INCIDENT 2026-09-05 07:31:10 trigger: php_rss=1547MB ================================================================== load: 1.99 2.29 2.18 2/696 496458 ncpu:10 mem_avail: 6740MB/13777MB (48.9%) swap_used:2182MB swapout:2/s blocked(D):1 running:2 iowait:9.9% steal:0.0% php: 14 procs / 1547MB heaviest user: madalice (9 procs, 1235MB) apache: 15 procs tcp_estab: 32 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2988 root 248 1399 madalice 9 1235 netdata 8 256 nobody 14 253 corpkicks 1 186 evolution 11 124 cpanellogin 1 85 infinium 4 71 dovenull 6 65 wp-toolkit 3 53 kurri 3 42 lowrange 2 30 dovecot 3 27 mailman 20 26 aaa 1 15 mailnull 3 13 zabbix 1 11 polkitd 1 7 named 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 9 1235 corpkicks 1 188 evolution 3 103 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5976 MB Active(file): 3783 MB Inactive(file): 2235 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 554 MB CommitLimit: 10984 MB Committed_AS: 8737 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 4-05:08:44 4832 /usr/bin/imunify-agent-proxy 4109079 root 02:46:22 3592 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 02:46:22 544136 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3060732 11.8 Ssl 2-17:16:59 /usr/sbin/mariadbd 4109105 4109079 root 544136 9.0 Sl 02:46:22 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 496428 481487 corpkicks 204532 93.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1542443 1 netdata 190636 2.6 Ssl 2-05:08:49 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3643624 3626973 root 168636 0.0 S 05:04:21 spamd child 424514 2601907 madalice 164248 7.5 S 18:54 php-fpm: pool madalice_com_au 424518 2601907 madalice 164132 7.2 S 18:53 php-fpm: pool madalice_com_au 424516 2601907 madalice 163856 7.4 S 18:54 php-fpm: pool madalice_com_au 495842 2601907 madalice 158692 6.7 S 00:55 php-fpm: pool madalice_com_au 424517 2601907 madalice 148836 7.3 R 18:53 php-fpm: pool madalice_com_au 496129 2601907 madalice 142224 4.3 S 00:32 php-fpm: pool madalice_com_au 3626973 1 root 131164 0.0 Ss 05:07:56 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 408460 2601907 madalice 123884 9.2 S 22:17 php-fpm: pool madalice_com_au 424513 2601907 madalice 122232 6.5 S 18:54 php-fpm: pool madalice_com_au 3643625 3626973 root 93208 0.0 S 05:04:21 spamd child 203496 1353308 cpanellogin 87592 0.0 S 01:23:59 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 424515 2601907 madalice 76960 7.7 S 18:54 php-fpm: pool madalice_com_au 509236 509098 root 61236 0.0 Sl 8-05:11:30 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3127357 3127312 evolution 54740 0.0 Ss 07:31:10 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3127358 3127320 evolution 51520 0.0 Ss 07:31:10 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509266 1 root 44644 0.0 Ss 8-05:11:30 /usr/lib/systemd/systemd-journald 1542981 1542551 netdata 41144 0.1 Sl 2-05:08:45 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1353308 1 root 40076 0.1 Ss 45-04:49:56 cpsrvd (SSL) - waiting for connections 1469 1 root 34704 0.1 Ss 67-21:21:25 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 480894 1542095 infinium 29544 0.1 S 02:15 php-fpm: pool user_infinium 1542487 1 wp-toolkit 29348 0.0 Ss 2-05:08:49 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28692 0.0 Ss 1-05:07:45 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3626082 1 root 28048 0.0 Ss 05:08:56 lfd - sleeping 1463 1 root 24188 0.0 Ss 67-21:21:25 tailwatchd 462751 506832 nobody 23528 0.0 S 06:58 /usr/sbin/httpd -k start 479422 506832 nobody 22796 0.1 S 04:11 /usr/sbin/httpd -k start 462122 506832 nobody 22448 0.0 S 07:39 /usr/sbin/httpd -k start 478836 506832 nobody 22420 0.0 S 04:46 /usr/sbin/httpd -k start 478479 506832 nobody 22260 0.1 S 05:24 /usr/sbin/httpd -k start 478768 506832 nobody 22124 0.1 S 04:53 /usr/sbin/httpd -k start 480945 506832 nobody 22120 0.0 S 02:12 /usr/sbin/httpd -k start 495297 506832 nobody 21156 0.1 S 00:59 /usr/sbin/httpd -k start 481487 506832 nobody 19864 0.0 S 01:12 /usr/sbin/httpd -k start 481480 506832 nobody 19500 0.0 S 01:13 /usr/sbin/httpd -k start 2602226 1 root 19364 0.1 Ssl 1-05:07:30 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1542531 1 wp-toolkit 19264 0.0 Ss 2-05:08:48 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1542982 1542551 netdata 18548 2.2 Sl 2-05:08:45 /usr/libexec/netdata/plugins.d/apps.plugin 1 496207 506832 nobody 18532 0.0 S 00:23 /usr/sbin/httpd -k start 496196 506832 nobody 17772 0.0 S 00:24 /usr/sbin/httpd -k start 306499 1471 root 16376 0.0 S 52:07 cPhulkd - dbprocessor 424143 508511 aaa 16172 0.0 S 19:42 dovecot/imap 4020744 508511 lowrange 15684 0.0 S 03:15:32 dovecot/imap 1542141 1 root 15420 0.0 Ss 2-05:08:52 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 3539428 508511 lowrange 15372 0.0 S 05:35:03 dovecot/imap 4124271 508511 kurri 15320 0.0 S 02:44:30 dovecot/imap 1471 1 root 14880 0.0 Ss 67-21:21:25 cPhulkd - processor 443413 508511 infinium 14828 0.0 S 12:34 dovecot/imap 373493 508511 infinium 14744 0.0 S 34:11 dovecot/imap 425142 508511 infinium 14596 0.0 S 18:33 dovecot/imap 496126 508511 kurri 14528 0.0 S 00:33 dovecot/imap 3141944 508511 kurri 13900 0.0 S 07:30:48 dovecot/imap 690505 508511 dovenull 13276 0.0 S 18:58:21 dovecot/imap-login 690514 508511 dovecot 13276 0.0 S 18:58:21 dovecot/auth 690509 508511 dovenull 13068 0.0 S 18:58:21 dovecot/imap-login 478724 508511 root 12856 0.0 S 04:56 dovecot/auth -w --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10746322 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 154 evolution/app.evolutionerp.com.au-ssl_log 114 evolution/portal.evolutionerp.com.au-ssl_log 6 nrg/nrgservices.net.au-ssl_log 4 evolution/my.evolutionerp.com.au-ssl_log 3 olympic/olympicfencing.com.au-ssl_log 2 corpkicks/corporatekicks.com.au-ssl_log 1 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 144 139.28.219.70 114 40.115.94.245 6 203.54.180.238 2 54.175.205.73 2 156.245.205.34 2 114.119.146.16 1 52.167.144.233 1 49.180.12.75 1 40.77.167.255 1 34.196.51.17 1 34.195.60.66 1 181.116.60.182 1 170.233.248.6 1 162.14.109.170 1 157.55.39.196 --- top request paths across all vhosts (last 3 min) --- 38 GET /api/getItem/LWFB2001KG 19 GET /api/getItem/LWPB2001KG 6 GET /heartbeat.php 5 GET /store/kids-swarovski-blinged-diamond-kicks/ 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 2 GET /api/getItem/SHSG656520 2 GET /api/getItem/SHSG3030258 2 GET / 1 POST /wp-cron.php 1 POST /functions.php 1 POST / 1 HEAD / 1 GET /wp-login.php 1 GET /wp-includes/sodium_compat/src/wp-includes/sodium_compat/ 1 GET /wp-includes/sodium_compat/src//wp-includes/sodium_compat/ 1 GET /wp-includes/sodium_compat/src/Core/wp-includes/sodium_compat/src/ --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 5 GET /store/kids-swarovski-blinged-diamond-kicks/ 1 POST / 1 GET /wp-login.php 1 GET /wp-includes/sodium_compat/src/wp-includes/sodium_compat/ 1 GET /wp-includes/sodium_compat/src//wp-includes/sodium_compat/ 1 GET /wp-includes/sodium_compat/src/Core/wp-includes/sodium_compat/src/ 1 GET /wp-includes/sodium_compat/src/Core//wp-includes/sodium_compat/src/ 1 GET /wp-includes/sodium_compat/src/Core/ChaCha20//wp-includes/sodium_compat/src/Core/ 1 GET /wp-includes/sodium_compat/src/Core/ChaCha20.php 1 GET /wp-includes/sodium_compat/src/Core/BLAKE2b.php 1 GET /wp-includes/sodium_compat/src/Core/Base64//wp-includes/sodium_compat/src/Core/ 1 GET /wp-includes/sodium_compat/src/Core/Base64/wp-includes/sodium_compat/src/Core/ -- last 10 requests -- 139.28.219.70 - - [05/Sep/2026:07:30:50 +1000] "GET /wp-includes/sodium_compat/src/Core/AEGIS256.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:30:50 +1000] "GET /wp-includes/sodium_compat/src/Core/AES.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:30:51 +1000] "GET /wp-includes/sodium_compat/src/Core/AES//wp-includes/sodium_compat/src/Core/ HTTP/1.1" 301 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:30:52 +1000] "GET /wp-includes/sodium_compat/src/Core/AES/wp-includes/sodium_compat/src/Core/ HTTP/1.1" 404 36663 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:30:54 +1000] "GET /wp-includes/sodium_compat/src/Core/AES/Expanded.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:30:54 +1000] "GET /wp-includes/sodium_compat/src/Core/BLAKE2b.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:30:55 +1000] "GET /wp-includes/sodium_compat/src/Core/Base64//wp-includes/sodium_compat/src/Core/ HTTP/1.1" 301 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:30:56 +1000] "GET /wp-includes/sodium_compat/src/Core/Base64/wp-includes/sodium_compat/src/Core/ HTTP/1.1" 404 36666 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:30:58 +1000] "GET /wp-includes/sodium_compat/src/Core/ChaCha20.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:30:58 +1000] "GET /wp-includes/sodium_compat/src/Core/ChaCha20//wp-includes/sodium_compat/src/Core/ HTTP/1.1" 301 1 "-" "-" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 38 GET /api/getItem/LWFB2001KG 19 GET /api/getItem/LWPB2001KG 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 2 GET /api/getItem/SHSG656520 2 GET /api/getItem/SHSG3030258 1 GET /api/getItem/SHSP7575608 1 GET /api/getItem/SHSP5050608 1 GET /api/getItem/SHSH2525308 -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:07:30:53 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:30:54 +1000] "GET /api/getItem/SHSP7575608 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:30:54 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:30:54 +1000] "GET /api/getItem/SHSG8989208 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:30:54 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:30:54 +1000] "GET /api/getItem/SHSG8989258 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:30:55 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:30:55 +1000] "GET /api/getItem/SHSG8989358 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:30:55 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:30:55 +1000] "GET /api/getItem/SHSG8989508 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 6 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [05/Sep/2026:07:29:07 +1000] "GET /heartbeat.php?sentAt=1788557347&bytes=106,155,56,35&_=1788436625301 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [05/Sep/2026:07:29:17 +1000] "GET /heartbeat.php?sentAt=1788557357&bytes=106,155,56,45&_=1788436625302 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [05/Sep/2026:07:29:27 +1000] "GET /heartbeat.php?sentAt=1788557367&bytes=106,155,56,55&_=1788436625303 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [05/Sep/2026:07:29:37 +1000] "GET /heartbeat.php?sentAt=1788557377&bytes=106,155,56,65&_=1788436625304 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [05/Sep/2026:07:29:47 +1000] "GET /heartbeat.php?sentAt=1788557387&bytes=106,155,56,75&_=1788436625305 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [05/Sep/2026:07:29:57 +1000] "GET /heartbeat.php?sentAt=1788557397&bytes=106,155,56,85&_=1788436625306 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-09-05 07:28:46 L1=2.01 run=2 blk=1 avail=6689 (48.6%) swpO=3 conn=4 myRSS=2989 php=13 phpRSS=1566 ap=16 tcp=35 topuser=madalice 2026-09-05 07:28:49 L1=2.09 run=3 blk=1 avail=6559 (47.6%) swpO=0 conn=5 myRSS=2989 php=14 phpRSS=1732 ap=15 tcp=37 topuser=madalice 2026-09-05 07:28:56 L1=2.16 run=2 blk=1 avail=6624 (48.1%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1566 ap=15 tcp=41 topuser=madalice 2026-09-05 07:28:59 L1=2.07 run=2 blk=1 avail=6591 (47.8%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1569 ap=16 tcp=38 topuser=madalice 2026-09-05 07:29:06 L1=2.06 run=3 blk=1 avail=6513 (47.3%) swpO=0 conn=5 myRSS=2989 php=14 phpRSS=1680 ap=16 tcp=37 topuser=madalice 2026-09-05 07:29:09 L1=2.14 run=1 blk=1 avail=6590 (47.8%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1566 ap=16 tcp=37 topuser=madalice 2026-09-05 07:29:16 L1=2.13 run=3 blk=1 avail=6604 (47.9%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1583 ap=16 tcp=38 topuser=madalice 2026-09-05 07:29:19 L1=2.04 run=1 blk=1 avail=6617 (48.0%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1566 ap=16 tcp=40 topuser=madalice 2026-09-05 07:29:26 L1=2.03 run=5 blk=1 avail=6611 (48.0%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1578 ap=16 tcp=37 topuser=madalice 2026-09-05 07:29:29 L1=2.03 run=2 blk=1 avail=6567 (47.7%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1619 ap=16 tcp=37 topuser=madalice 2026-09-05 07:29:36 L1=2.03 run=1 blk=1 avail=6865 (49.8%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=1319 ap=16 tcp=40 topuser=madalice 2026-09-05 07:29:40 L1=1.95 run=1 blk=1 avail=7190 (52.2%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=996 ap=16 tcp=37 topuser=madalice 2026-09-05 07:29:46 L1=1.87 run=5 blk=1 avail=7159 (52.0%) swpO=0 conn=4 myRSS=2989 php=13 phpRSS=935 ap=16 tcp=36 topuser=madalice 2026-09-05 07:29:50 L1=1.88 run=1 blk=1 avail=7381 (53.6%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=807 ap=16 tcp=38 topuser=madalice 2026-09-05 07:29:56 L1=1.97 run=3 blk=1 avail=7077 (51.4%) swpO=3 conn=6 myRSS=2989 php=15 phpRSS=1186 ap=16 tcp=37 topuser=madalice 2026-09-05 07:30:00 L1=2.05 run=1 blk=1 avail=7259 (52.7%) swpO=3 conn=3 myRSS=2989 php=13 phpRSS=950 ap=18 tcp=34 topuser=madalice 2026-09-05 07:30:06 L1=2.13 run=7 blk=1 avail=6974 (50.6%) swpO=0 conn=6 myRSS=2989 php=14 phpRSS=1275 ap=15 tcp=36 topuser=madalice 2026-09-05 07:30:10 L1=2.12 run=4 blk=1 avail=6998 (50.8%) swpO=0 conn=3 myRSS=2989 php=14 phpRSS=1247 ap=15 tcp=38 topuser=madalice 2026-09-05 07:30:16 L1=2.19 run=1 blk=1 avail=7026 (51.0%) swpO=0 conn=6 myRSS=2989 php=14 phpRSS=1208 ap=16 tcp=33 topuser=madalice 2026-09-05 07:30:20 L1=2.33 run=1 blk=1 avail=6991 (50.7%) swpO=0 conn=3 myRSS=2989 php=14 phpRSS=1244 ap=16 tcp=33 topuser=madalice 2026-09-05 07:30:26 L1=2.31 run=2 blk=1 avail=6895 (50.0%) swpO=0 conn=6 myRSS=2989 php=13 phpRSS=1334 ap=16 tcp=33 topuser=madalice 2026-09-05 07:30:30 L1=2.20 run=1 blk=1 avail=7081 (51.4%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1144 ap=16 tcp=35 topuser=madalice 2026-09-05 07:30:36 L1=2.19 run=1 blk=1 avail=7123 (51.7%) swpO=0 conn=6 myRSS=2989 php=13 phpRSS=1107 ap=16 tcp=32 topuser=madalice 2026-09-05 07:30:40 L1=2.09 run=2 blk=1 avail=7466 (54.2%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=748 ap=15 tcp=33 topuser=madalice 2026-09-05 07:30:46 L1=2.16 run=2 blk=1 avail=7073 (51.3%) swpO=0 conn=6 myRSS=2989 php=13 phpRSS=1140 ap=15 tcp=38 topuser=madalice 2026-09-05 07:30:50 L1=2.07 run=1 blk=1 avail=6914 (50.2%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1290 ap=18 tcp=33 topuser=madalice 2026-09-05 07:30:56 L1=1.98 run=3 blk=1 avail=7047 (51.2%) swpO=1 conn=4 myRSS=2989 php=14 phpRSS=1198 ap=18 tcp=32 topuser=madalice 2026-09-05 07:31:00 L1=1.99 run=1 blk=1 avail=6983 (50.7%) swpO=1 conn=3 myRSS=2989 php=13 phpRSS=1244 ap=18 tcp=33 topuser=madalice 2026-09-05 07:31:06 L1=1.99 run=1 blk=1 avail=6991 (50.7%) swpO=2 conn=4 myRSS=2988 php=13 phpRSS=1254 ap=16 tcp=28 topuser=madalice 2026-09-05 07:31:10 L1=1.99 run=2 blk=1 avail=6740 (48.9%) swpO=2 conn=4 myRSS=2988 php=14 phpRSS=1547 ap=15 tcp=32 topuser=madalice