INCIDENT 2026-09-05 07:36:40 trigger: php_rss=1513MB ================================================================== load: 2.22 2.30 2.21 2/699 515407 ncpu:10 mem_avail: 6755MB/13777MB (49.0%) swap_used:2194MB swapout:0/s blocked(D):1 running:2 iowait:9.9% steal:0.0% php: 13 procs / 1513MB heaviest user: madalice (9 procs, 1381MB) apache: 20 procs tcp_estab: 32 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2982 root 249 1409 madalice 9 1387 nobody 19 347 netdata 8 255 evolution 11 124 dovenull 6 65 wp-toolkit 3 53 infinium 2 28 candyfabcom 2 28 kurri 2 27 dovecot 3 27 mailman 20 26 mailnull 4 20 cpanellogin 1 16 lowrange 1 15 aaa 1 15 zabbix 1 10 polkitd 1 7 named 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 9 1389 evolution 3 103 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5390 MB Active(file): 3491 MB Inactive(file): 1939 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 552 MB CommitLimit: 10984 MB Committed_AS: 8776 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 4-05:14:14 4832 /usr/bin/imunify-agent-proxy 4109079 root 02:51:52 3444 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 02:51:52 542156 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3053952 11.8 Ssl 2-17:22:29 /usr/sbin/mariadbd 4109105 4109079 root 542156 8.7 Sl 02:51:52 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 424517 2601907 madalice 199216 7.3 R 24:23 php-fpm: pool madalice_com_au 1542443 1 netdata 189528 2.6 Ssl 2-05:14:19 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 424516 2601907 madalice 171268 7.6 S 24:24 php-fpm: pool madalice_com_au 3643624 3626973 root 168568 0.0 S 05:09:51 spamd child 424514 2601907 madalice 166764 7.6 S 24:24 php-fpm: pool madalice_com_au 496129 2601907 madalice 166692 7.9 S 06:02 php-fpm: pool madalice_com_au 424518 2601907 madalice 166396 7.5 S 24:23 php-fpm: pool madalice_com_au 424513 2601907 madalice 149204 6.8 S 24:24 php-fpm: pool madalice_com_au 424515 2601907 madalice 142652 7.9 S 24:24 php-fpm: pool madalice_com_au 495842 2601907 madalice 142392 7.8 S 06:25 php-fpm: pool madalice_com_au 3626973 1 root 128508 0.0 Ss 05:13:26 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 515304 2601907 madalice 127592 8.0 S 00:14 php-fpm: pool madalice_com_au 3643625 3626973 root 90524 0.0 S 05:09:51 spamd child 509236 509098 root 61236 0.0 Sl 8-05:17:00 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3127357 3127312 evolution 54536 0.0 Ss 07:36:40 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3127358 3127320 evolution 51348 0.0 Ss 07:36:40 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509266 1 root 45508 0.0 Ss 8-05:17:00 /usr/lib/systemd/systemd-journald 1353308 1 root 41880 0.1 Ss 45-04:55:26 cpsrvd (SSL) - waiting for connections 1542981 1542551 netdata 41144 0.1 Sl 2-05:14:15 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 34536 0.1 Ss 67-21:26:55 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542487 1 wp-toolkit 29348 0.0 Ss 2-05:14:19 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28692 0.0 Ss 1-05:13:15 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3626082 1 root 27880 0.0 Ss 05:14:26 lfd - sleeping 1463 1 root 24104 0.0 Ss 67-21:26:55 tailwatchd 499117 506832 nobody 22316 0.1 S 02:15 /usr/sbin/httpd -k start 497486 506832 nobody 22276 0.0 S 04:20 /usr/sbin/httpd -k start 499124 506832 nobody 21956 0.0 S 02:15 /usr/sbin/httpd -k start 499120 506832 nobody 21664 0.0 S 02:15 /usr/sbin/httpd -k start 499137 506832 nobody 21612 0.0 S 02:15 /usr/sbin/httpd -k start 498298 506832 nobody 21512 0.0 S 03:19 /usr/sbin/httpd -k start 499040 506832 nobody 21444 0.0 S 02:18 /usr/sbin/httpd -k start 499035 506832 nobody 20724 0.0 S 02:18 /usr/sbin/httpd -k start 499106 506832 nobody 20600 0.0 S 02:16 /usr/sbin/httpd -k start 499093 506832 nobody 20580 0.0 S 02:16 /usr/sbin/httpd -k start 499086 506832 nobody 20496 0.0 S 02:16 /usr/sbin/httpd -k start 499074 506832 nobody 20340 0.0 S 02:16 /usr/sbin/httpd -k start 499052 506832 nobody 20176 0.0 S 02:17 /usr/sbin/httpd -k start 499139 506832 nobody 20112 0.0 S 02:15 /usr/sbin/httpd -k start 498241 506832 nobody 19900 0.0 S 03:21 /usr/sbin/httpd -k start 2602226 1 root 19316 0.1 Ssl 1-05:13:00 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1542531 1 wp-toolkit 19264 0.0 Ss 2-05:14:18 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1542982 1542551 netdata 18552 2.2 Sl 2-05:14:15 /usr/libexec/netdata/plugins.d/apps.plugin 1 515230 506832 nobody 17932 0.0 S 00:23 /usr/sbin/httpd -k start 515231 506832 nobody 17212 0.0 S 00:23 /usr/sbin/httpd -k start 498558 1353308 cpanellogin 16656 0.0 S 02:46 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 306499 1471 root 16352 0.0 S 57:37 cPhulkd - dbprocessor 424143 508511 aaa 16168 0.0 S 25:12 dovecot/imap 1542141 1 root 15420 0.0 Ss 2-05:14:22 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 3539428 508511 lowrange 15372 0.0 S 05:40:33 dovecot/imap 497531 1471 root 14956 0.0 S 04:15 cPhulkd - processor - http socket 1471 1 root 14864 0.0 Ss 67-21:26:55 cPhulkd - processor 373493 508511 infinium 14744 0.0 S 39:41 dovecot/imap 515235 508511 candyfabcom 14728 0.0 S 00:21 dovecot/imap 425142 508511 infinium 14596 0.0 S 24:03 dovecot/imap 515368 508511 kurri 14512 0.0 S 00:05 dovecot/imap 515220 508511 candyfabcom 14464 0.0 S 00:25 dovecot/imap 3141944 508511 kurri 13864 0.0 S 07:36:18 dovecot/imap 690505 508511 dovenull 13276 0.0 S 19:03:51 dovecot/imap-login --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10748648 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 195 evolution/app.evolutionerp.com.au-ssl_log 94 tubesupplies/tubesupplies.com.au-ssl_log 7 aaa/aaadownunder.com.au-ssl_log 5 evolution/portal.evolutionerp.com.au-ssl_log 5 corpkicks/corporatekicks.com.au-ssl_log 3 tubesupplies/tubesupplies.com.au 3 evolution/pdev.evolutionerp.com.au-ssl_log 2 infinium/infinium.net.au-ssl_log 2 evolution/my.evolutionerp.com.au-ssl_log 1 evolution/pdev.evolutionerp.com.au 1 kamcool/kamcool.com.au-ssl_log 1 olytis/tis.com.au-ssl_log 1 vinesit/vinesit.com.au-ssl_log 1 (total vhosts taking traffic: 14) --- top client IPs across all vhosts (last 3 min) --- 172 139.28.219.70 94 40.115.94.245 12 2001:8003:153b:500:25ae:9f58:d8a8:392 9 62.60.130.198 5 203.54.180.238 5 118.127.40.55 2 51.8.102.230 2 2a01:cb10:8e03:a200:2fb7:f329:9e1a:e86b 2 216.73.217.34 2 141.98.186.30 2 114.119.143.104 2 114.119.137.101 1 74.7.244.52 1 74.7.227.14 1 66.249.73.172 --- top request paths across all vhosts (last 3 min) --- 27 GET /api/getItem/LWFB2001KG 20 GET /api/getItem/LWPG2001KG 8 GET / 6 GET /robots.txt 5 POST / 5 GET /heartbeat.php 4 GET /store/kids-hand-painted-af1-shoes/ 3 POST /wp-cron.php 3 POST /wp-admin/admin-ajax.php 3 GET /wp-login.php 2 GET /wp-admin/user/ 2 GET /wp-admin/css/colors/ 2 GET /wp-admin/css/ 2 GET /api/getItem/SHSG252516-8 2 GET /api/getItem/RHSG502520-8 1 POST /wp-login.php 1 POST /wp-json/wc-push-notifications/send 1 GET /wp-content/plugins/woocommerce/assets/wp-content/plugins/woocommerce/ 1 GET /wp-content/plugins/woocommerce/assets//wp-content/plugins/woocommerce/ 1 GET /wp-content/plugins/woocommerce/assets/js/zoom/wp-content/plugins/woocommerce/assets/js/ --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 6 GET / 5 POST / 4 GET /store/kids-hand-painted-af1-shoes/ 3 POST /wp-admin/admin-ajax.php 1 POST /wp-json/wc-push-notifications/send 1 GET /wp-content/plugins/woocommerce/assets/wp-content/plugins/woocommerce/ 1 GET /wp-content/plugins/woocommerce/assets//wp-content/plugins/woocommerce/ 1 GET /wp-content/plugins/woocommerce/assets/js/zoom/wp-content/plugins/woocommerce/assets/js/ 1 GET /wp-content/plugins/woocommerce/assets/js/zoom//wp-content/plugins/woocommerce/assets/js/ 1 GET /wp-content/plugins/woocommerce/assets/js/zoom/ 1 GET /wp-content/plugins/woocommerce/assets/js/stupidtable/wp-content/plugins/woocommerce/assets/js/ 1 GET /wp-content/plugins/woocommerce/assets/js/stupidtable//wp-content/plugins/woocommerce/assets/js/ -- last 10 requests -- 139.28.219.70 - - [05/Sep/2026:07:36:25 +1000] "GET /wp-content/plugins/woocommerce/assets/client/admin/wp-admin-scripts/woo-enable-autorenew.asset.php HTTP/1.1" 200 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:36:25 +1000] "GET /wp-content/plugins/woocommerce/assets/client/admin/wp-admin-scripts/woo-plugin-update-connect-notice.asset.php HTTP/1.1" 200 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:36:25 +1000] "GET /wp-content/plugins/woocommerce/assets/client/admin/wp-admin-scripts/woo-product-usage-notice.asset.php HTTP/1.1" 200 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:36:26 +1000] "GET /wp-content/plugins/woocommerce/assets/client/admin/wp-admin-scripts/woo-purchase-subscription.asset.php HTTP/1.1" 200 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:36:26 +1000] "GET /wp-content/plugins/woocommerce/assets/client/admin/wp-admin-scripts/woo-renew-subscription.asset.php HTTP/1.1" 200 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:36:27 +1000] "GET /wp-content/plugins/woocommerce/assets/client/admin/wp-admin-scripts/woo-subscriptions-notice.asset.php HTTP/1.1" 200 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:36:27 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/ HTTP/1.1" 200 6737 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:36:28 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks//wp-content/plugins/woocommerce/assets/client/ HTTP/1.1" 301 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:36:29 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/wp-content/plugins/woocommerce/assets/client/ HTTP/1.1" 404 36653 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:36:31 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/@woocommerce/ HTTP/1.1" 200 314 "-" "-" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 27 GET /api/getItem/LWFB2001KG 20 GET /api/getItem/LWPG2001KG 2 GET /api/getItem/SHSG252516-8 2 GET /api/getItem/RHSG502520-8 1 GET /api/getItem/SHSG252516-6.5 1 GET /api/getItem/SHSG10010050-12 1 GET /api/getItem/SHSG10010040-8 1 GET /api/getItem/SHSG10010040-12 1 GET /api/getItem/SHSG10010030-SP25-8 1 GET /api/getItem/SHSG10010030-DP25-8-DI 1 GET /api/getItem/SHSG10010030-DP25-8 1 GET /api/getItem/SHSG10010030-8 -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:07:35:40 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:35:40 +1000] "GET /api/getItem/SHSG10010030-DP25-8-DI HTTP/1.1" 200 1405 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:35:40 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:35:40 +1000] "GET /api/getItem/SHSG10010030-SP25-8 HTTP/1.1" 200 1409 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:35:41 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:35:41 +1000] "GET /api/getItem/SHSG10010040-12 HTTP/1.1" 200 1294 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:35:41 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:35:41 +1000] "GET /api/getItem/SHSG10010040-8 HTTP/1.1" 200 1867 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:35:41 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:35:41 +1000] "GET /api/getItem/SHSG10010050-12 HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 2 GET /wp-login.php 1 POST /wp-cron.php 1 GET /wp-admin/user/ 1 GET /wp-admin/network/ 1 GET /wp-admin/css/colors/ 1 GET /wp-admin/css/ -- last 10 requests -- 62.60.130.198 - - [05/Sep/2026:07:34:03 +1000] "GET /wp-admin/network/ HTTP/1.1" 302 - "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" 118.127.40.55 - - [05/Sep/2026:07:34:11 +1000] "POST /wp-cron.php?doing_wp_cron=1788557651.2399559020996093750000 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://tubesupplies.com.au" 62.60.130.198 - - [05/Sep/2026:07:34:12 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Ftubesupplies.com.au%2Fwp-admin%2Fnetwork%2F&reauth=1 HTTP/1.1" 200 7757 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 62.60.130.198 - - [05/Sep/2026:07:34:25 +1000] "GET /wp-admin/user/ HTTP/1.1" 302 - "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" 62.60.130.198 - - [05/Sep/2026:07:34:27 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Ftubesupplies.com.au%2Fwp-admin%2Fuser%2F&reauth=1 HTTP/1.1" 200 7754 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Ap 62.60.130.198 - - [05/Sep/2026:07:34:38 +1000] "GET /wp-admin/css/ HTTP/1.1" 200 20531 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" 62.60.130.198 - - [05/Sep/2026:07:34:49 +1000] "GET /wp-admin/css/colors/ HTTP/1.1" 200 2800 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537. --- last 30 samples (run-up to this incident) --- 2026-09-05 07:34:11 L1=2.37 run=2 blk=1 avail=6482 (47.0%) swpO=0 conn=5 myRSS=2989 php=15 phpRSS=1864 ap=19 tcp=35 topuser=madalice 2026-09-05 07:34:18 L1=2.34 run=2 blk=1 avail=6569 (47.7%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1714 ap=19 tcp=35 topuser=madalice 2026-09-05 07:34:22 L1=2.31 run=3 blk=1 avail=6551 (47.6%) swpO=0 conn=3 myRSS=2989 php=13 phpRSS=1714 ap=22 tcp=68 topuser=madalice 2026-09-05 07:34:28 L1=2.21 run=5 blk=1 avail=5598 (40.6%) swpO=308 conn=7 myRSS=2982 php=15 phpRSS=2093 ap=113 tcp=100 topuser=madalice 2026-09-05 07:34:32 L1=2.19 run=3 blk=1 avail=6006 (43.6%) swpO=308 conn=4 myRSS=2982 php=13 phpRSS=1625 ap=110 tcp=45 topuser=madalice 2026-09-05 07:34:39 L1=2.09 run=2 blk=1 avail=6056 (44.0%) swpO=0 conn=4 myRSS=2982 php=13 phpRSS=1627 ap=103 tcp=39 topuser=madalice 2026-09-05 07:34:42 L1=2.01 run=5 blk=1 avail=6078 (44.1%) swpO=0 conn=5 myRSS=2982 php=13 phpRSS=1622 ap=100 tcp=39 topuser=madalice 2026-09-05 07:34:49 L1=2.01 run=2 blk=1 avail=6138 (44.6%) swpO=0 conn=4 myRSS=2982 php=13 phpRSS=1623 ap=93 tcp=35 topuser=madalice 2026-09-05 07:34:52 L1=2.09 run=1 blk=1 avail=6151 (44.6%) swpO=0 conn=3 myRSS=2982 php=13 phpRSS=1621 ap=90 tcp=34 topuser=madalice 2026-09-05 07:34:59 L1=2.16 run=2 blk=1 avail=6193 (45.0%) swpO=0 conn=4 myRSS=2982 php=13 phpRSS=1622 ap=83 tcp=38 topuser=madalice 2026-09-05 07:35:02 L1=2.23 run=4 blk=1 avail=6111 (44.4%) swpO=0 conn=4 myRSS=2982 php=13 phpRSS=1708 ap=80 tcp=37 topuser=madalice 2026-09-05 07:35:09 L1=2.37 run=3 blk=1 avail=6084 (44.2%) swpO=0 conn=5 myRSS=2982 php=13 phpRSS=1801 ap=73 tcp=37 topuser=madalice 2026-09-05 07:35:12 L1=2.26 run=7 blk=1 avail=6088 (44.2%) swpO=0 conn=5 myRSS=2982 php=14 phpRSS=1860 ap=69 tcp=39 topuser=madalice 2026-09-05 07:35:19 L1=2.48 run=3 blk=1 avail=6277 (45.6%) swpO=0 conn=5 myRSS=2982 php=13 phpRSS=1679 ap=63 tcp=43 topuser=madalice 2026-09-05 07:35:22 L1=2.44 run=1 blk=1 avail=6277 (45.6%) swpO=0 conn=4 myRSS=2982 php=13 phpRSS=1704 ap=59 tcp=40 topuser=madalice 2026-09-05 07:35:30 L1=2.45 run=2 blk=1 avail=6407 (46.5%) swpO=0 conn=4 myRSS=2982 php=13 phpRSS=1624 ap=52 tcp=40 topuser=madalice 2026-09-05 07:35:32 L1=2.45 run=1 blk=1 avail=6433 (46.7%) swpO=0 conn=3 myRSS=2982 php=13 phpRSS=1620 ap=49 tcp=38 topuser=madalice 2026-09-05 07:35:40 L1=2.54 run=6 blk=1 avail=6472 (47.0%) swpO=0 conn=4 myRSS=2982 php=13 phpRSS=1602 ap=42 tcp=51 topuser=madalice 2026-09-05 07:35:42 L1=2.54 run=4 blk=1 avail=6442 (46.8%) swpO=0 conn=5 myRSS=2982 php=13 phpRSS=1664 ap=41 tcp=51 topuser=madalice 2026-09-05 07:35:50 L1=2.75 run=1 blk=1 avail=6584 (47.8%) swpO=0 conn=3 myRSS=2982 php=13 phpRSS=1582 ap=35 tcp=35 topuser=madalice 2026-09-05 07:35:52 L1=2.75 run=1 blk=1 avail=6633 (48.1%) swpO=0 conn=3 myRSS=2982 php=13 phpRSS=1537 ap=33 tcp=41 topuser=madalice 2026-09-05 07:36:00 L1=2.63 run=1 blk=1 avail=6728 (48.8%) swpO=0 conn=3 myRSS=2982 php=13 phpRSS=1514 ap=26 tcp=35 topuser=madalice 2026-09-05 07:36:02 L1=2.63 run=2 blk=1 avail=6669 (48.4%) swpO=0 conn=3 myRSS=2982 php=13 phpRSS=1586 ap=24 tcp=34 topuser=madalice 2026-09-05 07:36:10 L1=2.69 run=2 blk=1 avail=6723 (48.8%) swpO=0 conn=4 myRSS=2982 php=13 phpRSS=1529 ap=23 tcp=39 topuser=madalice 2026-09-05 07:36:12 L1=2.69 run=3 blk=1 avail=6604 (47.9%) swpO=0 conn=3 myRSS=2982 php=13 phpRSS=1646 ap=23 tcp=37 topuser=madalice 2026-09-05 07:36:20 L1=2.51 run=1 blk=1 avail=7285 (52.9%) swpO=0 conn=4 myRSS=2982 php=13 phpRSS=943 ap=26 tcp=41 topuser=madalice 2026-09-05 07:36:22 L1=2.51 run=1 blk=1 avail=7392 (53.7%) swpO=0 conn=3 myRSS=2982 php=13 phpRSS=834 ap=26 tcp=40 topuser=madalice 2026-09-05 07:36:30 L1=2.35 run=3 blk=1 avail=7111 (51.6%) swpO=0 conn=4 myRSS=2982 php=14 phpRSS=1132 ap=26 tcp=36 topuser=madalice 2026-09-05 07:36:32 L1=2.35 run=1 blk=1 avail=7208 (52.3%) swpO=0 conn=3 myRSS=2982 php=13 phpRSS=1005 ap=26 tcp=33 topuser=madalice 2026-09-05 07:36:40 L1=2.22 run=2 blk=1 avail=6755 (49.0%) swpO=0 conn=4 myRSS=2982 php=13 phpRSS=1513 ap=20 tcp=32 topuser=madalice