php-ai-client/third-party/Nyholm/ 1 GET /wp-includes/php-ai-client/third-party/Nyholm/Psr7/wp-includes/php-ai-client/third-party/Nyholm/ -- last 10 requests -- 139.28.219.70 - - [05/Sep/2026:07:15:51 +1000] "GET /wp-includes/php-ai-client/third-party/Nyholm/Psr7/wp-includes/php-ai-client/third-party/Nyholm/ HTTP/1.1" 404 36671 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:15:53 +1000] "GET /wp-includes/php-ai-client/third-party/Nyholm/Psr7/Factory//wp-includes/php-ai-client/third-party/Nyholm/Psr7/ HTTP/1.1" 301 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:15:54 +1000] "GET /wp-includes/php-ai-client/third-party/Nyholm/Psr7/Factory/wp-includes/php-ai-client/third-party/Nyholm/Psr7/ HTTP/1.1" 404 36679 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:15:56 +1000] "GET /wp-includes/php-ai-client/third-party/Nyholm/Psr7/Factory/HttplugFactory.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:15:56 +1000] "GET /wp-includes/php-ai-client/third-party/Nyholm/Psr7/Factory/Psr17Factory.php HTTP/1.1" 500 1 "-" "-" 114.119.143.104 - - [05/Sep/2026:07:15:56 +1000] "GET /store/leopard-print-custom-kids-kicks/?wcpr_rating=1&rating=4&wcpr_image=1 HTTP/1.1" 200 54641 "https://madalice.com.au/store/leopard-print-custom-kids-kicks/?wcpr_r 139.28.219.70 - - [05/Sep/2026:07:15:57 +1000] "GET /wp-includes/php-ai-client/third-party/Nyholm/Psr7/Request.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:15:58 +1000] "GET /wp-includes/php-ai-client/third-party/Nyholm/Psr7/Response.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:15:58 +1000] "GET /wp-includes/php-ai-client/third-party/Nyholm/Psr7/ServerRequest.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:15:59 +1000] "GET /wp-includes/php-ai-client/third-party/Nyholm/Psr7/Stream.php HTTP/1.1" 500 1 "-" "-" == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 2 GET /admin.php 1 GET /wp.php 1 GET /w.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /this_is_a_new_hello_world.php 1 GET /sky.php 1 GET /simple.php 1 GET /robots.php 1 GET /red.php 1 GET /puc.php 1 GET /pucci.php 1 GET /ops.php -- last 10 requests -- 20.151.10.161 - - [05/Sep/2026:07:15:58 +1000] "GET /av.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [05/Sep/2026:07:15:59 +1000] "GET /adminfuns.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [05/Sep/2026:07:15:59 +1000] "GET /ms-edit.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [05/Sep/2026:07:16:00 +1000] "GET /222.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [05/Sep/2026:07:16:00 +1000] "GET /BDKR28WP.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [05/Sep/2026:07:16:01 +1000] "GET /wp.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [05/Sep/2026:07:16:01 +1000] "GET /autoload_classmap.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [05/Sep/2026:07:16:02 +1000] "GET /simple.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [05/Sep/2026:07:16:02 +1000] "GET /chosen.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [05/Sep/2026:07:16:03 +1000] "GET /als.php HTTP/1.1" 401 36 "-" "-" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 1 GET /api/getItem/RGW90 1 GET /api/getItem/RGW80 1 GET /api/getItem/RGW160 1 GET /api/getItem/RGW120 1 GET /api/getItem/RGW117T 1 GET /api/getItem/RGW100 1 GET /api/getItem/PT75M 1 GET /api/getItem/PT65M 1 GET /api/getItem/PT50M 1 GET /api/getItem/PT100M 1 GET /api/getItem/PC19BL 1 GET /api/getItem/LOCKING_EYE%28DG%29 -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:07:14:10 +1000] "GET /api/getItem/RGW90 HTTP/1.1" 200 1182 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:14:11 +1000] "GET /api/getItem/RGW100 HTTP/1.1" 200 1732 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:14:11 +1000] "GET /api/getItem/RGW120 HTTP/1.1" 200 1737 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:14:11 +1000] "GET /api/getItem/RGW160 HTTP/1.1" 200 1607 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:14:12 +1000] "GET /api/getItem/RGW117T HTTP/1.1" 404 109 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:14:12 +1000] "GET /api/getItem/RGW80 HTTP/1.1" 200 1604 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:14:13 +1000] "GET /api/getItem/GP150x200x8 HTTP/1.1" 200 1522 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:14:13 +1000] "GET /api/getItem/K125MSGB HTTP/1.1" 200 1447 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:14:13 +1000] "GET /api/getItem/253-40SP HTTP/1.1" 200 1312 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:14:14 +1000] "GET /api/getItem/300558 HTTP/1.1" 200 1327 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-05 07:13:49 L1=1.94 run=3 blk=1 avail=6777 (49.2%) swpO=0 conn=4 myRSS=2997 php=13 phpRSS=1478 ap=19 tcp=39 topuser=madalice 2026-09-05 07:13:52 L1=1.94 run=1 blk=1 avail=7011 (50.9%) swpO=0 conn=3 myRSS=2997 php=13 phpRSS=1249 ap=19 tcp=38 topuser=madalice 2026-09-05 07:14:00 L1=2.17 run=5 blk=1 avail=6939 (50.4%) swpO=0 conn=4 myRSS=2997 php=13 phpRSS=1333 ap=17 tcp=38 topuser=madalice 2026-09-05 07:14:02 L1=2.17 run=2 blk=1 avail=6863 (49.8%) swpO=0 conn=3 myRSS=2997 php=13 phpRSS=1406 ap=17 tcp=38 topuser=madalice 2026-09-05 07:14:10 L1=2.15 run=2 blk=1 avail=6651 (48.3%) swpO=0 conn=4 myRSS=2997 php=13 phpRSS=1616 ap=17 tcp=39 topuser=madalice 2026-09-05 07:14:12 L1=2.15 run=1 blk=1 avail=6806 (49.4%) swpO=0 conn=3 myRSS=2997 php=13 phpRSS=1459 ap=17 tcp=38 topuser=madalice 2026-09-05 07:14:20 L1=2.05 run=2 blk=1 avail=6955 (50.5%) swpO=0 conn=4 myRSS=2997 php=13 phpRSS=1320 ap=17 tcp=37 topuser=madalice 2026-09-05 07:14:22 L1=2.05 run=1 blk=1 avail=6852 (49.7%) swpO=0 conn=3 myRSS=2997 php=13 phpRSS=1411 ap=17 tcp=39 topuser=madalice 2026-09-05 07:14:30 L1=1.97 run=1 blk=1 avail=6807 (49.4%) swpO=0 conn=4 myRSS=2997 php=13 phpRSS=1445 ap=18 tcp=40 topuser=madalice 2026-09-05 07:14:32 L1=1.97 run=1 blk=1 avail=6919 (50.2%) swpO=0 conn=3 myRSS=2997 php=13 phpRSS=1344 ap=18 tcp=36 topuser=madalice 2026-09-05 07:14:40 L1=1.89 run=1 blk=1 avail=6897 (50.1%) swpO=0 conn=4 myRSS=2997 php=13 phpRSS=1369 ap=17 tcp=35 topuser=madalice 2026-09-05 07:14:42 L1=1.89 run=2 blk=1 avail=6786 (49.3%) swpO=0 conn=4 myRSS=2997 php=13 phpRSS=1486 ap=17 tcp=34 topuser=madalice 2026-09-05 07:14:50 L1=1.99 run=2 blk=1 avail=6731 (48.9%) swpO=0 conn=4 myRSS=2997 php=13 phpRSS=1546 ap=16 tcp=34 topuser=madalice 2026-09-05 07:14:52 L1=1.99 run=2 blk=1 avail=6776 (49.2%) swpO=0 conn=4 myRSS=2997 php=13 phpRSS=1496 ap=17 tcp=34 topuser=madalice 2026-09-05 07:15:00 L1=1.84 run=3 blk=1 avail=6944 (50.4%) swpO=0 conn=4 myRSS=2997 php=13 phpRSS=1333 ap=17 tcp=31 topuser=madalice 2026-09-05 07:15:02 L1=1.84 run=1 blk=2 avail=6853 (49.7%) swpO=0 conn=4 myRSS=2997 php=14 phpRSS=1437 ap=16 tcp=31 topuser=madalice 2026-09-05 07:15:10 L1=2.02 run=3 blk=1 avail=6803 (49.4%) swpO=0 conn=4 myRSS=2997 php=14 phpRSS=1497 ap=16 tcp=37 topuser=madalice 2026-09-05 07:15:13 L1=2.02 run=3 blk=1 avail=6409 (46.5%) swpO=0 conn=6 myRSS=2997 php=16 phpRSS=1945 ap=17 tcp=38 topuser=madalice 2026-09-05 07:15:20 L1=2.09 run=3 blk=1 avail=6730 (48.9%) swpO=0 conn=5 myRSS=2997 php=14 phpRSS=1558 ap=17 tcp=36 topuser=madalice 2026-09-05 07:15:23 L1=2.09 run=2 blk=1 avail=6793 (49.3%) swpO=0 conn=6 myRSS=2997 php=14 phpRSS=1476 ap=17 tcp=38 topuser=madalice 2026-09-05 07:15:30 L1=2.07 run=2 blk=1 avail=6838 (49.6%) swpO=0 conn=5 myRSS=2997 php=13 phpRSS=1408 ap=17 tcp=36 topuser=madalice 2026-09-05 07:15:33 L1=2.07 run=2 blk=1 avail=6699 (48.6%) swpO=0 conn=4 myRSS=2997 php=13 phpRSS=1546 ap=17 tcp=37 topuser=madalice 2026-09-05 07:15:40 L1=1.91 run=3 blk=1 avail=6819 (49.5%) swpO=0 conn=5 myRSS=2997 php=13 phpRSS=1406 ap=20 tcp=39 topuser=madalice 2026-09-05 07:15:43 L1=1.91 run=1 blk=1 avail=6849 (49.7%) swpO=0 conn=3 myRSS=2997 php=13 phpRSS=1370 ap=19 tcp=39 topuser=madalice 2026-09-05 07:15:50 L1=2.00 run=2 blk=1 avail=6865 (49.8%) swpO=0 conn=4 myRSS=2997 php=13 phpRSS=1376 ap=17 tcp=36 topuser=madalice 2026-09-05 07:15:53 L1=2.00 run=1 blk=1 avail=6853 (49.7%) swpO=0 conn=3 myRSS=2997 php=13 phpRSS=1388 ap=17 tcp=36 topuser=madalice 2026-09-05 07:16:00 L1=1.92 run=1 blk=1 avail=7058 (51.2%) swpO=0 conn=4 myRSS=2997 php=13 phpRSS=1184 ap=17 tcp=40 topuser=madalice 2026-09-05 07:16:03 L1=1.92 run=3 blk=1 avail=6892 (50.0%) swpO=0 conn=3 myRSS=2997 php=13 phpRSS=1355 ap=17 tcp=37 topuser=madalice 2026-09-05 07:16:10 L1=1.94 run=2 blk=1 avail=6726 (48.8%) swpO=0 conn=4 myRSS=2997 php=14 phpRSS=1478 ap=17 tcp=37 topuser=madalice 2026-09-05 07:16:13 L1=1.94 run=2 blk=1 avail=6677 (48.5%) swpO=0 conn=4 myRSS=2997 php=13 phpRSS=1567 ap=17 tcp=37 topuser=madalice