INCIDENT 2026-09-05 07:19:01 trigger: php_rss=1676MB ================================================================== load: 2.27 2.02 1.88 5/707 443669 ncpu:10 mem_avail: 6625MB/13777MB (48.1%) swap_used:2182MB swapout:0/s blocked(D):1 running:6 iowait:8.5% steal:0.0% php: 17 procs / 1676MB heaviest user: madalice (9 procs, 1129MB) apache: 24 procs tcp_estab: 47 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2989 root 246 1415 madalice 9 1129 customc 4 448 nobody 23 415 netdata 8 261 evolution 11 124 dovenull 6 65 infinium 4 57 cpanellogin 1 55 wp-toolkit 3 53 kurri 3 42 lowrange 2 30 dovecot 3 27 mailman 20 26 mailnull 3 24 aaa 1 15 kamcool 1 13 zabbix 1 11 polkitd 1 7 --- php workers by user --- USER PROCS RSS_MB madalice 9 1129 customc 4 461 evolution 3 103 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4626 MB Active(file): 3331 MB Inactive(file): 1328 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 556 MB CommitLimit: 10984 MB Committed_AS: 9038 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 4-04:56:35 4832 /usr/bin/imunify-agent-proxy 4109079 root 02:34:13 3616 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 02:34:13 546316 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3061152 11.8 Ssl 2-17:04:50 /usr/sbin/mariadbd 4109105 4109079 root 546316 9.7 Sl 02:34:13 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1542443 1 netdata 194980 2.6 Ssl 2-04:56:40 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3643624 3626973 root 168588 0.0 S 04:52:12 spamd child 424516 2601907 madalice 164020 6.9 S 06:45 php-fpm: pool madalice_com_au 407474 2601907 madalice 163476 15.1 S 12:07 php-fpm: pool madalice_com_au 424517 2601907 madalice 161028 7.3 S 06:44 php-fpm: pool madalice_com_au 424515 2601907 madalice 159864 8.5 S 06:45 php-fpm: pool madalice_com_au 424514 2601907 madalice 145664 7.0 S 06:45 php-fpm: pool madalice_com_au 443637 442361 customc 143584 51.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 443636 442429 customc 138552 56.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3626973 1 root 131520 0.0 Ss 04:55:47 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 443639 443608 customc 120168 44.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 424518 2601907 madalice 115944 7.2 S 06:44 php-fpm: pool madalice_com_au 443638 443609 customc 106464 45.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3643625 3626973 root 93464 0.0 S 04:52:12 spamd child 407388 2601907 madalice 92040 15.6 S 12:20 php-fpm: pool madalice_com_au 424513 2601907 madalice 85836 6.0 S 06:45 php-fpm: pool madalice_com_au 408460 2601907 madalice 68300 11.2 S 10:08 php-fpm: pool madalice_com_au 509236 509098 root 61236 0.0 Sl 8-04:59:21 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 203496 1353308 cpanellogin 56864 0.0 S 01:11:50 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 3127357 3127312 evolution 54740 0.0 Ss 07:19:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3127358 3127320 evolution 51520 0.0 Ss 07:19:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509266 1 root 43756 0.0 Ss 8-04:59:21 /usr/lib/systemd/systemd-journald 1542981 1542551 netdata 41144 0.1 Sl 2-04:56:36 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1353308 1 root 40536 0.1 Ss 45-04:37:47 cpsrvd (SSL) - waiting for connections 1469 1 root 34804 0.1 Ss 67-21:09:16 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542487 1 wp-toolkit 29348 0.0 Ss 2-04:56:40 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28692 0.0 Ss 1-04:55:36 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3626082 1 root 28032 0.0 Ss 04:56:47 lfd - sleeping 1463 1 root 24188 0.0 Ss 67-21:09:16 tailwatchd 442461 506832 nobody 22864 0.0 S 02:17 /usr/sbin/httpd -k start 442468 506832 nobody 22184 0.0 S 02:17 /usr/sbin/httpd -k start 442270 506832 nobody 22088 0.0 S 02:23 /usr/sbin/httpd -k start 442361 506832 nobody 22072 0.0 S 02:19 /usr/sbin/httpd -k start 442417 506832 nobody 22016 0.0 S 02:18 /usr/sbin/httpd -k start 442425 506832 nobody 22000 0.1 S 02:18 /usr/sbin/httpd -k start 443328 506832 nobody 21836 0.1 S 00:34 /usr/sbin/httpd -k start 443329 506832 nobody 21108 0.0 S 00:34 /usr/sbin/httpd -k start 443322 506832 nobody 20996 0.1 S 00:35 /usr/sbin/httpd -k start 442429 506832 nobody 20884 0.0 S 02:18 /usr/sbin/httpd -k start 443410 506832 nobody 19940 0.0 S 00:25 /usr/sbin/httpd -k start 443495 506832 nobody 19660 0.1 S 00:16 /usr/sbin/httpd -k start 443496 506832 nobody 19496 0.1 S 00:16 /usr/sbin/httpd -k start 2602226 1 root 19364 0.1 Ssl 1-04:55:21 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1542531 1 wp-toolkit 19264 0.0 Ss 2-04:56:39 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 443489 506832 nobody 18856 0.1 S 00:17 /usr/sbin/httpd -k start 443460 506832 nobody 18764 0.1 S 00:18 /usr/sbin/httpd -k start 1542982 1542551 netdata 18548 2.2 Sl 2-04:56:36 /usr/libexec/netdata/plugins.d/apps.plugin 1 443490 506832 nobody 18512 0.1 S 00:17 /usr/sbin/httpd -k start 443494 506832 nobody 18504 0.1 S 00:16 /usr/sbin/httpd -k start 443604 506832 nobody 18408 0.0 S 00:02 /usr/sbin/httpd -k start 443418 506832 nobody 17836 0.1 S 00:24 /usr/sbin/httpd -k start 306499 1471 root 16400 0.0 S 39:58 cPhulkd - dbprocessor 424143 508511 aaa 16172 0.0 S 07:33 dovecot/imap 443608 506832 nobody 16120 0.0 S 00:01 /usr/sbin/httpd -k start 443609 506832 nobody 16056 0.0 S 00:01 /usr/sbin/httpd -k start 4020744 508511 lowrange 15684 0.0 S 03:03:23 dovecot/imap 443049 508720 mailnull 15436 0.0 S 01:01 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1542141 1 root 15420 0.0 Ss 2-04:56:43 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10740540 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min bigdeals/bigdeals.com.au-ssl_log 139 madalice/madalice.com.au-ssl_log 136 evolution/app.evolutionerp.com.au-ssl_log 54 customc/customcentral.com.au-ssl_log 25 otterfencing/otterfencing.com.au 12 otterfencing/otterfencing.com.au-ssl_log 12 evolution/portal.evolutionerp.com.au-ssl_log 7 corpkicks/corporatekicks.com.au-ssl_log 3 nrg/nrgservices.net.au-ssl_log 3 aaa/aaadownunder.com.au-ssl_log 1 alison/testing.alisonarts.com.au-ssl_log 1 candyfabcom/candyfab.com.au-ssl_log 1 evolution/evolutionerp.com.au-ssl_log 1 evolution/my.evolutionerp.com.au-ssl_log 1 (total vhosts taking traffic: 14) --- top client IPs across all vhosts (last 3 min) --- 159 13.203.219.17 124 139.28.219.70 54 40.115.94.245 24 88.187.63.164 24 136.70.94.99 7 203.54.180.238 5 2001:8003:153b:500:25ae:9f58:d8a8:392 2 118.127.40.55 2 114.119.140.234 1 93.123.109.53 1 75.247.0.21 1 52.205.222.214 1 45.80.198.12 1 45.61.187.30 1 34.196.51.17 --- top request paths across all vhosts (last 3 min) --- 8 GET / 7 GET /heartbeat.php 5 POST / 5 GET /store/leopard-print-custom-kids-kicks/ 3 GET /test-blog/ 3 GET /.git/config 3 GET /.env 3 GET /custom-shoes-for-australian-business-add-your-business-logo-to-sneakers/ 3 GET /cart/ 2 POST /wp-cron.php 2 GET /www/.git/config 2 GET /wordpress/.git/config 2 GET /var/www/.git/config 2 GET /src/.git/config 2 GET /site/.git/config 2 GET /public/.git/config 2 GET /html/.git/config 2 GET /htdocs/.git/config 2 GET /backend/.git/config 2 GET /app/.git/config --- busiest 3 vhosts: top paths + last 10 requests --- == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/.env 1 GET /wp/.env 1 GET /wordpress/.env 1 GET /web/.env 1 GET /vue/.env 1 GET /vite/.env 1 GET /vendor/.env 1 GET /var/www/html/.env 1 GET /var/www/.env -- last 10 requests -- 13.203.219.17 - - [05/Sep/2026:07:18:59 +1000] "GET /.env.backup2 HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 13.203.219.17 - - [05/Sep/2026:07:19:00 +1000] "GET /logs/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 13.203.219.17 - - [05/Sep/2026:07:19:00 +1000] "GET /cache/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 13.203.219.17 - - [05/Sep/2026:07:19:00 +1000] "GET /mailer/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 13.203.219.17 - - [05/Sep/2026:07:19:00 +1000] "GET /mail/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 13.203.219.17 - - [05/Sep/2026:07:19:00 +1000] "GET /email/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 13.203.219.17 - - [05/Sep/2026:07:19:01 +1000] "GET /smtp/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 13.203.219.17 - - [05/Sep/2026:07:19:01 +1000] "GET /mailing/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 13.203.219.17 - - [05/Sep/2026:07:19:01 +1000] "GET /notifications/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 13.203.219.17 - - [05/Sep/2026:07:19:01 +1000] "GET /notify/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 5 GET /store/leopard-print-custom-kids-kicks/ 4 GET / 1 POST / 1 GET /wp-includes/sodium_compat/wp-includes/ 1 GET /wp-includes/sodium_compat//wp-includes/ 1 GET /wp-includes/sodium_compat/src/wp-includes/sodium_compat/ 1 GET /wp-includes/sodium_compat/src//wp-includes/sodium_compat/ 1 GET /wp-includes/sodium_compat/src/Core/wp-includes/sodium_compat/src/ 1 GET /wp-includes/sodium_compat/src/Core//wp-includes/sodium_compat/src/ 1 GET /wp-includes/sodium_compat/src/Core/SecretStream/wp-includes/sodium_compat/src/Core/ 1 GET /wp-includes/sodium_compat/src/Core/SecretStream//wp-includes/sodium_compat/src/Core/ 1 GET /wp-includes/sodium_compat/src/Core/Salsa20.php -- last 10 requests -- 139.28.219.70 - - [05/Sep/2026:07:18:50 +1000] "GET /wp-includes/sodium_compat/src/Core/HSalsa20.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:18:50 +1000] "GET /wp-includes/sodium_compat/src/Core/Poly1305.php HTTP/1.1" 500 1 "-" "-" 114.119.140.234 - - [05/Sep/2026:07:18:50 +1000] "GET /store/leopard-print-custom-kids-kicks/?amp%3Brating=5&wcpr_rating=3&rating=2 HTTP/1.1" 200 54671 "https://madalice.com.au/store/leopard-print-custom-kids-kicks/?amp% 139.28.219.70 - - [05/Sep/2026:07:18:51 +1000] "GET /wp-includes/sodium_compat/src/Core/Poly1305//wp-includes/sodium_compat/src/Core/ HTTP/1.1" 301 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:18:52 +1000] "GET /wp-includes/sodium_compat/src/Core/Poly1305/wp-includes/sodium_compat/src/Core/ HTTP/1.1" 404 36665 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:18:54 +1000] "GET /wp-includes/sodium_compat/src/Core/Poly1305/State.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:18:55 +1000] "GET /wp-includes/sodium_compat/src/Core/Ristretto255.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:18:55 +1000] "GET /wp-includes/sodium_compat/src/Core/Salsa20.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:18:56 +1000] "GET /wp-includes/sodium_compat/src/Core/SecretStream//wp-includes/sodium_compat/src/Core/ HTTP/1.1" 301 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:18:57 +1000] "GET /wp-includes/sodium_compat/src/Core/SecretStream/wp-includes/sodium_compat/src/Core/ HTTP/1.1" 404 36669 "-" "-" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /api/getItem/SHSG656520 2 GET /api/getItem/SHSG656516 1 GET /api/getItem/SHSG8989508 1 GET /api/getItem/SHSG8989358 1 GET /api/getItem/SHSG8989258 1 GET /api/getItem/SHSG8989208 1 GET /api/getItem/SHSG7575508 1 GET /api/getItem/SHSG757540-8 1 GET /api/getItem/SHSG757540 1 GET /api/getItem/SHSG757530-8 1 GET /api/getItem/SHSG757530 1 GET /api/getItem/SHSG757525-8 -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:07:18:20 +1000] "GET /api/getItem/SHSG8989258 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:18:20 +1000] "GET /api/getItem/SHSG8989358 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:18:21 +1000] "GET /api/getItem/SHSG8989508 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:18:21 +1000] "GET /api/getItem/SHSG10010020 HTTP/1.1" 200 1822 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:18:21 +1000] "GET /api/getItem/SHSG10010025 HTTP/1.1" 200 1584 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:18:22 +1000] "GET /api/getItem/SHSG10010030 HTTP/1.1" 200 1590 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:18:22 +1000] "GET /api/getItem/SHSG10010040 HTTP/1.1" 200 1567 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:18:22 +1000] "GET /api/getItem/SHSG10010050 HTTP/1.1" 200 1566 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:18:23 +1000] "GET /api/getItem/SHSG125125408 HTTP/1.1" 404 115 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:18:23 +1000] "GET /api/getItem/SHSG125125508 HTTP/1.1" 404 115 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-05 07:16:33 L1=1.82 run=2 blk=1 avail=6898 (50.1%) swpO=0 conn=4 myRSS=2996 php=13 phpRSS=1351 ap=17 tcp=39 topuser=madalice 2026-09-05 07:16:41 L1=2.01 run=2 blk=1 avail=6628 (48.1%) swpO=0 conn=3 myRSS=2996 php=13 phpRSS=1554 ap=24 tcp=141 topuser=madalice 2026-09-05 07:16:43 L1=2.01 run=2 blk=1 avail=6453 (46.8%) swpO=0 conn=3 myRSS=2996 php=13 phpRSS=1554 ap=48 tcp=134 topuser=madalice 2026-09-05 07:16:51 L1=1.92 run=1 blk=1 avail=6230 (45.2%) swpO=0 conn=3 myRSS=2996 php=13 phpRSS=1305 ap=110 tcp=38 topuser=madalice 2026-09-05 07:16:53 L1=1.92 run=1 blk=1 avail=6456 (46.9%) swpO=0 conn=3 myRSS=2996 php=13 phpRSS=1094 ap=108 tcp=32 topuser=madalice 2026-09-05 07:17:01 L1=1.94 run=1 blk=1 avail=6837 (49.6%) swpO=0 conn=3 myRSS=2996 php=13 phpRSS=773 ap=100 tcp=36 topuser=madalice 2026-09-05 07:17:03 L1=1.94 run=3 blk=1 avail=6904 (50.1%) swpO=0 conn=3 myRSS=2996 php=13 phpRSS=725 ap=98 tcp=33 topuser=madalice 2026-09-05 07:17:11 L1=1.96 run=3 blk=1 avail=6490 (47.1%) swpO=0 conn=3 myRSS=2996 php=14 phpRSS=1219 ap=90 tcp=71 topuser=madalice 2026-09-05 07:17:13 L1=1.96 run=1 blk=1 avail=6742 (48.9%) swpO=0 conn=3 myRSS=2996 php=13 phpRSS=952 ap=87 tcp=40 topuser=madalice 2026-09-05 07:17:21 L1=1.96 run=3 blk=1 avail=6621 (48.1%) swpO=0 conn=3 myRSS=2996 php=13 phpRSS=1134 ap=80 tcp=38 topuser=madalice 2026-09-05 07:17:23 L1=1.96 run=1 blk=1 avail=6517 (47.3%) swpO=0 conn=3 myRSS=2996 php=13 phpRSS=1264 ap=77 tcp=57 topuser=madalice 2026-09-05 07:17:31 L1=1.82 run=2 blk=1 avail=6578 (47.7%) swpO=0 conn=3 myRSS=2996 php=13 phpRSS=1246 ap=70 tcp=33 topuser=madalice 2026-09-05 07:17:34 L1=1.82 run=1 blk=1 avail=6605 (47.9%) swpO=0 conn=3 myRSS=2996 php=13 phpRSS=1255 ap=67 tcp=32 topuser=madalice 2026-09-05 07:17:41 L1=1.76 run=1 blk=1 avail=6668 (48.4%) swpO=0 conn=3 myRSS=2996 php=13 phpRSS=1246 ap=60 tcp=34 topuser=madalice 2026-09-05 07:17:44 L1=1.76 run=2 blk=1 avail=6530 (47.4%) swpO=0 conn=4 myRSS=2996 php=13 phpRSS=1410 ap=57 tcp=32 topuser=madalice 2026-09-05 07:17:51 L1=1.73 run=3 blk=1 avail=6638 (48.2%) swpO=0 conn=4 myRSS=2996 php=13 phpRSS=1355 ap=50 tcp=60 topuser=madalice 2026-09-05 07:17:54 L1=1.73 run=2 blk=1 avail=6776 (49.2%) swpO=0 conn=4 myRSS=2996 php=13 phpRSS=1239 ap=47 tcp=59 topuser=madalice 2026-09-05 07:18:01 L1=1.85 run=2 blk=1 avail=6828 (49.6%) swpO=0 conn=4 myRSS=2996 php=13 phpRSS=1239 ap=40 tcp=33 topuser=madalice 2026-09-05 07:18:04 L1=1.85 run=2 blk=1 avail=7053 (51.2%) swpO=0 conn=4 myRSS=2996 php=13 phpRSS=1036 ap=37 tcp=34 topuser=madalice 2026-09-05 07:18:11 L1=1.87 run=2 blk=1 avail=7217 (52.4%) swpO=0 conn=4 myRSS=2996 php=13 phpRSS=912 ap=30 tcp=42 topuser=madalice 2026-09-05 07:18:14 L1=1.87 run=3 blk=1 avail=6955 (50.5%) swpO=0 conn=4 myRSS=2996 php=14 phpRSS=1246 ap=27 tcp=37 topuser=madalice 2026-09-05 07:18:21 L1=1.96 run=2 blk=1 avail=6769 (49.1%) swpO=0 conn=4 myRSS=2996 php=13 phpRSS=1445 ap=21 tcp=40 topuser=madalice 2026-09-05 07:18:24 L1=1.96 run=2 blk=1 avail=6938 (50.4%) swpO=0 conn=4 myRSS=2996 php=13 phpRSS=1273 ap=21 tcp=40 topuser=madalice 2026-09-05 07:18:31 L1=1.97 run=3 blk=1 avail=6766 (49.1%) swpO=0 conn=4 myRSS=2996 php=13 phpRSS=1398 ap=28 tcp=47 topuser=madalice 2026-09-05 07:18:34 L1=1.97 run=2 blk=1 avail=6861 (49.8%) swpO=0 conn=4 myRSS=2996 php=13 phpRSS=1312 ap=27 tcp=39 topuser=madalice 2026-09-05 07:18:41 L1=1.89 run=3 blk=1 avail=6891 (50.0%) swpO=288 conn=4 myRSS=2989 php=13 phpRSS=1296 ap=26 tcp=40 topuser=madalice 2026-09-05 07:18:44 L1=1.89 run=2 blk=1 avail=6828 (49.6%) swpO=288 conn=4 myRSS=2989 php=13 phpRSS=1311 ap=24 tcp=54 topuser=madalice 2026-09-05 07:18:51 L1=2.14 run=3 blk=1 avail=6897 (50.1%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1260 ap=30 tcp=37 topuser=madalice 2026-09-05 07:18:54 L1=2.21 run=3 blk=1 avail=6919 (50.2%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1258 ap=27 tcp=34 topuser=madalice 2026-09-05 07:19:01 L1=2.27 run=6 blk=1 avail=6625 (48.1%) swpO=0 conn=7 myRSS=2989 php=17 phpRSS=1676 ap=24 tcp=47 topuser=madalice