INCIDENT 2026-09-06 03:29:36 trigger: php_rss=1539MB ================================================================== load: 1.62 1.60 1.57 3/637 390623 ncpu:10 mem_avail: 9327MB/13777MB (67.7%) swap_used:1485MB swapout:0/s blocked(D):1 running:2 iowait:9.9% steal:0.0% php: 15 procs / 1539MB heaviest user: madalice (10 procs, 1416MB) apache: 21 procs tcp_estab: 28 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 10 1416 root 260 1128 mysql 1 812 mailman 20 364 nobody 20 296 netdata 8 292 wp-toolkit 3 109 vinesit 1 92 dovenull 6 65 named 1 52 mailnull 6 39 dovecot 3 28 polkitd 1 20 cpanellogin 1 18 lowrange 1 15 evolution 11 14 kurri 1 13 zabbix 1 11 rpc 1 5 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1416 vinesit 1 94 root 1 32 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 8390 MB Active(file): 4132 MB Inactive(file): 4386 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 565 MB CommitLimit: 10984 MB Committed_AS: 9021 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 338960 root 16:35 3148 /bin/bash /etc/cron.daily/imunify-antivirus.cron 338961 root 16:35 1224 sed 1i\ /etc/cron.daily/imunify-antivirus.cron:\ 338962 root 16:35 8680 /usr/libexec/report-command-error /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py 338973 root 16:35 14392 /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py 3926885 root 5-01:07:10 3776 /usr/bin/imunify-agent-proxy 4109079 root 22:44:48 1796 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 22:44:48 82920 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 831636 2.8 Ssl 07:53:05 /usr/sbin/mariadbd 220206 168913 root 186992 0.1 S 51:18 spamd child 166870 1 netdata 186752 2.7 Ssl 01:07:16 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 220207 168913 root 180320 0.0 S 51:18 spamd child 168913 1 root 175968 0.1 Ss 01:06:06 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 390456 167896 madalice 158892 16.0 S 00:16 php-fpm: pool madalice_com_au 390215 167896 madalice 158232 12.4 S 00:39 php-fpm: pool madalice_com_au 390454 167896 madalice 157540 14.8 S 00:16 php-fpm: pool madalice_com_au 390459 167896 madalice 157496 14.3 S 00:16 php-fpm: pool madalice_com_au 390452 167896 madalice 157488 14.8 S 00:16 php-fpm: pool madalice_com_au 390458 167896 madalice 157480 15.3 S 00:16 php-fpm: pool madalice_com_au 390463 167896 madalice 126796 8.2 S 00:15 php-fpm: pool madalice_com_au 390457 167896 madalice 126764 8.0 S 00:16 php-fpm: pool madalice_com_au 390453 167896 madalice 124912 8.7 S 00:16 php-fpm: pool madalice_com_au 390455 167896 madalice 124912 8.0 S 00:16 php-fpm: pool madalice_com_au 4109105 4109079 root 82920 2.2 Sl 22:44:48 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 167562 166914 netdata 71108 0.1 Sl 01:07:11 /usr/libexec/netdata/plugins.d/go.d.plugin 1 166645 1 wp-toolkit 62708 0.0 Ss 01:07:20 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 167871 1 root 60544 0.0 Ss 01:07:09 /usr/lib/systemd/systemd-journald 166809 1 named 54044 0.0 Ssl 01:07:18 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1353308 1 root 41688 0.1 Ss 46-00:48:22 cpsrvd (SSL) - waiting for connections 1469 1 root 41684 0.1 Ss 68-17:19:51 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 167845 1 wp-toolkit 41288 0.0 Ss 01:07:09 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 509236 509098 root 33932 0.0 Sl 9-01:09:56 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 167896 1 root 33060 0.0 Ss 01:07:08 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 167814 1 root 29380 0.0 Ss 01:07:09 lfd - sleeping 166757 1 root 26484 0.0 Ss 01:07:19 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 1463 1 root 26152 0.0 Ss 68-17:19:51 tailwatchd 167017 1 root 25876 0.1 Ssl 01:07:15 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 322587 506832 nobody 23232 0.0 S 20:39 /usr/sbin/httpd -k start 388816 506832 nobody 21524 0.1 S 03:21 /usr/sbin/httpd -k start 166667 1 polkitd 21464 0.0 Ssl 01:07:20 /usr/lib/polkit-1/polkitd --no-debug 371516 506832 nobody 20940 0.0 S 08:55 /usr/sbin/httpd -k start 373669 506832 nobody 20644 0.1 S 05:08 /usr/sbin/httpd -k start 167772 167758 mailman 20120 0.0 S 01:07:10 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 167776 167758 mailman 20104 0.0 S 01:07:10 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 167775 167758 mailman 19972 0.0 S 01:07:10 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 167770 167758 mailman 19932 0.0 S 01:07:10 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 167774 167758 mailman 19892 0.0 S 01:07:10 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 167773 167758 mailman 19840 0.0 S 01:07:10 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 167771 167758 mailman 19732 0.0 S 01:07:10 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 167769 167758 mailman 19696 0.0 S 01:07:10 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s 389238 506832 nobody 19552 0.0 S 02:28 /usr/sbin/httpd -k start 167777 167758 mailman 19380 0.0 S 01:07:10 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 167767 167758 mailman 19332 0.0 S 01:07:10 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 167765 167758 mailman 19304 0.0 S 01:07:10 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 167766 167758 mailman 19300 0.0 S 01:07:10 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 167778 167758 mailman 19300 0.0 S 01:07:10 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 167760 167758 mailman 19280 0.0 S 01:07:10 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=ArchRunner:0:1 -s 167768 167758 mailman 19236 0.0 S 01:07:10 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 167761 167758 mailman 19176 0.0 S 01:07:10 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:0:2 -s 167763 167758 mailman 19176 0.0 S 01:07:10 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s 167764 167758 mailman 19128 0.0 S 01:07:10 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 390227 506832 nobody 19104 0.0 S 00:37 /usr/sbin/httpd -k start 167762 167758 mailman 19072 0.0 S 01:07:10 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 371597 1353308 cpanellogin 18940 0.0 S 08:44 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 390480 506832 nobody 18648 0.0 S 00:13 /usr/sbin/httpd -k start 390462 506832 nobody 17880 0.0 S 00:16 /usr/sbin/httpd -k start 167566 166914 netdata 17696 2.2 Sl 01:07:11 /usr/libexec/netdata/plugins.d/apps.plugin 1 390478 506832 nobody 17644 0.0 S 00:13 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 208872 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 127 kamcool/kamcool.com.au-ssl_log 22 madalice/madalice.com.au-ssl_log 20 vinesit/vinesit.com.au-ssl_log 11 evolution/evolutionerp.com.au-ssl_log 6 aaa/aaadownunder.com.au-ssl_log 4 kamcool/kamcool.com.au 3 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 127 40.115.94.245 22 195.178.110.104 11 93.152.221.226 10 34.229.62.226 3 172.93.142.4 3 118.127.40.55 2 216.73.216.222 2 170.106.113.235 2 162.241.203.67 2 114.119.146.16 1 98.82.38.120 1 66.249.73.161 1 17.166.154.153 1 161.153.46.21 1 152.53.66.203 --- top request paths across all vhosts (last 3 min) --- 43 GET /api/getItem/LWFBW2001KG 6 POST /wordpress/ 5 GET /store/hand-painted-nike-cartoonsketchy/ 4 POST /wordpress/index.php 4 GET / 2 POST /wp-cron.php 2 POST /wordpress/wp-json/Batch/v1 2 POST /wordpress/wp-json/batch/v1/ 2 POST /wordpress/wp-json/batch/v1 2 POST /wordpress//wp-json/batch/v1 2 POST /wordpress/wordpress/wp-json/batch/v1 2 POST /wordpress/blog/wp-json/batch/v1 2 POST / 2 GET /wp-login.php 2 GET /api/getItem/S2 2 GET /api/getItem/GEB12-DL 1 POST /wp-login.php 1 GET /xmlrpc.php 1 GET /www.tar.gz 1 GET /www.tar --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 43 GET /api/getItem/LWFBW2001KG 2 GET /api/getItem/S2 2 GET /api/getItem/GEB12-DL 1 GET /api/getItem/SPHDG15040 1 GET /api/getItem/S6 1 GET /api/getItem/S5 1 GET /api/getItem/S4 1 GET /api/getItem/S3 1 GET /api/getItem/S1 1 GET /api/getItem/RGW90 1 GET /api/getItem/RGW80 1 GET /api/getItem/RGW160 -- last 10 requests -- 40.115.94.245 - - [06/Sep/2026:03:29:07 +1000] "GET /api/getItem/K100MSGB HTTP/1.1" 200 1717 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:03:29:07 +1000] "GET /api/getItem/K150MSGB HTTP/1.1" 200 1437 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:03:29:08 +1000] "GET /api/getItem/RGW90 HTTP/1.1" 200 1182 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:03:29:08 +1000] "GET /api/getItem/RGW100 HTTP/1.1" 200 1732 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:03:29:09 +1000] "GET /api/getItem/RGW120 HTTP/1.1" 200 1737 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:03:29:09 +1000] "GET /api/getItem/RGW160 HTTP/1.1" 200 1607 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:03:29:09 +1000] "GET /api/getItem/RGW117T HTTP/1.1" 404 109 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:03:29:10 +1000] "GET /api/getItem/RGW80 HTTP/1.1" 200 1604 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:03:29:10 +1000] "GET /api/getItem/GP150x200x8 HTTP/1.1" 200 1522 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:03:29:11 +1000] "GET /api/getItem/K125MSGB HTTP/1.1" 200 1447 "-" "RestSharp/106.13.0.0" == kamcool/kamcool.com.au-ssl_log == -- top paths -- 6 POST /wordpress/ 4 POST /wordpress/index.php 2 POST /wordpress/wp-json/Batch/v1 2 POST /wordpress/wp-json/batch/v1/ 2 POST /wordpress/wp-json/batch/v1 2 POST /wordpress//wp-json/batch/v1 2 POST /wordpress/wordpress/wp-json/batch/v1 2 POST /wordpress/blog/wp-json/batch/v1 -- last 10 requests -- 195.178.110.104 - - [06/Sep/2026:03:27:04 +1000] "POST /wordpress/wp-json/Batch/v1 HTTP/1.1" 404 - "https://kamcool.com.au/wordpress/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G 195.178.110.104 - - [06/Sep/2026:03:27:04 +1000] "POST /wordpress//wp-json/batch/v1 HTTP/1.1" 404 - "https://kamcool.com.au/wordpress/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 195.178.110.104 - - [06/Sep/2026:03:27:05 +1000] "POST /wordpress/wp-json/batch/v1/ HTTP/1.1" 404 - "https://kamcool.com.au/wordpress/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 195.178.110.104 - - [06/Sep/2026:03:27:05 +1000] "POST /wordpress/blog/wp-json/batch/v1 HTTP/1.1" 404 - "https://kamcool.com.au/wordpress/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, l 195.178.110.104 - - [06/Sep/2026:03:27:05 +1000] "POST /wordpress/wordpress/wp-json/batch/v1 HTTP/1.1" 404 - "https://kamcool.com.au/wordpress/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT 195.178.110.104 - - [06/Sep/2026:03:27:05 +1000] "POST /wordpress/index.php?rest_route=/batch/v1 HTTP/1.1" 404 - "https://kamcool.com.au/wordpress/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 195.178.110.104 - - [06/Sep/2026:03:27:06 +1000] "POST /wordpress/index.php?rest_route=%2Fbatch%2Fv1 HTTP/1.1" 404 - "https://kamcool.com.au/wordpress/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 195.178.110.104 - - [06/Sep/2026:03:27:06 +1000] "POST /wordpress/?rest_route=%2Fbatch%2Fv1 HTTP/1.1" 404 - "https://kamcool.com.au/wordpress/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM 195.178.110.104 - - [06/Sep/2026:03:27:06 +1000] "POST /wordpress/?rest_route=/batch%2Fv1 HTTP/1.1" 404 - "https://kamcool.com.au/wordpress/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 195.178.110.104 - - [06/Sep/2026:03:27:08 +1000] "POST /wordpress/?rest_route=/batch/v1 HTTP/1.1" 404 - "https://kamcool.com.au/wordpress/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, l == madalice/madalice.com.au-ssl_log == -- top paths -- 5 GET /store/hand-painted-nike-cartoonsketchy/ 2 POST / 1 GET /www.tar.gz 1 GET /www.tar 1 GET /sitemap.xml 1 GET /robots.txt 1 GET /public_html.tar.gz 1 GET /public_html.tar 1 GET /madalice.tar.gz 1 GET /madalice.tar 1 GET /html.tar.gz 1 GET /html.tar -- last 10 requests -- 34.229.62.226 - - [06/Sep/2026:03:29:20 +1000] "GET /public_html.tar HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" 34.229.62.226 - - [06/Sep/2026:03:29:20 +1000] "GET /www.tar.gz HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" 34.229.62.226 - - [06/Sep/2026:03:29:20 +1000] "GET /www.tar HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" 34.229.62.226 - - [06/Sep/2026:03:29:20 +1000] "GET /madalice.tar HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" 34.229.62.226 - - [06/Sep/2026:03:29:20 +1000] "GET /backup.tar.gz HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" 34.229.62.226 - - [06/Sep/2026:03:29:20 +1000] "GET /backup.tar HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" 34.229.62.226 - - [06/Sep/2026:03:29:20 +1000] "GET /madalice.tar.gz HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" 34.229.62.226 - - [06/Sep/2026:03:29:20 +1000] "GET /html.tar HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" 34.229.62.226 - - [06/Sep/2026:03:29:20 +1000] "GET /public_html.tar.gz HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" 34.229.62.226 - - [06/Sep/2026:03:29:20 +1000] "GET /html.tar.gz HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" --- last 30 samples (run-up to this incident) --- 2026-09-06 03:27:15 L1=1.58 run=1 blk=1 avail=10482(76.1%) swpO=0 conn=1 myRSS=829 php=5 phpRSS=188 ap=15 tcp=24 topuser=madalice 2026-09-06 03:27:15 L1=1.58 run=2 blk=1 avail=10483(76.1%) swpO=0 conn=2 myRSS=829 php=5 phpRSS=188 ap=15 tcp=24 topuser=madalice 2026-09-06 03:27:25 L1=1.56 run=2 blk=1 avail=10448(75.8%) swpO=0 conn=1 myRSS=829 php=6 phpRSS=284 ap=14 tcp=22 topuser=madalice 2026-09-06 03:27:25 L1=1.56 run=2 blk=1 avail=10447(75.8%) swpO=0 conn=2 myRSS=829 php=6 phpRSS=284 ap=14 tcp=22 topuser=madalice 2026-09-06 03:27:35 L1=1.48 run=3 blk=1 avail=10508(76.3%) swpO=0 conn=1 myRSS=829 php=6 phpRSS=228 ap=14 tcp=23 topuser=madalice 2026-09-06 03:27:35 L1=1.48 run=3 blk=1 avail=10504(76.2%) swpO=0 conn=2 myRSS=829 php=5 phpRSS=188 ap=14 tcp=23 topuser=madalice 2026-09-06 03:27:45 L1=1.48 run=2 blk=1 avail=10512(76.3%) swpO=0 conn=1 myRSS=829 php=5 phpRSS=188 ap=14 tcp=25 topuser=madalice 2026-09-06 03:27:45 L1=1.48 run=3 blk=1 avail=10510(76.3%) swpO=0 conn=2 myRSS=829 php=5 phpRSS=188 ap=14 tcp=25 topuser=madalice 2026-09-06 03:27:55 L1=1.40 run=1 blk=1 avail=10418(75.6%) swpO=81 conn=1 myRSS=827 php=6 phpRSS=312 ap=14 tcp=24 topuser=madalice 2026-09-06 03:27:55 L1=1.40 run=4 blk=1 avail=10417(75.6%) swpO=81 conn=2 myRSS=827 php=6 phpRSS=312 ap=14 tcp=24 topuser=madalice 2026-09-06 03:28:05 L1=1.34 run=2 blk=1 avail=10442(75.8%) swpO=0 conn=1 myRSS=827 php=5 phpRSS=272 ap=13 tcp=23 topuser=madalice 2026-09-06 03:28:05 L1=1.34 run=5 blk=1 avail=10438(75.8%) swpO=0 conn=2 myRSS=827 php=5 phpRSS=273 ap=13 tcp=23 topuser=madalice 2026-09-06 03:28:15 L1=1.29 run=1 blk=1 avail=10546(76.5%) swpO=0 conn=1 myRSS=827 php=5 phpRSS=165 ap=13 tcp=25 topuser=madalice 2026-09-06 03:28:15 L1=1.29 run=2 blk=1 avail=10546(76.5%) swpO=0 conn=2 myRSS=827 php=5 phpRSS=165 ap=13 tcp=25 topuser=madalice 2026-09-06 03:28:25 L1=1.24 run=2 blk=1 avail=10562(76.7%) swpO=0 conn=1 myRSS=827 php=5 phpRSS=165 ap=13 tcp=22 topuser=madalice 2026-09-06 03:28:25 L1=1.24 run=3 blk=1 avail=10561(76.7%) swpO=0 conn=2 myRSS=827 php=5 phpRSS=165 ap=13 tcp=22 topuser=madalice 2026-09-06 03:28:35 L1=1.20 run=3 blk=1 avail=10553(76.6%) swpO=0 conn=1 myRSS=827 php=5 phpRSS=165 ap=13 tcp=23 topuser=madalice 2026-09-06 03:28:36 L1=1.20 run=4 blk=1 avail=10552(76.6%) swpO=0 conn=2 myRSS=827 php=5 phpRSS=165 ap=13 tcp=23 topuser=madalice 2026-09-06 03:28:46 L1=1.25 run=3 blk=1 avail=10531(76.4%) swpO=0 conn=1 myRSS=827 php=6 phpRSS=202 ap=13 tcp=24 topuser=madalice 2026-09-06 03:28:46 L1=1.25 run=3 blk=1 avail=10526(76.4%) swpO=0 conn=2 myRSS=827 php=6 phpRSS=205 ap=13 tcp=24 topuser=madalice 2026-09-06 03:28:56 L1=1.29 run=2 blk=1 avail=10649(77.3%) swpO=0 conn=1 myRSS=827 php=5 phpRSS=70 ap=13 tcp=21 topuser=evolution 2026-09-06 03:28:56 L1=1.29 run=3 blk=1 avail=10643(77.3%) swpO=0 conn=2 myRSS=827 php=4 phpRSS=32 ap=13 tcp=21 topuser=root 2026-09-06 03:29:06 L1=1.39 run=1 blk=1 avail=10544(76.5%) swpO=107 conn=1 myRSS=825 php=5 phpRSS=154 ap=14 tcp=21 topuser=madalice 2026-09-06 03:29:06 L1=1.39 run=3 blk=1 avail=10544(76.5%) swpO=107 conn=1 myRSS=825 php=5 phpRSS=154 ap=14 tcp=21 topuser=madalice 2026-09-06 03:29:16 L1=1.41 run=2 blk=1 avail=10427(75.7%) swpO=0 conn=3 myRSS=825 php=7 phpRSS=335 ap=14 tcp=24 topuser=madalice 2026-09-06 03:29:16 L1=1.41 run=3 blk=1 avail=10423(75.7%) swpO=0 conn=1 myRSS=825 php=7 phpRSS=338 ap=14 tcp=24 topuser=madalice 2026-09-06 03:29:26 L1=1.74 run=1 blk=1 avail=9365 (68.0%) swpO=500 conn=3 myRSS=812 php=14 phpRSS=1417 ap=29 tcp=45 topuser=madalice 2026-09-06 03:29:26 L1=1.74 run=4 blk=1 avail=9364 (68.0%) swpO=500 conn=1 myRSS=812 php=14 phpRSS=1417 ap=29 tcp=45 topuser=madalice 2026-09-06 03:29:36 L1=1.62 run=2 blk=1 avail=9327 (67.7%) swpO=0 conn=2 myRSS=812 php=15 phpRSS=1539 ap=21 tcp=28 topuser=madalice 2026-09-06 03:29:36 L1=1.62 run=5 blk=1 avail=9324 (67.7%) swpO=0 conn=1 myRSS=812 php=15 phpRSS=1541 ap=21 tcp=28 topuser=madalice