INCIDENT 2026-09-06 08:54:44 trigger: php_rss=1599MB ================================================================== load: 2.86 1.78 1.57 1/666 1507226 ncpu:10 mem_avail: 8898MB/13777MB (64.6%) swap_used:1996MB swapout:301/s blocked(D):1 running:1 iowait:7.2% steal:0.0% php: 14 procs / 1599MB heaviest user: madalice (10 procs, 1575MB) apache: 51 procs tcp_estab: 58 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 10 1575 root 253 978 mysql 1 950 nobody 50 808 netdata 8 251 mailman 20 211 wp-toolkit 3 64 dovenull 6 54 cpanellogin 1 53 mailnull 2 35 named 1 29 dovecot 3 22 otterfencing 1 20 polkitd 1 15 vinesit 1 14 lowrange 1 14 infinium 1 14 corpkicks 1 14 evolution 11 12 zabbix 1 11 --- php workers by user --- USER PROCS RSS_MB madalice 10 1575 otterfencing 1 32 root 1 24 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7514 MB Active(file): 3641 MB Inactive(file): 4060 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 586 MB CommitLimit: 10984 MB Committed_AS: 9719 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 5-06:32:18 5480 /usr/bin/imunify-agent-proxy 4109079 root 1-04:09:56 1776 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 1-04:09:56 93868 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 972820 2.7 Ssl 13:18:13 /usr/sbin/mariadbd 166870 1 netdata 184248 2.6 Ssl 06:32:24 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 220206 168913 root 178080 0.0 S 06:16:26 spamd child 1507150 167896 madalice 161864 57.1 S 00:07 php-fpm: pool madalice_com_au 1507149 167896 madalice 161560 43.8 S 00:07 php-fpm: pool madalice_com_au 1507147 167896 madalice 161556 45.1 S 00:07 php-fpm: pool madalice_com_au 1507145 167896 madalice 161548 43.2 S 00:07 php-fpm: pool madalice_com_au 1507146 167896 madalice 161544 43.5 S 00:07 php-fpm: pool madalice_com_au 1507148 167896 madalice 161532 43.8 S 00:07 php-fpm: pool madalice_com_au 1507156 167896 madalice 160940 51.1 S 00:06 php-fpm: pool madalice_com_au 1507151 167896 madalice 160936 48.8 S 00:06 php-fpm: pool madalice_com_au 1507152 167896 madalice 160928 51.0 S 00:06 php-fpm: pool madalice_com_au 1507153 167896 madalice 160928 51.3 S 00:06 php-fpm: pool madalice_com_au 220207 168913 root 145332 0.0 S 06:16:26 spamd child 167871 1 root 108392 0.0 Ss 06:32:17 /usr/lib/systemd/systemd-journald 168913 1 root 96140 0.0 Ss 06:31:14 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4109105 4109079 root 93868 1.9 Sl 1-04:09:56 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1369234 1353308 cpanellogin 54552 0.0 S 43:01 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 1507213 1506871 otterfencing 52764 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 167562 166914 netdata 42512 0.1 Sl 06:32:19 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1353308 1 root 42048 0.1 Ss 46-06:13:30 cpsrvd (SSL) - waiting for connections 1469 1 root 41556 0.1 Ss 68-22:44:59 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 166645 1 wp-toolkit 35144 0.0 Ss 06:32:28 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 509236 509098 root 34144 0.0 Sl 9-06:35:04 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166809 1 named 30448 0.0 Ssl 06:32:26 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 167896 1 root 24628 0.0 Ss 06:32:16 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 167845 1 wp-toolkit 24524 0.0 Ss 06:32:17 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1463 1 root 23948 0.0 Ss 68-22:44:59 tailwatchd 1489304 506832 nobody 22088 0.0 S 06:24 /usr/sbin/httpd -k start 1488618 506832 nobody 21880 0.0 S 07:52 /usr/sbin/httpd -k start 1504645 506832 nobody 21880 0.0 S 04:07 /usr/sbin/httpd -k start 1504659 506832 nobody 21436 0.0 S 04:06 /usr/sbin/httpd -k start 167814 1 root 20420 0.0 Ss 06:32:17 lfd - sleeping 1504642 506832 nobody 20288 0.0 S 04:07 /usr/sbin/httpd -k start 1504638 506832 nobody 20008 0.0 S 04:08 /usr/sbin/httpd -k start 1504627 506832 nobody 19912 0.0 S 04:09 /usr/sbin/httpd -k start 508720 1 mailnull 19704 0.0 Ss 9-06:35:11 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1505966 506832 nobody 19684 0.2 S 02:06 /usr/sbin/httpd -k start 1506870 506832 nobody 18884 0.1 S 00:30 /usr/sbin/httpd -k start 1506789 506832 nobody 18720 0.0 S 00:39 /usr/sbin/httpd -k start 1506871 506832 nobody 18672 0.1 S 00:30 /usr/sbin/httpd -k start 1506859 506832 nobody 18612 0.0 S 00:31 /usr/sbin/httpd -k start 1506864 506832 nobody 18548 0.1 S 00:30 /usr/sbin/httpd -k start 1506857 506832 nobody 18300 0.0 S 00:31 /usr/sbin/httpd -k start 1506865 506832 nobody 18280 0.0 S 00:30 /usr/sbin/httpd -k start 1506867 506832 nobody 18260 0.0 S 00:30 /usr/sbin/httpd -k start 167017 1 root 18220 0.1 Ssl 06:32:23 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1507154 506832 nobody 18016 0.1 S 00:06 /usr/sbin/httpd -k start 1507167 506832 nobody 17948 0.4 S 00:05 /usr/sbin/httpd -k start 1507179 506832 nobody 17864 0.5 S 00:04 /usr/sbin/httpd -k start 167566 166914 netdata 17528 2.1 Sl 06:32:19 /usr/libexec/netdata/plugins.d/apps.plugin 1 1506914 506832 nobody 16940 0.0 S 00:29 /usr/sbin/httpd -k start 1506903 506832 nobody 16936 0.0 S 00:29 /usr/sbin/httpd -k start 1506843 506832 nobody 16888 0.0 S 00:33 /usr/sbin/httpd -k start 1506170 506832 nobody 16808 0.0 S 01:49 /usr/sbin/httpd -k start 1488617 506832 nobody 16804 0.0 S 07:52 /usr/sbin/httpd -k start 1506913 506832 nobody 16664 0.0 S 00:29 /usr/sbin/httpd -k start 1506849 506832 nobody 16588 0.0 S 00:32 /usr/sbin/httpd -k start 1507089 508720 mailnull 16548 0.0 S 00:10 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1506950 506832 nobody 16460 0.0 S 00:27 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 353605 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 148 speedlin/speedlinefencing.com.au-ssl_log 127 madalice/madalice.com.au-ssl_log 34 corpkicks/corporatekicks.com.au-ssl_log 2 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 148 40.115.94.245 127 4.204.224.164 19 34.65.32.5 6 118.127.40.55 2 2403:5805:c2ad:0:205b:3879:f316:12bc 2 149.167.44.186 2 114.119.131.88 1 47.128.17.162 1 114.119.159.70 1 114.119.143.104 1 114.119.140.234 1 114.119.137.101 --- top request paths across all vhosts (last 3 min) --- 52 GET /api/getItem/LWHG2001KG 6 POST / 5 GET /store/custom-af1-drippy-swoosh/ 4 GET /api/getItem/PWFBW3151KG 3 GET /admin.php 3 GET / 2 GET /wp-content/themes/index.php 2 GET /av.php 2 GET /api/getItem/SHSG404016-DP25-24-DI-110 2 GET /api/getItem/CLSGNSTD45250KK 1 POST /wp-cron.php 1 GET /xs.php 1 GET /xiugai.php 1 GET /wss.php 1 GET /wp-temp.php 1 GET /wp.php 1 GET /wp-manager.php 1 GET /wp-includes/Text/Diff/Engine/about.php 1 GET /wp-includes/Requests/ 1 GET /wp-includes/l10n/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 52 GET /api/getItem/LWHG2001KG 4 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/SHSG404016-DP25-24-DI-110 2 GET /api/getItem/CLSGNSTD45250KK 1 GET /api/getItem/SHSG909020-8 1 GET /api/getItem/SHSG898950-8 1 GET /api/getItem/SHSG898935-8 1 GET /api/getItem/SHSG898930-8 1 GET /api/getItem/SHSG898920-8 1 GET /api/getItem/SHSG757550-8 1 GET /api/getItem/SHSG757540-8 1 GET /api/getItem/SHSG757530-8 -- last 10 requests -- 40.115.94.245 - - [06/Sep/2026:08:54:15 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:08:54:15 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:08:54:15 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:08:54:16 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:08:54:16 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:08:54:16 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:08:54:17 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:08:54:18 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:08:54:18 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:08:54:18 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 3 GET /admin.php 2 GET /wp-content/themes/index.php 2 GET /av.php 1 GET /xs.php 1 GET /xiugai.php 1 GET /wss.php 1 GET /wp-temp.php 1 GET /wp.php 1 GET /wp-manager.php 1 GET /wp-includes/Text/Diff/Engine/about.php 1 GET /wp-includes/Requests/ 1 GET /wp-includes/l10n/ -- last 10 requests -- 4.204.224.164 - - [06/Sep/2026:08:52:56 +1000] "GET /8xmlr9ommwdy3ro8dCdefault.php HTTP/1.1" 404 5750 "-" "-" 4.204.224.164 - - [06/Sep/2026:08:52:56 +1000] "GET /fms.php HTTP/1.1" 404 5750 "-" "-" 4.204.224.164 - - [06/Sep/2026:08:52:56 +1000] "GET /0day.php HTTP/1.1" 404 5750 "-" "-" 4.204.224.164 - - [06/Sep/2026:08:52:57 +1000] "GET /das.php HTTP/1.1" 404 5750 "-" "-" 4.204.224.164 - - [06/Sep/2026:08:52:57 +1000] "GET /wss.php HTTP/1.1" 404 5750 "-" "-" 4.204.224.164 - - [06/Sep/2026:08:52:58 +1000] "GET /fw.php HTTP/1.1" 404 5750 "-" "-" 4.204.224.164 - - [06/Sep/2026:08:52:58 +1000] "GET /waa.php HTTP/1.1" 404 5750 "-" "-" 4.204.224.164 - - [06/Sep/2026:08:52:59 +1000] "GET /By4mzbsowFX.php HTTP/1.1" 404 5750 "-" "-" 4.204.224.164 - - [06/Sep/2026:08:52:59 +1000] "GET /cycfruf.php HTTP/1.1" 404 5750 "-" "-" 4.204.224.164 - - [06/Sep/2026:08:52:59 +1000] "GET /csknilus.php HTTP/1.1" 404 5750 "-" "-" == madalice/madalice.com.au-ssl_log == -- top paths -- 6 POST / 5 GET /store/custom-af1-drippy-swoosh/ 3 GET / 1 GET /wp-config.php.swp 1 GET /wp-config.php.bak 1 GET /wp-config.php~ 1 GET /store/custom-afl-carlton-kids/ 1 GET /storage/logs/laravel.log 1 GET /_ignition/health-check 1 GET /.env.save 1 GET /.env.production 1 GET /.env.prod -- last 10 requests -- 34.65.32.5 - - [06/Sep/2026:08:54:37 +1000] "GET /_ignition/health-check HTTP/1.1" 404 122872 "-" "crusader-worker/1.0" 34.65.32.5 - - [06/Sep/2026:08:54:37 +1000] "GET /storage/logs/laravel.log HTTP/1.1" 404 122872 "-" "crusader-worker/1.0" 34.65.32.5 - - [06/Sep/2026:08:54:37 +1000] "GET /.env.old HTTP/1.1" 404 122872 "-" "crusader-worker/1.0" 34.65.32.5 - - [06/Sep/2026:08:54:37 +1000] "GET /actuator/env HTTP/1.1" 404 122872 "-" "crusader-worker/1.0" 34.65.32.5 - - [06/Sep/2026:08:54:37 +1000] "GET /crusader-404-probe HTTP/1.1" 404 122872 "-" "crusader-worker/1.0" 118.127.40.55 - - [06/Sep/2026:08:54:38 +1000] "POST /?wordfence_syncAttackData=1788648878.2526 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://madalice.com.au" 118.127.40.55 - - [06/Sep/2026:08:54:38 +1000] "POST /?wordfence_syncAttackData=1788648878.255 HTTP/1.1" 200 42763 "-" "WordPress/7.1; https://madalice.com.au" 118.127.40.55 - - [06/Sep/2026:08:54:38 +1000] "POST /?wordfence_syncAttackData=1788648878.2278 HTTP/1.1" 200 42768 "-" "WordPress/7.1; https://madalice.com.au" 118.127.40.55 - - [06/Sep/2026:08:54:38 +1000] "POST /?wordfence_syncAttackData=1788648878.2816 HTTP/1.1" 200 42769 "-" "WordPress/7.1; https://madalice.com.au" 118.127.40.55 - - [06/Sep/2026:08:54:38 +1000] "POST /?wordfence_syncAttackData=1788648878.3353 HTTP/1.1" 200 42766 "-" "WordPress/7.1; https://madalice.com.au" --- last 30 samples (run-up to this incident) --- 2026-09-06 08:52:15 L1=1.46 run=1 blk=1 avail=10399(75.5%) swpO=0 conn=1 myRSS=956 php=5 phpRSS=156 ap=14 tcp=28 topuser=madalice 2026-09-06 08:52:23 L1=1.46 run=1 blk=1 avail=10519(76.4%) swpO=0 conn=1 myRSS=956 php=4 phpRSS=24 ap=14 tcp=27 topuser=root 2026-09-06 08:52:25 L1=1.46 run=2 blk=1 avail=10517(76.3%) swpO=0 conn=1 myRSS=956 php=4 phpRSS=24 ap=14 tcp=27 topuser=root 2026-09-06 08:52:33 L1=1.55 run=3 blk=1 avail=10400(75.5%) swpO=0 conn=1 myRSS=956 php=5 phpRSS=156 ap=14 tcp=27 topuser=madalice 2026-09-06 08:52:35 L1=1.55 run=2 blk=1 avail=10407(75.5%) swpO=0 conn=1 myRSS=956 php=5 phpRSS=156 ap=14 tcp=29 topuser=madalice 2026-09-06 08:52:43 L1=1.61 run=3 blk=1 avail=10260(74.5%) swpO=0 conn=1 myRSS=956 php=6 phpRSS=299 ap=19 tcp=23 topuser=madalice 2026-09-06 08:52:45 L1=1.61 run=1 blk=1 avail=10264(74.5%) swpO=0 conn=1 myRSS=956 php=6 phpRSS=299 ap=17 tcp=26 topuser=madalice 2026-09-06 08:52:53 L1=1.60 run=2 blk=1 avail=10258(74.5%) swpO=21 conn=1 myRSS=956 php=6 phpRSS=299 ap=17 tcp=26 topuser=madalice 2026-09-06 08:52:55 L1=1.60 run=1 blk=1 avail=10233(74.3%) swpO=21 conn=1 myRSS=956 php=6 phpRSS=300 ap=20 tcp=32 topuser=madalice 2026-09-06 08:53:03 L1=1.59 run=2 blk=1 avail=10236(74.3%) swpO=0 conn=1 myRSS=956 php=6 phpRSS=300 ap=19 tcp=27 topuser=madalice 2026-09-06 08:53:05 L1=1.59 run=1 blk=1 avail=10242(74.3%) swpO=0 conn=1 myRSS=956 php=6 phpRSS=300 ap=17 tcp=25 topuser=madalice 2026-09-06 08:53:14 L1=1.57 run=1 blk=1 avail=10267(74.5%) swpO=0 conn=1 myRSS=956 php=6 phpRSS=300 ap=14 tcp=25 topuser=madalice 2026-09-06 08:53:16 L1=1.57 run=4 blk=1 avail=10265(74.5%) swpO=0 conn=1 myRSS=956 php=6 phpRSS=300 ap=14 tcp=26 topuser=madalice 2026-09-06 08:53:24 L1=1.56 run=1 blk=1 avail=10289(74.7%) swpO=0 conn=1 myRSS=956 php=6 phpRSS=277 ap=14 tcp=25 topuser=madalice 2026-09-06 08:53:26 L1=1.56 run=1 blk=1 avail=10288(74.7%) swpO=0 conn=1 myRSS=956 php=6 phpRSS=277 ap=14 tcp=25 topuser=madalice 2026-09-06 08:53:34 L1=1.47 run=1 blk=1 avail=10233(74.3%) swpO=0 conn=1 myRSS=956 php=6 phpRSS=310 ap=16 tcp=34 topuser=madalice 2026-09-06 08:53:36 L1=1.47 run=1 blk=1 avail=10206(74.1%) swpO=0 conn=1 myRSS=956 php=6 phpRSS=310 ap=20 tcp=33 topuser=madalice 2026-09-06 08:53:44 L1=1.40 run=1 blk=1 avail=10265(74.5%) swpO=0 conn=1 myRSS=956 php=6 phpRSS=310 ap=14 tcp=21 topuser=madalice 2026-09-06 08:53:46 L1=1.40 run=2 blk=1 avail=10257(74.4%) swpO=0 conn=1 myRSS=956 php=7 phpRSS=350 ap=13 tcp=21 topuser=madalice 2026-09-06 08:53:54 L1=1.56 run=1 blk=1 avail=10372(75.3%) swpO=0 conn=1 myRSS=957 php=5 phpRSS=178 ap=13 tcp=24 topuser=madalice 2026-09-06 08:53:56 L1=1.56 run=1 blk=1 avail=10372(75.3%) swpO=0 conn=2 myRSS=957 php=6 phpRSS=203 ap=13 tcp=25 topuser=madalice 2026-09-06 08:54:04 L1=1.47 run=2 blk=1 avail=10305(74.8%) swpO=0 conn=1 myRSS=957 php=6 phpRSS=278 ap=13 tcp=28 topuser=madalice 2026-09-06 08:54:06 L1=1.47 run=2 blk=1 avail=10333(75.0%) swpO=0 conn=2 myRSS=957 php=6 phpRSS=248 ap=14 tcp=28 topuser=madalice 2026-09-06 08:54:14 L1=1.55 run=1 blk=1 avail=10407(75.5%) swpO=0 conn=1 myRSS=957 php=4 phpRSS=24 ap=29 tcp=48 topuser=root 2026-09-06 08:54:16 L1=1.55 run=1 blk=1 avail=10190(74.0%) swpO=0 conn=2 myRSS=957 php=5 phpRSS=156 ap=45 tcp=49 topuser=madalice 2026-09-06 08:54:24 L1=1.93 run=2 blk=2 avail=10178(73.9%) swpO=281 conn=1 myRSS=955 php=5 phpRSS=156 ap=45 tcp=43 topuser=madalice 2026-09-06 08:54:26 L1=1.93 run=1 blk=1 avail=10171(73.8%) swpO=281 conn=2 myRSS=955 php=5 phpRSS=156 ap=44 tcp=62 topuser=madalice 2026-09-06 08:54:34 L1=1.78 run=2 blk=1 avail=10035(72.8%) swpO=0 conn=1 myRSS=955 php=7 phpRSS=361 ap=43 tcp=58 topuser=tubesupplies 2026-09-06 08:54:36 L1=1.78 run=2 blk=1 avail=10185(73.9%) swpO=0 conn=2 myRSS=955 php=5 phpRSS=156 ap=43 tcp=54 topuser=madalice 2026-09-06 08:54:44 L1=2.86 run=1 blk=1 avail=8898 (64.6%) swpO=301 conn=1 myRSS=950 php=14 phpRSS=1599 ap=51 tcp=58 topuser=madalice