INCIDENT 2026-09-05 07:23:36 trigger: php_rss=1568MB ================================================================== load: 3.13 2.34 2.03 3/712 462195 ncpu:10 mem_avail: 6650MB/13777MB (48.3%) swap_used:2182MB swapout:1/s blocked(D):1 running:2 iowait:10.1% steal:0.0% php: 13 procs / 1568MB heaviest user: madalice (9 procs, 1436MB) apache: 23 procs tcp_estab: 47 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2989 root 256 1573 madalice 9 1443 nobody 22 353 netdata 8 257 evolution 11 124 cpanellogin 1 87 dovenull 6 65 wp-toolkit 3 53 infinium 3 43 kurri 3 42 lowrange 2 30 mailnull 5 27 dovecot 3 27 mailman 20 26 aaa 1 15 zabbix 1 10 polkitd 1 7 named 1 5 nscd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 9 1445 evolution 3 103 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5869 MB Active(file): 3908 MB Inactive(file): 2007 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 556 MB CommitLimit: 10984 MB Committed_AS: 9117 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 4-05:01:09 4832 /usr/bin/imunify-agent-proxy 4109079 root 02:38:47 3616 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 02:38:47 546300 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3061216 11.8 Ssl 2-17:09:24 /usr/sbin/mariadbd 4109105 4109079 root 546300 9.4 Sl 02:38:47 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 424514 2601907 madalice 193200 7.1 R 11:19 php-fpm: pool madalice_com_au 1542443 1 netdata 191780 2.6 Ssl 2-05:01:14 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3643624 3626973 root 168580 0.0 S 04:56:46 spamd child 424516 2601907 madalice 164340 7.0 S 11:19 php-fpm: pool madalice_com_au 407474 2601907 madalice 163852 13.1 S 16:41 php-fpm: pool madalice_com_au 407388 2601907 madalice 163528 13.2 S 16:54 php-fpm: pool madalice_com_au 424513 2601907 madalice 163056 6.0 S 11:19 php-fpm: pool madalice_com_au 424515 2601907 madalice 162068 7.8 S 11:19 php-fpm: pool madalice_com_au 424518 2601907 madalice 160920 6.7 S 11:18 php-fpm: pool madalice_com_au 424517 2601907 madalice 159888 7.3 S 11:18 php-fpm: pool madalice_com_au 408460 2601907 madalice 157988 9.8 S 14:42 php-fpm: pool madalice_com_au 3626973 1 root 131444 0.0 Ss 05:00:21 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3643625 3626973 root 93388 0.0 S 04:56:46 spamd child 203496 1353308 cpanellogin 89396 0.0 S 01:16:24 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 509236 509098 root 61236 0.0 Sl 8-05:03:55 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3127357 3127312 evolution 54740 0.0 Ss 07:23:35 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3127358 3127320 evolution 51520 0.0 Ss 07:23:35 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509266 1 root 43756 0.0 Ss 8-05:03:55 /usr/lib/systemd/systemd-journald 1542981 1542551 netdata 41144 0.1 Sl 2-05:01:10 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1353308 1 root 40536 0.1 Ss 45-04:42:21 cpsrvd (SSL) - waiting for connections 1469 1 root 34804 0.1 Ss 67-21:13:50 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 462106 1353308 root 34032 0.0 S 00:07 cpaneld - serving 172.105.169.180 462129 1353308 root 34032 0.0 S 00:03 whostmgrd - serving 172.105.169.180 462124 1353308 root 31308 0.0 S 00:03 whostmgrd - serving 172.105.169.180 462125 1353308 root 31308 0.0 S 00:03 cpaneld - serving 172.105.169.180 462126 1353308 root 31308 0.0 S 00:03 webmaild - serving 172.105.169.180 1542487 1 wp-toolkit 29348 0.0 Ss 2-05:01:14 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28692 0.0 Ss 1-05:00:10 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3626082 1 root 28032 0.0 Ss 05:01:21 lfd - sleeping 1463 1 root 24188 0.0 Ss 67-21:13:50 tailwatchd 460635 506832 nobody 22220 0.0 S 01:51 /usr/sbin/httpd -k start 460670 506832 nobody 20796 0.0 S 01:50 /usr/sbin/httpd -k start 461185 506832 nobody 20480 0.1 S 01:03 /usr/sbin/httpd -k start 460687 506832 nobody 20448 0.0 S 01:49 /usr/sbin/httpd -k start 461132 506832 nobody 20224 0.0 S 01:05 /usr/sbin/httpd -k start 461151 506832 nobody 20128 0.0 S 01:04 /usr/sbin/httpd -k start 461181 506832 nobody 20072 0.0 S 01:03 /usr/sbin/httpd -k start 461115 506832 nobody 20056 0.0 S 01:07 /usr/sbin/httpd -k start 461184 506832 nobody 19872 0.0 S 01:03 /usr/sbin/httpd -k start 461179 506832 nobody 19380 0.0 S 01:03 /usr/sbin/httpd -k start 2602226 1 root 19364 0.1 Ssl 1-04:59:55 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 460666 506832 nobody 19336 0.1 S 01:50 /usr/sbin/httpd -k start 461175 506832 nobody 19312 0.0 S 01:03 /usr/sbin/httpd -k start 1542531 1 wp-toolkit 19264 0.0 Ss 2-05:01:13 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 461180 506832 nobody 18780 0.0 S 01:03 /usr/sbin/httpd -k start 1542982 1542551 netdata 18548 2.2 Sl 2-05:01:10 /usr/libexec/netdata/plugins.d/apps.plugin 1 462122 506832 nobody 16900 0.0 S 00:04 /usr/sbin/httpd -k start 306499 1471 root 16400 0.0 S 44:32 cPhulkd - dbprocessor 462127 506832 nobody 16316 0.0 S 00:03 /usr/sbin/httpd -k start 424143 508511 aaa 16172 0.0 S 12:07 dovecot/imap 4020744 508511 lowrange 15684 0.0 S 03:07:57 dovecot/imap 1542141 1 root 15420 0.0 Ss 2-05:01:17 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 3539428 508511 lowrange 15372 0.0 S 05:27:28 dovecot/imap 4124271 508511 kurri 15320 0.0 S 02:36:55 dovecot/imap 1471 1 root 14900 0.0 Ss 67-21:13:50 cPhulkd - processor 443413 508511 infinium 14828 0.0 S 04:59 dovecot/imap 373493 508511 infinium 14744 0.0 S 26:36 dovecot/imap 425142 508511 infinium 14596 0.0 S 10:58 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10742261 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 191 otterfencing/otterfencing.com.au-ssl_log 103 evolution/app.evolutionerp.com.au-ssl_log 97 coscom/coscom.com.au 52 evolution/portal.evolutionerp.com.au-ssl_log 7 customc/customcentral.com.au-ssl_log 1 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 138 139.28.219.70 103 34.24.200.89 97 40.115.94.245 52 62.60.130.117 43 213.209.159.84 7 203.54.180.238 3 85.206.128.219 2 114.119.130.40 1 118.127.40.55 1 114.119.146.16 1 114.119.143.14 1 114.119.143.104 1 114.119.140.234 1 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 47 GET / 7 GET /heartbeat.php 4 GET /store/kidscarskicks/ 3 GET /store/kids-swarovski-crystal-airmax90/ 2 GET /resetpass 2 GET /_image 2 GET /api/getItem/SHSG404016-DP25-24-DI-110 2 GET /api/getItem/SHSG252516-8 2 GET /api/getItem/SHSG252516--8 2 GET /api/getItem/SHSG252516-6.5 2 GET /api/getItem/19R-8000 2 GET /api/getItem/19R-7320 1 POST /wp-cron.php 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 POST / 1 GET /z9x8c7v6b5-debug-trigger-cpanel.otterfencing.com.au 1 GET /wp-json 1 GET /wp-includes/widgets/ --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 43 GET / 4 GET /store/kidscarskicks/ 3 GET /store/kids-swarovski-crystal-airmax90/ 1 POST / 1 GET /wp-includes/Text/Diff/wp-includes/Text/ 1 GET /wp-includes/Text/Diff//wp-includes/Text/ 1 GET /wp-includes/Text/Diff/Renderer//wp-includes/Text/Diff/ 1 GET /wp-includes/Text/Diff/Engine/wp-includes/Text/Diff/ 1 GET /wp-includes/Text/Diff/Engine//wp-includes/Text/Diff/ 1 GET /wp-includes/SimplePie/src/XML/wp-includes/SimplePie/src/ 1 GET /wp-includes/SimplePie/src/XML//wp-includes/SimplePie/src/ 1 GET /wp-includes/SimplePie/src/XML/Declaration/wp-includes/SimplePie/src/XML/ -- last 10 requests -- 139.28.219.70 - - [05/Sep/2026:07:23:16 +1000] "GET /wp-includes/SimplePie/src/XML//wp-includes/SimplePie/src/ HTTP/1.1" 301 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:23:18 +1000] "GET /wp-includes/SimplePie/src/XML/wp-includes/SimplePie/src/ HTTP/1.1" 404 36725 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:23:19 +1000] "GET /wp-includes/SimplePie/src/XML/Declaration//wp-includes/SimplePie/src/XML/ HTTP/1.1" 301 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:23:21 +1000] "GET /wp-includes/SimplePie/src/XML/Declaration/wp-includes/SimplePie/src/XML/ HTTP/1.1" 404 36666 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:23:22 +1000] "GET /wp-includes/Text/Diff//wp-includes/Text/ HTTP/1.1" 301 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:23:24 +1000] "GET /wp-includes/Text/Diff/wp-includes/Text/ HTTP/1.1" 404 36653 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:23:25 +1000] "GET /wp-includes/Text/Diff/Engine//wp-includes/Text/Diff/ HTTP/1.1" 301 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:23:27 +1000] "GET /wp-includes/Text/Diff/Engine/wp-includes/Text/Diff/ HTTP/1.1" 404 36659 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:23:29 +1000] "GET /wp-includes/Text/Diff/Renderer//wp-includes/Text/Diff/ HTTP/1.1" 301 1 "-" "-" 114.119.140.234 - - [05/Sep/2026:07:23:29 +1000] "GET /store/kids-swarovski-crystal-airmax90/?verified=1&rating=2&image=1&wcpr_rating=2 HTTP/1.1" 200 51377 "https://madalice.com.au/store/kids-swarovski-crystal-airmax90/? == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 4 GET / 2 GET /_image 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /z9x8c7v6b5-debug-trigger-cpanel.otterfencing.com.au 1 GET /wp-json 1 GET /wp/.env 1 GET /wp-config.php.swp 1 GET /wp-config.php~ 1 GET /wp-config.old 1 GET /web/.env -- last 10 requests -- 34.24.200.89 - - [05/Sep/2026:07:22:58 +1000] "GET /api/.env.bak HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.24.200.89 - - [05/Sep/2026:07:22:58 +1000] "GET /.env.docker HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.24.200.89 - - [05/Sep/2026:07:22:58 +1000] "GET /env.bak HTTP/1.1" 401 12606 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.24.200.89 - - [05/Sep/2026:07:22:58 +1000] "GET /@fs/.env?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.24.200.89 - - [05/Sep/2026:07:22:58 +1000] "GET /@fs/root/.env?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.24.200.89 - - [05/Sep/2026:07:22:58 +1000] "GET /.env.prod.bak HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.24.200.89 - - [05/Sep/2026:07:22:58 +1000] "GET /@fs/proc/self/environ?import&raw?? HTTP/1.1" 404 3493 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537. 34.24.200.89 - - [05/Sep/2026:07:22:59 +1000] "GET /_image?href=/proc/self/environ HTTP/1.1" 401 12596 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.24.200.89 - - [05/Sep/2026:07:22:59 +1000] "GET /_image?href=/../../../.env HTTP/1.1" 401 12599 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.24.200.89 - - [05/Sep/2026:07:23:01 +1000] "GET /debug/vars HTTP/1.1" 404 3493 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /api/getItem/SHSG404016-DP25-24-DI-110 2 GET /api/getItem/SHSG252516-8 2 GET /api/getItem/SHSG252516--8 2 GET /api/getItem/SHSG252516-6.5 2 GET /api/getItem/19R-8000 2 GET /api/getItem/19R-7320 1 GET /api/getItem/SHSG909020-8 1 GET /api/getItem/SHSG898950-8 1 GET /api/getItem/SHSG898935-8 1 GET /api/getItem/SHSG898930-8 1 GET /api/getItem/SHSG898920-8 1 GET /api/getItem/SHSG757550-8 -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:07:22:32 +1000] "GET /api/getItem/SHSG898935-8 HTTP/1.1" 200 1491 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:22:33 +1000] "GET /api/getItem/SHSG898950-8 HTTP/1.1" 200 1346 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:22:33 +1000] "GET /api/getItem/SHSG909020-8 HTTP/1.1" 200 1464 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:22:33 +1000] "GET /api/getItem/SHSG303016-DP19-8 HTTP/1.1" 200 1400 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:22:34 +1000] "GET /api/getItem/SHSG303016-SP19-8 HTTP/1.1" 200 1404 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:22:34 +1000] "GET /api/getItem/SHSG404016-DP19-8 HTTP/1.1" 200 1542 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:22:35 +1000] "GET /api/getItem/SHSG404016-DP25-24-DI-110 HTTP/1.1" 200 1441 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:22:35 +1000] "GET /api/getItem/SHSG404016-DP25-24-DI-110 HTTP/1.1" 200 1441 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:22:35 +1000] "GET /api/getItem/SHSG404016-DP25-8 HTTP/1.1" 200 1545 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:22:36 +1000] "GET /api/getItem/SHSG404016-RDP25-24-DI HTTP/1.1" 200 1472 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-05 07:21:13 L1=1.93 run=4 blk=1 avail=6564 (47.6%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1612 ap=28 tcp=49 topuser=madalice 2026-09-05 07:21:15 L1=1.94 run=1 blk=1 avail=6611 (48.0%) swpO=0 conn=4 myRSS=2989 php=14 phpRSS=1601 ap=28 tcp=44 topuser=madalice 2026-09-05 07:21:23 L1=1.94 run=2 blk=1 avail=6737 (48.9%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1499 ap=21 tcp=41 topuser=madalice 2026-09-05 07:21:25 L1=1.95 run=2 blk=1 avail=6705 (48.7%) swpO=0 conn=3 myRSS=2989 php=14 phpRSS=1562 ap=20 tcp=39 topuser=madalice 2026-09-05 07:21:33 L1=1.87 run=1 blk=1 avail=7241 (52.6%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1022 ap=16 tcp=37 topuser=madalice 2026-09-05 07:21:35 L1=1.88 run=1 blk=1 avail=7368 (53.5%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=897 ap=16 tcp=36 topuser=madalice 2026-09-05 07:21:43 L1=1.81 run=1 blk=2 avail=7518 (54.6%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=748 ap=16 tcp=63 topuser=madalice 2026-09-05 07:21:45 L1=1.75 run=3 blk=1 avail=7436 (54.0%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=796 ap=22 tcp=64 topuser=madalice 2026-09-05 07:21:53 L1=1.69 run=2 blk=1 avail=6921 (50.2%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1189 ap=41 tcp=41 topuser=madalice 2026-09-05 07:21:55 L1=1.63 run=2 blk=1 avail=6842 (49.7%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1270 ap=39 tcp=52 topuser=madalice 2026-09-05 07:22:03 L1=1.66 run=1 blk=1 avail=6861 (49.8%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1305 ap=31 tcp=50 topuser=madalice 2026-09-05 07:22:05 L1=1.61 run=1 blk=1 avail=6873 (49.9%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1305 ap=29 tcp=48 topuser=madalice 2026-09-05 07:22:13 L1=1.80 run=1 blk=1 avail=6750 (49.0%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1497 ap=21 tcp=36 topuser=madalice 2026-09-05 07:22:15 L1=1.89 run=3 blk=1 avail=6695 (48.6%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1567 ap=19 tcp=36 topuser=madalice 2026-09-05 07:22:23 L1=2.06 run=2 blk=1 avail=6785 (49.3%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1487 ap=17 tcp=39 topuser=madalice 2026-09-05 07:22:25 L1=2.30 run=3 blk=1 avail=6782 (49.2%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1488 ap=17 tcp=40 topuser=madalice 2026-09-05 07:22:34 L1=2.36 run=4 blk=1 avail=6552 (47.6%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1494 ap=48 tcp=77 topuser=madalice 2026-09-05 07:22:35 L1=2.49 run=3 blk=1 avail=6421 (46.6%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1640 ap=48 tcp=69 topuser=madalice 2026-09-05 07:22:44 L1=2.53 run=3 blk=1 avail=6478 (47.0%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1637 ap=40 tcp=41 topuser=madalice 2026-09-05 07:22:46 L1=2.73 run=3 blk=1 avail=6557 (47.6%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1567 ap=38 tcp=48 topuser=madalice 2026-09-05 07:22:54 L1=2.83 run=2 blk=1 avail=6737 (48.9%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1424 ap=31 tcp=52 topuser=madalice 2026-09-05 07:22:56 L1=2.84 run=5 blk=1 avail=6823 (49.5%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1349 ap=30 tcp=53 topuser=madalice 2026-09-05 07:23:04 L1=2.86 run=2 blk=1 avail=6784 (49.2%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1415 ap=26 tcp=39 topuser=madalice 2026-09-05 07:23:06 L1=2.95 run=1 blk=1 avail=6852 (49.7%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1359 ap=24 tcp=41 topuser=madalice 2026-09-05 07:23:14 L1=2.95 run=2 blk=1 avail=6811 (49.4%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1427 ap=19 tcp=43 topuser=madalice 2026-09-05 07:23:16 L1=2.88 run=2 blk=1 avail=6959 (50.5%) swpO=0 conn=5 myRSS=2989 php=14 phpRSS=1304 ap=19 tcp=42 topuser=madalice 2026-09-05 07:23:24 L1=2.89 run=2 blk=1 avail=6927 (50.3%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1320 ap=17 tcp=41 topuser=madalice 2026-09-05 07:23:26 L1=2.89 run=2 blk=1 avail=6875 (49.9%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1382 ap=17 tcp=39 topuser=madalice 2026-09-05 07:23:34 L1=3.14 run=2 blk=1 avail=6680 (48.5%) swpO=1 conn=4 myRSS=2989 php=13 phpRSS=1559 ap=19 tcp=47 topuser=madalice 2026-09-05 07:23:36 L1=3.13 run=2 blk=1 avail=6650 (48.3%) swpO=1 conn=4 myRSS=2989 php=13 phpRSS=1568 ap=23 tcp=47 topuser=madalice