INCIDENT 2026-09-06 11:14:37 trigger: php_rss=1593MB ================================================================== load: 1.15 1.30 1.43 19/685 1984417 ncpu:10 mem_avail: 8844MB/13777MB (64.2%) swap_used:2135MB swapout:419/s blocked(D):1 running:17 iowait:8.0% steal:0.0% php: 16 procs / 1593MB heaviest user: madalice (10 procs, 1489MB) apache: 73 procs tcp_estab: 51 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 10 1593 nobody 72 1083 mysql 1 1061 root 256 886 netdata 8 244 mailman 20 184 evolution 13 92 cpanellogin 1 91 wp-toolkit 3 63 dovenull 6 56 named 1 25 dovecot 3 23 mailnull 1 17 candyfabcom 1 13 polkitd 1 12 zabbix 1 11 kurri 1 9 rpc 1 4 nscd 1 4 dbus 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1622 evolution 5 40 root 1 23 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7314 MB Active(file): 3279 MB Inactive(file): 4219 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 609 MB CommitLimit: 10984 MB Committed_AS: 10092 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1933746 root 14:36 1268 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 5-08:52:11 5860 /usr/bin/imunify-agent-proxy 4109079 root 1-06:29:49 1776 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 1-06:29:49 63660 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 1087352 2.8 Ssl 15:38:06 /usr/sbin/mariadbd 1984355 167896 madalice 208684 75.0 R 00:03 php-fpm: pool madalice_com_au 1984357 167896 madalice 201680 73.3 R 00:03 php-fpm: pool madalice_com_au 1984358 167896 madalice 197124 74.3 R 00:03 php-fpm: pool madalice_com_au 1984353 167896 madalice 187040 72.3 R 00:03 php-fpm: pool madalice_com_au 166870 1 netdata 182292 2.6 Ssl 08:52:17 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 220206 168913 root 179556 0.0 S 08:36:19 spamd child 1984356 167896 madalice 172496 72.3 R 00:03 php-fpm: pool madalice_com_au 1984354 167896 madalice 162940 70.6 R 00:03 php-fpm: pool madalice_com_au 1984352 167896 madalice 154760 73.6 R 00:03 php-fpm: pool madalice_com_au 1984359 167896 madalice 152988 67.0 R 00:03 php-fpm: pool madalice_com_au 1984360 167896 madalice 144200 62.3 R 00:03 php-fpm: pool madalice_com_au 167871 1 root 142800 0.0 Ss 08:52:10 /usr/lib/systemd/systemd-journald 1984362 167896 madalice 139432 72.5 R 00:02 php-fpm: pool madalice_com_au 168913 1 root 96072 0.0 Ss 08:51:07 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1882716 1353308 cpanellogin 93576 0.0 S 29:50 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 4109105 4109079 root 63660 1.8 Sl 1-06:29:49 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 220207 168913 root 56848 0.0 S 08:36:19 spamd child 1353308 1 root 42004 0.1 Ss 46-08:33:23 cpsrvd (SSL) - waiting for connections 1469 1 root 41968 0.1 Ss 69-01:04:52 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 167562 166914 netdata 37696 0.1 Sl 08:52:12 /usr/libexec/netdata/plugins.d/go.d.plugin 1 166645 1 wp-toolkit 34756 0.0 Ss 08:52:21 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 509236 509098 root 34584 0.0 Sl 9-08:54:57 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166809 1 named 26276 0.0 Ssl 08:52:19 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1463 1 root 24624 0.0 Ss 69-01:04:52 tailwatchd 167896 1 root 24568 0.0 Ss 08:52:09 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 167845 1 wp-toolkit 24244 0.0 Ss 08:52:10 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1982847 506832 nobody 19220 0.0 S 02:25 /usr/sbin/httpd -k start 1982827 506832 nobody 19192 0.0 S 02:26 /usr/sbin/httpd -k start 1982840 506832 nobody 19016 0.0 S 02:25 /usr/sbin/httpd -k start 1984044 506832 nobody 18680 0.0 S 00:40 /usr/sbin/httpd -k start 1983966 506832 nobody 18584 0.0 S 00:42 /usr/sbin/httpd -k start 1984031 506832 nobody 18432 0.0 S 00:40 /usr/sbin/httpd -k start 1983978 506832 nobody 18244 0.0 S 00:42 /usr/sbin/httpd -k start 1983984 506832 nobody 18240 0.0 S 00:41 /usr/sbin/httpd -k start 167814 1 root 18212 0.0 Ss 08:52:10 lfd - sleeping 1983974 506832 nobody 18208 0.0 S 00:42 /usr/sbin/httpd -k start 1983979 506832 nobody 18192 0.0 S 00:42 /usr/sbin/httpd -k start 1983972 506832 nobody 18156 0.0 S 00:42 /usr/sbin/httpd -k start 1983985 506832 nobody 18156 0.0 S 00:41 /usr/sbin/httpd -k start 1983976 506832 nobody 18140 0.0 S 00:42 /usr/sbin/httpd -k start 1983969 506832 nobody 18120 0.0 S 00:42 /usr/sbin/httpd -k start 1983983 506832 nobody 18092 0.0 S 00:41 /usr/sbin/httpd -k start 1983987 506832 nobody 18092 0.0 S 00:41 /usr/sbin/httpd -k start 1984021 506832 nobody 18036 0.0 S 00:40 /usr/sbin/httpd -k start 1984032 506832 nobody 17908 0.0 S 00:40 /usr/sbin/httpd -k start 508720 1 mailnull 17784 0.0 Ss 9-08:55:04 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 167566 166914 netdata 17528 2.1 Sl 08:52:12 /usr/libexec/netdata/plugins.d/apps.plugin 1 1984026 506832 nobody 17272 0.0 S 00:40 /usr/sbin/httpd -k start 1982823 506832 nobody 17140 0.0 S 02:26 /usr/sbin/httpd -k start 1982811 506832 nobody 17132 0.0 S 02:26 /usr/sbin/httpd -k start 1982774 506832 nobody 17088 0.0 S 02:28 /usr/sbin/httpd -k start 1982843 506832 nobody 17004 0.0 S 02:25 /usr/sbin/httpd -k start 1982804 506832 nobody 16812 0.0 S 02:26 /usr/sbin/httpd -k start 1982853 506832 nobody 16640 0.0 S 02:25 /usr/sbin/httpd -k start 1982787 506832 nobody 16632 0.0 S 02:27 /usr/sbin/httpd -k start 1982820 506832 nobody 16616 0.0 S 02:26 /usr/sbin/httpd -k start 1983955 506832 nobody 16580 0.0 S 00:43 /usr/sbin/httpd -k start 1982863 506832 nobody 16572 0.0 S 02:25 /usr/sbin/httpd -k start 167017 1 root 16568 0.1 Ssl 08:52:16 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 429783 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min aaa/aaadownunder.com.au-ssl_log 194 evolution/app.evolutionerp.com.au-ssl_log 133 cosgrovecreative/cosgrovecreative.com.au-ssl_log 52 madalice/madalice.com.au-ssl_log 10 alison/alisonarts.com.au-ssl_log 4 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 133 40.115.94.245 133 35.196.166.33 81 35.229.197.126 30 4.204.224.164 4 34.90.115.63 2 188.239.38.234 2 114.119.137.101 2 103.168.66.229 1 66.249.73.172 1 209.141.37.195 1 118.127.40.55 1 114.119.146.16 1 114.119.143.104 1 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 97 GET /api/getItem/LWPB2001KG 5 GET /store/airmax-90-sneakers/ 3 GET /api/getItem/SHSG656516 2 GET /.zshrc 2 GET /.zsh_history 2 GET /.zprofile 2 GET /www.zip 2 GET /web.zip 2 GET /sql.gz 2 GET /site.zip 2 GET /secrets.yml 2 GET /secrets.yaml 2 GET /.secrets 2 GET /.python_history 2 GET /public_html.zip 2 GET /.psql_history 2 GET /proxy_config.yaml 2 GET /.profile 2 GET /phpinfo.php 2 GET /.openai --- busiest 3 vhosts: top paths + last 10 requests --- == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 1 POST /wp-login.php 1 POST /wp-cron.php 1 GET /.zshrc 1 GET /.zsh_history 1 GET /.zprofile 1 GET /xex.php 1 GET /www.zip 1 GET /w.php 1 GET /wp-content/uploads/ 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp_blog_footer.php 1 GET /web.zip -- last 10 requests -- 35.229.197.126 - - [06/Sep/2026:11:14:14 +1000] "-" 408 - "-" "-" 35.229.197.126 - - [06/Sep/2026:11:14:15 +1000] "-" 408 - "-" "-" 35.229.197.126 - - [06/Sep/2026:11:14:15 +1000] "-" 408 - "-" "-" 35.229.197.126 - - [06/Sep/2026:11:14:15 +1000] "-" 408 - "-" "-" 35.229.197.126 - - [06/Sep/2026:11:14:15 +1000] "-" 408 - "-" "-" 35.229.197.126 - - [06/Sep/2026:11:14:15 +1000] "-" 408 - "-" "-" 35.229.197.126 - - [06/Sep/2026:11:14:15 +1000] "-" 408 - "-" "-" 35.229.197.126 - - [06/Sep/2026:11:14:15 +1000] "-" 408 - "-" "-" 35.229.197.126 - - [06/Sep/2026:11:14:15 +1000] "-" 408 - "-" "-" 35.229.197.126 - - [06/Sep/2026:11:14:15 +1000] "-" 408 - "-" "-" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 97 GET /api/getItem/LWPB2001KG 3 GET /api/getItem/SHSG656516 2 GET /api/getItem/SHSG656520 2 GET /api/getItem/PXLG20 1 GET /api/getItem/SHSG505050 1 GET /api/getItem/SHSG505040 1 GET /api/getItem/SHSG505030 1 GET /api/getItem/SHSG505025 1 GET /api/getItem/SHSG505020 1 GET /api/getItem/SHSG505016 1 GET /api/getItem/SHSG404030 1 GET /api/getItem/SHSG404025 -- last 10 requests -- 40.115.94.245 - - [06/Sep/2026:11:13:34 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:11:14:34 +1000] "GET /api/getItem/SHSG656516 HTTP/1.1" 200 1591 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:11:14:34 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:11:14:35 +1000] "GET /api/getItem/SHSG656520 HTTP/1.1" 200 1595 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:11:14:35 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:11:14:35 +1000] "GET /api/getItem/SHSG656516 HTTP/1.1" 200 1591 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:11:14:35 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:11:14:36 +1000] "GET /api/getItem/SHSG656520 HTTP/1.1" 200 1595 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:11:14:36 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:11:14:36 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 1 GET /.zshrc 1 GET /.zsh_history 1 GET /.zprofile 1 GET /www.zip 1 GET /web.zip 1 GET /sql.gz 1 GET /site.zip 1 GET /secrets.yml 1 GET /secrets.yaml 1 GET /.secrets 1 GET /.python_history 1 GET /public_html.zip -- last 10 requests -- 35.229.197.126 - - [06/Sep/2026:11:13:51 +1000] "GET /.config/fish/config.fish HTTP/1.1" 404 5750 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.229.197.126 - - [06/Sep/2026:11:13:51 +1000] "GET /.secrets HTTP/1.1" 404 5750 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.229.197.126 - - [06/Sep/2026:11:13:51 +1000] "GET /secrets.yaml HTTP/1.1" 404 5750 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.229.197.126 - - [06/Sep/2026:11:13:51 +1000] "GET /secrets.yml HTTP/1.1" 404 5750 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.229.197.126 - - [06/Sep/2026:11:13:51 +1000] "GET /Admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.229.197.126 - - [06/Sep/2026:11:13:51 +1000] "GET /phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.229.197.126 - - [06/Sep/2026:11:13:51 +1000] "GET /admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.229.197.126 - - [06/Sep/2026:11:13:51 +1000] "GET /api/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.229.197.126 - - [06/Sep/2026:11:13:51 +1000] "GET /info.php HTTP/1.1" 404 5750 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.229.197.126 - - [06/Sep/2026:11:13:51 +1000] "GET /.htaccess HTTP/1.1" 404 5750 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-06 11:12:07 L1=1.17 run=1 blk=1 avail=10370(75.3%) swpO=0 conn=1 myRSS=1069 php=4 phpRSS=24 ap=16 tcp=114 topuser=root 2026-09-06 11:12:16 L1=1.22 run=2 blk=1 avail=9774 (70.9%) swpO=0 conn=1 myRSS=1069 php=6 phpRSS=155 ap=106 tcp=106 topuser=madalice 2026-09-06 11:12:17 L1=1.22 run=2 blk=1 avail=9791 (71.1%) swpO=0 conn=1 myRSS=1069 php=5 phpRSS=155 ap=104 tcp=106 topuser=madalice 2026-09-06 11:12:26 L1=1.19 run=1 blk=1 avail=9830 (71.4%) swpO=0 conn=1 myRSS=1069 php=5 phpRSS=155 ap=98 tcp=103 topuser=madalice 2026-09-06 11:12:27 L1=1.19 run=1 blk=1 avail=9831 (71.4%) swpO=0 conn=1 myRSS=1069 php=5 phpRSS=155 ap=98 tcp=103 topuser=madalice 2026-09-06 11:12:36 L1=1.16 run=2 blk=1 avail=9763 (70.9%) swpO=0 conn=1 myRSS=1069 php=5 phpRSS=270 ap=92 tcp=20 topuser=madalice 2026-09-06 11:12:37 L1=1.16 run=1 blk=1 avail=9865 (71.6%) swpO=0 conn=1 myRSS=1069 php=5 phpRSS=177 ap=90 tcp=20 topuser=madalice 2026-09-06 11:12:46 L1=1.13 run=1 blk=1 avail=9917 (72.0%) swpO=0 conn=1 myRSS=1069 php=5 phpRSS=177 ap=82 tcp=22 topuser=madalice 2026-09-06 11:12:47 L1=1.13 run=1 blk=1 avail=9929 (72.1%) swpO=0 conn=1 myRSS=1069 php=5 phpRSS=177 ap=80 tcp=22 topuser=madalice 2026-09-06 11:12:56 L1=1.11 run=2 blk=1 avail=9986 (72.5%) swpO=0 conn=1 myRSS=1069 php=5 phpRSS=179 ap=72 tcp=23 topuser=madalice 2026-09-06 11:12:57 L1=1.11 run=1 blk=1 avail=9994 (72.5%) swpO=0 conn=1 myRSS=1069 php=5 phpRSS=179 ap=70 tcp=22 topuser=madalice 2026-09-06 11:13:06 L1=1.10 run=1 blk=1 avail=10055(73.0%) swpO=1 conn=1 myRSS=1069 php=5 phpRSS=179 ap=62 tcp=21 topuser=madalice 2026-09-06 11:13:07 L1=1.10 run=1 blk=1 avail=10065(73.1%) swpO=1 conn=1 myRSS=1069 php=5 phpRSS=179 ap=60 tcp=21 topuser=madalice 2026-09-06 11:13:16 L1=1.08 run=1 blk=1 avail=10110(73.4%) swpO=31 conn=1 myRSS=1069 php=5 phpRSS=178 ap=52 tcp=24 topuser=madalice 2026-09-06 11:13:18 L1=1.08 run=2 blk=1 avail=10066(73.1%) swpO=28 conn=1 myRSS=1069 php=6 phpRSS=264 ap=50 tcp=24 topuser=madalice 2026-09-06 11:13:26 L1=1.14 run=1 blk=1 avail=10178(73.9%) swpO=0 conn=1 myRSS=1069 php=5 phpRSS=178 ap=41 tcp=26 topuser=madalice 2026-09-06 11:13:28 L1=1.14 run=3 blk=1 avail=10188(74.0%) swpO=0 conn=1 myRSS=1069 php=5 phpRSS=178 ap=40 tcp=27 topuser=madalice 2026-09-06 11:13:36 L1=1.20 run=1 blk=1 avail=10384(75.4%) swpO=0 conn=1 myRSS=1069 php=4 phpRSS=24 ap=31 tcp=26 topuser=root 2026-09-06 11:13:38 L1=1.20 run=3 blk=1 avail=10388(75.4%) swpO=0 conn=1 myRSS=1069 php=5 phpRSS=58 ap=30 tcp=27 topuser=evolution 2026-09-06 11:13:46 L1=1.25 run=1 blk=1 avail=10453(75.9%) swpO=0 conn=1 myRSS=1069 php=4 phpRSS=24 ap=21 tcp=25 topuser=root 2026-09-06 11:13:48 L1=1.25 run=1 blk=1 avail=10459(75.9%) swpO=0 conn=1 myRSS=1069 php=4 phpRSS=24 ap=20 tcp=23 topuser=root 2026-09-06 11:13:56 L1=1.21 run=2 blk=1 avail=9938 (72.1%) swpO=0 conn=1 myRSS=1069 php=4 phpRSS=24 ap=112 tcp=104 topuser=root 2026-09-06 11:13:58 L1=1.21 run=2 blk=1 avail=9863 (71.6%) swpO=0 conn=1 myRSS=1069 php=4 phpRSS=24 ap=112 tcp=104 topuser=root 2026-09-06 11:14:06 L1=1.25 run=1 blk=1 avail=9786 (71.0%) swpO=63 conn=1 myRSS=1068 php=5 phpRSS=177 ap=103 tcp=102 topuser=madalice 2026-09-06 11:14:08 L1=1.25 run=2 blk=1 avail=9788 (71.0%) swpO=63 conn=1 myRSS=1068 php=5 phpRSS=177 ap=102 tcp=102 topuser=madalice 2026-09-06 11:14:16 L1=1.21 run=1 blk=1 avail=9846 (71.5%) swpO=0 conn=1 myRSS=1068 php=5 phpRSS=177 ap=93 tcp=26 topuser=madalice 2026-09-06 11:14:18 L1=1.21 run=1 blk=1 avail=9847 (71.5%) swpO=0 conn=1 myRSS=1068 php=5 phpRSS=177 ap=92 tcp=27 topuser=madalice 2026-09-06 11:14:27 L1=1.18 run=1 blk=1 avail=10024(72.8%) swpO=0 conn=1 myRSS=1068 php=4 phpRSS=24 ap=83 tcp=21 topuser=root 2026-09-06 11:14:28 L1=1.18 run=1 blk=1 avail=10035(72.8%) swpO=0 conn=1 myRSS=1068 php=4 phpRSS=24 ap=82 tcp=21 topuser=root 2026-09-06 11:14:37 L1=1.15 run=17 blk=1 avail=8844 (64.2%) swpO=419 conn=13 myRSS=1061 php=16 phpRSS=1593 ap=73 tcp=51 topuser=madalice