INCIDENT 2026-09-05 07:25:37 trigger: php_rss=1606MB ================================================================== load: 3.20 2.71 2.21 1/711 478203 ncpu:10 mem_avail: 6631MB/13777MB (48.1%) swap_used:2182MB swapout:0/s blocked(D):1 running:1 iowait:9.5% steal:0.0% php: 14 procs / 1606MB heaviest user: madalice (9 procs, 1435MB) apache: 17 procs tcp_estab: 43 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2989 root 259 1597 madalice 9 1435 nobody 16 292 netdata 8 259 evolution 12 164 cpanellogin 1 85 dovenull 6 65 wp-toolkit 3 53 infinium 3 43 kurri 3 42 lowrange 2 30 dovecot 3 27 mailman 20 26 mailnull 4 22 aaa 1 15 vinesit 1 14 zabbix 1 10 cpanelphpmyadmin 1 10 polkitd 1 7 --- php workers by user --- USER PROCS RSS_MB madalice 9 1435 evolution 4 143 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5696 MB Active(file): 3820 MB Inactive(file): 1897 MB Dirty: 2 MB Writeback: 0 MB SReclaimable: 555 MB CommitLimit: 10984 MB Committed_AS: 9179 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 463466 root 00:37 1284 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : 3926885 root 4-05:03:11 4832 /usr/bin/imunify-agent-proxy 4109079 root 02:40:49 3592 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 02:40:49 544144 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3061100 11.8 Ssl 2-17:11:26 /usr/sbin/mariadbd 4109105 4109079 root 544144 9.3 Sl 02:40:49 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1542443 1 netdata 192940 2.6 Ssl 2-05:03:16 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3643624 3626973 root 168564 0.0 S 04:58:48 spamd child 408460 2601907 madalice 164732 9.6 S 16:44 php-fpm: pool madalice_com_au 424514 2601907 madalice 164352 7.1 S 13:21 php-fpm: pool madalice_com_au 407388 2601907 madalice 164068 12.4 S 18:56 php-fpm: pool madalice_com_au 424516 2601907 madalice 163956 7.1 S 13:21 php-fpm: pool madalice_com_au 407474 2601907 madalice 163852 12.5 S 18:43 php-fpm: pool madalice_com_au 424513 2601907 madalice 163224 6.3 S 13:21 php-fpm: pool madalice_com_au 424515 2601907 madalice 163156 7.6 S 13:21 php-fpm: pool madalice_com_au 424517 2601907 madalice 161208 7.3 S 13:20 php-fpm: pool madalice_com_au 424518 2601907 madalice 161000 6.8 S 13:20 php-fpm: pool madalice_com_au 3626973 1 root 131308 0.0 Ss 05:02:23 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3643625 3626973 root 93348 0.0 S 04:58:48 spamd child 203496 1353308 cpanellogin 87124 0.0 S 01:18:26 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 509236 509098 root 61236 0.0 Sl 8-05:05:57 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3127357 3127312 evolution 54740 0.0 Ss 07:25:37 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3127358 3127320 evolution 51520 0.0 Ss 07:25:37 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509266 1 root 44644 0.0 Ss 8-05:05:57 /usr/lib/systemd/systemd-journald 1542981 1542551 netdata 41144 0.1 Sl 2-05:03:12 /usr/libexec/netdata/plugins.d/go.d.plugin 1 478172 462744 evolution 40680 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 40200 0.1 Ss 45-04:44:23 cpsrvd (SSL) - waiting for connections 1469 1 root 34704 0.1 Ss 67-21:15:52 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 477998 1353308 root 34012 0.0 S 00:05 webmaild - serving 172.105.169.180 478173 1353308 root 34012 0.0 S 00:01 whostmgrd - serving 172.105.169.180 478171 1353308 root 33880 0.0 S 00:01 cpaneld - serving 172.105.169.180 478163 1353308 root 31288 0.0 S 00:02 cpaneld - serving 172.105.169.180 478164 1353308 root 31288 0.0 S 00:02 webmaild - serving 172.105.169.180 478165 1353308 root 31288 0.0 S 00:02 whostmgrd - serving 172.105.169.180 1542487 1 wp-toolkit 29348 0.0 Ss 2-05:03:16 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28692 0.0 Ss 1-05:02:12 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3626082 1 root 28032 0.0 Ss 05:03:23 lfd - sleeping 1463 1 root 24188 0.0 Ss 67-21:15:52 tailwatchd 462762 506832 nobody 22140 0.2 S 01:24 /usr/sbin/httpd -k start 461185 506832 nobody 21932 0.1 S 03:05 /usr/sbin/httpd -k start 461151 506832 nobody 21836 0.0 S 03:06 /usr/sbin/httpd -k start 462751 506832 nobody 21524 0.0 S 01:25 /usr/sbin/httpd -k start 462729 506832 nobody 21336 0.0 S 01:29 /usr/sbin/httpd -k start 462752 506832 nobody 21296 0.0 S 01:25 /usr/sbin/httpd -k start 462162 506832 nobody 21276 0.0 S 02:04 /usr/sbin/httpd -k start 462122 506832 nobody 20940 0.0 S 02:06 /usr/sbin/httpd -k start 462163 506832 nobody 20772 0.0 S 02:04 /usr/sbin/httpd -k start 462759 506832 nobody 20660 0.2 S 01:24 /usr/sbin/httpd -k start 460687 506832 nobody 20576 0.1 S 03:51 /usr/sbin/httpd -k start 462744 506832 nobody 20328 0.0 S 01:26 /usr/sbin/httpd -k start 461115 506832 nobody 20056 0.0 S 03:09 /usr/sbin/httpd -k start 462750 506832 nobody 19420 0.0 S 01:25 /usr/sbin/httpd -k start 2602226 1 root 19364 0.1 Ssl 1-05:01:57 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1542531 1 wp-toolkit 19264 0.0 Ss 2-05:03:15 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1542982 1542551 netdata 18548 2.2 Sl 2-05:03:12 /usr/libexec/netdata/plugins.d/apps.plugin 1 306499 1471 root 16400 0.0 S 46:34 cPhulkd - dbprocessor 424143 508511 aaa 16172 0.0 S 14:09 dovecot/imap 4020744 508511 lowrange 15684 0.0 S 03:09:59 dovecot/imap 1542141 1 root 15420 0.0 Ss 2-05:03:19 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 3539428 508511 lowrange 15372 0.0 S 05:29:30 dovecot/imap 4124271 508511 kurri 15320 0.0 S 02:38:57 dovecot/imap 460925 1471 root 14980 0.0 S 03:27 cPhulkd - processor - http socket 1471 1 root 14900 0.0 Ss 67-21:15:52 cPhulkd - processor 443413 508511 infinium 14828 0.0 S 07:01 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10743492 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 131 evolution/app.evolutionerp.com.au-ssl_log 104 alison/alisonarts.com.au-ssl_log 18 evolution/portal.evolutionerp.com.au-ssl_log 6 nrg/nrgservices.net.au-ssl_log 6 otterfencing/otterfencing.com.au-ssl_log 1 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 118 139.28.219.70 104 40.115.94.245 17 187.124.38.173 6 203.54.180.238 4 2001:8003:153b:500:25ae:9f58:d8a8:392 3 114.119.140.234 2 114.119.143.14 1 85.208.96.206 1 54.236.1.242 1 45.238.41.50 1 41.56.170.205 1 34.24.200.89 1 2.49.102.49 1 222.137.183.49 1 217.181.68.37 --- top request paths across all vhosts (last 3 min) --- 71 GET /api/getItem/LWHG2001KG 6 GET /store/kids-swarovski-crystal-airmax90/ 6 GET /heartbeat.php 4 GET /api/getItem/PWFBW3151KG 4 GET / 3 GET /store/ 3 GET /products/ 3 GET /product-category/ 3 GET /catalog/ 2 POST / 2 GET /wp-login.php 2 GET /collections/ 1 POST /wp-admin/admin-ajax.php 1 GET /www/ 1 GET /wp-includes/Text/Diff/wp-includes/Text/ 1 GET /wp-includes/Text/Diff//wp-includes/Text/ 1 GET /wp-includes/Text/Diff/Renderer/wp-includes/Text/Diff/ 1 GET /wp-includes/Text/Diff/Renderer//wp-includes/Text/Diff/ 1 GET /wp-includes/Text/Diff/Engine/wp-includes/Text/Diff/ 1 GET /wp-includes/Text/Diff/Engine//wp-includes/Text/Diff/ --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 6 GET /store/kids-swarovski-crystal-airmax90/ 2 POST / 2 GET / 1 POST /wp-admin/admin-ajax.php 1 GET /www/ 1 GET /wp-login.php 1 GET /wp-includes/Text/Diff/wp-includes/Text/ 1 GET /wp-includes/Text/Diff//wp-includes/Text/ 1 GET /wp-includes/Text/Diff/Renderer/wp-includes/Text/Diff/ 1 GET /wp-includes/Text/Diff/Renderer//wp-includes/Text/Diff/ 1 GET /wp-includes/Text/Diff/Engine/wp-includes/Text/Diff/ 1 GET /wp-includes/Text/Diff/Engine//wp-includes/Text/Diff/ -- last 10 requests -- 139.28.219.70 - - [05/Sep/2026:07:25:07 +1000] "GET /wp-admin/css/ HTTP/1.1" 200 1515 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:25:07 +1000] "GET /wp-admin/css/colors/ HTTP/1.1" 200 480 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:25:08 +1000] "GET /wp-admin/css/colors//wp-admin/css/ HTTP/1.1" 301 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:25:09 +1000] "GET /wp-admin/css/colors/wp-admin/css/ HTTP/1.1" 404 36647 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:25:11 +1000] "GET /wp-admin/css/colors/blue/ HTTP/1.1" 200 349 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:25:11 +1000] "GET /wp-admin/css/colors/blue//wp-admin/css/colors/ HTTP/1.1" 301 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:25:13 +1000] "GET /wp-admin/css/colors/blue/wp-admin/css/colors/ HTTP/1.1" 404 36653 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:25:15 +1000] "GET /wp-admin/css/colors/coffee/ HTTP/1.1" 200 350 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:25:15 +1000] "GET /wp-admin/css/colors/coffee//wp-admin/css/colors/ HTTP/1.1" 301 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:25:17 +1000] "GET /wp-admin/css/colors/coffee/wp-admin/css/colors/ HTTP/1.1" 404 36653 "-" "-" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 71 GET /api/getItem/LWHG2001KG 4 GET /api/getItem/PWFBW3151KG 1 GET /api/getItem/CLSGNSTD40250KK 1 GET /api/getItem/CLSGNSTD32350KK 1 GET /api/getItem/CLPGNSTD50315KK 1 GET /api/getItem/CLPGNSTD50250KK 1 GET /api/getItem/CLPGNSTD45315KK 1 GET /api/getItem/CLPGNSTD45250KK 1 GET /api/getItem/CLPGNSTD40315KK 1 GET /api/getItem/CLPGNSTD40250KK 1 GET /api/getItem/CLPGNSTD32315KK 1 GET /api/getItem/CLPGNSTD32250KK -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:07:24:21 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:24:21 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:24:22 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:24:22 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:24:22 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:25:23 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:25:23 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:25:23 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:25:24 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:25:24 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" == alison/alisonarts.com.au-ssl_log == -- top paths -- 3 GET /store/ 3 GET /products/ 3 GET /product-category/ 3 GET /catalog/ 2 GET /collections/ 2 GET / 1 GET /shop/ 1 GET /custom-paint-and-airbrush-gallery/page/4/ -- last 10 requests -- 187.124.38.173 - - [05/Sep/2026:07:24:59 +1000] "GET /product-category/ HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 187.124.38.173 - - [05/Sep/2026:07:25:03 +1000] "GET /product-category/ HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 187.124.38.173 - - [05/Sep/2026:07:25:06 +1000] "GET /store/ HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 187.124.38.173 - - [05/Sep/2026:07:25:09 +1000] "GET /store/ HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 187.124.38.173 - - [05/Sep/2026:07:25:13 +1000] "GET /store/ HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 187.124.38.173 - - [05/Sep/2026:07:25:16 +1000] "GET /catalog/ HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 187.124.38.173 - - [05/Sep/2026:07:25:19 +1000] "GET /catalog/ HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 187.124.38.173 - - [05/Sep/2026:07:25:22 +1000] "GET /catalog/ HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 187.124.38.173 - - [05/Sep/2026:07:25:25 +1000] "GET /collections/ HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 187.124.38.173 - - [05/Sep/2026:07:25:28 +1000] "GET /collections/ HTTP/1.1" 404 49417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-05 07:23:14 L1=2.95 run=2 blk=1 avail=6811 (49.4%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1427 ap=19 tcp=43 topuser=madalice 2026-09-05 07:23:16 L1=2.88 run=2 blk=1 avail=6959 (50.5%) swpO=0 conn=5 myRSS=2989 php=14 phpRSS=1304 ap=19 tcp=42 topuser=madalice 2026-09-05 07:23:24 L1=2.89 run=2 blk=1 avail=6927 (50.3%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1320 ap=17 tcp=41 topuser=madalice 2026-09-05 07:23:26 L1=2.89 run=2 blk=1 avail=6875 (49.9%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1382 ap=17 tcp=39 topuser=madalice 2026-09-05 07:23:34 L1=3.14 run=2 blk=1 avail=6680 (48.5%) swpO=1 conn=4 myRSS=2989 php=13 phpRSS=1559 ap=19 tcp=47 topuser=madalice 2026-09-05 07:23:36 L1=3.13 run=2 blk=1 avail=6650 (48.3%) swpO=1 conn=4 myRSS=2989 php=13 phpRSS=1568 ap=23 tcp=47 topuser=madalice 2026-09-05 07:23:44 L1=3.20 run=4 blk=1 avail=7073 (51.3%) swpO=2 conn=4 myRSS=2989 php=14 phpRSS=1211 ap=18 tcp=39 topuser=madalice 2026-09-05 07:23:46 L1=3.27 run=3 blk=1 avail=7363 (53.4%) swpO=2 conn=3 myRSS=2989 php=14 phpRSS=917 ap=16 tcp=39 topuser=madalice 2026-09-05 07:23:54 L1=3.16 run=4 blk=1 avail=7354 (53.4%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=904 ap=16 tcp=40 topuser=madalice 2026-09-05 07:23:56 L1=3.31 run=2 blk=1 avail=7299 (53.0%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=958 ap=16 tcp=42 topuser=madalice 2026-09-05 07:24:04 L1=3.26 run=4 blk=1 avail=6869 (49.9%) swpO=0 conn=4 myRSS=2989 php=14 phpRSS=1422 ap=16 tcp=41 topuser=madalice 2026-09-05 07:24:06 L1=3.26 run=3 blk=1 avail=6740 (48.9%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1507 ap=16 tcp=43 topuser=madalice 2026-09-05 07:24:14 L1=3.92 run=7 blk=1 avail=6423 (46.6%) swpO=0 conn=8 myRSS=2989 php=13 phpRSS=1758 ap=32 tcp=59 topuser=madalice 2026-09-05 07:24:16 L1=3.92 run=2 blk=1 avail=6568 (47.7%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1565 ap=32 tcp=57 topuser=madalice 2026-09-05 07:24:24 L1=3.87 run=1 blk=1 avail=6607 (48.0%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1567 ap=27 tcp=45 topuser=madalice 2026-09-05 07:24:26 L1=3.87 run=3 blk=1 avail=6621 (48.1%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1573 ap=25 tcp=45 topuser=madalice 2026-09-05 07:24:34 L1=3.81 run=4 blk=1 avail=6481 (47.0%) swpO=0 conn=6 myRSS=2989 php=13 phpRSS=1755 ap=19 tcp=46 topuser=madalice 2026-09-05 07:24:36 L1=3.81 run=1 blk=1 avail=6660 (48.3%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1567 ap=19 tcp=44 topuser=madalice 2026-09-05 07:24:44 L1=3.77 run=2 blk=1 avail=6450 (46.8%) swpO=0 conn=4 myRSS=2989 php=14 phpRSS=1786 ap=19 tcp=44 topuser=madalice 2026-09-05 07:24:47 L1=3.77 run=2 blk=0 avail=6624 (48.1%) swpO=0 conn=5 myRSS=2989 php=14 phpRSS=1615 ap=19 tcp=45 topuser=madalice 2026-09-05 07:24:54 L1=3.50 run=2 blk=1 avail=6520 (47.3%) swpO=0 conn=4 myRSS=2989 php=14 phpRSS=1709 ap=19 tcp=43 topuser=madalice 2026-09-05 07:24:57 L1=3.50 run=5 blk=1 avail=6520 (47.3%) swpO=1 conn=6 myRSS=2989 php=15 phpRSS=1743 ap=19 tcp=46 topuser=madalice 2026-09-05 07:25:04 L1=3.43 run=4 blk=1 avail=6485 (47.1%) swpO=1 conn=4 myRSS=2989 php=14 phpRSS=1718 ap=19 tcp=45 topuser=madalice 2026-09-05 07:25:07 L1=3.43 run=3 blk=1 avail=6543 (47.5%) swpO=0 conn=5 myRSS=2989 php=15 phpRSS=1698 ap=19 tcp=45 topuser=madalice 2026-09-05 07:25:14 L1=3.29 run=1 blk=2 avail=6294 (45.7%) swpO=0 conn=5 myRSS=2989 php=15 phpRSS=1970 ap=18 tcp=41 topuser=madalice 2026-09-05 07:25:17 L1=3.29 run=7 blk=1 avail=6449 (46.8%) swpO=0 conn=8 myRSS=2989 php=16 phpRSS=1846 ap=18 tcp=43 topuser=madalice 2026-09-05 07:25:24 L1=3.24 run=3 blk=1 avail=6629 (48.1%) swpO=0 conn=5 myRSS=2989 php=14 phpRSS=1590 ap=18 tcp=42 topuser=madalice 2026-09-05 07:25:27 L1=3.24 run=3 blk=1 avail=6626 (48.1%) swpO=0 conn=5 myRSS=2989 php=14 phpRSS=1607 ap=17 tcp=43 topuser=madalice 2026-09-05 07:25:35 L1=3.20 run=3 blk=1 avail=6641 (48.2%) swpO=0 conn=5 myRSS=2989 php=13 phpRSS=1567 ap=17 tcp=42 topuser=madalice 2026-09-05 07:25:37 L1=3.20 run=1 blk=1 avail=6631 (48.1%) swpO=0 conn=4 myRSS=2989 php=14 phpRSS=1606 ap=17 tcp=43 topuser=madalice