INCIDENT 2026-09-05 08:01:12 trigger: php_rss=2121MB ================================================================== load: 2.52 2.50 2.32 5/730 606100 ncpu:10 mem_avail: 6283MB/13777MB (45.6%) swap_used:2288MB swapout:0/s blocked(D):1 running:4 iowait:9.9% steal:0.0% php: 18 procs / 2121MB heaviest user: madalice (9 procs, 1245MB) apache: 44 procs tcp_estab: 38 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2929 root 256 1362 madalice 9 1254 nobody 42 656 netdata 8 262 corpkicks 2 230 speedlin 2 216 evolution 12 202 dovenull 6 65 wp-toolkit 3 53 kurri 2 27 dovecot 3 27 mailman 20 26 mailnull 3 20 aaa 1 15 lowrange 1 14 cpanellogin 1 13 zabbix 1 10 polkitd 1 7 named 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 9 1256 corpkicks 1 218 speedlin 2 217 evolution 4 183 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5819 MB Active(file): 4363 MB Inactive(file): 1376 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 487 MB CommitLimit: 10984 MB Committed_AS: 9662 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 590897 root 01:11 1260 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 4-05:38:46 4696 /usr/bin/imunify-agent-proxy 4109079 root 03:16:24 3036 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 03:16:24 513012 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 2999812 11.7 Ssl 2-17:47:01 /usr/sbin/mariadbd 4109105 4109079 root 513012 7.6 Sl 03:16:24 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 606068 590696 corpkicks 230320 50.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 536487 2601907 madalice 208552 9.6 R 16:53 php-fpm: pool madalice_com_au 1542443 1 netdata 196808 2.6 Ssl 2-05:38:51 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3643624 3626973 root 167276 0.0 S 05:34:23 spamd child 536530 2601907 madalice 164920 10.2 S 16:47 php-fpm: pool madalice_com_au 536420 2601907 madalice 164252 11.2 S 17:01 php-fpm: pool madalice_com_au 605572 2601907 madalice 160904 10.0 S 00:48 php-fpm: pool madalice_com_au 606066 590700 speedlin 159492 58.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 588714 2601907 madalice 134636 6.8 S 04:23 php-fpm: pool madalice_com_au 536452 2601907 madalice 125672 8.3 S 16:57 php-fpm: pool madalice_com_au 536397 2601907 madalice 124172 8.7 S 17:05 php-fpm: pool madalice_com_au 536493 2601907 madalice 118044 9.1 S 16:51 php-fpm: pool madalice_com_au 3626973 1 root 118044 0.0 Ss 05:37:58 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 589361 2601907 madalice 95764 5.1 S 03:44 php-fpm: pool madalice_com_au 590933 590869 evolution 84852 2.0 Ss 01:11 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3643625 3626973 root 83264 0.0 S 05:34:23 spamd child 606071 589617 speedlin 66588 31.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509236 509098 root 60564 0.0 Sl 8-05:41:32 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3127357 3127312 evolution 52816 0.0 Ss 08:01:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3127358 3127320 evolution 49840 0.0 Ss 08:01:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509266 1 root 46360 0.0 Ss 8-05:41:32 /usr/lib/systemd/systemd-journald 1469 1 root 41936 0.1 Ss 67-21:51:27 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 41568 0.1 Ss 45-05:19:58 cpsrvd (SSL) - waiting for connections 1542981 1542551 netdata 41144 0.1 Sl 2-05:38:47 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1542487 1 wp-toolkit 29252 0.0 Ss 2-05:38:51 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28680 0.0 Ss 1-05:37:47 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3626082 1 root 26848 0.0 Ss 05:38:58 lfd - sleeping 1463 1 root 23156 0.0 Ss 67-21:51:27 tailwatchd 573029 506832 nobody 22704 0.0 S 06:13 /usr/sbin/httpd -k start 590628 506832 nobody 21716 0.0 S 01:48 /usr/sbin/httpd -k start 590696 506832 nobody 21716 0.0 S 01:39 /usr/sbin/httpd -k start 589741 506832 nobody 21652 0.0 S 03:06 /usr/sbin/httpd -k start 589617 506832 nobody 21460 0.1 S 03:15 /usr/sbin/httpd -k start 589541 506832 nobody 21084 0.0 S 03:26 /usr/sbin/httpd -k start 589733 506832 nobody 20940 0.0 S 03:06 /usr/sbin/httpd -k start 590778 506832 nobody 20760 0.0 S 01:24 /usr/sbin/httpd -k start 590700 506832 nobody 20632 0.0 S 01:38 /usr/sbin/httpd -k start 596665 506832 nobody 19940 0.0 S 01:05 /usr/sbin/httpd -k start 1542531 1 wp-toolkit 19260 0.0 Ss 2-05:38:50 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 605577 506832 nobody 19028 0.0 S 00:48 /usr/sbin/httpd -k start 2602226 1 root 18892 0.1 Ssl 1-05:37:32 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 606034 506832 nobody 18696 0.1 S 00:09 /usr/sbin/httpd -k start 605924 506832 nobody 18660 0.0 S 00:12 /usr/sbin/httpd -k start 1542982 1542551 netdata 18572 2.2 Sl 2-05:38:47 /usr/libexec/netdata/plugins.d/apps.plugin 1 606048 506832 nobody 18536 0.1 S 00:09 /usr/sbin/httpd -k start 606046 506832 nobody 18300 0.1 S 00:09 /usr/sbin/httpd -k start 605990 506832 nobody 18292 0.0 S 00:11 /usr/sbin/httpd -k start 606042 506832 nobody 17236 0.0 S 00:09 /usr/sbin/httpd -k start 606047 506832 nobody 17216 0.0 S 00:09 /usr/sbin/httpd -k start 606037 506832 nobody 16840 0.1 S 00:09 /usr/sbin/httpd -k start 606036 506832 nobody 16836 0.0 S 00:09 /usr/sbin/httpd -k start 606023 506832 nobody 16800 0.0 S 00:10 /usr/sbin/httpd -k start 606043 506832 nobody 16384 0.0 S 00:09 /usr/sbin/httpd -k start 606045 506832 nobody 16320 0.0 S 00:09 /usr/sbin/httpd -k start 606038 506832 nobody 16256 0.0 S 00:09 /usr/sbin/httpd -k start 606039 506832 nobody 16232 0.0 S 00:09 /usr/sbin/httpd -k start 606041 506832 nobody 16204 0.0 S 00:09 /usr/sbin/httpd -k start 306499 1471 root 16056 0.0 S 01:22:09 cPhulkd - dbprocessor --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10764963 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 213 lowrange/lowrange.com.au-ssl_log 185 evolution/app.evolutionerp.com.au-ssl_log 41 aaa/aaadownunder.com.au-ssl_log 6 evolution/portal.evolutionerp.com.au-ssl_log 3 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 185 35.228.117.168 177 139.28.219.70 41 40.115.94.245 4 118.127.40.55 3 98.81.33.208 3 203.54.180.238 3 185.60.105.9 3 167.17.71.189 2 57.128.200.130 2 48.214.177.47 2 216.244.66.236 2 209.141.37.250 2 152.53.66.203 2 115.192.55.253 1 95.111.193.11 --- top request paths across all vhosts (last 3 min) --- 4 POST / 4 GET /store/hand-painted-nike-bandana/ 4 GET / 3 GET /readme.html 3 GET /heartbeat.php 3 GET /feed/ 2 POST /wp-cron.php 2 GET /wp-json/wp/v2/users 2 GET /shop/ 2 GET /feed/atom/ 2 GET /author-sitemap.xml 2 GET /api/getItem/IPC2525 1 POST /wp-login.php 1 POST /graphql 1 POST /api/graphql 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /wp-sitemap-users-1.xml 1 GET /wp-login.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 4 POST / 4 GET /store/hand-painted-nike-bandana/ 3 GET /readme.html 3 GET /feed/ 3 GET / 2 GET /wp-json/wp/v2/users 2 GET /shop/ 2 GET /feed/atom/ 2 GET /author-sitemap.xml 1 POST /graphql 1 POST /api/graphql 1 GET /wp-sitemap-users-1.xml -- last 10 requests -- 139.28.219.70 - - [05/Sep/2026:08:00:58 +1000] "GET /wp-content/plugins/woocommerce/lib/classes/symfony/polyfill-php80/Resources//wp-content/plugins/woocommerce/lib/classes/symfony/polyfill-php80/ HTTP/1.1" 301 1 "-" "-" 216.244.66.236 - - [05/Sep/2026:08:00:59 +1000] "GET /shop/?add-to-cart=10057 HTTP/1.1" 200 35975 "-" "Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot; help@moz.com)" 139.28.219.70 - - [05/Sep/2026:08:00:59 +1000] "GET /wp-content/plugins/woocommerce/lib/classes/symfony/polyfill-php80/Resources/wp-content/plugins/woocommerce/lib/classes/symfony/polyfill-php80/ HTTP/1.1" 404 36672 "-" 139.28.219.70 - - [05/Sep/2026:08:01:02 +1000] "GET /wp-content/plugins/woocommerce/lib/classes/symfony/polyfill-php80/Resources/stubs/ HTTP/1.1" 200 429 "-" "-" 114.119.130.40 - - [05/Sep/2026:08:01:01 +1000] "GET /store/hand-painted-nike-air-force-1-butterfly/?wcpr_verified=1&wcpr_rating=2&wcpr_page=2&rating=2 HTTP/1.1" 200 55104 "https://madalice.com.au/store/hand-painted-nike 139.28.219.70 - - [05/Sep/2026:08:01:03 +1000] "GET /wp-content/plugins/woocommerce/lib/classes/symfony/polyfill-php80/Resources/stubs//wp-content/plugins/woocommerce/lib/classes/symfony/polyfill-php80/Resources/ HTTP/1. 139.28.219.70 - - [05/Sep/2026:08:01:04 +1000] "GET /wp-content/plugins/woocommerce/lib/classes/symfony/polyfill-php80/Resources/stubs/wp-content/plugins/woocommerce/lib/classes/symfony/polyfill-php80/Resources/ HTTP/1.1 216.244.66.236 - - [05/Sep/2026:08:01:04 +1000] "GET /shop/?add-to-cart=24014 HTTP/1.1" 200 35977 "-" "Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot; help@moz.com)" 139.28.219.70 - - [05/Sep/2026:08:01:06 +1000] "GET /wp-content/plugins/woocommerce/lib/classes/symfony/polyfill-php80/Resources/stubs/Attribute.php HTTP/1.1" 200 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:08:01:06 +1000] "GET /wp-content/plugins/woocommerce/lib/classes/symfony/polyfill-php80/Resources/stubs/PhpToken.php HTTP/1.1" 200 1 "-" "-" == lowrange/lowrange.com.au-ssl_log == -- top paths -- 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /vue/.env 1 GET /vite/.env 1 GET /vendor/.env 1 GET /v3/.env -- last 10 requests -- 35.228.117.168 - - [05/Sep/2026:08:00:03 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.228.117.168 - - [05/Sep/2026:08:00:03 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.228.117.168 - - [05/Sep/2026:08:00:04 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.228.117.168 - - [05/Sep/2026:08:00:04 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.228.117.168 - - [05/Sep/2026:08:00:04 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.228.117.168 - - [05/Sep/2026:08:00:05 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.228.117.168 - - [05/Sep/2026:08:00:05 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.228.117.168 - - [05/Sep/2026:08:00:05 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.228.117.168 - - [05/Sep/2026:08:00:06 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.228.117.168 - - [05/Sep/2026:08:00:06 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /api/getItem/IPC2525 1 GET /api/getItem/SGC-100 1 GET /api/getItem/RGW90 1 GET /api/getItem/RGW80 1 GET /api/getItem/RGW160 1 GET /api/getItem/RGW120 1 GET /api/getItem/RGW117T 1 GET /api/getItem/RGW100 1 GET /api/getItem/PT75M 1 GET /api/getItem/PT65M 1 GET /api/getItem/PT50M 1 GET /api/getItem/PT100M -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:07:59:12 +1000] "GET /api/getItem/300558 HTTP/1.1" 200 1327 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:59:12 +1000] "GET /api/getItem/SGC-100 HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:59:12 +1000] "GET /api/getItem/IPC2020 HTTP/1.1" 200 1352 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:59:13 +1000] "GET /api/getItem/IPC2525 HTTP/1.1" 200 1621 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:59:13 +1000] "GET /api/getItem/IPC25NB HTTP/1.1" 200 1470 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:59:13 +1000] "GET /api/getItem/IPC32NB HTTP/1.1" 200 1491 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:59:14 +1000] "GET /api/getItem/IPC3825 HTTP/1.1" 200 1467 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:59:14 +1000] "GET /api/getItem/IPC4040-1 HTTP/1.1" 404 111 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:59:15 +1000] "GET /api/getItem/IPC40NB HTTP/1.1" 200 1342 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:07:59:15 +1000] "GET /api/getItem/IPC5050 HTTP/1.1" 200 1740 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-05 07:58:41 L1=2.20 run=2 blk=1 avail=7473 (54.2%) swpO=0 conn=4 myRSS=2929 php=13 phpRSS=926 ap=26 tcp=32 topuser=madalice 2026-09-05 07:58:51 L1=2.41 run=2 blk=1 avail=7207 (52.3%) swpO=0 conn=3 myRSS=2929 php=13 phpRSS=1232 ap=20 tcp=35 topuser=madalice 2026-09-05 07:58:51 L1=2.41 run=1 blk=1 avail=7206 (52.3%) swpO=0 conn=4 myRSS=2929 php=13 phpRSS=1232 ap=20 tcp=35 topuser=madalice 2026-09-05 07:59:01 L1=2.35 run=2 blk=1 avail=6993 (50.8%) swpO=0 conn=4 myRSS=2929 php=13 phpRSS=1443 ap=20 tcp=34 topuser=madalice 2026-09-05 07:59:01 L1=2.35 run=3 blk=1 avail=6985 (50.7%) swpO=0 conn=4 myRSS=2929 php=13 phpRSS=1450 ap=20 tcp=34 topuser=madalice 2026-09-05 07:59:11 L1=2.21 run=3 blk=1 avail=6773 (49.2%) swpO=0 conn=6 myRSS=2929 php=15 phpRSS=1732 ap=19 tcp=36 topuser=madalice 2026-09-05 07:59:11 L1=2.21 run=5 blk=1 avail=6758 (49.1%) swpO=0 conn=7 myRSS=2929 php=15 phpRSS=1746 ap=19 tcp=36 topuser=madalice 2026-09-05 07:59:21 L1=2.18 run=5 blk=1 avail=7041 (51.1%) swpO=2 conn=7 myRSS=2929 php=13 phpRSS=1405 ap=19 tcp=35 topuser=madalice 2026-09-05 07:59:21 L1=2.18 run=6 blk=1 avail=7026 (51.0%) swpO=2 conn=6 myRSS=2929 php=14 phpRSS=1449 ap=19 tcp=34 topuser=madalice 2026-09-05 07:59:31 L1=2.16 run=3 blk=1 avail=7152 (51.9%) swpO=0 conn=7 myRSS=2929 php=13 phpRSS=1240 ap=23 tcp=34 topuser=madalice 2026-09-05 07:59:31 L1=2.16 run=1 blk=1 avail=7186 (52.2%) swpO=0 conn=6 myRSS=2929 php=13 phpRSS=1226 ap=23 tcp=33 topuser=madalice 2026-09-05 07:59:41 L1=2.06 run=2 blk=1 avail=7436 (54.0%) swpO=0 conn=7 myRSS=2929 php=13 phpRSS=970 ap=24 tcp=37 topuser=madalice 2026-09-05 07:59:41 L1=2.06 run=3 blk=1 avail=7403 (53.7%) swpO=0 conn=6 myRSS=2929 php=13 phpRSS=1003 ap=24 tcp=37 topuser=madalice 2026-09-05 07:59:51 L1=2.06 run=2 blk=1 avail=7340 (53.3%) swpO=0 conn=7 myRSS=2929 php=13 phpRSS=1071 ap=24 tcp=37 topuser=madalice 2026-09-05 07:59:52 L1=2.06 run=2 blk=1 avail=7307 (53.0%) swpO=0 conn=6 myRSS=2929 php=13 phpRSS=1101 ap=24 tcp=36 topuser=madalice 2026-09-05 08:00:01 L1=1.89 run=15 blk=2 avail=7371 (53.5%) swpO=0 conn=7 myRSS=2929 php=13 phpRSS=1038 ap=22 tcp=38 topuser=madalice 2026-09-05 08:00:02 L1=1.89 run=9 blk=2 avail=7298 (53.0%) swpO=0 conn=5 myRSS=2929 php=16 phpRSS=1163 ap=22 tcp=41 topuser=madalice 2026-09-05 08:00:11 L1=2.29 run=3 blk=1 avail=6943 (50.4%) swpO=0 conn=5 myRSS=2929 php=17 phpRSS=1533 ap=28 tcp=46 topuser=madalice 2026-09-05 08:00:12 L1=2.29 run=7 blk=1 avail=6924 (50.3%) swpO=0 conn=5 myRSS=2929 php=17 phpRSS=1517 ap=28 tcp=42 topuser=madalice 2026-09-05 08:00:22 L1=2.25 run=3 blk=1 avail=6917 (50.2%) swpO=0 conn=5 myRSS=2929 php=15 phpRSS=1539 ap=23 tcp=39 topuser=madalice 2026-09-05 08:00:22 L1=2.25 run=4 blk=1 avail=6971 (50.6%) swpO=0 conn=5 myRSS=2929 php=15 phpRSS=1489 ap=23 tcp=38 topuser=madalice 2026-09-05 08:00:32 L1=2.54 run=4 blk=1 avail=6944 (50.4%) swpO=2 conn=5 myRSS=2929 php=14 phpRSS=1485 ap=24 tcp=37 topuser=madalice 2026-09-05 08:00:33 L1=2.54 run=3 blk=1 avail=6993 (50.8%) swpO=2 conn=5 myRSS=2929 php=14 phpRSS=1389 ap=24 tcp=36 topuser=madalice 2026-09-05 08:00:42 L1=2.45 run=2 blk=1 avail=7155 (51.9%) swpO=0 conn=5 myRSS=2929 php=14 phpRSS=1184 ap=24 tcp=41 topuser=madalice 2026-09-05 08:00:43 L1=2.45 run=1 blk=1 avail=7303 (53.0%) swpO=0 conn=5 myRSS=2929 php=14 phpRSS=1093 ap=24 tcp=40 topuser=madalice 2026-09-05 08:00:52 L1=2.61 run=2 blk=1 avail=6920 (50.2%) swpO=0 conn=5 myRSS=2929 php=14 phpRSS=1479 ap=24 tcp=35 topuser=madalice 2026-09-05 08:00:53 L1=2.61 run=4 blk=1 avail=6942 (50.4%) swpO=0 conn=5 myRSS=2929 php=15 phpRSS=1494 ap=24 tcp=32 topuser=madalice 2026-09-05 08:01:02 L1=2.44 run=5 blk=1 avail=6786 (49.3%) swpO=0 conn=3 myRSS=2929 php=14 phpRSS=1628 ap=22 tcp=58 topuser=madalice 2026-09-05 08:01:03 L1=2.44 run=2 blk=1 avail=6761 (49.1%) swpO=0 conn=3 myRSS=2929 php=14 phpRSS=1619 ap=26 tcp=59 topuser=madalice 2026-09-05 08:01:12 L1=2.52 run=4 blk=1 avail=6283 (45.6%) swpO=0 conn=6 myRSS=2929 php=18 phpRSS=2121 ap=44 tcp=38 topuser=madalice