INCIDENT 2026-09-05 08:15:47 trigger: php_rss=1557MB ================================================================== load: 2.36 2.13 2.19 3/700 658747 ncpu:10 mem_avail: 6984MB/13777MB (50.7%) swap_used:2388MB swapout:177/s blocked(D):1 running:3 iowait:9.8% steal:0.0% php: 15 procs / 1557MB heaviest user: madalice (9 procs, 1233MB) apache: 22 procs tcp_estab: 33 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2872 root 250 1307 madalice 9 1233 nobody 21 372 netdata 8 258 otterfencing 1 164 evolution 12 155 dovenull 6 65 wp-toolkit 3 53 mailnull 5 35 dovecot 3 27 mailman 20 26 cpanellogin 1 18 lowrange 1 14 kurri 1 13 zabbix 1 10 polkitd 1 7 named 1 5 nscd 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 9 1233 otterfencing 1 165 evolution 4 135 root 1 28 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6404 MB Active(file): 3873 MB Inactive(file): 2524 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 479 MB CommitLimit: 10984 MB Committed_AS: 8962 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 4-05:53:21 4572 /usr/bin/imunify-agent-proxy 4109079 root 03:30:59 2984 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 03:30:59 491448 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 2940960 11.7 Ssl 2-18:01:36 /usr/sbin/mariadbd 4109105 4109079 root 491448 7.1 Sl 03:30:59 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1542443 1 netdata 193192 2.6 Ssl 2-05:53:26 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3643624 3626973 root 166176 0.0 S 05:48:58 spamd child 588714 2601907 madalice 163804 6.2 S 18:58 php-fpm: pool madalice_com_au 608042 2601907 madalice 163288 5.8 S 11:12 php-fpm: pool madalice_com_au 608066 2601907 madalice 160868 6.1 S 11:07 php-fpm: pool madalice_com_au 589361 2601907 madalice 148584 5.8 S 18:19 php-fpm: pool madalice_com_au 607858 2601907 madalice 148012 6.7 S 11:33 php-fpm: pool madalice_com_au 607935 2601907 madalice 145756 6.0 R 11:23 php-fpm: pool madalice_com_au 608033 2601907 madalice 141948 5.9 S 11:13 php-fpm: pool madalice_com_au 607878 2601907 madalice 120864 6.0 S 11:26 php-fpm: pool madalice_com_au 3626973 1 root 106524 0.0 Ss 05:52:33 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 605572 2601907 madalice 70884 5.9 S 15:23 php-fpm: pool madalice_com_au 3643625 3626973 root 70660 0.0 S 05:48:58 spamd child 509236 509098 root 62416 0.0 Sl 8-05:56:07 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3127357 3127312 evolution 51332 0.0 Ss 08:15:47 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 3127358 3127320 evolution 47312 0.0 Ss 08:15:47 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509266 1 root 46632 0.0 Ss 8-05:56:07 /usr/lib/systemd/systemd-journald 1353308 1 root 41780 0.1 Ss 45-05:34:33 cpsrvd (SSL) - waiting for connections 1469 1 root 41580 0.1 Ss 67-22:06:02 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1542981 1542551 netdata 41140 0.1 Sl 2-05:53:22 /usr/libexec/netdata/plugins.d/go.d.plugin 1 658716 628174 evolution 40384 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1542487 1 wp-toolkit 29016 0.0 Ss 2-05:53:26 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2601907 1 root 28676 0.0 Ss 1-05:52:22 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3626082 1 root 25688 0.0 Ss 05:53:33 lfd - sleeping 658704 658696 otterfencing 23464 75.5 R 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1463 1 root 23304 0.0 Ss 67-22:06:02 tailwatchd 624953 506832 nobody 22964 0.0 S 07:04 /usr/sbin/httpd -k start 628174 506832 nobody 22916 0.0 S 05:44 /usr/sbin/httpd -k start 624939 506832 nobody 22600 0.0 S 07:09 /usr/sbin/httpd -k start 641989 506832 nobody 22600 0.0 S 03:58 /usr/sbin/httpd -k start 623177 506832 nobody 22372 0.0 S 09:58 /usr/sbin/httpd -k start 608134 506832 nobody 22228 0.0 S 11:03 /usr/sbin/httpd -k start 629742 506832 nobody 22104 0.0 S 05:43 /usr/sbin/httpd -k start 643466 506832 nobody 22084 0.0 S 02:08 /usr/sbin/httpd -k start 643638 506832 nobody 20556 0.0 S 01:44 /usr/sbin/httpd -k start 644061 506832 nobody 20104 0.0 S 01:00 /usr/sbin/httpd -k start 643674 506832 nobody 20092 0.0 S 01:41 /usr/sbin/httpd -k start 658469 506832 nobody 20020 0.1 S 00:35 /usr/sbin/httpd -k start 643535 506832 nobody 19872 0.1 S 02:00 /usr/sbin/httpd -k start 1542531 1 wp-toolkit 19144 0.0 Ss 2-05:53:25 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 626153 1353308 cpanellogin 19128 0.0 S 05:59 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 658470 506832 nobody 19116 0.1 S 00:35 /usr/sbin/httpd -k start 658467 506832 nobody 19084 0.0 S 00:36 /usr/sbin/httpd -k start 1542982 1542551 netdata 18568 2.2 Sl 2-05:53:22 /usr/libexec/netdata/plugins.d/apps.plugin 1 2602226 1 root 18508 0.1 Ssl 1-05:52:07 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 658696 506832 nobody 16692 0.0 S 00:03 /usr/sbin/httpd -k start 658687 506832 nobody 16628 0.0 S 00:06 /usr/sbin/httpd -k start 306499 1471 root 15924 0.0 S 01:36:44 cPhulkd - dbprocessor 1471 1 root 15816 0.0 Ss 67-22:06:02 cPhulkd - processor 1542141 1 root 15380 0.0 Ss 2-05:53:29 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 3539428 508511 lowrange 15172 0.0 S 06:19:40 dovecot/imap 658487 508720 mailnull 14680 0.0 S 00:31 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 658616 1471 root 13932 0.0 S 00:16 cPhulkd - processor - http socket 3141944 508511 kurri 13564 0.0 S 08:15:25 dovecot/imap 690505 508511 dovenull 13256 0.0 S 19:42:58 dovecot/imap-login 690514 508511 dovecot 13252 0.0 S 19:42:58 dovecot/auth 690509 508511 dovenull 13032 0.0 S 19:42:58 dovecot/imap-login 506832 1 root 12332 0.0 Ss 8-05:56:40 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10775678 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 215 evolution/app.evolutionerp.com.au-ssl_log 107 speedlin/speedlinefencing.com.au 9 speedlin/speedlinefencing.com.au-ssl_log 9 evolution/portal.evolutionerp.com.au-ssl_log 7 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 207 139.28.219.70 107 40.115.94.245 18 62.60.130.198 7 203.54.180.238 4 114.119.131.88 2 114.119.159.70 1 114.119.143.104 1 114.119.137.101 --- top request paths across all vhosts (last 3 min) --- 51 GET /api/getItem/LWPB2001KG 7 GET /heartbeat.php 5 GET /store/hand-painted-nike-af1-sunflower/ 3 GET /store/hand-painted-nike-af1-thegang/ 3 GET /api/getItem/SHSG656516 2 GET /wp-includes/class-wp-url-pattern-prefixer.php 2 GET /wp-includes/class-wp-token-map.php 2 GET /wp-includes/class-wp-theme-json-schema.php 2 GET /wp-includes/class-wp-theme-json-resolver.php 2 GET /wp-includes/class-wp-theme-json.php 2 GET /wp-includes/class-wp-theme-json-data.php 2 GET /wp-includes/class-wp-textdomain-registry.php 2 GET /wp-includes/class-wp-styles.php 2 GET /wp-includes/class-wp-speculation-rules.php 2 GET /api/getItem/SHSG656520 2 GET /api/getItem/LWFB2001KG 1 GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages//wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony//wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/ --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 5 GET /store/hand-painted-nike-af1-sunflower/ 3 GET /store/hand-painted-nike-af1-thegang/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages//wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony//wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/Polyfill/wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/Polyfill//wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/Polyfill/Php80//wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/Polyfill/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/Polyfill/Php80/wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/Polyfill/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/Polyfill/Php80/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/Polyfill/ -- last 10 requests -- 139.28.219.70 - - [05/Sep/2026:08:15:32 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/Component/CssSelector/XPath/Extension/PseudoClassExtension.php HTTP/1.1" 500 1 "- 139.28.219.70 - - [05/Sep/2026:08:15:33 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/Component/CssSelector/XPath/Translator.php HTTP/1.1" 500 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:08:15:33 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/Component/CssSelector/XPath/TranslatorInterface.php HTTP/1.1" 200 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:08:15:34 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/Component/CssSelector/XPath/XPathExpr.php HTTP/1.1" 200 1 "-" "-" 139.28.219.70 - - [05/Sep/2026:08:15:34 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/Polyfill/ HTTP/1.1" 200 343 "-" "-" 139.28.219.70 - - [05/Sep/2026:08:15:34 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/Polyfill//wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/pa 139.28.219.70 - - [05/Sep/2026:08:15:36 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/Polyfill/wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/pac 139.28.219.70 - - [05/Sep/2026:08:15:38 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/Polyfill/Php80/ HTTP/1.1" 200 421 "-" "-" 139.28.219.70 - - [05/Sep/2026:08:15:38 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/Polyfill/Php80//wp-content/plugins/woocommerce/packages/email-editor/vendor-prefi 139.28.219.70 - - [05/Sep/2026:08:15:39 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/vendor-prefixed/packages/Symfony/Polyfill/Php80/wp-content/plugins/woocommerce/packages/email-editor/vendor-prefix == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 51 GET /api/getItem/LWPB2001KG 3 GET /api/getItem/SHSG656516 2 GET /api/getItem/SHSG656520 2 GET /api/getItem/LWFB2001KG 1 GET /api/getItem/SHSG8989508 1 GET /api/getItem/SHSG8989358 1 GET /api/getItem/SHSG8989258 1 GET /api/getItem/SHSG8989208 1 GET /api/getItem/SHSG7575508 1 GET /api/getItem/SHSG757540-8 1 GET /api/getItem/SHSG757540 1 GET /api/getItem/SHSG757530-8 -- last 10 requests -- 40.115.94.245 - - [05/Sep/2026:08:14:40 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:08:14:41 +1000] "GET /api/getItem/SHSG10010025 HTTP/1.1" 200 1584 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:08:14:41 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:08:14:41 +1000] "GET /api/getItem/SHSG100100308 HTTP/1.1" 404 115 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:08:14:41 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:08:14:41 +1000] "GET /api/getItem/SHSG100100408 HTTP/1.1" 404 115 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:08:14:42 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:08:14:42 +1000] "GET /api/getItem/SHSG100100508 HTTP/1.1" 404 115 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:08:14:42 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [05/Sep/2026:08:14:42 +1000] "GET /api/getItem/SHSG125125408 HTTP/1.1" 404 115 "-" "RestSharp/106.13.0.0" == speedlin/speedlinefencing.com.au == -- top paths -- 1 GET /wp-includes/class-wp-url-pattern-prefixer.php 1 GET /wp-includes/class-wp-token-map.php 1 GET /wp-includes/class-wp-theme-json-schema.php 1 GET /wp-includes/class-wp-theme-json-resolver.php 1 GET /wp-includes/class-wp-theme-json.php 1 GET /wp-includes/class-wp-theme-json-data.php 1 GET /wp-includes/class-wp-textdomain-registry.php 1 GET /wp-includes/class-wp-styles.php 1 GET /wp-includes/class-wp-speculation-rules.php -- last 10 requests -- 62.60.130.198 - - [05/Sep/2026:08:13:06 +1000] "GET /wp-includes/class-wp-speculation-rules.php HTTP/1.1" 301 322 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90. 62.60.130.198 - - [05/Sep/2026:08:13:22 +1000] "GET /wp-includes/class-wp-styles.php HTTP/1.1" 301 311 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 S 62.60.130.198 - - [05/Sep/2026:08:13:37 +1000] "GET /wp-includes/class-wp-textdomain-registry.php HTTP/1.1" 301 324 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/9 62.60.130.198 - - [05/Sep/2026:08:13:56 +1000] "GET /wp-includes/class-wp-theme-json-data.php HTTP/1.1" 301 320 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0. 62.60.130.198 - - [05/Sep/2026:08:14:11 +1000] "GET /wp-includes/class-wp-theme-json-resolver.php HTTP/1.1" 301 324 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/9 62.60.130.198 - - [05/Sep/2026:08:14:23 +1000] "GET /wp-includes/class-wp-theme-json-schema.php HTTP/1.1" 301 322 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90. 62.60.130.198 - - [05/Sep/2026:08:14:32 +1000] "GET /wp-includes/class-wp-theme-json.php HTTP/1.1" 301 315 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430. 62.60.130.198 - - [05/Sep/2026:08:14:43 +1000] "GET /wp-includes/class-wp-token-map.php HTTP/1.1" 301 314 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.8 62.60.130.198 - - [05/Sep/2026:08:14:56 +1000] "GET /wp-includes/class-wp-url-pattern-prefixer.php HTTP/1.1" 301 325 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ --- last 30 samples (run-up to this incident) --- 2026-09-05 08:13:17 L1=1.86 run=2 blk=1 avail=7123 (51.7%) swpO=255 conn=2 myRSS=2876 php=14 phpRSS=1399 ap=17 tcp=34 topuser=madalice 2026-09-05 08:13:27 L1=1.87 run=3 blk=1 avail=7051 (51.2%) swpO=0 conn=2 myRSS=2876 php=14 phpRSS=1463 ap=17 tcp=34 topuser=madalice 2026-09-05 08:13:27 L1=1.87 run=3 blk=1 avail=6961 (50.5%) swpO=0 conn=3 myRSS=2876 php=14 phpRSS=1549 ap=17 tcp=34 topuser=madalice 2026-09-05 08:13:37 L1=1.81 run=2 blk=1 avail=7095 (51.5%) swpO=0 conn=2 myRSS=2876 php=13 phpRSS=1389 ap=17 tcp=35 topuser=madalice 2026-09-05 08:13:37 L1=1.81 run=2 blk=1 avail=7033 (51.0%) swpO=0 conn=3 myRSS=2876 php=14 phpRSS=1482 ap=17 tcp=36 topuser=madalice 2026-09-05 08:13:47 L1=1.69 run=2 blk=1 avail=7306 (53.0%) swpO=0 conn=2 myRSS=2876 php=13 phpRSS=1171 ap=18 tcp=38 topuser=madalice 2026-09-05 08:13:47 L1=1.69 run=2 blk=1 avail=7235 (52.5%) swpO=0 conn=3 myRSS=2876 php=14 phpRSS=1268 ap=19 tcp=40 topuser=madalice 2026-09-05 08:13:57 L1=1.66 run=1 blk=1 avail=7147 (51.9%) swpO=0 conn=2 myRSS=2876 php=14 phpRSS=1363 ap=17 tcp=37 topuser=madalice 2026-09-05 08:13:57 L1=1.66 run=2 blk=1 avail=7158 (52.0%) swpO=0 conn=3 myRSS=2876 php=14 phpRSS=1315 ap=16 tcp=36 topuser=madalice 2026-09-05 08:14:07 L1=1.79 run=4 blk=1 avail=7255 (52.7%) swpO=0 conn=3 myRSS=2876 php=14 phpRSS=1278 ap=17 tcp=37 topuser=madalice 2026-09-05 08:14:07 L1=1.79 run=1 blk=1 avail=7373 (53.5%) swpO=0 conn=3 myRSS=2876 php=14 phpRSS=1148 ap=18 tcp=35 topuser=madalice 2026-09-05 08:14:17 L1=1.83 run=2 blk=1 avail=7267 (52.7%) swpO=0 conn=3 myRSS=2876 php=15 phpRSS=1274 ap=18 tcp=35 topuser=madalice 2026-09-05 08:14:17 L1=1.83 run=3 blk=1 avail=7245 (52.6%) swpO=0 conn=3 myRSS=2876 php=15 phpRSS=1293 ap=18 tcp=36 topuser=madalice 2026-09-05 08:14:27 L1=1.93 run=2 blk=2 avail=7186 (52.2%) swpO=0 conn=3 myRSS=2876 php=14 phpRSS=1310 ap=18 tcp=47 topuser=madalice 2026-09-05 08:14:27 L1=1.93 run=2 blk=1 avail=7316 (53.1%) swpO=0 conn=3 myRSS=2876 php=14 phpRSS=1172 ap=18 tcp=42 topuser=madalice 2026-09-05 08:14:37 L1=1.86 run=1 blk=1 avail=7647 (55.5%) swpO=0 conn=3 myRSS=2876 php=14 phpRSS=877 ap=17 tcp=29 topuser=madalice 2026-09-05 08:14:38 L1=1.86 run=4 blk=1 avail=7632 (55.4%) swpO=0 conn=3 myRSS=2876 php=14 phpRSS=897 ap=17 tcp=36 topuser=madalice 2026-09-05 08:14:47 L1=1.96 run=3 blk=1 avail=7244 (52.6%) swpO=0 conn=3 myRSS=2876 php=14 phpRSS=1254 ap=17 tcp=35 topuser=madalice 2026-09-05 08:14:48 L1=1.96 run=2 blk=1 avail=7266 (52.7%) swpO=0 conn=3 myRSS=2876 php=14 phpRSS=1254 ap=17 tcp=31 topuser=madalice 2026-09-05 08:14:57 L1=1.97 run=2 blk=1 avail=7353 (53.4%) swpO=0 conn=3 myRSS=2876 php=14 phpRSS=1173 ap=18 tcp=25 topuser=madalice 2026-09-05 08:14:58 L1=1.97 run=1 blk=1 avail=7413 (53.8%) swpO=0 conn=3 myRSS=2876 php=14 phpRSS=1114 ap=17 tcp=24 topuser=madalice 2026-09-05 08:15:07 L1=2.13 run=3 blk=1 avail=7253 (52.6%) swpO=0 conn=4 myRSS=2876 php=15 phpRSS=1317 ap=16 tcp=26 topuser=madalice 2026-09-05 08:15:08 L1=2.13 run=6 blk=1 avail=7248 (52.6%) swpO=0 conn=3 myRSS=2876 php=16 phpRSS=1345 ap=16 tcp=26 topuser=madalice 2026-09-05 08:15:17 L1=2.33 run=2 blk=1 avail=7356 (53.4%) swpO=0 conn=4 myRSS=2876 php=17 phpRSS=1265 ap=19 tcp=32 topuser=madalice 2026-09-05 08:15:18 L1=2.33 run=2 blk=1 avail=7532 (54.7%) swpO=0 conn=2 myRSS=2876 php=14 phpRSS=981 ap=19 tcp=31 topuser=madalice 2026-09-05 08:15:27 L1=2.36 run=2 blk=1 avail=7175 (52.1%) swpO=0 conn=4 myRSS=2876 php=15 phpRSS=1388 ap=19 tcp=29 topuser=madalice 2026-09-05 08:15:28 L1=2.36 run=3 blk=1 avail=7019 (51.0%) swpO=0 conn=2 myRSS=2876 php=14 phpRSS=1388 ap=19 tcp=28 topuser=madalice 2026-09-05 08:15:37 L1=2.23 run=3 blk=1 avail=7308 (53.0%) swpO=0 conn=4 myRSS=2876 php=14 phpRSS=1115 ap=18 tcp=32 topuser=madalice 2026-09-05 08:15:38 L1=2.23 run=1 blk=1 avail=7423 (53.9%) swpO=0 conn=2 myRSS=2876 php=13 phpRSS=1076 ap=18 tcp=32 topuser=madalice 2026-09-05 08:15:47 L1=2.36 run=3 blk=1 avail=6984 (50.7%) swpO=177 conn=4 myRSS=2872 php=15 phpRSS=1557 ap=22 tcp=33 topuser=madalice