INCIDENT 2026-09-05 07:41:55 trigger: php_rss=1656MB ================================================================== load: 2.10 2.26 2.22 2/698 534940 ncpu:10 mem_avail: 6593MB/13777MB (47.9%) swap_used:2192MB swapout:0/s blocked(D):1 running:3 iowait:9.2% steal:0.0% php: 13 procs / 1656MB heaviest user: madalice (9 procs, 1524MB) apache: 19 procs tcp_estab: 30 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2985 madalice 9 1531 root 251 1408 nobody 18 330 netdata 8 259 evolution 11 124 dovenull 6 65 wp-toolkit 3 53 infinium 2 28 kurri 2 27 dovecot 3 27 mailman 20 26 cpanellogin 1 24 mailnull 4 19 lowrange 1 15 aaa 1 14 zabbix 1 10 polkitd 1 7 named 1 5 nscd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 9 1533 evolution 3 103 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5757 MB Active(file): 3994 MB Inactive(file): 1835 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 548 MB CommitLimit: 10984 MB Committed_AS: 8892 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 4-05:19:29 4832 /usr/bin/imunify-agent-proxy 4109079 root 02:57:07 3136 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 02:57:07 541736 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3057020 11.8 Ssl 2-17:27:44 /usr/sbin/mariadbd 4109105 4109079 root 541736 8.4 Sl 02:57:07 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 424515 2601907 madalice 216208 7.9 R 29:39 php-fpm: pool madalice_com_au 1542443 1 netdata 193320 2.6 Ssl 2-05:19:34 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 424516 2601907 madalice 179616 7.7 S 29:39 php-fpm: pool madalice_com_au 424514 2601907 madalice 179212 7.6 S 29:39 php-fpm: pool madalice_com_au 424518 2601907 madalice 178696 7.4 S 29:38 php-fpm: pool madalice_com_au 496129 2601907 madalice 176988 7.3 S 11:17 php-fpm: pool madalice_com_au 3643624 3626973 root 168568 0.0 S 05:15:06 spamd child 424513 2601907 madalice 163328 7.0 S 29:39 php-fpm: pool madalice_com_au 424517 2601907 madalice 162004 7.2 S 29:38 php-fpm: pool madalice_com_au 495842 2601907 madalice 160936 7.3 S 11:40 php-fpm: pool madalice_com_au 515304 2601907 madalice 160704 7.4 S 05:29 php-fpm: pool madalice_com_au 3626973 1 root 128508 0.0 Ss 05:18:41 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3643625 3626973 root 90524 0.0 S 05:15:06 spamd child 509236 509098 root 61236 0.0 Sl 8-05:22:15 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3127357 3127312 evolution 54536 0.0 Ss 07:41:55 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3127358 3127320 evolution 51348 0.0 Ss 07:41:55 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509266 1 root 45508 0.0 Ss 8-05:22:15 /usr/lib/systemd/systemd-journald 1353308 1 root 41880 0.1 Ss 45-05:00:41 cpsrvd (SSL) - waiting for connections 1542981 1542551 netdata 41144 0.1 Sl 2-05:19:30 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 34544 0.1 Ss 67-21:32:10 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542487 1 wp-toolkit 29348 0.0 Ss 2-05:19:34 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28692 0.0 Ss 1-05:18:30 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3626082 1 root 27880 0.0 Ss 05:19:41 lfd - sleeping 498558 1353308 cpanellogin 25476 0.0 S 08:01 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 1463 1 root 24096 0.0 Ss 67-21:32:10 tailwatchd 516315 506832 nobody 22956 0.1 S 04:52 /usr/sbin/httpd -k start 516235 506832 nobody 22600 0.0 S 04:54 /usr/sbin/httpd -k start 516241 506832 nobody 22576 0.0 S 04:54 /usr/sbin/httpd -k start 516321 506832 nobody 22492 0.0 S 04:52 /usr/sbin/httpd -k start 518290 506832 nobody 21992 0.0 S 02:43 /usr/sbin/httpd -k start 518214 506832 nobody 21764 0.1 S 02:48 /usr/sbin/httpd -k start 516306 506832 nobody 21552 0.0 S 04:53 /usr/sbin/httpd -k start 533884 506832 nobody 21260 0.1 S 01:13 /usr/sbin/httpd -k start 533814 506832 nobody 20252 0.0 S 01:14 /usr/sbin/httpd -k start 533880 506832 nobody 20192 0.0 S 01:13 /usr/sbin/httpd -k start 533538 506832 nobody 20024 0.0 S 01:38 /usr/sbin/httpd -k start 533882 506832 nobody 19908 0.0 S 01:13 /usr/sbin/httpd -k start 533891 506832 nobody 19348 0.0 S 01:13 /usr/sbin/httpd -k start 2602226 1 root 19316 0.1 Ssl 1-05:18:15 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1542531 1 wp-toolkit 19264 0.0 Ss 2-05:19:33 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 533819 506832 nobody 19124 0.0 S 01:14 /usr/sbin/httpd -k start 533883 506832 nobody 18960 0.2 S 01:13 /usr/sbin/httpd -k start 1542982 1542551 netdata 18552 2.2 Sl 2-05:19:30 /usr/libexec/netdata/plugins.d/apps.plugin 1 533793 506832 nobody 18480 0.0 S 01:15 /usr/sbin/httpd -k start 306499 1471 root 16400 0.0 S 01:02:52 cPhulkd - dbprocessor 1542141 1 root 15420 0.0 Ss 2-05:19:37 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 3539428 508511 lowrange 15372 0.0 S 05:45:48 dovecot/imap 534505 508511 aaa 14972 0.0 S 00:39 dovecot/imap 518245 1471 root 14940 0.0 S 02:44 cPhulkd - processor - http socket 1471 1 root 14864 0.0 Ss 67-21:32:10 cPhulkd - processor 373493 508511 infinium 14744 0.0 S 44:56 dovecot/imap 425142 508511 infinium 14596 0.0 S 29:18 dovecot/imap 534908 508511 kurri 14488 0.0 S 00:02 dovecot/imap 3141944 508511 kurri 13864 0.0 S 07:41:33 dovecot/imap 690505 508511 dovenull 13276 0.0 S 19:09:06 dovecot/imap-login 690514 508511 dovecot 13276 0.0 S 19:09:06 dovecot/auth 690509 508511 dovenull 13068 0.0 S 19:09:06 dovecot/imap-login 534468 508511 root 12968 0.0 S 00:41 dovecot/auth -w --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10751267 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min kamcool/kamcool.com.au-ssl_log 258 evolution/app.evolutionerp.com.au-ssl_log 168 madalice/madalice.com.au-ssl_log 156 tubesupplies/tubesupplies.com.au-ssl_log 63 lowrange/lowrange.com.au-ssl_log 35 olympic/olympicfencing.com.au-ssl_log 14 tubesupplies/tubesupplies.com.au 12 evolution/portal.evolutionerp.com.au-ssl_log 7 aaa/aaadownunder.com.au-ssl_log 6 nrg/nrgservices.net.au-ssl_log 2 evolution/evolutionerp.com.au-ssl_log 1 vinesit/vinesit.com.au-ssl_log 1 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 258 18.143.183.113 168 40.115.94.245 145 139.28.219.70 60 4.204.224.164 35 195.178.110.22 15 62.60.130.198 13 34.181.250.80 7 203.54.180.238 3 85.206.128.219 3 31.129.170.42 2 205.210.31.53 2 118.127.40.55 2 114.119.159.70 1 5.36.236.239 1 49.180.12.75 --- top request paths across all vhosts (last 3 min) --- 58 GET /api/getItem/LWHG2001KG 44 GET /api/getItem/LWFBW2001KG 41 GET /api/getItem/LWPG2001KG 8 GET /store/kids-custom-af1-cookie-shoes/ 7 GET /heartbeat.php 5 POST / 5 GET / 4 GET /api/getItem/PWFBW3151KG 2 POST /wp-cron.php 2 HEAD /wp/ 2 HEAD /old/ 2 HEAD /new/ 2 HEAD /blog/ 2 HEAD /backup/ 2 HEAD / 2 GET /wp-includes/class-wp-block-metadata-registry.php 2 GET /wp-includes/class-wp-block-editor-context.php 2 GET /wp-includes/class-wp-block-bindings-source.php 2 GET /backup.zip 1 HEAD /wordpress/ --- busiest 3 vhosts: top paths + last 10 requests --- == kamcool/kamcool.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env -- last 10 requests -- 18.143.183.113 - - [05/Sep/2026:07:41:30 +1000] "GET /beta/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.143.183.113 - - [05/Sep/2026:07:41:31 +1000] "GET /uat/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.143.183.113 - - [05/Sep/2026:07:41:31 +1000] "GET /qa/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.143.183.113 - - [05/Sep/2026:07:41:31 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.143.183.113 - - [05/Sep/2026:07:41:32 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.143.183.113 - - [05/Sep/2026:07:41:32 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.143.183.113 - - [05/Sep/2026:07:41:32 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.143.183.113 - - [05/Sep/2026:07:41:32 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.143.183.113 - - [05/Sep/2026:07:41:33 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.143.183.113 - - [05/Sep/2026:07:41:33 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 58 GET /api/getItem/LWHG2001KG 44 GET /api/getItem/LWFBW2001KG 41 GET /api/getItem/LWPG2001KG 4 GET /api/getItem/PWFBW3151KG 1 GET /api/getItem/CLSGNSTD32350KK 1 GET /api/getItem/CLPGNSTD50315KK 1 GET /api/getItem/CLPGNSTD50250KK 1 GET /api/getItem/CLPGNSTD45315KK 1 GET /api/getItem/CLPGNSTD45250KK 1 GET /api/getItem/CLPGNSTD40315KK 1 GET /api/getItem/CLPGNSTD40250KK 1 GET /api/getItem/CLPGNSTD32315KK -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:07:41:41 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:41:41 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:41:41 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:41:41 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:41:41 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:41:41 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:41:42 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:41:42 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:41:42 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:41:42 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" == madalice/madalice.com.au-ssl_log == -- top paths -- 8 GET /store/kids-custom-af1-cookie-shoes/ 1 POST / 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/wp-content/plugins/woocommerce/assets/client/blocks/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks//wp-content/plugins/woocommerce/assets/client/blocks/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/filled-cart-block/wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/filled-cart-block//wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/filled-cart-block/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/empty-mini-cart-contents-block/wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/empty-mini-cart-contents-block//wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/empty-mini-cart-contents-block/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/empty-cart-block/wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ 1 GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/empty-cart-block//wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ -- last 10 requests -- 139.28.219.70 - - [05/Sep/2026:07:41:37 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/checkout-totals-block//wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ HTTP/1.1" 301 139.28.219.70 - - [05/Sep/2026:07:41:38 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/checkout-totals-block/wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ HTTP/1.1" 404 139.28.219.70 - - [05/Sep/2026:07:41:40 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/empty-cart-block//wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ HTTP/1.1" 301 1 "- 139.28.219.70 - - [05/Sep/2026:07:41:41 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/empty-cart-block/wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ HTTP/1.1" 404 36668 139.28.219.70 - - [05/Sep/2026:07:41:43 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/empty-mini-cart-contents-block/ HTTP/1.1" 200 334 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:41:43 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/empty-mini-cart-contents-block//wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ HTTP 139.28.219.70 - - [05/Sep/2026:07:41:44 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/empty-mini-cart-contents-block/wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ HTTP/ 139.28.219.70 - - [05/Sep/2026:07:41:46 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/filled-cart-block/ HTTP/1.1" 200 330 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:41:46 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/filled-cart-block//wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ HTTP/1.1" 301 1 " 139.28.219.70 - - [05/Sep/2026:07:41:48 +1000] "GET /wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/filled-cart-block/wp-content/plugins/woocommerce/assets/client/blocks/inner-blocks/ HTTP/1.1" 404 3667 --- last 30 samples (run-up to this incident) --- 2026-09-05 07:39:32 L1=2.39 run=2 blk=1 avail=6554 (47.6%) swpO=2 conn=4 myRSS=2985 php=13 phpRSS=1679 ap=23 tcp=36 topuser=madalice 2026-09-05 07:39:34 L1=2.39 run=2 blk=1 avail=6552 (47.6%) swpO=2 conn=4 myRSS=2985 php=13 phpRSS=1686 ap=21 tcp=33 topuser=madalice 2026-09-05 07:39:42 L1=2.18 run=2 blk=1 avail=6592 (47.8%) swpO=2 conn=4 myRSS=2985 php=13 phpRSS=1669 ap=19 tcp=36 topuser=madalice 2026-09-05 07:39:44 L1=2.18 run=2 blk=1 avail=6576 (47.7%) swpO=2 conn=4 myRSS=2985 php=13 phpRSS=1686 ap=18 tcp=34 topuser=madalice 2026-09-05 07:39:52 L1=2.16 run=2 blk=1 avail=6632 (48.1%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1623 ap=18 tcp=36 topuser=madalice 2026-09-05 07:39:54 L1=2.16 run=4 blk=1 avail=6632 (48.1%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1626 ap=18 tcp=33 topuser=madalice 2026-09-05 07:40:02 L1=2.21 run=3 blk=1 avail=6592 (47.9%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1618 ap=18 tcp=36 topuser=madalice 2026-09-05 07:40:04 L1=2.19 run=3 blk=1 avail=6615 (48.0%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1622 ap=18 tcp=32 topuser=madalice 2026-09-05 07:40:12 L1=2.17 run=1 blk=1 avail=6624 (48.1%) swpO=0 conn=3 myRSS=2985 php=13 phpRSS=1619 ap=18 tcp=36 topuser=madalice 2026-09-05 07:40:14 L1=2.08 run=1 blk=1 avail=6626 (48.1%) swpO=0 conn=3 myRSS=2985 php=13 phpRSS=1619 ap=18 tcp=35 topuser=madalice 2026-09-05 07:40:23 L1=1.99 run=2 blk=1 avail=6599 (47.9%) swpO=0 conn=4 myRSS=2985 php=14 phpRSS=1667 ap=19 tcp=38 topuser=madalice 2026-09-05 07:40:24 L1=2.47 run=3 blk=1 avail=6562 (47.6%) swpO=0 conn=5 myRSS=2985 php=14 phpRSS=1695 ap=20 tcp=42 topuser=madalice 2026-09-05 07:40:33 L1=2.76 run=1 blk=1 avail=6601 (47.9%) swpO=0 conn=3 myRSS=2985 php=13 phpRSS=1619 ap=21 tcp=38 topuser=madalice 2026-09-05 07:40:34 L1=2.70 run=2 blk=1 avail=6597 (47.9%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1622 ap=21 tcp=35 topuser=madalice 2026-09-05 07:40:43 L1=2.56 run=5 blk=1 avail=6351 (46.1%) swpO=0 conn=5 myRSS=2985 php=13 phpRSS=1668 ap=52 tcp=61 topuser=madalice 2026-09-05 07:40:44 L1=2.68 run=3 blk=1 avail=6383 (46.3%) swpO=2 conn=5 myRSS=2985 php=13 phpRSS=1655 ap=51 tcp=51 topuser=madalice 2026-09-05 07:40:53 L1=2.62 run=3 blk=1 avail=6383 (46.3%) swpO=2 conn=5 myRSS=2985 php=13 phpRSS=1701 ap=43 tcp=37 topuser=madalice 2026-09-05 07:40:54 L1=2.57 run=2 blk=1 avail=6481 (47.0%) swpO=2 conn=4 myRSS=2985 php=13 phpRSS=1629 ap=41 tcp=32 topuser=madalice 2026-09-05 07:41:03 L1=2.45 run=2 blk=1 avail=6531 (47.4%) swpO=2 conn=4 myRSS=2985 php=13 phpRSS=1621 ap=33 tcp=33 topuser=madalice 2026-09-05 07:41:05 L1=2.57 run=3 blk=1 avail=6497 (47.2%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1672 ap=31 tcp=31 topuser=madalice 2026-09-05 07:41:13 L1=2.52 run=2 blk=1 avail=6398 (46.4%) swpO=0 conn=4 myRSS=2985 php=14 phpRSS=1850 ap=23 tcp=34 topuser=madalice 2026-09-05 07:41:15 L1=2.40 run=2 blk=1 avail=6605 (47.9%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1625 ap=22 tcp=33 topuser=madalice 2026-09-05 07:41:23 L1=2.29 run=3 blk=1 avail=6566 (47.7%) swpO=0 conn=4 myRSS=2985 php=14 phpRSS=1697 ap=20 tcp=37 topuser=madalice 2026-09-05 07:41:25 L1=2.19 run=3 blk=1 avail=6601 (47.9%) swpO=0 conn=4 myRSS=2985 php=14 phpRSS=1668 ap=20 tcp=34 topuser=madalice 2026-09-05 07:41:33 L1=2.09 run=1 blk=1 avail=6624 (48.1%) swpO=0 conn=3 myRSS=2985 php=13 phpRSS=1620 ap=19 tcp=34 topuser=madalice 2026-09-05 07:41:35 L1=2.16 run=4 blk=1 avail=6550 (47.5%) swpO=0 conn=5 myRSS=2985 php=13 phpRSS=1695 ap=19 tcp=35 topuser=madalice 2026-09-05 07:41:43 L1=2.15 run=1 blk=1 avail=6625 (48.1%) swpO=0 conn=3 myRSS=2985 php=13 phpRSS=1619 ap=19 tcp=32 topuser=madalice 2026-09-05 07:41:45 L1=2.30 run=2 blk=1 avail=6616 (48.0%) swpO=0 conn=4 myRSS=2985 php=14 phpRSS=1648 ap=19 tcp=33 topuser=madalice 2026-09-05 07:41:53 L1=2.19 run=4 blk=1 avail=6459 (46.9%) swpO=0 conn=5 myRSS=2985 php=14 phpRSS=1815 ap=19 tcp=34 topuser=madalice 2026-09-05 07:41:55 L1=2.10 run=3 blk=1 avail=6593 (47.9%) swpO=0 conn=4 myRSS=2985 php=13 phpRSS=1656 ap=19 tcp=30 topuser=madalice