INCIDENT 2026-09-05 07:39:54 trigger: php_rss=1626MB ================================================================== load: 2.16 2.26 2.21 2/695 518929 ncpu:10 mem_avail: 6632MB/13777MB (48.1%) swap_used:2192MB swapout:0/s blocked(D):1 running:4 iowait:9.9% steal:0.0% php: 13 procs / 1626MB heaviest user: madalice (9 procs, 1494MB) apache: 18 procs tcp_estab: 33 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2985 madalice 9 1495 root 249 1406 nobody 17 309 netdata 8 257 evolution 11 124 wp-toolkit 3 83 dovenull 6 65 infinium 2 28 kurri 2 27 dovecot 3 27 mailman 20 26 cpanellogin 1 18 lowrange 1 15 aaa 1 15 zabbix 1 11 mailnull 3 11 polkitd 1 7 named 1 5 nscd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 9 1497 evolution 3 103 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5478 MB Active(file): 3731 MB Inactive(file): 1818 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 548 MB CommitLimit: 10984 MB Committed_AS: 8822 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 4-05:17:27 4832 /usr/bin/imunify-agent-proxy 4109079 root 02:55:05 3136 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 02:55:05 541588 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3057044 11.8 Ssl 2-17:25:42 /usr/sbin/mariadbd 4109105 4109079 root 541588 8.5 Sl 02:55:05 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1542443 1 netdata 190956 2.6 Ssl 2-05:17:32 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 515304 2601907 madalice 183036 7.5 R 03:27 php-fpm: pool madalice_com_au 424516 2601907 madalice 179596 7.7 S 27:37 php-fpm: pool madalice_com_au 424514 2601907 madalice 179192 7.6 S 27:37 php-fpm: pool madalice_com_au 424518 2601907 madalice 178752 7.4 S 27:36 php-fpm: pool madalice_com_au 496129 2601907 madalice 177024 7.4 S 09:15 php-fpm: pool madalice_com_au 3643624 3626973 root 168568 0.0 S 05:13:04 spamd child 424513 2601907 madalice 163320 6.9 S 27:37 php-fpm: pool madalice_com_au 424517 2601907 madalice 161992 7.1 S 27:36 php-fpm: pool madalice_com_au 424515 2601907 madalice 161912 7.9 S 27:37 php-fpm: pool madalice_com_au 495842 2601907 madalice 160828 7.1 S 09:38 php-fpm: pool madalice_com_au 3626973 1 root 128508 0.0 Ss 05:16:39 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3643625 3626973 root 90524 0.0 S 05:13:04 spamd child 509236 509098 root 61236 0.0 Sl 8-05:20:13 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3127357 3127312 evolution 54536 0.0 Ss 07:39:53 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3127358 3127320 evolution 51348 0.0 Ss 07:39:53 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509266 1 root 45508 0.0 Ss 8-05:20:13 /usr/lib/systemd/systemd-journald 1353308 1 root 41880 0.1 Ss 45-04:58:39 cpsrvd (SSL) - waiting for connections 1542981 1542551 netdata 41144 0.1 Sl 2-05:17:28 /usr/libexec/netdata/plugins.d/go.d.plugin 1 518055 1542141 wp-toolkit 36540 0.0 S 00:57 sw-engine-fpm: pool wordpress-toolkit 1469 1 root 34544 0.1 Ss 67-21:30:08 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542487 1 wp-toolkit 29348 0.0 Ss 2-05:17:32 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28692 0.0 Ss 1-05:16:28 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3626082 1 root 27880 0.0 Ss 05:17:39 lfd - sleeping 1463 1 root 24096 0.0 Ss 67-21:30:08 tailwatchd 497486 506832 nobody 22572 0.0 S 07:33 /usr/sbin/httpd -k start 516241 506832 nobody 22384 0.0 S 02:52 /usr/sbin/httpd -k start 516333 506832 nobody 22172 0.0 S 02:50 /usr/sbin/httpd -k start 516292 506832 nobody 21644 0.0 S 02:51 /usr/sbin/httpd -k start 516235 506832 nobody 21192 0.0 S 02:52 /usr/sbin/httpd -k start 518214 506832 nobody 21080 0.0 S 00:46 /usr/sbin/httpd -k start 516315 506832 nobody 20832 0.1 S 02:50 /usr/sbin/httpd -k start 516286 506832 nobody 20812 0.0 S 02:51 /usr/sbin/httpd -k start 516168 506832 nobody 20728 0.0 S 02:54 /usr/sbin/httpd -k start 516321 506832 nobody 20520 0.0 S 02:50 /usr/sbin/httpd -k start 518151 506832 nobody 20132 0.0 S 00:51 /usr/sbin/httpd -k start 518248 506832 nobody 19936 0.0 S 00:42 /usr/sbin/httpd -k start 518290 506832 nobody 19928 0.1 S 00:41 /usr/sbin/httpd -k start 2602226 1 root 19316 0.1 Ssl 1-05:16:13 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1542531 1 wp-toolkit 19264 0.0 Ss 2-05:17:31 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 516306 506832 nobody 19248 0.0 S 02:51 /usr/sbin/httpd -k start 498558 1353308 cpanellogin 18944 0.0 S 05:59 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 1542982 1542551 netdata 18552 2.2 Sl 2-05:17:28 /usr/libexec/netdata/plugins.d/apps.plugin 1 518291 506832 nobody 17876 0.0 S 00:41 /usr/sbin/httpd -k start 306499 1471 root 16400 0.0 S 01:00:50 cPhulkd - dbprocessor 424143 508511 aaa 16168 0.0 S 28:25 dovecot/imap 1542141 1 root 15420 0.0 Ss 2-05:17:35 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 3539428 508511 lowrange 15372 0.0 S 05:43:46 dovecot/imap 1471 1 root 14864 0.0 Ss 67-21:30:08 cPhulkd - processor 373493 508511 infinium 14744 0.0 S 42:54 dovecot/imap 518899 508511 kurri 14604 0.0 S 00:00 dovecot/imap 425142 508511 infinium 14596 0.0 S 27:16 dovecot/imap 3141944 508511 kurri 13864 0.0 S 07:39:31 dovecot/imap 518245 1471 root 13624 0.0 S 00:42 cPhulkd - processor - http socket 690505 508511 dovenull 13276 0.0 S 19:07:04 dovecot/imap-login 690514 508511 dovecot 13276 0.0 S 19:07:04 dovecot/auth 690509 508511 dovenull 13068 0.0 S 19:07:04 dovecot/imap-login 516504 508511 root 12736 0.0 S 02:27 dovecot/auth -w --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10750318 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 171 evolution/app.evolutionerp.com.au-ssl_log 101 tubesupplies/tubesupplies.com.au-ssl_log 79 olympic/olympicfencing.com.au-ssl_log 17 evolution/evolutionerp.com.au-ssl_log 12 evolution/portal.evolutionerp.com.au-ssl_log 9 tubesupplies/tubesupplies.com.au 7 aaa/aaadownunder.com.au-ssl_log 6 evolution/my.evolutionerp.com.au-ssl_log 3 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 161 139.28.219.70 101 40.115.94.245 62 4.204.224.164 21 62.60.130.198 14 34.181.250.80 9 136.124.35.100 8 203.54.180.238 6 118.127.40.55 3 136.124.33.218 2 91.92.243.248 2 2001:8a0:db6e:a500:dae:8894:ed85:9a82 2 136.124.35.188 2 114.119.159.70 2 114.119.131.88 2 114.119.130.40 --- top request paths across all vhosts (last 3 min) --- 50 GET /api/getItem/LWPG2001KG 8 GET /heartbeat.php 8 GET / 6 POST /wp-cron.php 5 GET /store/kids-custom-cookie-swoosh-muncher-af1/ 4 GET /wp-includes/ 4 GET /index.php 2 POST /wp-login.php 2 POST / 2 HEAD /wp/ 2 HEAD /wordpress/ 2 HEAD /old/ 2 HEAD /new/ 2 HEAD /blog/ 2 HEAD /backup/ 2 HEAD / 2 GET /wp-includes/block-editor.php 2 GET /wp-includes/block-bindings.php 2 GET /wp-includes/ai-client.php 2 GET /wp-includes/abilities.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 5 GET /store/kids-custom-cookie-swoosh-muncher-af1/ 2 POST / 2 GET /store/kids-custom-af1-cookie-shoes/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/wp-content/plugins/woocommerce/assets/client/blocks/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks//wp-content/plugins/woocommerce/assets/client/blocks/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/cart-express-payment-block/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/cart-cross-sells-products-block/wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/cart-cross-sells-products-block//wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/cart-cross-sells-products-block/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/cart-cross-sells-block/wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/cart-cross-sells-block//wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/cart-cross-sells-block/ -- last 10 requests -- 114.119.159.70 - - [05/Sep/2026:07:39:23 +1000] "GET /store/kids-custom-af1-cookie-shoes/?wcpr_rating=4&rating=3&wcpr_verified=1 HTTP/1.1" 200 51838 "https://madalice.com.au/store/kids-custom-af1-cookie-shoes/?wcpr_ratin 139.28.219.70 - - [05/Sep/2026:07:39:24 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/cart-accepted-payment-methods-block//wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ 139.28.219.70 - - [05/Sep/2026:07:39:25 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/cart-accepted-payment-methods-block/wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ 139.28.219.70 - - [05/Sep/2026:07:39:27 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/cart-cross-sells-block/ HTTP/1.1" 200 333 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:39:27 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/cart-cross-sells-block//wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ HTTP/1.1" 30 139.28.219.70 - - [05/Sep/2026:07:39:29 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/cart-cross-sells-block/wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ HTTP/1.1" 404 139.28.219.70 - - [05/Sep/2026:07:39:31 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/cart-cross-sells-products-block/ HTTP/1.1" 200 338 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:39:31 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/cart-cross-sells-products-block//wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ HTT 139.28.219.70 - - [05/Sep/2026:07:39:33 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/cart-cross-sells-products-block/wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ HTTP 139.28.219.70 - - [05/Sep/2026:07:39:34 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/cart-express-payment-block/ HTTP/1.1" 200 332 "-" "-" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 50 GET /api/getItem/LWPG2001KG 2 GET /api/getItem/CLPBNSTD32250KK 1 GET /api/getItem/SHSG757520-SP25-8 1 GET /api/getItem/SHSG757520-DP25-8-DI 1 GET /api/getItem/SHSG757520-DP25-8 1 GET /api/getItem/SHSG656520-SP25-8 1 GET /api/getItem/SHSG656520-DP25-8-DI 1 GET /api/getItem/SHSG656520-DP25-8 1 GET /api/getItem/SHSG505016-SP25-8 1 GET /api/getItem/SHSG505016-SP19-8 1 GET /api/getItem/SHSG505016-DP25-8-DI 1 GET /api/getItem/SHSG505016-DP25-8 -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:07:39:16 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:39:16 +1000] "GET /api/getItem/CLHGNSTD40250KK HTTP/1.1" 200 1547 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:39:16 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:39:17 +1000] "GET /api/getItem/CLHGNSTD40315KK HTTP/1.1" 200 1544 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:39:17 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:39:17 +1000] "GET /api/getItem/CLHGNSTD45250KK HTTP/1.1" 200 1547 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:39:17 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:39:17 +1000] "GET /api/getItem/CLHGNSTD45315KK HTTP/1.1" 200 1545 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:39:18 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:39:18 +1000] "GET /api/getItem/CLHGNSTD50250KK HTTP/1.1" 200 1547 "-" "RestSharp/106.13.0.0" == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 2 POST /wp-login.php 2 GET /wp-includes/ 1 POST /wp-cron.php 1 GET /xex.php 1 GET /wp.php 1 GET /wp-includes/class-wp-block-metadata-registry.php 1 GET /wp-includes/class-wp-block-editor-context.php 1 GET /wp-includes/class-wp-block-bindings-source.php 1 GET /wp-includes/class-wp-block-bindings-registry.php 1 GET /wp-includes/class-avif-info.php 1 GET /wp-includes/block-template-utils.php 1 GET /wp-includes/block-template.php -- last 10 requests -- 4.204.224.164 - - [05/Sep/2026:07:39:24 +1000] "GET /ffile.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [05/Sep/2026:07:39:25 +1000] "GET /xex.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [05/Sep/2026:07:39:25 +1000] "GET /user-new.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [05/Sep/2026:07:39:26 +1000] "GET /flash-kiss.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [05/Sep/2026:07:39:26 +1000] "GET /k2.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [05/Sep/2026:07:39:26 +1000] "GET /ftde.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [05/Sep/2026:07:39:27 +1000] "GET /wp-blog.php HTTP/1.1" 401 36 "-" "-" 4.204.224.164 - - [05/Sep/2026:07:39:27 +1000] "GET /CAE-2.5.php HTTP/1.1" 401 36 "-" "-" 62.60.130.198 - - [05/Sep/2026:07:39:28 +1000] "GET /wp-includes/class-wp-block-metadata-registry.php HTTP/1.1" 200 - "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome 4.204.224.164 - - [05/Sep/2026:07:39:28 +1000] "GET /ass.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-09-05 07:37:31 L1=2.42 run=1 blk=1 avail=6275 (45.5%) swpO=0 conn=5 myRSS=2985 php=13 phpRSS=1449 ap=93 tcp=39 topuser=madalice 2026-09-05 07:37:33 L1=2.42 run=2 blk=1 avail=6137 (44.5%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1599 ap=91 tcp=38 topuser=madalice 2026-09-05 07:37:41 L1=2.27 run=3 blk=1 avail=6267 (45.5%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1528 ap=83 tcp=39 topuser=madalice 2026-09-05 07:37:43 L1=2.27 run=4 blk=1 avail=6240 (45.3%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1470 ap=81 tcp=36 topuser=madalice 2026-09-05 07:37:52 L1=2.15 run=2 blk=1 avail=6419 (46.6%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1448 ap=72 tcp=37 topuser=madalice 2026-09-05 07:37:53 L1=2.15 run=1 blk=1 avail=6426 (46.6%) swpO=0 conn=3 myRSS=2985 php=13 phpRSS=1448 ap=71 tcp=33 topuser=madalice 2026-09-05 07:38:02 L1=2.14 run=1 blk=1 avail=6556 (47.6%) swpO=0 conn=3 myRSS=2985 php=13 phpRSS=1376 ap=62 tcp=42 topuser=madalice 2026-09-05 07:38:03 L1=2.14 run=2 blk=1 avail=6394 (46.4%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1561 ap=61 tcp=41 topuser=madalice 2026-09-05 07:38:12 L1=1.96 run=2 blk=1 avail=6785 (49.2%) swpO=0 conn=3 myRSS=2985 php=13 phpRSS=1242 ap=52 tcp=44 topuser=madalice 2026-09-05 07:38:13 L1=1.96 run=2 blk=1 avail=6815 (49.5%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1219 ap=51 tcp=46 topuser=madalice 2026-09-05 07:38:22 L1=2.19 run=2 blk=1 avail=6782 (49.2%) swpO=7 conn=3 myRSS=2985 php=13 phpRSS=1292 ap=42 tcp=50 topuser=madalice 2026-09-05 07:38:23 L1=2.19 run=2 blk=1 avail=6736 (48.9%) swpO=7 conn=4 myRSS=2985 php=14 phpRSS=1375 ap=41 tcp=40 topuser=madalice 2026-09-05 07:38:32 L1=2.24 run=1 blk=1 avail=6842 (49.7%) swpO=1 conn=3 myRSS=2985 php=13 phpRSS=1309 ap=33 tcp=36 topuser=madalice 2026-09-05 07:38:33 L1=2.24 run=1 blk=1 avail=6872 (49.9%) swpO=1 conn=4 myRSS=2985 php=13 phpRSS=1287 ap=32 tcp=34 topuser=madalice 2026-09-05 07:38:42 L1=2.21 run=1 blk=1 avail=6929 (50.3%) swpO=0 conn=3 myRSS=2985 php=13 phpRSS=1278 ap=24 tcp=39 topuser=madalice 2026-09-05 07:38:43 L1=2.21 run=3 blk=1 avail=6833 (49.6%) swpO=0 conn=4 myRSS=2985 php=14 phpRSS=1410 ap=24 tcp=37 topuser=madalice 2026-09-05 07:38:52 L1=2.25 run=3 blk=1 avail=6833 (49.6%) swpO=0 conn=3 myRSS=2985 php=13 phpRSS=1382 ap=23 tcp=37 topuser=madalice 2026-09-05 07:38:53 L1=2.25 run=5 blk=1 avail=6748 (49.0%) swpO=0 conn=5 myRSS=2985 php=15 phpRSS=1538 ap=23 tcp=38 topuser=madalice 2026-09-05 07:39:02 L1=2.14 run=5 blk=2 avail=6620 (48.0%) swpO=0 conn=6 myRSS=2985 php=14 phpRSS=1594 ap=21 tcp=40 topuser=madalice 2026-09-05 07:39:03 L1=2.14 run=3 blk=2 avail=6627 (48.1%) swpO=0 conn=5 myRSS=2985 php=14 phpRSS=1485 ap=22 tcp=40 topuser=madalice 2026-09-05 07:39:12 L1=2.35 run=4 blk=1 avail=6577 (47.7%) swpO=0 conn=7 myRSS=2985 php=17 phpRSS=1756 ap=24 tcp=45 topuser=madalice 2026-09-05 07:39:14 L1=2.35 run=4 blk=1 avail=6709 (48.7%) swpO=0 conn=5 myRSS=2985 php=14 phpRSS=1520 ap=26 tcp=40 topuser=madalice 2026-09-05 07:39:22 L1=2.38 run=4 blk=1 avail=6812 (49.4%) swpO=0 conn=7 myRSS=2985 php=13 phpRSS=1386 ap=26 tcp=37 topuser=madalice 2026-09-05 07:39:24 L1=2.38 run=3 blk=1 avail=6653 (48.3%) swpO=0 conn=5 myRSS=2985 php=14 phpRSS=1582 ap=24 tcp=40 topuser=madalice 2026-09-05 07:39:32 L1=2.39 run=2 blk=1 avail=6554 (47.6%) swpO=2 conn=4 myRSS=2985 php=13 phpRSS=1679 ap=23 tcp=36 topuser=madalice 2026-09-05 07:39:34 L1=2.39 run=2 blk=1 avail=6552 (47.6%) swpO=2 conn=4 myRSS=2985 php=13 phpRSS=1686 ap=21 tcp=33 topuser=madalice 2026-09-05 07:39:42 L1=2.18 run=2 blk=1 avail=6592 (47.8%) swpO=2 conn=4 myRSS=2985 php=13 phpRSS=1669 ap=19 tcp=36 topuser=madalice 2026-09-05 07:39:44 L1=2.18 run=2 blk=1 avail=6576 (47.7%) swpO=2 conn=4 myRSS=2985 php=13 phpRSS=1686 ap=18 tcp=34 topuser=madalice 2026-09-05 07:39:52 L1=2.16 run=2 blk=1 avail=6632 (48.1%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1623 ap=18 tcp=36 topuser=madalice 2026-09-05 07:39:54 L1=2.16 run=4 blk=1 avail=6632 (48.1%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1626 ap=18 tcp=33 topuser=madalice