INCIDENT 2026-09-06 07:01:48 trigger: php_rss=1697MB ================================================================== load: 1.44 1.53 1.71 11/616 1131620 ncpu:10 mem_avail: 9180MB/13777MB (66.6%) swap_used:1954MB swapout:55/s blocked(D):1 running:14 iowait:9.4% steal:0.0% php: 15 procs / 1697MB heaviest user: customc (10 procs, 1537MB) apache: 14 procs tcp_estab: 38 --- RSS by user (all processes) --- USER PROCS RSS_MB customc 10 1611 root 253 956 mysql 1 797 mailman 20 266 netdata 8 241 nobody 13 215 madalice 1 130 cpanellogin 1 77 wp-toolkit 3 69 mailnull 3 57 dovenull 6 55 named 1 36 dovecot 3 21 polkitd 1 15 lowrange 1 15 aaa 1 15 evolution 11 13 zabbix 1 11 kurri 1 10 rpc 1 4 --- php workers by user --- USER PROCS RSS_MB customc 10 1625 madalice 1 130 root 1 29 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 8545 MB Active(file): 3484 MB Inactive(file): 5230 MB Dirty: 2 MB Writeback: 0 MB SReclaimable: 614 MB CommitLimit: 10984 MB Committed_AS: 8981 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1131476 root 00:10 58000 /opt/imunify360/venv/bin/python3 -m imav.run 3926885 root 5-04:39:23 5684 /usr/bin/imunify-agent-proxy 4109079 root 1-02:17:01 1764 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 1-02:17:01 81656 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 816800 2.7 Ssl 11:25:18 /usr/sbin/mariadbd 1131581 1114776 customc 190148 83.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1131580 1114794 customc 189064 94.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1131584 1120389 customc 180624 78.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 166870 1 netdata 179036 2.7 Ssl 04:39:29 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1131583 1113327 customc 176732 86.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 220206 168913 root 176392 0.0 S 04:23:31 spamd child 1131587 1118685 customc 154664 67.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1131586 1131096 customc 138776 66.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1131396 167896 madalice 133992 6.5 S 00:18 php-fpm: pool madalice_com_au 1131589 1131588 customc 128100 48.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 167871 1 root 115468 0.0 Ss 04:39:22 /usr/lib/systemd/systemd-journald 168913 1 root 99308 0.0 Ss 04:38:19 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1131579 1114665 customc 90628 88.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4109105 4109079 root 81656 2.0 Sl 1-02:17:01 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 627522 1353308 cpanellogin 79820 0.0 S 02:24:54 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 1131476 1 root 58000 13.4 Ssl 00:10 /opt/imunify360/venv/bin/python3 -m imav.run 1469 1 root 41860 0.1 Ss 68-20:52:04 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 39860 0.1 Ss 46-04:20:35 cpsrvd (SSL) - waiting for connections 167562 166914 netdata 39492 0.1 Sl 04:39:24 /usr/libexec/netdata/plugins.d/go.d.plugin 1 166645 1 wp-toolkit 38000 0.0 Ss 04:39:33 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 166809 1 named 37516 0.0 Ssl 04:39:31 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 509236 509098 root 34728 0.0 Sl 9-04:42:09 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 220207 168913 root 33948 0.0 S 04:23:31 spamd child 1131607 1353308 root 32264 0.0 S 00:00 cpsrvd (SSL) - waiting for connections 167896 1 root 29992 0.0 Ss 04:39:21 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 167845 1 wp-toolkit 27028 0.0 Ss 04:39:22 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1463 1 root 24700 0.0 Ss 68-20:52:04 tailwatchd 508720 1 mailnull 22764 0.0 Ss 9-04:42:16 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 167814 1 root 22404 0.0 Ss 04:39:22 lfd - sleeping 1114666 506832 nobody 22040 0.0 S 04:19 /usr/sbin/httpd -k start 1113327 506832 nobody 21912 0.0 S 06:17 /usr/sbin/httpd -k start 167017 1 root 21488 0.1 Ssl 04:39:28 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1114665 506832 nobody 20824 0.1 S 04:19 /usr/sbin/httpd -k start 1114794 506832 nobody 20480 0.0 S 04:03 /usr/sbin/httpd -k start 1118682 506832 nobody 20416 0.0 S 01:44 /usr/sbin/httpd -k start 1120387 506832 nobody 19920 0.0 S 01:43 /usr/sbin/httpd -k start 1130853 508720 mailnull 19636 0.0 S 00:57 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1114776 506832 nobody 19340 0.0 S 04:05 /usr/sbin/httpd -k start 1118685 506832 nobody 19304 0.1 S 01:44 /usr/sbin/httpd -k start 1120389 506832 nobody 19180 0.0 S 01:43 /usr/sbin/httpd -k start 166757 1 root 17912 0.0 Ss 04:39:32 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 1131574 508720 mailnull 16708 0.0 S 00:02 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 167566 166914 netdata 16636 2.1 Sl 04:39:24 /usr/libexec/netdata/plugins.d/apps.plugin 1 1131096 506832 nobody 16560 0.0 S 00:47 /usr/sbin/httpd -k start 166667 1 polkitd 16288 0.0 Ssl 04:39:33 /usr/lib/polkit-1/polkitd --no-debug 972770 167382 aaa 15912 0.0 S 43:45 dovecot/imap 1131588 506832 nobody 15792 0.0 S 00:01 /usr/sbin/httpd -k start 780574 167382 lowrange 15752 0.0 S 01:38:26 dovecot/imap 167772 167758 mailman 15560 0.0 S 04:39:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 167770 167758 mailman 15544 0.0 S 04:39:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 167776 167758 mailman 15440 0.0 S 04:39:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 167773 167758 mailman 15132 0.0 S 04:39:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 167775 167758 mailman 15088 0.0 S 04:39:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 167774 167758 mailman 14888 0.0 S 04:39:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 167778 167758 mailman 14616 0.0 S 04:39:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 167767 167758 mailman 14608 0.0 S 04:39:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 167765 167758 mailman 14468 0.0 S 04:39:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 167764 167758 mailman 14384 0.0 S 04:39:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 167760 167758 mailman 14224 0.0 S 04:39:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=ArchRunner:0:1 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 300794 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 161 madalice/madalice.com.au-ssl_log 13 alison/alisonarts.com.au-ssl_log 4 evolution/my.evolutionerp.com.au-ssl_log 3 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 161 40.115.94.245 3 114.119.143.104 2 52.167.144.211 1 54.87.95.7 1 52.200.58.199 1 52.167.144.186 1 44.221.180.179 1 40.77.167.14 1 40.77.167.10 1 34.205.170.13 1 3.211.181.86 1 2620:121:5043:41:86ce:: 1 217.181.88.21 1 195.63.15.204 1 18.215.77.19 --- top request paths across all vhosts (last 3 min) --- 48 GET /api/getItem/LWPB2001KG 42 GET /api/getItem/LWFBW2001KG 32 GET /api/getItem/LWHG2001KG 3 GET /store/custom-rainbow-swoosh-sneakers-copy/ 3 GET /index.php 2 GET /store/custom-rainbow-fade-monogram-shoes/ 2 GET /sitemaps.xml 2 GET /api/getItem/S4 2 GET /api/getItem/GEB12-DL 1 GET /wp-login.php 1 GET /wp-json/wp/v2/users/ 1 GET /wp-content/plugins/elementor/vendor_prefixed/twig/symfony/polyfill-php81/ 1 GET /wp-content/plugins/elementor/vendor_prefixed/twig/symfony/polyfill-mbstring/ 1 GET /wp-content/plugins/elementor/vendor_prefixed/twig/symfony/deprecation-contracts/ 1 GET /wp-content/plugins/elementor/vendor/elementor/wp-one-package/assets/build/ 1 GET /wp-content/plugins/elementor/vendor/elementor/wp-one-package/assets/ 1 GET /wp-content/plugins/elementor/includes/template-library/sources/admin-menu-items/ 1 GET /wp-content/plugins/elementor/includes/controls/ 1 GET /product-category/customised-shoes/wedding/ 1 GET /api/getItem/SPHDG15040 --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 48 GET /api/getItem/LWPB2001KG 42 GET /api/getItem/LWFBW2001KG 32 GET /api/getItem/LWHG2001KG 2 GET /api/getItem/S4 2 GET /api/getItem/GEB12-DL 1 GET /api/getItem/SPHDG15040 1 GET /api/getItem/S6 1 GET /api/getItem/S5 1 GET /api/getItem/S3 1 GET /api/getItem/S2 1 GET /api/getItem/S1 1 GET /api/getItem/KEB-8MM-CHAIN -- last 10 requests -- 40.115.94.245 - - [06/Sep/2026:07:01:27 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:01:28 +1000] "GET /api/getItem/GDB430 HTTP/1.1" 200 1666 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:01:28 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:01:28 +1000] "GET /api/getItem/GDB600 HTTP/1.1" 200 1540 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:01:28 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:01:28 +1000] "GET /api/getItem/GDB850 HTTP/1.1" 200 1668 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:01:29 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:01:29 +1000] "GET /api/getItem/FPDB900-BG HTTP/1.1" 200 1700 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:01:29 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:01:29 +1000] "GET /api/getItem/FPDB1050-BG HTTP/1.1" 200 1694 "-" "RestSharp/106.13.0.0" == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET /store/custom-rainbow-swoosh-sneakers-copy/ 2 GET /store/custom-rainbow-fade-monogram-shoes/ 1 GET /wp-content/plugins/elementor/vendor_prefixed/twig/symfony/polyfill-php81/ 1 GET /wp-content/plugins/elementor/vendor_prefixed/twig/symfony/polyfill-mbstring/ 1 GET /wp-content/plugins/elementor/vendor_prefixed/twig/symfony/deprecation-contracts/ 1 GET /wp-content/plugins/elementor/vendor/elementor/wp-one-package/assets/build/ 1 GET /wp-content/plugins/elementor/vendor/elementor/wp-one-package/assets/ 1 GET /wp-content/plugins/elementor/includes/template-library/sources/admin-menu-items/ 1 GET /wp-content/plugins/elementor/includes/controls/ 1 GET /product-category/customised-shoes/wedding/ -- last 10 requests -- 114.119.130.40 - - [06/Sep/2026:07:00:08 +1000] "GET /store/custom-rainbow-swoosh-sneakers-copy/?amp%3Brating=1&wcpr_image=1&wcpr_page=2&rating=1 HTTP/1.1" 404 36669 "https://madalice.com.au/store/custom-rainbow-swoosh-s 114.119.143.104 - - [06/Sep/2026:07:00:41 +1000] "GET /store/custom-rainbow-fade-monogram-shoes/?verified=1&wcpr_rating=5 HTTP/1.1" 200 51954 "https://madalice.com.au/store/custom-rainbow-fade-monogram-shoes/?verified=1& 54.87.95.7 - - [06/Sep/2026:07:01:01 +1000] "GET /wp-content/plugins/elementor/vendor_prefixed/twig/symfony/polyfill-php81/?C=S;O%3DD HTTP/1.1" 200 396 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; 114.119.143.104 - - [06/Sep/2026:07:01:02 +1000] "GET /store/custom-rainbow-fade-monogram-shoes/?rating=5&wcpr_rating=5 HTTP/1.1" 200 51825 "https://madalice.com.au/store/custom-rainbow-fade-monogram-shoes/?rating=5&wcpr 18.215.77.19 - - [06/Sep/2026:07:01:06 +1000] "GET /wp-content/plugins/elementor/vendor/elementor/wp-one-package/assets/?C=S;O%3DD HTTP/1.1" 200 335 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Ama 44.221.180.179 - - [06/Sep/2026:07:01:09 +1000] "GET /wp-content/plugins/elementor/vendor_prefixed/twig/symfony/polyfill-mbstring/?C=D;O%3DD HTTP/1.1" 200 411 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compa 34.205.170.13 - - [06/Sep/2026:07:01:13 +1000] "GET /wp-content/plugins/elementor/includes/template-library/sources/admin-menu-items/?C=M;O%3DD HTTP/1.1" 200 394 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; co 3.211.181.86 - - [06/Sep/2026:07:01:17 +1000] "GET /wp-content/plugins/elementor/vendor/elementor/wp-one-package/assets/build/?C=S;O%3DA HTTP/1.1" 200 426 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatibl 52.200.58.199 - - [06/Sep/2026:07:01:21 +1000] "GET /wp-content/plugins/elementor/includes/controls/?C=D;O%3DD HTTP/1.1" 200 971 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https:/ 100.28.44.58 - - [06/Sep/2026:07:01:25 +1000] "GET /wp-content/plugins/elementor/vendor_prefixed/twig/symfony/deprecation-contracts/?C=N;O%3DD HTTP/1.1" 200 357 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; com == alison/alisonarts.com.au-ssl_log == -- top paths -- 2 GET /sitemaps.xml 1 GET /wp-login.php 1 GET /wp-json/wp/v2/users/ -- last 10 requests -- 40.77.167.14 - - [06/Sep/2026:06:59:35 +1000] "GET /sitemaps.xml HTTP/1.1" 301 1 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Saf 52.167.144.186 - - [06/Sep/2026:06:59:55 +1000] "GET /sitemaps.xml HTTP/1.1" 404 9226 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.7 195.63.15.204 - - [06/Sep/2026:07:01:20 +1000] "GET /wp-login.php HTTP/1.1" 200 7418 "http://alisonarts.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0" 217.181.88.21 - - [06/Sep/2026:07:01:23 +1000] "GET /wp-json/wp/v2/users/ HTTP/1.1" 401 108 "-" "Go-http-client/1.1" --- last 30 samples (run-up to this incident) --- 2026-09-06 06:59:18 L1=2.04 run=1 blk=1 avail=10695(77.6%) swpO=0 conn=1 myRSS=797 php=4 phpRSS=29 ap=15 tcp=24 topuser=root 2026-09-06 06:59:28 L1=1.88 run=1 blk=1 avail=10575(76.8%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=162 ap=14 tcp=22 topuser=madalice 2026-09-06 06:59:28 L1=1.88 run=2 blk=1 avail=10536(76.5%) swpO=0 conn=1 myRSS=797 php=6 phpRSS=236 ap=14 tcp=24 topuser=madalice 2026-09-06 06:59:38 L1=1.90 run=1 blk=1 avail=10571(76.7%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=183 ap=14 tcp=22 topuser=madalice 2026-09-06 06:59:38 L1=1.90 run=1 blk=1 avail=10569(76.7%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=183 ap=14 tcp=22 topuser=madalice 2026-09-06 06:59:48 L1=1.91 run=1 blk=1 avail=10571(76.7%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=184 ap=14 tcp=21 topuser=madalice 2026-09-06 06:59:48 L1=1.91 run=1 blk=1 avail=10568(76.7%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=184 ap=14 tcp=21 topuser=madalice 2026-09-06 06:59:58 L1=1.77 run=1 blk=1 avail=10575(76.8%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=184 ap=13 tcp=24 topuser=madalice 2026-09-06 06:59:58 L1=1.77 run=1 blk=1 avail=10574(76.8%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=184 ap=13 tcp=24 topuser=madalice 2026-09-06 07:00:08 L1=1.73 run=2 blk=1 avail=10619(77.1%) swpO=0 conn=2 myRSS=797 php=5 phpRSS=89 ap=20 tcp=33 topuser=evolution 2026-09-06 07:00:08 L1=1.73 run=3 blk=1 avail=10614(77.0%) swpO=0 conn=1 myRSS=797 php=6 phpRSS=111 ap=20 tcp=33 topuser=evolution 2026-09-06 07:00:18 L1=1.70 run=1 blk=1 avail=10536(76.5%) swpO=0 conn=2 myRSS=797 php=6 phpRSS=225 ap=16 tcp=27 topuser=madalice 2026-09-06 07:00:18 L1=1.70 run=2 blk=1 avail=10533(76.5%) swpO=0 conn=2 myRSS=797 php=7 phpRSS=265 ap=16 tcp=27 topuser=madalice 2026-09-06 07:00:28 L1=1.59 run=1 blk=1 avail=10573(76.7%) swpO=0 conn=2 myRSS=797 php=5 phpRSS=165 ap=15 tcp=26 topuser=madalice 2026-09-06 07:00:28 L1=1.59 run=2 blk=1 avail=10568(76.7%) swpO=0 conn=2 myRSS=797 php=5 phpRSS=165 ap=15 tcp=25 topuser=madalice 2026-09-06 07:00:38 L1=1.50 run=2 blk=1 avail=10697(77.6%) swpO=0 conn=2 myRSS=797 php=4 phpRSS=29 ap=13 tcp=26 topuser=root 2026-09-06 07:00:39 L1=1.50 run=1 blk=1 avail=10696(77.6%) swpO=0 conn=2 myRSS=797 php=4 phpRSS=29 ap=13 tcp=26 topuser=root 2026-09-06 07:00:48 L1=1.42 run=1 blk=1 avail=10602(77.0%) swpO=0 conn=2 myRSS=797 php=5 phpRSS=160 ap=13 tcp=24 topuser=madalice 2026-09-06 07:00:49 L1=1.42 run=2 blk=1 avail=10563(76.7%) swpO=0 conn=2 myRSS=797 php=6 phpRSS=227 ap=13 tcp=24 topuser=madalice 2026-09-06 07:00:58 L1=1.36 run=2 blk=1 avail=10516(76.3%) swpO=0 conn=2 myRSS=797 php=6 phpRSS=211 ap=13 tcp=27 topuser=madalice 2026-09-06 07:00:59 L1=1.36 run=1 blk=1 avail=10533(76.5%) swpO=0 conn=2 myRSS=797 php=5 phpRSS=160 ap=13 tcp=26 topuser=madalice 2026-09-06 07:01:08 L1=1.45 run=2 blk=1 avail=10554(76.6%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=183 ap=14 tcp=29 topuser=madalice 2026-09-06 07:01:09 L1=1.45 run=1 blk=1 avail=10554(76.6%) swpO=0 conn=2 myRSS=797 php=5 phpRSS=183 ap=14 tcp=27 topuser=madalice 2026-09-06 07:01:18 L1=1.38 run=1 blk=1 avail=10554(76.6%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=183 ap=14 tcp=25 topuser=madalice 2026-09-06 07:01:19 L1=1.38 run=1 blk=1 avail=10552(76.6%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=183 ap=14 tcp=26 topuser=madalice 2026-09-06 07:01:28 L1=1.33 run=2 blk=1 avail=10680(77.5%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=66 ap=14 tcp=28 topuser=evolution 2026-09-06 07:01:29 L1=1.33 run=1 blk=1 avail=10682(77.5%) swpO=0 conn=1 myRSS=797 php=4 phpRSS=29 ap=14 tcp=30 topuser=root 2026-09-06 07:01:38 L1=1.35 run=1 blk=1 avail=10575(76.8%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=160 ap=14 tcp=25 topuser=madalice 2026-09-06 07:01:39 L1=1.35 run=3 blk=1 avail=10488(76.1%) swpO=0 conn=1 myRSS=797 php=6 phpRSS=245 ap=14 tcp=25 topuser=madalice 2026-09-06 07:01:48 L1=1.44 run=14 blk=1 avail=9180 (66.6%) swpO=55 conn=11 myRSS=797 php=15 phpRSS=1697 ap=14 tcp=38 topuser=customc