INCIDENT 2026-09-05 07:22:35 trigger: php_rss=1640MB ================================================================== load: 2.49 2.08 1.93 3/740 461264 ncpu:10 mem_avail: 6421MB/13777MB (46.6%) swap_used:2182MB swapout:0/s blocked(D):1 running:3 iowait:9.0% steal:0.0% php: 13 procs / 1640MB heaviest user: madalice (9 procs, 1508MB) apache: 48 procs tcp_estab: 69 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2989 root 255 1560 madalice 9 1518 nobody 47 729 netdata 8 257 evolution 12 164 cpanellogin 1 83 dovenull 6 65 infinium 4 57 wp-toolkit 3 53 kurri 3 42 mailnull 6 32 lowrange 2 30 dovecot 3 27 mailman 20 26 aaa 1 15 zabbix 1 10 polkitd 1 7 named 1 5 nscd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 9 1521 evolution 3 103 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5712 MB Active(file): 3837 MB Inactive(file): 1919 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 557 MB CommitLimit: 10984 MB Committed_AS: 9655 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 4-05:00:09 4832 /usr/bin/imunify-agent-proxy 4109079 root 02:37:47 3616 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 02:37:47 546412 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3061248 11.8 Ssl 2-17:08:24 /usr/sbin/mariadbd 4109105 4109079 root 546412 9.5 Sl 02:37:47 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 424516 2601907 madalice 255984 6.7 S 10:19 php-fpm: pool madalice_com_au 1542443 1 netdata 190988 2.6 Ssl 2-05:00:14 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3643624 3626973 root 168588 0.0 S 04:55:46 spamd child 408460 2601907 madalice 164564 10.1 S 13:42 php-fpm: pool madalice_com_au 424514 2601907 madalice 164244 6.9 S 10:19 php-fpm: pool madalice_com_au 407474 2601907 madalice 163848 13.3 S 15:41 php-fpm: pool madalice_com_au 407388 2601907 madalice 163448 13.4 S 15:54 php-fpm: pool madalice_com_au 424513 2601907 madalice 163244 6.1 S 10:19 php-fpm: pool madalice_com_au 424515 2601907 madalice 163156 7.7 S 10:19 php-fpm: pool madalice_com_au 424517 2601907 madalice 161256 7.4 S 10:18 php-fpm: pool madalice_com_au 424518 2601907 madalice 161004 6.9 S 10:18 php-fpm: pool madalice_com_au 3626973 1 root 131460 0.0 Ss 04:59:21 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3643625 3626973 root 93404 0.0 S 04:55:46 spamd child 203496 1353308 cpanellogin 85152 0.0 S 01:15:24 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 509236 509098 root 61236 0.0 Sl 8-05:02:55 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3127357 3127312 evolution 54740 0.0 Ss 07:22:35 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3127358 3127320 evolution 51520 0.0 Ss 07:22:35 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509266 1 root 43756 0.0 Ss 8-05:02:55 /usr/lib/systemd/systemd-journald 1542981 1542551 netdata 41144 0.1 Sl 2-05:00:10 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1353308 1 root 40536 0.1 Ss 45-04:41:21 cpsrvd (SSL) - waiting for connections 1469 1 root 34804 0.1 Ss 67-21:12:50 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 461026 1353308 root 34032 0.0 S 00:12 cpaneld - serving 172.105.169.180 461137 1353308 root 34032 0.0 S 00:05 whostmgrd - serving 172.105.169.180 461135 1353308 root 31308 0.0 S 00:05 webmaild - serving 172.105.169.180 461138 1353308 root 31308 0.0 S 00:05 whostmgrd - serving 172.105.169.180 461139 1353308 root 31308 0.0 S 00:05 cpaneld - serving 172.105.169.180 1542487 1 wp-toolkit 29348 0.0 Ss 2-05:00:14 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28692 0.0 Ss 1-04:59:10 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3626082 1 root 28032 0.0 Ss 05:00:21 lfd - sleeping 1463 1 root 24188 0.0 Ss 67-21:12:50 tailwatchd 443322 506832 nobody 21676 0.0 S 04:09 /usr/sbin/httpd -k start 460670 506832 nobody 19844 0.0 S 00:50 /usr/sbin/httpd -k start 460669 506832 nobody 19780 0.0 S 00:50 /usr/sbin/httpd -k start 2602226 1 root 19364 0.1 Ssl 1-04:58:55 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 460133 506832 nobody 19356 0.0 S 01:24 /usr/sbin/httpd -k start 1542531 1 wp-toolkit 19264 0.0 Ss 2-05:00:13 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 460686 506832 nobody 19052 0.0 S 00:49 /usr/sbin/httpd -k start 460681 506832 nobody 18920 0.0 S 00:49 /usr/sbin/httpd -k start 460693 506832 nobody 18912 0.0 S 00:49 /usr/sbin/httpd -k start 460635 506832 nobody 18840 0.0 S 00:51 /usr/sbin/httpd -k start 460683 506832 nobody 18812 0.0 S 00:49 /usr/sbin/httpd -k start 460687 506832 nobody 18696 0.0 S 00:49 /usr/sbin/httpd -k start 1542982 1542551 netdata 18548 2.2 Sl 2-05:00:10 /usr/libexec/netdata/plugins.d/apps.plugin 1 460682 506832 nobody 18516 0.0 S 00:49 /usr/sbin/httpd -k start 460628 506832 nobody 17324 0.0 S 00:52 /usr/sbin/httpd -k start 460632 506832 nobody 16960 0.0 S 00:51 /usr/sbin/httpd -k start 460666 506832 nobody 16728 0.2 S 00:50 /usr/sbin/httpd -k start 461131 506832 nobody 16460 0.0 S 00:05 /usr/sbin/httpd -k start 461175 506832 nobody 16460 0.0 S 00:03 /usr/sbin/httpd -k start 461134 506832 nobody 16456 0.0 S 00:05 /usr/sbin/httpd -k start 461180 506832 nobody 16456 0.0 S 00:03 /usr/sbin/httpd -k start 461121 506832 nobody 16404 0.0 S 00:06 /usr/sbin/httpd -k start 461154 506832 nobody 16404 0.0 S 00:04 /usr/sbin/httpd -k start 461170 506832 nobody 16404 0.0 S 00:03 /usr/sbin/httpd -k start 461173 506832 nobody 16404 0.0 S 00:03 /usr/sbin/httpd -k start 461181 506832 nobody 16404 0.0 S 00:03 /usr/sbin/httpd -k start 306499 1471 root 16400 0.0 S 43:32 cPhulkd - dbprocessor 461152 506832 nobody 16400 0.0 S 00:04 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10742000 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 10741973 | madalice_wp | madalice_wp | Query | 0 | Statistics | SELECT * FROM AMuqf6qZ_posts WHERE ID = 30661 LIMIT 1 | +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 175 evolution/app.evolutionerp.com.au-ssl_log 95 coscom/coscom.com.au 52 evolution/portal.evolutionerp.com.au-ssl_log 13 evolution/my.evolutionerp.com.au-ssl_log 5 customc/customcentral.com.au-ssl_log 2 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 136 139.28.219.70 95 40.115.94.245 52 62.60.130.117 29 213.209.159.84 13 203.54.180.238 3 85.206.128.219 3 52.167.144.233 2 114.119.131.88 1 54.157.112.104 1 40.77.167.25 1 162.243.46.220 1 118.127.40.55 1 114.119.159.70 1 114.119.146.16 1 114.119.143.104 --- top request paths across all vhosts (last 3 min) --- 30 GET / 13 GET /heartbeat.php 4 GET /store/kidscarskicks/ 3 GET /store/lakers-custom-af1-shoes/ 2 GET /index.php 2 GET /api/getItem/SHSG252516-8 2 GET /api/getItem/SHSG252516--8 2 GET /api/getItem/SHSG252516-6.5 2 GET /api/getItem/RHSG15050308 2 GET /api/getItem/RHSG15050208 2 GET /api/getItem/RHSG150100408 2 GET /api/getItem/RHSG12575408 2 GET /api/getItem/RHSG12575308 2 GET /api/getItem/RHSG1257530 2 GET /api/getItem/RHSG10050208 2 GET /api/getItem/19R-8000 2 GET /api/getItem/19R-7320 1 POST /wp-cron.php 1 POST /functions.php 1 POST / --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 29 GET / 4 GET /store/kidscarskicks/ 3 GET /store/lakers-custom-af1-shoes/ 1 POST / 1 GET /wp-includes/widgets/class-wp-widget-text.php 1 GET /wp-includes/widgets/class-wp-widget-tag-cloud.php 1 GET /wp-includes/widgets/class-wp-widget-search.php 1 GET /wp-includes/widgets/class-wp-widget-rss.php 1 GET /wp-includes/widgets/class-wp-widget-recent-posts.php 1 GET /wp-includes/widgets/class-wp-widget-recent-comments.php 1 GET /wp-includes/widgets/class-wp-widget-pages.php 1 GET /wp-includes/widgets/class-wp-widget-meta.php -- last 10 requests -- 213.209.159.84 - - [05/Sep/2026:07:22:32 +1000] "GET /?locale=th HTTP/1.1" 200 12871 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 [ip:93.41.125.186] 213.209.159.84 - - [05/Sep/2026:07:22:32 +1000] "GET /?locale=de HTTP/1.1" 200 12683 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 [ip:93.41.125.186] 213.209.159.84 - - [05/Sep/2026:07:22:32 +1000] "GET /?locale=pt HTTP/1.1" 200 12503 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 [ip:93.41.125.186] 213.209.159.84 - - [05/Sep/2026:07:22:32 +1000] "GET /?locale=en HTTP/1.1" 200 12487 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 [ip:93.41.125.186] 213.209.159.84 - - [05/Sep/2026:07:22:32 +1000] "GET /?locale=he HTTP/1.1" 200 12667 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 [ip:93.41.125.186] 213.209.159.84 - - [05/Sep/2026:07:22:32 +1000] "GET /?locale=ms HTTP/1.1" 200 12589 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 [ip:93.41.125.186] 213.209.159.84 - - [05/Sep/2026:07:22:32 +1000] "GET /?locale=vi HTTP/1.1" 200 12686 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 [ip:93.41.125.186] 213.209.159.84 - - [05/Sep/2026:07:22:32 +1000] "GET /?locale=es_es HTTP/1.1" 200 12653 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 [ip:93.41.125.1 213.209.159.84 - - [05/Sep/2026:07:22:33 +1000] "GET /?locale=da HTTP/1.1" 200 12582 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 [ip:93.41.125.186] 213.209.159.84 - - [05/Sep/2026:07:22:33 +1000] "GET /?locale=ja HTTP/1.1" 200 12913 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 [ip:93.41.125.186] == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /api/getItem/SHSG252516-8 2 GET /api/getItem/SHSG252516--8 2 GET /api/getItem/SHSG252516-6.5 2 GET /api/getItem/RHSG15050308 2 GET /api/getItem/RHSG15050208 2 GET /api/getItem/RHSG150100408 2 GET /api/getItem/RHSG12575408 2 GET /api/getItem/RHSG12575308 2 GET /api/getItem/RHSG1257530 2 GET /api/getItem/RHSG10050208 2 GET /api/getItem/19R-8000 2 GET /api/getItem/19R-7320 -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:07:21:21 +1000] "GET /api/getItem/SHSG12512550-8 HTTP/1.1" 200 1355 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:21:21 +1000] "GET /api/getItem/SHSG15015040-8 HTTP/1.1" 200 1459 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:21:21 +1000] "GET /api/getItem/SHSG202012-8 HTTP/1.1" 200 1352 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:21:22 +1000] "GET /api/getItem/SHSG202016-8 HTTP/1.1" 200 1476 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:21:22 +1000] "GET /api/getItem/SHSG252516--6.5 HTTP/1.1" 404 117 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:21:22 +1000] "GET /api/getItem/SHSG252516--8 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:22:23 +1000] "GET /api/getItem/SHSG252516--8 HTTP/1.1" 404 115 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:22:23 +1000] "GET /api/getItem/SHSG252520-6.5 HTTP/1.1" 200 1765 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:22:23 +1000] "GET /api/getItem/SHSG303016-8 HTTP/1.1" 200 2102 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:22:24 +1000] "GET /api/getItem/SHSG3535208 HTTP/1.1" 200 1112 "-" "RestSharp/106.13.0.0" == coscom/coscom.com.au == -- top paths -- 1 GET /wp-includes/widgets/ 1 GET /wp-includes/Text/Diff/Renderer/ 1 GET /wp-includes/Text/Diff/Engine/ 1 GET /wp-includes/Text/Diff/ 1 GET /wp-includes/Text/ 1 GET /wp-includes/sitemaps/providers/ 1 GET /wp-includes/sitemaps/ 1 GET /wp-includes/pomo/ 1 GET /wp-includes/PHPMailer/ 1 GET /wp-includes/js/plupload/ 1 GET /wp-includes/js/codemirror/ 1 GET /wp-includes/js/ -- last 10 requests -- 62.60.130.117 - - [05/Sep/2026:07:21:41 +1000] "GET /wp-admin/css/colors/coffee/ HTTP/1.1" 404 - "https://www.binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0. 62.60.130.117 - - [05/Sep/2026:07:21:41 +1000] "GET /wp-includes/images/crystal/ HTTP/1.1" 404 - "https://www.binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0. 62.60.130.117 - - [05/Sep/2026:07:21:42 +1000] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 404 - "https://www.binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0. 62.60.130.117 - - [05/Sep/2026:07:21:42 +1000] "GET /wp-admin/css/colors/light/ HTTP/1.1" 404 - "https://www.binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 62.60.130.117 - - [05/Sep/2026:07:21:42 +1000] "GET /wp-admin/css/colors/ocean/ HTTP/1.1" 404 - "https://www.binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 62.60.130.117 - - [05/Sep/2026:07:21:43 +1000] "GET /wp-includes/Text/Diff/Engine/ HTTP/1.1" 404 - "https://www.binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0. 62.60.130.117 - - [05/Sep/2026:07:21:43 +1000] "GET /wp-includes/images/media/ HTTP/1.1" 404 - "https://www.binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 62.60.130.117 - - [05/Sep/2026:07:21:43 +1000] "GET /wp-includes/Text/Diff/Renderer/ HTTP/1.1" 404 - "https://www.binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133. 62.60.130.117 - - [05/Sep/2026:07:21:44 +1000] "GET /wp-admin/css/colors/sunrise/ HTTP/1.1" 404 - "https://www.binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0 62.60.130.117 - - [05/Sep/2026:07:21:44 +1000] "GET /wp-admin/css/colors/midnight/ HTTP/1.1" 404 - "https://www.binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0. --- last 30 samples (run-up to this incident) --- 2026-09-05 07:20:12 L1=1.97 run=3 blk=1 avail=7079 (51.4%) swpO=0 conn=6 myRSS=2989 php=13 phpRSS=1204 ap=15 tcp=35 topuser=madalice 2026-09-05 07:20:14 L1=1.89 run=2 blk=1 avail=7062 (51.3%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1218 ap=15 tcp=34 topuser=madalice 2026-09-05 07:20:22 L1=1.90 run=3 blk=1 avail=6748 (49.0%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1532 ap=15 tcp=33 topuser=madalice 2026-09-05 07:20:24 L1=1.91 run=1 blk=1 avail=6749 (49.0%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1527 ap=15 tcp=31 topuser=madalice 2026-09-05 07:20:33 L1=1.84 run=4 blk=1 avail=6626 (48.1%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1631 ap=16 tcp=33 topuser=madalice 2026-09-05 07:20:34 L1=1.93 run=4 blk=1 avail=6552 (47.6%) swpO=0 conn=5 myRSS=2989 php=14 phpRSS=1748 ap=16 tcp=31 topuser=madalice 2026-09-05 07:20:43 L1=1.85 run=3 blk=1 avail=6660 (48.3%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1608 ap=16 tcp=31 topuser=madalice 2026-09-05 07:20:44 L1=1.87 run=2 blk=1 avail=6687 (48.5%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1580 ap=16 tcp=32 topuser=madalice 2026-09-05 07:20:53 L1=1.88 run=2 blk=1 avail=6695 (48.6%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1569 ap=16 tcp=34 topuser=madalice 2026-09-05 07:20:55 L1=1.81 run=2 blk=1 avail=6694 (48.6%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1572 ap=16 tcp=34 topuser=madalice 2026-09-05 07:21:03 L1=1.82 run=5 blk=1 avail=6652 (48.3%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1566 ap=23 tcp=40 topuser=madalice 2026-09-05 07:21:05 L1=1.84 run=1 blk=1 avail=6666 (48.4%) swpO=0 conn=3 myRSS=2989 php=14 phpRSS=1578 ap=22 tcp=39 topuser=madalice 2026-09-05 07:21:13 L1=1.93 run=4 blk=1 avail=6564 (47.6%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1612 ap=28 tcp=49 topuser=madalice 2026-09-05 07:21:15 L1=1.94 run=1 blk=1 avail=6611 (48.0%) swpO=0 conn=4 myRSS=2989 php=14 phpRSS=1601 ap=28 tcp=44 topuser=madalice 2026-09-05 07:21:23 L1=1.94 run=2 blk=1 avail=6737 (48.9%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1499 ap=21 tcp=41 topuser=madalice 2026-09-05 07:21:25 L1=1.95 run=2 blk=1 avail=6705 (48.7%) swpO=0 conn=3 myRSS=2989 php=14 phpRSS=1562 ap=20 tcp=39 topuser=madalice 2026-09-05 07:21:33 L1=1.87 run=1 blk=1 avail=7241 (52.6%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1022 ap=16 tcp=37 topuser=madalice 2026-09-05 07:21:35 L1=1.88 run=1 blk=1 avail=7368 (53.5%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=897 ap=16 tcp=36 topuser=madalice 2026-09-05 07:21:43 L1=1.81 run=1 blk=2 avail=7518 (54.6%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=748 ap=16 tcp=63 topuser=madalice 2026-09-05 07:21:45 L1=1.75 run=3 blk=1 avail=7436 (54.0%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=796 ap=22 tcp=64 topuser=madalice 2026-09-05 07:21:53 L1=1.69 run=2 blk=1 avail=6921 (50.2%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1189 ap=41 tcp=41 topuser=madalice 2026-09-05 07:21:55 L1=1.63 run=2 blk=1 avail=6842 (49.7%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1270 ap=39 tcp=52 topuser=madalice 2026-09-05 07:22:03 L1=1.66 run=1 blk=1 avail=6861 (49.8%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1305 ap=31 tcp=50 topuser=madalice 2026-09-05 07:22:05 L1=1.61 run=1 blk=1 avail=6873 (49.9%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1305 ap=29 tcp=48 topuser=madalice 2026-09-05 07:22:13 L1=1.80 run=1 blk=1 avail=6750 (49.0%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1497 ap=21 tcp=36 topuser=madalice 2026-09-05 07:22:15 L1=1.89 run=3 blk=1 avail=6695 (48.6%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1567 ap=19 tcp=36 topuser=madalice 2026-09-05 07:22:23 L1=2.06 run=2 blk=1 avail=6785 (49.3%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1487 ap=17 tcp=39 topuser=madalice 2026-09-05 07:22:25 L1=2.30 run=3 blk=1 avail=6782 (49.2%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1488 ap=17 tcp=40 topuser=madalice 2026-09-05 07:22:34 L1=2.36 run=4 blk=1 avail=6552 (47.6%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1494 ap=48 tcp=77 topuser=madalice 2026-09-05 07:22:35 L1=2.49 run=3 blk=1 avail=6421 (46.6%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1640 ap=48 tcp=69 topuser=madalice