INCIDENT 2026-09-05 07:24:36 trigger: php_rss=1567MB ================================================================== load: 3.81 2.68 2.17 2/709 463043 ncpu:10 mem_avail: 6660MB/13777MB (48.3%) swap_used:2183MB swapout:0/s blocked(D):1 running:1 iowait:10.0% steal:0.0% php: 13 procs / 1567MB heaviest user: madalice (9 procs, 1436MB) apache: 19 procs tcp_estab: 44 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2989 root 256 1605 madalice 9 1436 nobody 18 315 netdata 8 258 evolution 11 124 cpanellogin 1 87 dovenull 6 65 wp-toolkit 3 53 infinium 3 43 kurri 3 42 mailnull 8 35 lowrange 2 30 dovecot 3 27 mailman 20 26 aaa 1 15 zabbix 1 9 polkitd 1 7 named 1 5 nscd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 9 1436 evolution 3 103 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5811 MB Active(file): 3908 MB Inactive(file): 1947 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 556 MB CommitLimit: 10984 MB Committed_AS: 9096 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 4-05:02:10 4832 /usr/bin/imunify-agent-proxy 4109079 root 02:39:48 3592 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 02:39:48 545632 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3061236 11.8 Ssl 2-17:10:25 /usr/sbin/mariadbd 4109105 4109079 root 545632 9.3 Sl 02:39:48 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1542443 1 netdata 192560 2.6 Ssl 2-05:02:15 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3643624 3626973 root 168568 0.0 S 04:57:47 spamd child 408460 2601907 madalice 165212 9.7 S 15:43 php-fpm: pool madalice_com_au 424514 2601907 madalice 164584 7.0 S 12:20 php-fpm: pool madalice_com_au 407388 2601907 madalice 164568 12.7 S 17:55 php-fpm: pool madalice_com_au 424516 2601907 madalice 164352 7.0 S 12:20 php-fpm: pool madalice_com_au 424513 2601907 madalice 163760 6.2 S 12:20 php-fpm: pool madalice_com_au 424515 2601907 madalice 163480 7.7 S 12:20 php-fpm: pool madalice_com_au 407474 2601907 madalice 163160 12.7 S 17:42 php-fpm: pool madalice_com_au 424518 2601907 madalice 161420 6.8 S 12:19 php-fpm: pool madalice_com_au 424517 2601907 madalice 160048 7.3 S 12:19 php-fpm: pool madalice_com_au 3626973 1 root 131340 0.0 Ss 05:01:22 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3643625 3626973 root 93376 0.0 S 04:57:47 spamd child 203496 1353308 cpanellogin 89192 0.0 S 01:17:25 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 509236 509098 root 61236 0.0 Sl 8-05:04:56 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3127357 3127312 evolution 54740 0.0 Ss 07:24:36 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3127358 3127320 evolution 51520 0.0 Ss 07:24:36 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509266 1 root 43756 0.0 Ss 8-05:04:56 /usr/lib/systemd/systemd-journald 1542981 1542551 netdata 41144 0.1 Sl 2-05:02:11 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1353308 1 root 40204 0.1 Ss 45-04:43:22 cpsrvd (SSL) - waiting for connections 1469 1 root 34708 0.1 Ss 67-21:14:51 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 462973 1353308 root 34012 0.0 S 00:05 webmaild - serving 172.105.169.180 463013 1353308 root 34012 0.0 S 00:00 cpaneld - serving 172.105.169.180 463034 1353308 root 34012 0.0 S 00:00 whostmgrd - serving 172.105.169.180 463009 1353308 root 31288 0.0 S 00:01 cpaneld - serving 172.105.169.180 463010 1353308 root 31288 0.0 S 00:01 webmaild - serving 172.105.169.180 463011 1353308 root 31288 0.0 S 00:01 whostmgrd - serving 172.105.169.180 1542487 1 wp-toolkit 29348 0.0 Ss 2-05:02:15 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28692 0.0 Ss 1-05:01:11 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3626082 1 root 28032 0.0 Ss 05:02:22 lfd - sleeping 1463 1 root 24188 0.0 Ss 67-21:14:51 tailwatchd 461185 506832 nobody 21828 0.1 S 02:04 /usr/sbin/httpd -k start 461151 506832 nobody 21684 0.0 S 02:05 /usr/sbin/httpd -k start 460687 506832 nobody 20552 0.1 S 02:50 /usr/sbin/httpd -k start 462163 506832 nobody 20488 0.0 S 01:03 /usr/sbin/httpd -k start 462162 506832 nobody 20088 0.0 S 01:03 /usr/sbin/httpd -k start 461115 506832 nobody 20056 0.0 S 02:08 /usr/sbin/httpd -k start 462762 506832 nobody 20000 0.0 S 00:23 /usr/sbin/httpd -k start 462729 506832 nobody 19836 0.0 S 00:28 /usr/sbin/httpd -k start 462750 506832 nobody 19660 0.0 S 00:24 /usr/sbin/httpd -k start 462749 506832 nobody 19484 0.0 S 00:24 /usr/sbin/httpd -k start 462122 506832 nobody 19408 0.0 S 01:05 /usr/sbin/httpd -k start 2602226 1 root 19364 0.1 Ssl 1-05:00:56 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1542531 1 wp-toolkit 19264 0.0 Ss 2-05:02:14 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 462759 506832 nobody 19188 0.0 S 00:23 /usr/sbin/httpd -k start 462763 506832 nobody 19076 0.0 S 00:23 /usr/sbin/httpd -k start 462752 506832 nobody 18760 0.0 S 00:24 /usr/sbin/httpd -k start 462751 506832 nobody 18680 0.0 S 00:24 /usr/sbin/httpd -k start 462744 506832 nobody 18584 0.0 S 00:25 /usr/sbin/httpd -k start 1542982 1542551 netdata 18548 2.2 Sl 2-05:02:11 /usr/libexec/netdata/plugins.d/apps.plugin 1 306499 1471 root 16400 0.0 S 45:33 cPhulkd - dbprocessor 424143 508511 aaa 16172 0.0 S 13:08 dovecot/imap 4020744 508511 lowrange 15684 0.0 S 03:08:58 dovecot/imap 1542141 1 root 15420 0.0 Ss 2-05:02:18 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 3539428 508511 lowrange 15372 0.0 S 05:28:29 dovecot/imap 4124271 508511 kurri 15320 0.0 S 02:37:56 dovecot/imap 1471 1 root 14900 0.0 Ss 67-21:14:51 cPhulkd - processor 443413 508511 infinium 14828 0.0 S 06:00 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10743074 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 191 evolution/app.evolutionerp.com.au-ssl_log 132 otterfencing/otterfencing.com.au-ssl_log 103 evolution/portal.evolutionerp.com.au-ssl_log 12 nrg/nrgservices.net.au-ssl_log 7 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 135 139.28.219.70 132 40.115.94.245 103 34.24.200.89 43 213.209.159.84 12 203.54.180.238 4 2001:8003:153b:500:25ae:9f58:d8a8:392 3 114.119.140.234 2 114.119.143.104 1 85.208.96.206 1 45.238.41.50 1 41.56.170.205 1 2.49.102.49 1 217.181.68.37 1 195.63.25.45 1 187.172.190.39 --- top request paths across all vhosts (last 3 min) --- 48 GET / 38 GET /api/getItem/LWHG2001KG 12 GET /heartbeat.php 6 GET /store/kids-swarovski-crystal-airmax90/ 4 GET /api/getItem/PWFBW3151KG 2 POST / 2 GET /wp-login.php 2 GET /store/kidscarskicks/ 2 GET /resetpass 2 GET /_image 2 GET /api/getItem/SHSG404016-DP25-24-DI-110 2 GET /api/getItem/CLFBNSTD45250KK 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /z9x8c7v6b5-debug-trigger-cpanel.otterfencing.com.au 1 GET /www/ 1 GET /wp-json 1 GET /wp-includes/Text/Diff/wp-includes/Text/ 1 GET /wp-includes/Text/Diff//wp-includes/Text/ --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 44 GET / 6 GET /store/kids-swarovski-crystal-airmax90/ 2 POST / 2 GET /store/kidscarskicks/ 1 GET /www/ 1 GET /wp-login.php 1 GET /wp-includes/Text/Diff/wp-includes/Text/ 1 GET /wp-includes/Text/Diff//wp-includes/Text/ 1 GET /wp-includes/Text/Diff/Renderer/wp-includes/Text/Diff/ 1 GET /wp-includes/Text/Diff/Renderer//wp-includes/Text/Diff/ 1 GET /wp-includes/Text/Diff/Engine/wp-includes/Text/Diff/ 1 GET /wp-includes/Text/Diff/Engine//wp-includes/Text/Diff/ -- last 10 requests -- 139.28.219.70 - - [05/Sep/2026:07:24:18 +1000] "GET /web/ HTTP/1.1" 404 36643 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:24:20 +1000] "GET /uploads/ HTTP/1.1" 404 36641 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:24:21 +1000] "GET /upload/ HTTP/1.1" 404 36643 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:24:23 +1000] "GET /admin/uploads/ HTTP/1.1" 404 36643 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:24:24 +1000] "GET /Admin/uploads/ HTTP/1.1" 404 36643 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:24:26 +1000] "GET /admin/ HTTP/1.1" 302 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:24:28 +1000] "GET /wp-admin/ HTTP/1.1" 302 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:24:31 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Fmadalice.com.au%2Fwp-admin%2F&reauth=1 HTTP/1.1" 200 4024 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:24:33 +1000] "GET /images/ HTTP/1.1" 404 36643 "-" "-" 114.119.140.234 - - [05/Sep/2026:07:24:33 +1000] "GET /store/kids-swarovski-crystal-airmax90/?image=1&rating=2&wcpr_rating=3&wcpr_page=2 HTTP/1.1" 200 51436 "https://madalice.com.au/store/kids-swarovski-crystal-airmax90/ == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 38 GET /api/getItem/LWHG2001KG 4 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/SHSG404016-DP25-24-DI-110 2 GET /api/getItem/CLFBNSTD45250KK 1 GET /api/getItem/SHSG909020-8 1 GET /api/getItem/SHSG898950-8 1 GET /api/getItem/SHSG898935-8 1 GET /api/getItem/SHSG898930-8 1 GET /api/getItem/SHSG898920-8 1 GET /api/getItem/SHSG757550-8 1 GET /api/getItem/SHSG757540-8 1 GET /api/getItem/SHSG757530-8 -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:07:24:09 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:24:09 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:24:09 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:24:10 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:24:10 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:24:10 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:24:11 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:24:11 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:24:12 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:24:12 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 4 GET / 2 GET /_image 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /z9x8c7v6b5-debug-trigger-cpanel.otterfencing.com.au 1 GET /wp-json 1 GET /wp/.env 1 GET /wp-config.php.swp 1 GET /wp-config.php~ 1 GET /wp-config.old 1 GET /web/.env -- last 10 requests -- 34.24.200.89 - - [05/Sep/2026:07:22:58 +1000] "GET /api/.env.bak HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.24.200.89 - - [05/Sep/2026:07:22:58 +1000] "GET /.env.docker HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.24.200.89 - - [05/Sep/2026:07:22:58 +1000] "GET /env.bak HTTP/1.1" 401 12606 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.24.200.89 - - [05/Sep/2026:07:22:58 +1000] "GET /@fs/.env?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.24.200.89 - - [05/Sep/2026:07:22:58 +1000] "GET /@fs/root/.env?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.24.200.89 - - [05/Sep/2026:07:22:58 +1000] "GET /.env.prod.bak HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.24.200.89 - - [05/Sep/2026:07:22:58 +1000] "GET /@fs/proc/self/environ?import&raw?? HTTP/1.1" 404 3493 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537. 34.24.200.89 - - [05/Sep/2026:07:22:59 +1000] "GET /_image?href=/proc/self/environ HTTP/1.1" 401 12596 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.24.200.89 - - [05/Sep/2026:07:22:59 +1000] "GET /_image?href=/../../../.env HTTP/1.1" 401 12599 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.24.200.89 - - [05/Sep/2026:07:23:01 +1000] "GET /debug/vars HTTP/1.1" 404 3493 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-05 07:22:13 L1=1.80 run=1 blk=1 avail=6750 (49.0%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1497 ap=21 tcp=36 topuser=madalice 2026-09-05 07:22:15 L1=1.89 run=3 blk=1 avail=6695 (48.6%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1567 ap=19 tcp=36 topuser=madalice 2026-09-05 07:22:23 L1=2.06 run=2 blk=1 avail=6785 (49.3%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1487 ap=17 tcp=39 topuser=madalice 2026-09-05 07:22:25 L1=2.30 run=3 blk=1 avail=6782 (49.2%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1488 ap=17 tcp=40 topuser=madalice 2026-09-05 07:22:34 L1=2.36 run=4 blk=1 avail=6552 (47.6%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1494 ap=48 tcp=77 topuser=madalice 2026-09-05 07:22:35 L1=2.49 run=3 blk=1 avail=6421 (46.6%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1640 ap=48 tcp=69 topuser=madalice 2026-09-05 07:22:44 L1=2.53 run=3 blk=1 avail=6478 (47.0%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1637 ap=40 tcp=41 topuser=madalice 2026-09-05 07:22:46 L1=2.73 run=3 blk=1 avail=6557 (47.6%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1567 ap=38 tcp=48 topuser=madalice 2026-09-05 07:22:54 L1=2.83 run=2 blk=1 avail=6737 (48.9%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1424 ap=31 tcp=52 topuser=madalice 2026-09-05 07:22:56 L1=2.84 run=5 blk=1 avail=6823 (49.5%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1349 ap=30 tcp=53 topuser=madalice 2026-09-05 07:23:04 L1=2.86 run=2 blk=1 avail=6784 (49.2%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1415 ap=26 tcp=39 topuser=madalice 2026-09-05 07:23:06 L1=2.95 run=1 blk=1 avail=6852 (49.7%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1359 ap=24 tcp=41 topuser=madalice 2026-09-05 07:23:14 L1=2.95 run=2 blk=1 avail=6811 (49.4%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1427 ap=19 tcp=43 topuser=madalice 2026-09-05 07:23:16 L1=2.88 run=2 blk=1 avail=6959 (50.5%) swpO=0 conn=5 myRSS=2989 php=14 phpRSS=1304 ap=19 tcp=42 topuser=madalice 2026-09-05 07:23:24 L1=2.89 run=2 blk=1 avail=6927 (50.3%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1320 ap=17 tcp=41 topuser=madalice 2026-09-05 07:23:26 L1=2.89 run=2 blk=1 avail=6875 (49.9%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1382 ap=17 tcp=39 topuser=madalice 2026-09-05 07:23:34 L1=3.14 run=2 blk=1 avail=6680 (48.5%) swpO=1 conn=4 myRSS=2989 php=13 phpRSS=1559 ap=19 tcp=47 topuser=madalice 2026-09-05 07:23:36 L1=3.13 run=2 blk=1 avail=6650 (48.3%) swpO=1 conn=4 myRSS=2989 php=13 phpRSS=1568 ap=23 tcp=47 topuser=madalice 2026-09-05 07:23:44 L1=3.20 run=4 blk=1 avail=7073 (51.3%) swpO=2 conn=4 myRSS=2989 php=14 phpRSS=1211 ap=18 tcp=39 topuser=madalice 2026-09-05 07:23:46 L1=3.27 run=3 blk=1 avail=7363 (53.4%) swpO=2 conn=3 myRSS=2989 php=14 phpRSS=917 ap=16 tcp=39 topuser=madalice 2026-09-05 07:23:54 L1=3.16 run=4 blk=1 avail=7354 (53.4%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=904 ap=16 tcp=40 topuser=madalice 2026-09-05 07:23:56 L1=3.31 run=2 blk=1 avail=7299 (53.0%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=958 ap=16 tcp=42 topuser=madalice 2026-09-05 07:24:04 L1=3.26 run=4 blk=1 avail=6869 (49.9%) swpO=0 conn=4 myRSS=2989 php=14 phpRSS=1422 ap=16 tcp=41 topuser=madalice 2026-09-05 07:24:06 L1=3.26 run=3 blk=1 avail=6740 (48.9%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1507 ap=16 tcp=43 topuser=madalice 2026-09-05 07:24:14 L1=3.92 run=7 blk=1 avail=6423 (46.6%) swpO=0 conn=8 myRSS=2989 php=13 phpRSS=1758 ap=32 tcp=59 topuser=madalice 2026-09-05 07:24:16 L1=3.92 run=2 blk=1 avail=6568 (47.7%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1565 ap=32 tcp=57 topuser=madalice 2026-09-05 07:24:24 L1=3.87 run=1 blk=1 avail=6607 (48.0%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1567 ap=27 tcp=45 topuser=madalice 2026-09-05 07:24:26 L1=3.87 run=3 blk=1 avail=6621 (48.1%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1573 ap=25 tcp=45 topuser=madalice 2026-09-05 07:24:34 L1=3.81 run=4 blk=1 avail=6481 (47.0%) swpO=0 conn=6 myRSS=2989 php=13 phpRSS=1755 ap=19 tcp=46 topuser=madalice 2026-09-05 07:24:36 L1=3.81 run=1 blk=1 avail=6660 (48.3%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1567 ap=19 tcp=44 topuser=madalice