INCIDENT 2026-09-05 07:53:08 trigger: php_rss=1885MB ================================================================== load: 2.57 2.15 2.12 6/706 571559 ncpu:10 mem_avail: 6417MB/13777MB (46.6%) swap_used:2204MB swapout:4/s blocked(D):1 running:5 iowait:9.5% steal:0.0% php: 15 procs / 1885MB heaviest user: madalice (9 procs, 1392MB) apache: 24 procs tcp_estab: 47 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2979 madalice 9 1395 root 249 1378 nobody 23 422 corpkicks 2 376 netdata 8 258 evolution 11 123 alison 4 85 dovenull 6 65 wp-toolkit 3 53 cpanellogin 1 53 mailnull 5 28 kurri 2 27 dovecot 3 27 mailman 20 26 lowrange 1 15 aaa 1 15 zabbix 1 12 polkitd 1 7 named 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 9 1396 corpkicks 2 384 evolution 3 102 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5922 MB Active(file): 4998 MB Inactive(file): 986 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 539 MB CommitLimit: 10984 MB Committed_AS: 9242 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 4-05:30:42 4832 /usr/bin/imunify-agent-proxy 4109079 root 03:08:20 3136 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 03:08:20 540864 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 3050532 11.8 Ssl 2-17:38:57 /usr/sbin/mariadbd 4109105 4109079 root 540864 8.0 Sl 03:08:20 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 571526 570802 corpkicks 209000 94.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 571527 571158 corpkicks 207876 93.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1542443 1 netdata 192432 2.6 Ssl 2-05:30:47 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 496129 2601907 madalice 178068 7.6 R 22:30 php-fpm: pool madalice_com_au 515304 2601907 madalice 169008 7.6 R 16:42 php-fpm: pool madalice_com_au 3643624 3626973 root 168348 0.0 S 05:26:19 spamd child 536530 2601907 madalice 164336 8.8 S 08:43 php-fpm: pool madalice_com_au 536420 2601907 madalice 161328 9.2 S 08:57 php-fpm: pool madalice_com_au 536487 2601907 madalice 161200 8.8 S 08:49 php-fpm: pool madalice_com_au 495842 2601907 madalice 160016 7.1 S 22:53 php-fpm: pool madalice_com_au 536452 2601907 madalice 156736 7.7 R 08:53 php-fpm: pool madalice_com_au 536397 2601907 madalice 149024 7.5 S 09:01 php-fpm: pool madalice_com_au 536493 2601907 madalice 131112 8.8 S 08:47 php-fpm: pool madalice_com_au 3626973 1 root 125328 0.0 Ss 05:29:54 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3643625 3626973 root 87844 0.0 S 05:26:19 spamd child 509236 509098 root 60608 0.0 Sl 8-05:33:28 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 498558 1353308 cpanellogin 54492 0.0 S 19:14 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 3127357 3127312 evolution 54212 0.0 Ss 07:53:08 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3127358 3127320 evolution 51072 0.0 Ss 07:53:08 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509266 1 root 46040 0.0 Ss 8-05:33:28 /usr/lib/systemd/systemd-journald 1353308 1 root 41776 0.1 Ss 45-05:11:54 cpsrvd (SSL) - waiting for connections 1542981 1542551 netdata 41144 0.1 Sl 2-05:30:43 /usr/libexec/netdata/plugins.d/go.d.plugin 1 553880 508511 alison 40328 0.2 S 04:11 dovecot/imap 571592 570790 evolution 35344 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1542487 1 wp-toolkit 29348 0.0 Ss 2-05:30:47 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28692 0.0 Ss 1-05:29:43 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3626082 1 root 27620 0.0 Ss 05:30:54 lfd - sleeping 1463 1 root 23944 0.0 Ss 67-21:43:23 tailwatchd 569846 506832 nobody 22060 0.0 S 02:09 /usr/sbin/httpd -k start 569854 506832 nobody 21744 0.0 S 02:09 /usr/sbin/httpd -k start 569799 506832 nobody 21688 0.0 S 02:12 /usr/sbin/httpd -k start 569453 506832 nobody 21592 0.0 S 02:28 /usr/sbin/httpd -k start 571040 506832 nobody 21236 0.1 S 00:59 /usr/sbin/httpd -k start 571042 506832 nobody 21208 0.1 S 00:59 /usr/sbin/httpd -k start 570801 506832 nobody 21160 0.0 S 01:23 /usr/sbin/httpd -k start 570798 506832 nobody 21048 0.0 S 01:24 /usr/sbin/httpd -k start 569858 506832 nobody 20908 0.1 S 02:09 /usr/sbin/httpd -k start 570791 506832 nobody 20816 0.0 S 01:25 /usr/sbin/httpd -k start 571009 506832 nobody 20800 0.0 S 01:00 /usr/sbin/httpd -k start 569809 506832 nobody 20668 0.0 S 02:10 /usr/sbin/httpd -k start 570804 506832 nobody 20456 0.0 S 01:23 /usr/sbin/httpd -k start 571159 506832 nobody 20244 0.0 S 00:41 /usr/sbin/httpd -k start 570790 506832 nobody 20124 0.2 S 01:25 /usr/sbin/httpd -k start 569812 506832 nobody 19696 0.0 S 02:10 /usr/sbin/httpd -k start 1542531 1 wp-toolkit 19264 0.0 Ss 2-05:30:46 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2602226 1 root 19256 0.1 Rsl 1-05:29:28 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 570802 506832 nobody 19252 0.0 S 01:23 /usr/sbin/httpd -k start 571158 506832 nobody 18520 0.0 S 00:41 /usr/sbin/httpd -k start 1542982 1542551 netdata 18520 2.2 Sl 2-05:30:43 /usr/libexec/netdata/plugins.d/apps.plugin 1 571149 506832 nobody 18496 0.0 S 00:42 /usr/sbin/httpd -k start 571160 506832 nobody 18292 0.0 S 00:41 /usr/sbin/httpd -k start 570979 506832 nobody 17328 0.0 S 01:01 /usr/sbin/httpd -k start 306499 1471 root 16308 0.0 S 01:14:05 cPhulkd - dbprocessor 1471 1 root 16248 0.0 Ss 67-21:43:23 cPhulkd - processor 553913 508511 alison 16084 0.0 S 04:11 dovecot/imap 534505 508511 aaa 15916 0.0 S 11:52 dovecot/imap 553883 508511 alison 15700 0.0 S 04:11 dovecot/imap 1542141 1 root 15420 0.0 Ss 2-05:30:50 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10756428 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 10756427 | root | evolution | Execute | 0 | Commit | UPDATE rate_limits SET count = count + 1 WHERE cache_key = ? | | 10756421 | madalice_wp | madalice_wp | Query | 0 | checking permissions | SHOW TABLES LIKE '%AMuqf6qZ_wfpklist_template_data%' | +----------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 211 evolution/app.evolutionerp.com.au-ssl_log 96 evolution/my.evolutionerp.com.au-ssl_log 8 evolution/portal.evolutionerp.com.au-ssl_log 3 otterfencing/otterfencing.com.au-ssl_log 3 tubesupplies/tubesupplies.com.au 3 tubesupplies/tubesupplies.com.au-ssl_log 3 aaa/aaadownunder.com.au-ssl_log 2 corpkicks/corporatekicks.com.au-ssl_log 2 infinium/infinium.net.au-ssl_log 2 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 161 139.28.219.70 96 40.115.94.245 39 20.151.10.161 6 62.60.130.198 6 101.119.127.165 3 85.206.128.219 3 203.54.180.238 3 118.127.40.55 3 114.119.130.40 2 34.64.108.191 2 2001:8003:153b:500:25ae:9f58:d8a8:392 1 52.167.144.170 1 51.89.83.53 1 51.81.163.72 1 43.130.67.6 --- top request paths across all vhosts (last 3 min) --- 94 GET /api/getItem/LWFB2001KG 6 GET /store/hand-painted-nike-cartoonsketchy/ 4 POST /functions.php 3 POST /wp-cron.php 3 GET /heartbeat.php 2 POST / 2 GET /wp-includes/view-transitions.php 2 GET /wp-includes/view-config.php 2 GET /wp-includes/utf8.php 2 GET /w.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /this_is_a_new_hello_world.php 2 GET /sky.php 2 GET /robots.php 2 GET /red.php 2 GET /k.php 2 GET /images.php 2 GET /great.php 2 GET /geck.php 2 GET /FWAZ.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 6 GET /store/hand-painted-nike-cartoonsketchy/ 2 POST / 2 GET /w.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /this_is_a_new_hello_world.php 2 GET /sky.php 2 GET /robots.php 2 GET /red.php 2 GET /k.php 2 GET /images.php 2 GET /great.php 2 GET /geck.php -- last 10 requests -- 139.28.219.70 - - [05/Sep/2026:07:52:56 +1000] "GET /wp-content/plugins/woocommerce/includes/admin/marketplace-suggestions/wp-content/plugins/woocommerce/includes/admin/ HTTP/1.1" 404 36666 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:52:58 +1000] "GET /wp-content/plugins/woocommerce/includes/admin/marketplace-suggestions/class-wc-marketplace-suggestions.php HTTP/1.1" 200 1 "-" "-" 20.151.10.161 - - [05/Sep/2026:07:52:57 +1000] "GET /biufile.php HTTP/1.1" 301 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:52:58 +1000] "GET /wp-content/plugins/woocommerce/includes/admin/marketplace-suggestions/class-wc-marketplace-updater.php HTTP/1.1" 200 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:52:58 +1000] "GET /wp-content/plugins/woocommerce/includes/admin/marketplace-suggestions/templates/ HTTP/1.1" 200 340 "-" "-" 20.151.10.161 - - [05/Sep/2026:07:52:58 +1000] "GET /biufile.php HTTP/1.1" 404 36645 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:52:59 +1000] "GET /wp-content/plugins/woocommerce/includes/admin/marketplace-suggestions/templates//wp-content/plugins/woocommerce/includes/admin/marketplace-suggestions/ HTTP/1.1" 301 1 20.151.10.161 - - [05/Sep/2026:07:53:00 +1000] "GET /dejavu.php HTTP/1.1" 301 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:07:53:00 +1000] "GET /wp-content/plugins/woocommerce/includes/admin/marketplace-suggestions/templates/wp-content/plugins/woocommerce/includes/admin/marketplace-suggestions/ HTTP/1.1" 404 36 139.28.219.70 - - [05/Sep/2026:07:53:02 +1000] "GET /wp-content/plugins/woocommerce/includes/admin/marketplace-suggestions/templates/html-product-data-extensions.php HTTP/1.1" 200 1 "-" "-" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 94 GET /api/getItem/LWFB2001KG 2 GET /api/getItem/LWPG2001KG -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:07:52:53 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:52:54 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:52:54 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:52:55 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:52:55 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:52:55 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:52:56 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:52:56 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:52:56 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:52:57 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 4 POST /functions.php 2 GET /app/ajax.php 1 GET /logoff.php 1 GET /index.php -- last 10 requests -- 52.167.144.170 - - [05/Sep/2026:07:51:05 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 52 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=76904" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gec 40.77.167.132 - - [05/Sep/2026:07:51:05 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotedit%26quoteid%3D76904&call=getUserSetting&caller=ajaxSubmitLocal&seq=17412008050 HTTP/1.1" 200 101 "https://my.evolutionerp. 101.119.127.165 - - [05/Sep/2026:07:51:21 +1000] "GET /logoff.php?page=opportunities HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=opportunities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5 101.119.127.165 - - [05/Sep/2026:07:51:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=opportunities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 101.119.127.165 - - [05/Sep/2026:07:51:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=opportunities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 101.119.127.165 - - [05/Sep/2026:07:51:21 +1000] "GET /index.php?page=opportunities HTTP/1.1" 200 5357 "https://my.evolutionerp.com.au/index.php?page=opportunities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 101.119.127.165 - - [05/Sep/2026:07:51:25 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 52 "https://my.evolutionerp.com.au/index.php?page=opportunities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5 101.119.127.165 - - [05/Sep/2026:07:51:25 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dopportunities&call=getUserSetting&caller=ajaxSubmitLocal&seq=11906235375 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index --- last 30 samples (run-up to this incident) --- 2026-09-05 07:50:38 L1=1.91 run=4 blk=1 avail=6650 (48.3%) swpO=0 conn=6 myRSS=2978 php=14 phpRSS=1642 ap=17 tcp=36 topuser=madalice 2026-09-05 07:50:47 L1=2.15 run=4 blk=1 avail=6635 (48.2%) swpO=0 conn=4 myRSS=2978 php=14 phpRSS=1604 ap=18 tcp=34 topuser=madalice 2026-09-05 07:50:48 L1=2.15 run=1 blk=1 avail=6657 (48.3%) swpO=0 conn=3 myRSS=2978 php=13 phpRSS=1564 ap=18 tcp=35 topuser=madalice 2026-09-05 07:50:57 L1=2.21 run=3 blk=1 avail=6565 (47.7%) swpO=0 conn=5 myRSS=2978 php=14 phpRSS=1683 ap=20 tcp=57 topuser=madalice 2026-09-05 07:50:58 L1=2.21 run=2 blk=1 avail=6575 (47.7%) swpO=0 conn=4 myRSS=2978 php=13 phpRSS=1572 ap=32 tcp=57 topuser=madalice 2026-09-05 07:51:07 L1=2.10 run=1 blk=1 avail=6518 (47.3%) swpO=40 conn=4 myRSS=2978 php=14 phpRSS=1605 ap=42 tcp=38 topuser=madalice 2026-09-05 07:51:09 L1=2.10 run=1 blk=1 avail=6542 (47.5%) swpO=36 conn=3 myRSS=2978 php=13 phpRSS=1565 ap=40 tcp=36 topuser=madalice 2026-09-05 07:51:17 L1=2.09 run=2 blk=1 avail=6547 (47.5%) swpO=14 conn=5 myRSS=2978 php=14 phpRSS=1664 ap=32 tcp=34 topuser=madalice 2026-09-05 07:51:19 L1=2.09 run=2 blk=1 avail=6577 (47.7%) swpO=14 conn=4 myRSS=2978 php=13 phpRSS=1617 ap=30 tcp=34 topuser=madalice 2026-09-05 07:51:27 L1=2.15 run=3 blk=1 avail=6628 (48.1%) swpO=0 conn=5 myRSS=2978 php=14 phpRSS=1606 ap=25 tcp=38 topuser=madalice 2026-09-05 07:51:29 L1=2.15 run=3 blk=1 avail=6536 (47.4%) swpO=0 conn=5 myRSS=2978 php=14 phpRSS=1713 ap=24 tcp=37 topuser=madalice 2026-09-05 07:51:37 L1=2.13 run=2 blk=1 avail=6667 (48.4%) swpO=0 conn=5 myRSS=2979 php=14 phpRSS=1607 ap=19 tcp=40 topuser=madalice 2026-09-05 07:51:39 L1=2.13 run=2 blk=1 avail=6674 (48.4%) swpO=0 conn=4 myRSS=2979 php=13 phpRSS=1569 ap=19 tcp=39 topuser=madalice 2026-09-05 07:51:48 L1=2.19 run=2 blk=1 avail=6755 (49.0%) swpO=0 conn=5 myRSS=2979 php=14 phpRSS=1415 ap=34 tcp=49 topuser=madalice 2026-09-05 07:51:49 L1=2.19 run=3 blk=1 avail=6770 (49.1%) swpO=0 conn=4 myRSS=2979 php=13 phpRSS=1375 ap=34 tcp=45 topuser=madalice 2026-09-05 07:51:58 L1=2.08 run=2 blk=1 avail=7150 (51.9%) swpO=0 conn=5 myRSS=2979 php=13 phpRSS=1068 ap=25 tcp=48 topuser=madalice 2026-09-05 07:51:59 L1=2.08 run=1 blk=1 avail=7208 (52.3%) swpO=0 conn=3 myRSS=2979 php=13 phpRSS=1009 ap=25 tcp=46 topuser=madalice 2026-09-05 07:52:08 L1=1.99 run=4 blk=1 avail=7137 (51.8%) swpO=0 conn=4 myRSS=2979 php=13 phpRSS=1101 ap=23 tcp=51 topuser=madalice 2026-09-05 07:52:09 L1=1.99 run=1 blk=1 avail=7220 (52.4%) swpO=0 conn=3 myRSS=2979 php=13 phpRSS=1000 ap=25 tcp=52 topuser=madalice 2026-09-05 07:52:18 L1=2.00 run=2 blk=1 avail=7075 (51.4%) swpO=0 conn=4 myRSS=2979 php=13 phpRSS=1106 ap=29 tcp=52 topuser=madalice 2026-09-05 07:52:19 L1=2.00 run=2 blk=1 avail=6862 (49.8%) swpO=0 conn=3 myRSS=2979 php=13 phpRSS=1323 ap=29 tcp=48 topuser=madalice 2026-09-05 07:52:28 L1=2.00 run=10 blk=1 avail=6519 (47.3%) swpO=37 conn=9 myRSS=2979 php=16 phpRSS=1688 ap=33 tcp=56 topuser=madalice 2026-09-05 07:52:29 L1=2.00 run=11 blk=1 avail=6756 (49.0%) swpO=37 conn=3 myRSS=2979 php=14 phpRSS=1387 ap=33 tcp=50 topuser=madalice 2026-09-05 07:52:38 L1=2.46 run=3 blk=1 avail=6719 (48.8%) swpO=0 conn=9 myRSS=2979 php=13 phpRSS=1415 ap=30 tcp=41 topuser=madalice 2026-09-05 07:52:39 L1=2.46 run=2 blk=1 avail=6686 (48.5%) swpO=0 conn=3 myRSS=2979 php=13 phpRSS=1455 ap=29 tcp=40 topuser=madalice 2026-09-05 07:52:48 L1=2.47 run=3 blk=1 avail=6793 (49.3%) swpO=0 conn=9 myRSS=2979 php=13 phpRSS=1372 ap=25 tcp=42 topuser=madalice 2026-09-05 07:52:49 L1=2.47 run=2 blk=1 avail=6832 (49.6%) swpO=0 conn=3 myRSS=2979 php=13 phpRSS=1327 ap=25 tcp=43 topuser=madalice 2026-09-05 07:52:58 L1=2.39 run=2 blk=1 avail=6852 (49.7%) swpO=0 conn=9 myRSS=2979 php=14 phpRSS=1334 ap=24 tcp=43 topuser=madalice 2026-09-05 07:52:59 L1=2.39 run=5 blk=1 avail=6736 (48.9%) swpO=0 conn=6 myRSS=2979 php=14 phpRSS=1464 ap=24 tcp=43 topuser=madalice 2026-09-05 07:53:08 L1=2.57 run=5 blk=1 avail=6417 (46.6%) swpO=4 conn=7 myRSS=2979 php=15 phpRSS=1885 ap=24 tcp=47 topuser=madalice