INCIDENT 2026-09-05 07:40:54 trigger: php_rss=1629MB ================================================================== load: 2.57 2.36 2.25 2/720 534083 ncpu:10 mem_avail: 6481MB/13777MB (47.0%) swap_used:2192MB swapout:2/s blocked(D):1 running:2 iowait:9.8% steal:0.0% php: 13 procs / 1629MB heaviest user: madalice (9 procs, 1497MB) apache: 41 procs tcp_estab: 32 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2985 madalice 9 1504 root 250 1395 nobody 40 684 netdata 8 259 evolution 11 124 dovenull 6 65 wp-toolkit 3 53 infinium 2 28 kurri 2 27 dovecot 3 27 mailman 20 26 cpanellogin 1 24 lowrange 1 15 aaa 1 15 mailnull 3 11 zabbix 1 10 cpanelphpmyadmin 1 10 polkitd 1 7 named 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 9 1505 evolution 3 103 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5632 MB Active(file): 3869 MB Inactive(file): 1833 MB Dirty: 3 MB Writeback: 0 MB SReclaimable: 548 MB CommitLimit: 10984 MB Committed_AS: 9292 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 4-05:18:28 4832 /usr/bin/imunify-agent-proxy 4109079 root 02:56:06 3136 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 02:56:06 541736 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3056968 11.8 Ssl 2-17:26:43 /usr/sbin/mariadbd 4109105 4109079 root 541736 8.5 Sl 02:56:06 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1542443 1 netdata 193512 2.6 Ssl 2-05:18:33 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 495842 2601907 madalice 186564 7.3 R 10:39 php-fpm: pool madalice_com_au 424516 2601907 madalice 179604 7.8 S 28:38 php-fpm: pool madalice_com_au 424514 2601907 madalice 179116 7.6 S 28:38 php-fpm: pool madalice_com_au 424518 2601907 madalice 178024 7.4 S 28:37 php-fpm: pool madalice_com_au 496129 2601907 madalice 177104 7.3 S 10:16 php-fpm: pool madalice_com_au 3643624 3626973 root 168568 0.0 S 05:14:05 spamd child 424515 2601907 madalice 163128 7.9 S 28:38 php-fpm: pool madalice_com_au 424513 2601907 madalice 162876 6.9 S 28:38 php-fpm: pool madalice_com_au 424517 2601907 madalice 161904 7.2 S 28:37 php-fpm: pool madalice_com_au 515304 2601907 madalice 160792 7.5 S 04:28 php-fpm: pool madalice_com_au 3626973 1 root 128508 0.0 Ss 05:17:40 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3643625 3626973 root 90524 0.0 S 05:14:05 spamd child 509236 509098 root 61236 0.0 Sl 8-05:21:14 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3127357 3127312 evolution 54536 0.0 Ss 07:40:54 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3127358 3127320 evolution 51348 0.0 Ss 07:40:54 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509266 1 root 45508 0.0 Ss 8-05:21:14 /usr/lib/systemd/systemd-journald 1353308 1 root 41880 0.1 Ss 45-04:59:40 cpsrvd (SSL) - waiting for connections 1542981 1542551 netdata 41144 0.1 Sl 2-05:18:29 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 34544 0.1 Ss 67-21:31:09 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542487 1 wp-toolkit 29348 0.0 Ss 2-05:18:33 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28692 0.0 Ss 1-05:17:29 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3626082 1 root 27880 0.0 Ss 05:18:40 lfd - sleeping 498558 1353308 cpanellogin 25476 0.0 S 07:00 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 1463 1 root 24096 0.0 Ss 67-21:31:09 tailwatchd 497486 506832 nobody 22908 0.0 S 08:34 /usr/sbin/httpd -k start 516235 506832 nobody 22588 0.0 S 03:53 /usr/sbin/httpd -k start 516241 506832 nobody 22384 0.0 S 03:53 /usr/sbin/httpd -k start 516315 506832 nobody 22356 0.0 S 03:51 /usr/sbin/httpd -k start 516333 506832 nobody 22216 0.0 S 03:51 /usr/sbin/httpd -k start 516321 506832 nobody 22196 0.0 S 03:51 /usr/sbin/httpd -k start 516292 506832 nobody 21968 0.0 S 03:52 /usr/sbin/httpd -k start 518248 506832 nobody 21824 0.0 S 01:43 /usr/sbin/httpd -k start 518290 506832 nobody 21800 0.1 S 01:42 /usr/sbin/httpd -k start 518214 506832 nobody 21404 0.1 S 01:47 /usr/sbin/httpd -k start 516306 506832 nobody 20380 0.0 S 03:52 /usr/sbin/httpd -k start 518151 506832 nobody 20132 0.0 S 01:52 /usr/sbin/httpd -k start 533591 506832 nobody 20112 0.0 S 00:31 /usr/sbin/httpd -k start 533538 506832 nobody 19660 0.0 S 00:37 /usr/sbin/httpd -k start 2602226 1 root 19316 0.1 Ssl 1-05:17:14 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1542531 1 wp-toolkit 19264 0.0 Ss 2-05:18:32 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 533779 506832 nobody 18844 0.0 S 00:16 /usr/sbin/httpd -k start 518291 506832 nobody 18752 0.0 S 01:42 /usr/sbin/httpd -k start 1542982 1542551 netdata 18552 2.2 Sl 2-05:18:29 /usr/libexec/netdata/plugins.d/apps.plugin 1 533876 506832 nobody 18468 0.0 S 00:12 /usr/sbin/httpd -k start 533884 506832 nobody 18404 0.0 S 00:12 /usr/sbin/httpd -k start 533820 506832 nobody 18292 0.0 S 00:13 /usr/sbin/httpd -k start 533877 506832 nobody 18188 0.0 S 00:12 /usr/sbin/httpd -k start 533891 506832 nobody 18184 0.0 S 00:12 /usr/sbin/httpd -k start 533882 506832 nobody 18180 0.0 S 00:12 /usr/sbin/httpd -k start 533818 506832 nobody 17340 0.0 S 00:13 /usr/sbin/httpd -k start 533886 506832 nobody 17300 0.0 S 00:12 /usr/sbin/httpd -k start 533880 506832 nobody 16596 0.0 S 00:12 /usr/sbin/httpd -k start 533889 506832 nobody 16584 0.0 S 00:12 /usr/sbin/httpd -k start 306499 1471 root 16400 0.0 S 01:01:51 cPhulkd - dbprocessor 533793 506832 nobody 16320 0.0 S 00:14 /usr/sbin/httpd -k start 533814 506832 nobody 16320 0.0 S 00:13 /usr/sbin/httpd -k start 533816 506832 nobody 16320 0.0 S 00:13 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10750816 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 173 evolution/app.evolutionerp.com.au-ssl_log 163 kamcool/kamcool.com.au-ssl_log 119 tubesupplies/tubesupplies.com.au-ssl_log 73 olympic/olympicfencing.com.au-ssl_log 17 evolution/portal.evolutionerp.com.au-ssl_log 13 evolution/evolutionerp.com.au-ssl_log 12 aaa/aaadownunder.com.au-ssl_log 8 tubesupplies/tubesupplies.com.au 1 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 163 40.115.94.245 163 139.28.219.70 119 18.143.183.113 62 4.204.224.164 14 34.181.250.80 13 203.54.180.238 9 62.60.130.198 9 136.124.35.100 7 118.127.40.55 3 85.206.128.219 3 31.129.170.42 2 91.92.243.248 2 205.210.31.53 2 114.119.159.70 2 114.119.130.40 --- top request paths across all vhosts (last 3 min) --- 71 GET /api/getItem/LWPG2001KG 25 GET /api/getItem/LWHG2001KG 13 GET /heartbeat.php 11 GET /api/getItem/LWFBW2001KG 7 POST /wp-cron.php 6 GET / 5 POST / 5 GET /store/kids-custom-af1-cookie-shoes/ 4 GET /api/getItem/PWFBW3151KG 2 POST /wp-login.php 2 HEAD /wp/ 2 HEAD /wordpress/ 2 HEAD /old/ 2 HEAD /new/ 2 HEAD /blog/ 2 HEAD /backup/ 2 HEAD / 2 GET /wp-includes/block-editor.php 2 GET /store/kids-custom-cookie-swoosh-muncher-af1/ 2 GET /api/getItem/CLPBNSTD32250KK --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 5 GET /store/kids-custom-af1-cookie-shoes/ 2 GET /store/kids-custom-cookie-swoosh-muncher-af1/ 1 POST / 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/wp-content/plugins/woocommerce/assets/client/blocks/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks//wp-content/plugins/woocommerce/assets/client/blocks/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/checkout-order-summary-coupon-form-block/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/checkout-order-summary-cart-items-block/wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/checkout-order-summary-cart-items-block//wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/checkout-order-summary-cart-items-block/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/checkout-order-summary-block/wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/checkout-order-summary-block//wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/checkout-order-summary-block/ -- last 10 requests -- 139.28.219.70 - - [05/Sep/2026:07:40:42 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/checkout-order-note-block//wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ HTTP/1.1" 85.206.128.219 - - [05/Sep/2026:07:40:44 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 601 "https://madalice.com.au/tag/leaf/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Headle 139.28.219.70 - - [05/Sep/2026:07:40:44 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/checkout-order-note-block/wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ HTTP/1.1" 139.28.219.70 - - [05/Sep/2026:07:40:45 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/checkout-order-summary-block/ HTTP/1.1" 200 335 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:40:46 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/checkout-order-summary-block//wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ HTTP/1 139.28.219.70 - - [05/Sep/2026:07:40:47 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/checkout-order-summary-block/wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ HTTP/1. 139.28.219.70 - - [05/Sep/2026:07:40:49 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/checkout-order-summary-cart-items-block/ HTTP/1.1" 200 340 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:40:49 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/checkout-order-summary-cart-items-block//wp-content/plugins/woocommerce/assets/client/blocks/inner-blo 139.28.219.70 - - [05/Sep/2026:07:40:50 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/checkout-order-summary-cart-items-block/wp-content/plugins/woocommerce/assets/client/blocks/inner-bloc 139.28.219.70 - - [05/Sep/2026:07:40:52 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/checkout-order-summary-coupon-form-block/ HTTP/1.1" 200 340 "-" "-" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 71 GET /api/getItem/LWPG2001KG 25 GET /api/getItem/LWHG2001KG 11 GET /api/getItem/LWFBW2001KG 4 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/CLPBNSTD32250KK 1 GET /api/getItem/SHSG757520-SP25-8 1 GET /api/getItem/SHSG757520-DP25-8-DI 1 GET /api/getItem/SHSG757520-DP25-8 1 GET /api/getItem/SHSG656520-SP25-8 1 GET /api/getItem/SHSG656520-DP25-8-DI 1 GET /api/getItem/SHSG656520-DP25-8 1 GET /api/getItem/SHSG505016-SP25-8 -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:07:40:28 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:40:29 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:40:29 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:40:29 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:40:29 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:40:29 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:40:29 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:40:30 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:40:30 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:40:30 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" == kamcool/kamcool.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/.env 1 GET /wp/.env 1 GET /wordpress/.env 1 GET /web/.env 1 GET /vendor/.env 1 GET /var/www/html/.env 1 GET /var/www/.env 1 GET /v3/.env 1 GET /v2/.env -- last 10 requests -- 18.143.183.113 - - [05/Sep/2026:07:40:49 +1000] "GET /bin/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.143.183.113 - - [05/Sep/2026:07:40:49 +1000] "GET /sbin/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.143.183.113 - - [05/Sep/2026:07:40:49 +1000] "GET /local/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.143.183.113 - - [05/Sep/2026:07:40:50 +1000] "GET /portal/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.143.183.113 - - [05/Sep/2026:07:40:50 +1000] "GET /dashboard/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.143.183.113 - - [05/Sep/2026:07:40:50 +1000] "GET /panel/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.143.183.113 - - [05/Sep/2026:07:40:51 +1000] "GET /crm/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.143.183.113 - - [05/Sep/2026:07:40:51 +1000] "GET /erp/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.143.183.113 - - [05/Sep/2026:07:40:51 +1000] "GET /shop/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.143.183.113 - - [05/Sep/2026:07:40:51 +1000] "GET /store/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-05 07:38:32 L1=2.24 run=1 blk=1 avail=6842 (49.7%) swpO=1 conn=3 myRSS=2985 php=13 phpRSS=1309 ap=33 tcp=36 topuser=madalice 2026-09-05 07:38:33 L1=2.24 run=1 blk=1 avail=6872 (49.9%) swpO=1 conn=4 myRSS=2985 php=13 phpRSS=1287 ap=32 tcp=34 topuser=madalice 2026-09-05 07:38:42 L1=2.21 run=1 blk=1 avail=6929 (50.3%) swpO=0 conn=3 myRSS=2985 php=13 phpRSS=1278 ap=24 tcp=39 topuser=madalice 2026-09-05 07:38:43 L1=2.21 run=3 blk=1 avail=6833 (49.6%) swpO=0 conn=4 myRSS=2985 php=14 phpRSS=1410 ap=24 tcp=37 topuser=madalice 2026-09-05 07:38:52 L1=2.25 run=3 blk=1 avail=6833 (49.6%) swpO=0 conn=3 myRSS=2985 php=13 phpRSS=1382 ap=23 tcp=37 topuser=madalice 2026-09-05 07:38:53 L1=2.25 run=5 blk=1 avail=6748 (49.0%) swpO=0 conn=5 myRSS=2985 php=15 phpRSS=1538 ap=23 tcp=38 topuser=madalice 2026-09-05 07:39:02 L1=2.14 run=5 blk=2 avail=6620 (48.0%) swpO=0 conn=6 myRSS=2985 php=14 phpRSS=1594 ap=21 tcp=40 topuser=madalice 2026-09-05 07:39:03 L1=2.14 run=3 blk=2 avail=6627 (48.1%) swpO=0 conn=5 myRSS=2985 php=14 phpRSS=1485 ap=22 tcp=40 topuser=madalice 2026-09-05 07:39:12 L1=2.35 run=4 blk=1 avail=6577 (47.7%) swpO=0 conn=7 myRSS=2985 php=17 phpRSS=1756 ap=24 tcp=45 topuser=madalice 2026-09-05 07:39:14 L1=2.35 run=4 blk=1 avail=6709 (48.7%) swpO=0 conn=5 myRSS=2985 php=14 phpRSS=1520 ap=26 tcp=40 topuser=madalice 2026-09-05 07:39:22 L1=2.38 run=4 blk=1 avail=6812 (49.4%) swpO=0 conn=7 myRSS=2985 php=13 phpRSS=1386 ap=26 tcp=37 topuser=madalice 2026-09-05 07:39:24 L1=2.38 run=3 blk=1 avail=6653 (48.3%) swpO=0 conn=5 myRSS=2985 php=14 phpRSS=1582 ap=24 tcp=40 topuser=madalice 2026-09-05 07:39:32 L1=2.39 run=2 blk=1 avail=6554 (47.6%) swpO=2 conn=4 myRSS=2985 php=13 phpRSS=1679 ap=23 tcp=36 topuser=madalice 2026-09-05 07:39:34 L1=2.39 run=2 blk=1 avail=6552 (47.6%) swpO=2 conn=4 myRSS=2985 php=13 phpRSS=1686 ap=21 tcp=33 topuser=madalice 2026-09-05 07:39:42 L1=2.18 run=2 blk=1 avail=6592 (47.8%) swpO=2 conn=4 myRSS=2985 php=13 phpRSS=1669 ap=19 tcp=36 topuser=madalice 2026-09-05 07:39:44 L1=2.18 run=2 blk=1 avail=6576 (47.7%) swpO=2 conn=4 myRSS=2985 php=13 phpRSS=1686 ap=18 tcp=34 topuser=madalice 2026-09-05 07:39:52 L1=2.16 run=2 blk=1 avail=6632 (48.1%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1623 ap=18 tcp=36 topuser=madalice 2026-09-05 07:39:54 L1=2.16 run=4 blk=1 avail=6632 (48.1%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1626 ap=18 tcp=33 topuser=madalice 2026-09-05 07:40:02 L1=2.21 run=3 blk=1 avail=6592 (47.9%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1618 ap=18 tcp=36 topuser=madalice 2026-09-05 07:40:04 L1=2.19 run=3 blk=1 avail=6615 (48.0%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1622 ap=18 tcp=32 topuser=madalice 2026-09-05 07:40:12 L1=2.17 run=1 blk=1 avail=6624 (48.1%) swpO=0 conn=3 myRSS=2985 php=13 phpRSS=1619 ap=18 tcp=36 topuser=madalice 2026-09-05 07:40:14 L1=2.08 run=1 blk=1 avail=6626 (48.1%) swpO=0 conn=3 myRSS=2985 php=13 phpRSS=1619 ap=18 tcp=35 topuser=madalice 2026-09-05 07:40:23 L1=1.99 run=2 blk=1 avail=6599 (47.9%) swpO=0 conn=4 myRSS=2985 php=14 phpRSS=1667 ap=19 tcp=38 topuser=madalice 2026-09-05 07:40:24 L1=2.47 run=3 blk=1 avail=6562 (47.6%) swpO=0 conn=5 myRSS=2985 php=14 phpRSS=1695 ap=20 tcp=42 topuser=madalice 2026-09-05 07:40:33 L1=2.76 run=1 blk=1 avail=6601 (47.9%) swpO=0 conn=3 myRSS=2985 php=13 phpRSS=1619 ap=21 tcp=38 topuser=madalice 2026-09-05 07:40:34 L1=2.70 run=2 blk=1 avail=6597 (47.9%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1622 ap=21 tcp=35 topuser=madalice 2026-09-05 07:40:43 L1=2.56 run=5 blk=1 avail=6351 (46.1%) swpO=0 conn=5 myRSS=2985 php=13 phpRSS=1668 ap=52 tcp=61 topuser=madalice 2026-09-05 07:40:44 L1=2.68 run=3 blk=1 avail=6383 (46.3%) swpO=2 conn=5 myRSS=2985 php=13 phpRSS=1655 ap=51 tcp=51 topuser=madalice 2026-09-05 07:40:53 L1=2.62 run=3 blk=1 avail=6383 (46.3%) swpO=2 conn=5 myRSS=2985 php=13 phpRSS=1701 ap=43 tcp=37 topuser=madalice 2026-09-05 07:40:54 L1=2.57 run=2 blk=1 avail=6481 (47.0%) swpO=2 conn=4 myRSS=2985 php=13 phpRSS=1629 ap=41 tcp=32 topuser=madalice