INCIDENT 2026-09-05 07:20:22 trigger: php_rss=1532MB ================================================================== load: 1.90 2.00 1.89 2/696 458992 ncpu:10 mem_avail: 6748MB/13777MB (49.0%) swap_used:2182MB swapout:0/s blocked(D):1 running:3 iowait:9.8% steal:0.0% php: 13 procs / 1532MB heaviest user: madalice (9 procs, 1400MB) apache: 15 procs tcp_estab: 33 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2989 root 251 1419 madalice 9 1407 netdata 8 260 nobody 14 251 evolution 11 124 dovenull 6 65 infinium 4 57 cpanellogin 1 55 wp-toolkit 3 53 kurri 3 42 lowrange 2 30 dovecot 3 27 mailman 20 26 aaa 1 15 kamcool 1 13 zabbix 1 11 polkitd 1 7 named 1 5 nscd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 9 1409 evolution 3 103 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4876 MB Active(file): 3386 MB Inactive(file): 1524 MB Dirty: 156 MB Writeback: 0 MB SReclaimable: 556 MB CommitLimit: 10984 MB Committed_AS: 8693 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 444624 root 00:22 1264 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : 3926885 root 4-04:57:56 4832 /usr/bin/imunify-agent-proxy 4109079 root 02:35:34 3616 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 02:35:34 546448 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3061172 11.8 Ssl 2-17:06:11 /usr/sbin/mariadbd 4109105 4109079 root 546448 9.6 Sl 02:35:34 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 407388 2601907 madalice 196664 14.6 R 13:41 php-fpm: pool madalice_com_au 1542443 1 netdata 194848 2.6 Ssl 2-04:58:01 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3643624 3626973 root 168588 0.0 S 04:53:33 spamd child 424516 2601907 madalice 164252 6.7 S 08:06 php-fpm: pool madalice_com_au 424514 2601907 madalice 164036 6.7 S 08:06 php-fpm: pool madalice_com_au 424515 2601907 madalice 163072 8.0 S 08:06 php-fpm: pool madalice_com_au 424518 2601907 madalice 160824 7.0 S 08:05 php-fpm: pool madalice_com_au 424517 2601907 madalice 156932 7.2 S 08:05 php-fpm: pool madalice_com_au 408460 2601907 madalice 153892 10.6 S 11:29 php-fpm: pool madalice_com_au 424513 2601907 madalice 148772 5.8 S 08:06 php-fpm: pool madalice_com_au 407474 2601907 madalice 143304 14.2 S 13:28 php-fpm: pool madalice_com_au 3626973 1 root 131512 0.0 Ss 04:57:08 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3643625 3626973 root 93456 0.0 S 04:53:33 spamd child 509236 509098 root 61236 0.0 Sl 8-05:00:42 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 203496 1353308 cpanellogin 56864 0.0 S 01:13:11 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 3127357 3127312 evolution 54740 0.0 Ss 07:20:22 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3127358 3127320 evolution 51520 0.0 Ss 07:20:22 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509266 1 root 43756 0.0 Ss 8-05:00:42 /usr/lib/systemd/systemd-journald 1542981 1542551 netdata 41144 0.1 Sl 2-04:57:57 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1353308 1 root 40536 0.1 Ss 45-04:39:08 cpsrvd (SSL) - waiting for connections 1469 1 root 34804 0.1 Ss 67-21:10:37 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542487 1 wp-toolkit 29348 0.0 Ss 2-04:58:01 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28692 0.0 Ss 1-04:56:57 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3626082 1 root 28032 0.0 Ss 04:58:08 lfd - sleeping 1463 1 root 24188 0.0 Ss 67-21:10:37 tailwatchd 442461 506832 nobody 23488 0.0 S 03:38 /usr/sbin/httpd -k start 442425 506832 nobody 22692 0.1 S 03:39 /usr/sbin/httpd -k start 442417 506832 nobody 22560 0.0 S 03:39 /usr/sbin/httpd -k start 442270 506832 nobody 22488 0.0 S 03:44 /usr/sbin/httpd -k start 444182 506832 nobody 21440 0.0 S 01:12 /usr/sbin/httpd -k start 443609 506832 nobody 21436 0.0 S 01:22 /usr/sbin/httpd -k start 443322 506832 nobody 21276 0.0 S 01:56 /usr/sbin/httpd -k start 443490 506832 nobody 20632 0.2 S 01:38 /usr/sbin/httpd -k start 444176 506832 nobody 20324 0.0 S 01:13 /usr/sbin/httpd -k start 2602226 1 root 19364 0.1 Ssl 1-04:56:42 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1542531 1 wp-toolkit 19264 0.0 Ss 2-04:58:00 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 444194 506832 nobody 19220 0.0 S 01:11 /usr/sbin/httpd -k start 1542982 1542551 netdata 18548 2.2 Sl 2-04:57:57 /usr/libexec/netdata/plugins.d/apps.plugin 1 458898 506832 nobody 18372 0.0 S 00:11 /usr/sbin/httpd -k start 443418 506832 nobody 18228 0.0 S 01:45 /usr/sbin/httpd -k start 306499 1471 root 16400 0.0 S 41:19 cPhulkd - dbprocessor 424143 508511 aaa 16172 0.0 S 08:54 dovecot/imap 4020744 508511 lowrange 15684 0.0 S 03:04:44 dovecot/imap 1542141 1 root 15420 0.0 Ss 2-04:58:04 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 3539428 508511 lowrange 15372 0.0 S 05:24:15 dovecot/imap 4124271 508511 kurri 15320 0.0 S 02:33:42 dovecot/imap 1471 1 root 14900 0.0 Ss 67-21:10:37 cPhulkd - processor 373493 508511 infinium 14744 0.0 S 23:23 dovecot/imap 443413 508511 infinium 14672 0.0 S 01:46 dovecot/imap 425142 508511 infinium 14596 0.0 S 07:45 dovecot/imap 289344 508511 infinium 14588 0.0 S 46:39 dovecot/imap 458959 508511 kurri 14540 0.0 S 00:02 dovecot/imap 3141944 508511 kurri 13900 0.0 S 07:20:00 dovecot/imap 443455 508511 kamcool 13692 0.0 S 01:40 dovecot/quota-status -p postfix 441374 1471 root 13636 0.0 S 04:44 cPhulkd - processor - http socket 690505 508511 dovenull 13276 0.0 S 18:47:33 dovecot/imap-login 690514 508511 dovecot 13276 0.0 S 18:47:33 dovecot/auth 690509 508511 dovenull 13068 0.0 S 18:47:33 dovecot/imap-login --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10740907 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min bigdeals/bigdeals.com.au-ssl_log 258 madalice/madalice.com.au-ssl_log 143 evolution/app.evolutionerp.com.au-ssl_log 120 customc/customcentral.com.au-ssl_log 51 evolution/portal.evolutionerp.com.au-ssl_log 13 nrg/nrgservices.net.au-ssl_log 1 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 258 13.203.219.17 134 139.28.219.70 120 40.115.94.245 50 88.187.63.164 13 203.54.180.238 3 114.119.140.234 2 2001:8003:153b:500:25ae:9f58:d8a8:392 2 114.119.130.40 1 75.247.0.21 1 2a09:bac3:18a:3464::538:a 1 118.127.40.55 1 114.119.146.16 --- top request paths across all vhosts (last 3 min) --- 13 GET /heartbeat.php 6 GET /store/leopard-print-custom-kids-kicks/ 6 GET / 4 POST / 3 GET /test-blog/ 3 GET /tag/kids-shoes/ 3 GET /tag/kicks/ 3 GET /tag/custom-shoes/ 3 GET /tag/custom/ 3 GET /tag/business/ 3 GET /tag/australia/ 3 GET /shop/ 3 GET /custom-shoes-for-australian-business-add-your-business-logo-to-sneakers/ 3 GET /category/aussiecustoms/ 3 GET /category/auscustom/ 3 GET /cart/ 3 GET /author/customc/ 2 GET /tag/logo/ 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 --- busiest 3 vhosts: top paths + last 10 requests --- == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env -- last 10 requests -- 13.203.219.17 - - [05/Sep/2026:07:19:23 +1000] "GET /beta/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 13.203.219.17 - - [05/Sep/2026:07:19:23 +1000] "GET /uat/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 13.203.219.17 - - [05/Sep/2026:07:19:23 +1000] "GET /qa/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 13.203.219.17 - - [05/Sep/2026:07:19:23 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 13.203.219.17 - - [05/Sep/2026:07:19:23 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 13.203.219.17 - - [05/Sep/2026:07:19:24 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 13.203.219.17 - - [05/Sep/2026:07:19:24 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 13.203.219.17 - - [05/Sep/2026:07:19:24 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 13.203.219.17 - - [05/Sep/2026:07:19:24 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 13.203.219.17 - - [05/Sep/2026:07:19:25 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 6 GET /store/leopard-print-custom-kids-kicks/ 2 GET / 1 GET /wp-includes/widgets/wp-includes/ 1 GET /wp-includes/widgets//wp-includes/ 1 GET /wp-includes/widgets/class-wp-widget-text.php 1 GET /wp-includes/widgets/class-wp-widget-tag-cloud.php 1 GET /wp-includes/widgets/class-wp-widget-search.php 1 GET /wp-includes/widgets/class-wp-widget-rss.php 1 GET /wp-includes/widgets/class-wp-widget-recent-posts.php 1 GET /wp-includes/widgets/class-wp-widget-recent-comments.php 1 GET /wp-includes/widgets/class-wp-widget-pages.php 1 GET /wp-includes/widgets/class-wp-widget-meta.php -- last 10 requests -- 139.28.219.70 - - [05/Sep/2026:07:20:00 +1000] "GET /wp-includes/widgets/class-wp-widget-media-video.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:20:01 +1000] "GET /wp-includes/widgets/class-wp-widget-media.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:20:01 +1000] "GET /wp-includes/widgets/class-wp-widget-meta.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:20:02 +1000] "GET /wp-includes/widgets/class-wp-widget-pages.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:20:02 +1000] "GET /wp-includes/widgets/class-wp-widget-recent-comments.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:20:03 +1000] "GET /wp-includes/widgets/class-wp-widget-recent-posts.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:20:03 +1000] "GET /wp-includes/widgets/class-wp-widget-rss.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:20:03 +1000] "GET /wp-includes/widgets/class-wp-widget-search.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:20:04 +1000] "GET /wp-includes/widgets/class-wp-widget-tag-cloud.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:20:04 +1000] "GET /wp-includes/widgets/class-wp-widget-text.php HTTP/1.1" 500 1 "-" "-" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 2 GET /api/getItem/SHSG656520 2 GET /api/getItem/SHSG656516 2 GET /api/getItem/SHSG3030208 2 GET /api/getItem/SHSG125125508 2 GET /api/getItem/SHSG125125408 2 GET /api/getItem/SHSG10010050 2 GET /api/getItem/SHSG10010040 -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:07:19:44 +1000] "GET /api/getItem/RHSG6535208 HTTP/1.1" 200 1344 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:19:44 +1000] "GET /api/getItem/RHSG6535258 HTTP/1.1" 200 1168 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:19:45 +1000] "GET /api/getItem/RHSG6535308 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:19:45 +1000] "GET /api/getItem/RHSG6535408 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:19:46 +1000] "GET /api/getItem/RHSG7525168 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:19:46 +1000] "GET /api/getItem/RHSG7525208 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:19:46 +1000] "GET /api/getItem/RHSG7525258 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:19:47 +1000] "GET /api/getItem/RHSG7550168 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:19:47 +1000] "GET /api/getItem/RHSG755020 HTTP/1.1" 200 1502 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:19:47 +1000] "GET /api/getItem/RHSG7550258 HTTP/1.1" 200 1340 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-05 07:17:54 L1=1.73 run=2 blk=1 avail=6776 (49.2%) swpO=0 conn=4 myRSS=2996 php=13 phpRSS=1239 ap=47 tcp=59 topuser=madalice 2026-09-05 07:18:01 L1=1.85 run=2 blk=1 avail=6828 (49.6%) swpO=0 conn=4 myRSS=2996 php=13 phpRSS=1239 ap=40 tcp=33 topuser=madalice 2026-09-05 07:18:04 L1=1.85 run=2 blk=1 avail=7053 (51.2%) swpO=0 conn=4 myRSS=2996 php=13 phpRSS=1036 ap=37 tcp=34 topuser=madalice 2026-09-05 07:18:11 L1=1.87 run=2 blk=1 avail=7217 (52.4%) swpO=0 conn=4 myRSS=2996 php=13 phpRSS=912 ap=30 tcp=42 topuser=madalice 2026-09-05 07:18:14 L1=1.87 run=3 blk=1 avail=6955 (50.5%) swpO=0 conn=4 myRSS=2996 php=14 phpRSS=1246 ap=27 tcp=37 topuser=madalice 2026-09-05 07:18:21 L1=1.96 run=2 blk=1 avail=6769 (49.1%) swpO=0 conn=4 myRSS=2996 php=13 phpRSS=1445 ap=21 tcp=40 topuser=madalice 2026-09-05 07:18:24 L1=1.96 run=2 blk=1 avail=6938 (50.4%) swpO=0 conn=4 myRSS=2996 php=13 phpRSS=1273 ap=21 tcp=40 topuser=madalice 2026-09-05 07:18:31 L1=1.97 run=3 blk=1 avail=6766 (49.1%) swpO=0 conn=4 myRSS=2996 php=13 phpRSS=1398 ap=28 tcp=47 topuser=madalice 2026-09-05 07:18:34 L1=1.97 run=2 blk=1 avail=6861 (49.8%) swpO=0 conn=4 myRSS=2996 php=13 phpRSS=1312 ap=27 tcp=39 topuser=madalice 2026-09-05 07:18:41 L1=1.89 run=3 blk=1 avail=6891 (50.0%) swpO=288 conn=4 myRSS=2989 php=13 phpRSS=1296 ap=26 tcp=40 topuser=madalice 2026-09-05 07:18:44 L1=1.89 run=2 blk=1 avail=6828 (49.6%) swpO=288 conn=4 myRSS=2989 php=13 phpRSS=1311 ap=24 tcp=54 topuser=madalice 2026-09-05 07:18:51 L1=2.14 run=3 blk=1 avail=6897 (50.1%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1260 ap=30 tcp=37 topuser=madalice 2026-09-05 07:18:54 L1=2.21 run=3 blk=1 avail=6919 (50.2%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1258 ap=27 tcp=34 topuser=madalice 2026-09-05 07:19:01 L1=2.27 run=6 blk=1 avail=6625 (48.1%) swpO=0 conn=7 myRSS=2989 php=17 phpRSS=1676 ap=24 tcp=47 topuser=madalice 2026-09-05 07:19:04 L1=2.41 run=3 blk=1 avail=7019 (50.9%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1180 ap=23 tcp=41 topuser=madalice 2026-09-05 07:19:12 L1=2.62 run=8 blk=1 avail=6019 (43.7%) swpO=0 conn=9 myRSS=2989 php=20 phpRSS=2381 ap=27 tcp=46 topuser=madalice 2026-09-05 07:19:14 L1=2.65 run=2 blk=2 avail=6778 (49.2%) swpO=0 conn=4 myRSS=2989 php=14 phpRSS=1435 ap=26 tcp=40 topuser=madalice 2026-09-05 07:19:22 L1=2.68 run=1 blk=1 avail=7027 (51.0%) swpO=0 conn=9 myRSS=2989 php=13 phpRSS=1201 ap=19 tcp=31 topuser=madalice 2026-09-05 07:19:24 L1=2.54 run=1 blk=1 avail=7131 (51.8%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1112 ap=18 tcp=34 topuser=madalice 2026-09-05 07:19:32 L1=2.50 run=1 blk=1 avail=6895 (50.0%) swpO=0 conn=9 myRSS=2989 php=13 phpRSS=1352 ap=17 tcp=32 topuser=madalice 2026-09-05 07:19:34 L1=2.38 run=5 blk=1 avail=7062 (51.3%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1175 ap=17 tcp=31 topuser=madalice 2026-09-05 07:19:42 L1=2.27 run=4 blk=1 avail=6984 (50.7%) swpO=0 conn=9 myRSS=2989 php=13 phpRSS=1277 ap=16 tcp=33 topuser=madalice 2026-09-05 07:19:44 L1=2.17 run=1 blk=1 avail=7050 (51.2%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1207 ap=16 tcp=32 topuser=madalice 2026-09-05 07:19:52 L1=2.07 run=3 blk=1 avail=7062 (51.3%) swpO=0 conn=6 myRSS=2989 php=15 phpRSS=1273 ap=16 tcp=35 topuser=madalice 2026-09-05 07:19:54 L1=2.07 run=3 blk=1 avail=7075 (51.4%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1198 ap=16 tcp=33 topuser=madalice 2026-09-05 07:20:02 L1=2.06 run=2 blk=1 avail=7393 (53.7%) swpO=0 conn=6 myRSS=2989 php=13 phpRSS=837 ap=16 tcp=31 topuser=madalice 2026-09-05 07:20:04 L1=2.06 run=2 blk=1 avail=7553 (54.8%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=720 ap=15 tcp=29 topuser=madalice 2026-09-05 07:20:12 L1=1.97 run=3 blk=1 avail=7079 (51.4%) swpO=0 conn=6 myRSS=2989 php=13 phpRSS=1204 ap=15 tcp=35 topuser=madalice 2026-09-05 07:20:14 L1=1.89 run=2 blk=1 avail=7062 (51.3%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1218 ap=15 tcp=34 topuser=madalice 2026-09-05 07:20:22 L1=1.90 run=3 blk=1 avail=6748 (49.0%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1532 ap=15 tcp=33 topuser=madalice