INCIDENT 2026-09-06 15:10:06 trigger: php_rss=1714MB ================================================================== load: 3.22 2.24 2.65 20/774 2790090 ncpu:10 mem_avail: 8258MB/13777MB (59.9%) swap_used:2279MB swapout:0/s blocked(D):1 running:19 iowait:7.6% steal:0.0% php: 16 procs / 1714MB heaviest user: madalice (10 procs, 1495MB) apache: 109 procs tcp_estab: 163 --- RSS by user (all processes) --- USER PROCS RSS_MB nobody 108 1796 madalice 10 1709 mysql 1 1305 root 256 745 netdata 8 239 mailman 20 132 alison 1 124 tubesupplies 1 109 wp-toolkit 3 55 dovenull 6 55 mailnull 3 38 kurri 2 24 dovecot 3 21 cpanellogin 1 18 evolution 13 16 vinesit 1 14 named 1 14 aaa 1 14 zabbix 1 10 polkitd 1 8 --- php workers by user --- USER PROCS RSS_MB madalice 10 1745 alison 1 129 tubesupplies 1 113 root 1 23 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7066 MB Active(file): 2235 MB Inactive(file): 4848 MB Dirty: 6 MB Writeback: 0 MB SReclaimable: 530 MB CommitLimit: 10984 MB Committed_AS: 11227 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2752333 root 10:06 1292 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 2786106 root 00:06 1248 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : 3926885 root 5-12:47:41 5580 /usr/bin/imunify-agent-proxy 4109079 root 1-10:25:19 1704 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 1-10:25:19 43268 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 1336588 2.8 Ssl 19:33:36 /usr/sbin/mariadbd 2785974 167896 madalice 251992 26.4 S 00:24 php-fpm: pool madalice_com_au 2786244 167896 madalice 238312 71.3 R 00:06 php-fpm: pool madalice_com_au 2789848 167896 madalice 232160 67.0 R 00:02 php-fpm: pool madalice_com_au 2787095 167896 madalice 222348 66.7 R 00:04 php-fpm: pool madalice_com_au 2786245 167896 madalice 187688 82.0 R 00:05 php-fpm: pool madalice_com_au 220206 168913 root 179200 0.0 S 12:31:49 spamd child 166870 1 netdata 178260 2.6 Ssl 12:47:47 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2787096 167896 madalice 168968 60.2 R 00:04 php-fpm: pool madalice_com_au 2786246 167896 madalice 163780 70.6 R 00:05 php-fpm: pool madalice_com_au 2789855 2789163 alison 160700 76.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2786093 167896 madalice 158704 63.1 R 00:07 php-fpm: pool madalice_com_au 2788727 167896 madalice 150188 77.6 R 00:03 php-fpm: pool madalice_com_au 2789797 2786084 tubesupplies 134744 75.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2789879 167896 madalice 131852 36.5 R 00:02 php-fpm: pool madalice_com_au 168913 1 root 95000 0.0 Ss 12:46:37 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 220207 168913 root 64488 0.0 S 12:31:49 spamd child 4109105 4109079 root 43268 1.6 Sl 1-10:25:19 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1353308 1 root 41060 0.1 Ss 46-12:28:53 cpsrvd (SSL) - waiting for connections 1469 1 root 40444 0.1 Ss 69-05:00:22 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 167562 166914 netdata 39448 0.1 Sl 12:47:42 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 34244 0.0 Sl 9-12:50:27 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166645 1 wp-toolkit 31560 0.0 Ss 12:47:51 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1463 1 root 24428 0.0 Ss 69-05:00:22 tailwatchd 167896 1 root 23924 0.0 Rs 12:47:39 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 2749764 506832 nobody 23452 0.0 S 14:17 /usr/sbin/httpd -k start 2784079 506832 nobody 22940 0.0 S 03:54 /usr/sbin/httpd -k start 2784240 506832 nobody 22864 0.1 S 03:49 /usr/sbin/httpd -k start 2768826 506832 nobody 21476 0.0 S 05:57 /usr/sbin/httpd -k start 2784242 506832 nobody 21360 0.0 S 03:49 /usr/sbin/httpd -k start 2785367 506832 nobody 20632 0.0 S 01:35 /usr/sbin/httpd -k start 2786236 506832 nobody 19888 0.5 S 00:06 /usr/sbin/httpd -k start 2785446 506832 nobody 19696 0.0 S 01:24 /usr/sbin/httpd -k start 2681299 1353308 cpanellogin 19288 0.0 S 31:47 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 167845 1 wp-toolkit 19224 0.0 Ss 12:47:40 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2787936 506832 nobody 18912 0.2 S 00:04 /usr/sbin/httpd -k start 2786635 506832 nobody 18880 0.2 S 00:05 /usr/sbin/httpd -k start 2786085 506832 nobody 18856 0.1 S 00:08 /usr/sbin/httpd -k start 2787914 506832 nobody 18848 0.5 S 00:04 /usr/sbin/httpd -k start 2787938 506832 nobody 18848 0.2 S 00:04 /usr/sbin/httpd -k start 2786241 506832 nobody 18844 0.3 S 00:06 /usr/sbin/httpd -k start 2786242 506832 nobody 18844 0.1 S 00:06 /usr/sbin/httpd -k start 2786636 506832 nobody 18844 0.2 S 00:05 /usr/sbin/httpd -k start 2786638 506832 nobody 18844 0.2 S 00:05 /usr/sbin/httpd -k start 2786091 506832 nobody 18840 0.2 S 00:07 /usr/sbin/httpd -k start 2785559 506832 nobody 18832 0.0 S 01:10 /usr/sbin/httpd -k start 2786092 506832 nobody 18820 0.2 S 00:07 /usr/sbin/httpd -k start 2786631 506832 nobody 18780 0.2 S 00:05 /usr/sbin/httpd -k start 2784961 506832 nobody 18172 0.1 S 02:19 /usr/sbin/httpd -k start 167566 166914 netdata 17940 2.1 Sl 12:47:42 /usr/libexec/netdata/plugins.d/apps.plugin 1 2785555 506832 nobody 17680 0.0 S 01:11 /usr/sbin/httpd -k start 2787888 506832 nobody 16960 0.0 S 00:04 /usr/sbin/httpd -k start 2787886 506832 nobody 16896 0.0 S 00:04 /usr/sbin/httpd -k start 2787908 506832 nobody 16896 0.0 S 00:04 /usr/sbin/httpd -k start 2787916 506832 nobody 16896 0.0 S 00:04 /usr/sbin/httpd -k start 2787924 506832 nobody 16896 0.0 S 00:04 /usr/sbin/httpd -k start 2787928 506832 nobody 16896 0.0 S 00:04 /usr/sbin/httpd -k start 2787930 506832 nobody 16896 0.0 S 00:04 /usr/sbin/httpd -k start 2787934 506832 nobody 16896 0.2 S 00:04 /usr/sbin/httpd -k start 2787945 506832 nobody 16896 0.0 S 00:04 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 538583 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 91 evolution/my.evolutionerp.com.au-ssl_log 11 madalice/madalice.com.au-ssl_log 9 evolution/evolutionerp.com.au-ssl_log 2 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 91 40.115.94.245 6 203.166.236.147 3 40.77.167.152 2 114.119.130.40 1 40.77.167.61 1 2a01:4f8:242:5a62::2 1 2001:4860:7:801::e2 1 192.178.8.68 1 185.247.137.220 1 157.55.39.59 1 118.127.40.55 1 114.119.146.16 1 114.119.143.104 1 114.119.137.43 1 114.119.137.101 --- top request paths across all vhosts (last 3 min) --- 46 GET /api/getItem/LWPG2001KG 5 GET /index.php 3 POST /functions.php 3 GET /store/hand-painted-nike-bandana/ 2 GET /logoff.php 2 GET /api/getItem/CLPGNSTD32315KK 2 GET / 1 POST /wp-cron.php 1 GET /.well-known/traffic-advice 1 GET /store/toys-kids-custom-shoes/ 1 GET /store/pearl-and-rhinestone-nike-swoosh/ 1 GET /robots.txt 1 GET /products-and-services/construction/ 1 GET /app/ajax.php 1 GET /api/getItem/SHSG757520-SP25-8 1 GET /api/getItem/SHSG757520-DP25-8-DI 1 GET /api/getItem/SHSG757520-DP25-8 1 GET /api/getItem/SHSG656520-SP25-8 1 GET /api/getItem/SHSG656520-DP25-8-DI 1 GET /api/getItem/SHSG656520-DP25-8 --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 46 GET /api/getItem/LWPG2001KG 2 GET /api/getItem/CLPGNSTD32315KK 1 GET /api/getItem/SHSG757520-SP25-8 1 GET /api/getItem/SHSG757520-DP25-8-DI 1 GET /api/getItem/SHSG757520-DP25-8 1 GET /api/getItem/SHSG656520-SP25-8 1 GET /api/getItem/SHSG656520-DP25-8-DI 1 GET /api/getItem/SHSG656520-DP25-8 1 GET /api/getItem/SHSG505016-SP25-8 1 GET /api/getItem/SHSG505016-SP19-8 1 GET /api/getItem/CLSGNSTD50250KK 1 GET /api/getItem/CLSGNSTD45250KK -- last 10 requests -- 40.115.94.245 - - [06/Sep/2026:15:09:15 +1000] "GET /api/getItem/CLHGNSTD40315KK HTTP/1.1" 200 1544 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:15:09:15 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:15:09:15 +1000] "GET /api/getItem/CLHGNSTD45250KK HTTP/1.1" 200 1547 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:15:09:15 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:15:09:16 +1000] "GET /api/getItem/CLHGNSTD45315KK HTTP/1.1" 200 1545 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:15:09:16 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:15:09:16 +1000] "GET /api/getItem/CLHGNSTD50250KK HTTP/1.1" 200 1547 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:15:09:16 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:15:09:17 +1000] "GET /api/getItem/CLHGNSTD50315KK HTTP/1.1" 200 1546 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:15:09:17 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 5 GET /index.php 3 POST /functions.php 2 GET /logoff.php 1 GET /app/ajax.php -- last 10 requests -- 40.77.167.61 - - [06/Sep/2026:15:08:14 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 52 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=70907" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko 40.77.167.152 - - [06/Sep/2026:15:08:51 +1000] "GET /index.php?page=quotedit"eid=78769§ionid=0 HTTP/1.1" 200 5372 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing. 157.55.39.59 - - [06/Sep/2026:15:09:03 +1000] "GET /index.php?page=jobedit&id=27969 HTTP/1.1" 200 5369 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Ch 40.77.167.152 - - [06/Sep/2026:15:09:07 +1000] "GET /index.php?page=quotedit"eid=76710§ionid=0 HTTP/1.1" 200 5376 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing. 203.166.236.147 - - [06/Sep/2026:15:09:47 +1000] "GET /logoff.php?page=quotereg HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT 203.166.236.147 - - [06/Sep/2026:15:09:47 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 203.166.236.147 - - [06/Sep/2026:15:09:47 +1000] "GET /index.php?page=quotereg HTTP/1.1" 200 5354 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KH 203.166.236.147 - - [06/Sep/2026:15:09:47 +1000] "GET /logoff.php?page=quotereg HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT 203.166.236.147 - - [06/Sep/2026:15:09:47 +1000] "GET /index.php?page=quotereg HTTP/1.1" 200 5355 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KH 203.166.236.147 - - [06/Sep/2026:15:09:49 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 52 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET /store/hand-painted-nike-bandana/ 2 GET / 1 GET /.well-known/traffic-advice 1 GET /store/toys-kids-custom-shoes/ 1 GET /store/pearl-and-rhinestone-nike-swoosh/ 1 GET /robots.txt -- last 10 requests -- 114.119.143.104 - - [06/Sep/2026:15:08:05 +1000] "GET /store/hand-painted-nike-bandana/?amp%3Brating=3&wcpr_image=1&wcpr_rating=4 HTTP/1.1" 200 54924 "https://madalice.com.au/store/hand-painted-nike-bandana/?amp%3Brating 114.119.146.16 - - [06/Sep/2026:15:08:29 +1000] "GET /store/hand-painted-nike-bandana/?amp%3Brating=2&wcpr_page=4&wcpr_image=1&wcpr_verified=1 HTTP/1.1" 200 55203 "https://madalice.com.au/store/hand-painted-nike-bandana/ 2a01:4f8:242:5a62::2 - - [06/Sep/2026:15:08:31 +1000] "GET /robots.txt HTTP/1.1" 304 - "-" "Observer/1.0 (+https://obsrvr.net/about; crawler@obsrvr.net)" 192.178.8.68 - - [06/Sep/2026:15:08:36 +1000] "GET /.well-known/traffic-advice HTTP/1.1" 404 36629 "-" "Chrome Privacy Preserving Prefetch Proxy" 2001:4860:7:801::e2 - - [06/Sep/2026:15:08:36 +1000] "GET /?srsltid=AfmBOoq_UcinOnZhKRLnVauPS5ftGeVbEiWpmp2wW1JgaHSGgedQpcKx HTTP/1.1" 200 42815 "https://www.google.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) 185.247.137.220 - - [06/Sep/2026:15:08:49 +1000] "GET / HTTP/1.1" 301 - "http://mail.madalice.com.au" "Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)" 114.119.130.40 - - [06/Sep/2026:15:09:02 +1000] "GET /store/hand-painted-nike-bandana/?amp%3Brating=1&wcpr_page=2&wcpr_image=1&wcpr_rating=3 HTTP/1.1" 200 55042 "https://madalice.com.au/store/hand-painted-nike-bandana/?a 114.119.137.101 - - [06/Sep/2026:15:09:18 +1000] "GET /store/toys-kids-custom-shoes/?image=1&rating=3&verified=1&wcpr_page=4 HTTP/1.1" 200 55056 "https://madalice.com.au/store/toys-kids-custom-shoes/?image=1&rating=3&ver 114.119.130.40 - - [06/Sep/2026:15:09:42 +1000] "GET /store/pearl-and-rhinestone-nike-swoosh/?wcpr_rating=5&rating=2&wcpr_page=2 HTTP/1.1" 301 1 "https://madalice.com.au/store/pearl-and-rhinestone-nike-swoosh/?wcpr_ratin --- last 30 samples (run-up to this incident) --- 2026-09-06 15:07:40 L1=1.74 run=1 blk=1 avail=10367(75.2%) swpO=0 conn=1 myRSS=1274 php=4 phpRSS=23 ap=13 tcp=25 topuser=root 2026-09-06 15:07:45 L1=1.84 run=2 blk=1 avail=10155(73.7%) swpO=0 conn=1 myRSS=1278 php=7 phpRSS=316 ap=13 tcp=30 topuser=evolution 2026-09-06 15:07:50 L1=1.77 run=1 blk=1 avail=10237(74.3%) swpO=0 conn=1 myRSS=1279 php=5 phpRSS=155 ap=16 tcp=25 topuser=madalice 2026-09-06 15:07:55 L1=1.71 run=1 blk=1 avail=10259(74.5%) swpO=0 conn=1 myRSS=1279 php=5 phpRSS=155 ap=14 tcp=23 topuser=madalice 2026-09-06 15:08:00 L1=1.65 run=1 blk=1 avail=10254(74.4%) swpO=0 conn=1 myRSS=1279 php=5 phpRSS=155 ap=13 tcp=26 topuser=madalice 2026-09-06 15:08:05 L1=1.76 run=3 blk=1 avail=10236(74.3%) swpO=0 conn=1 myRSS=1279 php=5 phpRSS=162 ap=13 tcp=27 topuser=madalice 2026-09-06 15:08:10 L1=1.78 run=1 blk=1 avail=10229(74.2%) swpO=0 conn=1 myRSS=1279 php=6 phpRSS=203 ap=13 tcp=28 topuser=madalice 2026-09-06 15:08:15 L1=1.72 run=2 blk=1 avail=10230(74.3%) swpO=0 conn=1 myRSS=1279 php=5 phpRSS=178 ap=13 tcp=30 topuser=madalice 2026-09-06 15:08:20 L1=1.66 run=2 blk=1 avail=10152(73.7%) swpO=0 conn=1 myRSS=1279 php=6 phpRSS=293 ap=13 tcp=25 topuser=madalice 2026-09-06 15:08:25 L1=1.69 run=1 blk=1 avail=10229(74.2%) swpO=0 conn=1 myRSS=1285 php=5 phpRSS=178 ap=13 tcp=23 topuser=madalice 2026-09-06 15:08:30 L1=1.63 run=1 blk=1 avail=10249(74.4%) swpO=0 conn=1 myRSS=1285 php=5 phpRSS=156 ap=13 tcp=27 topuser=madalice 2026-09-06 15:08:35 L1=1.58 run=1 blk=1 avail=10229(74.2%) swpO=0 conn=1 myRSS=1285 php=5 phpRSS=156 ap=16 tcp=25 topuser=madalice 2026-09-06 15:08:41 L1=1.61 run=2 blk=1 avail=10096(73.3%) swpO=0 conn=1 myRSS=1286 php=6 phpRSS=314 ap=15 tcp=26 topuser=madalice 2026-09-06 15:08:45 L1=1.56 run=1 blk=1 avail=10066(73.1%) swpO=0 conn=1 myRSS=1301 php=6 phpRSS=314 ap=17 tcp=32 topuser=madalice 2026-09-06 15:08:51 L1=1.52 run=1 blk=1 avail=10066(73.1%) swpO=0 conn=1 myRSS=1301 php=6 phpRSS=316 ap=18 tcp=24 topuser=madalice 2026-09-06 15:08:55 L1=1.56 run=1 blk=1 avail=10085(73.2%) swpO=0 conn=1 myRSS=1302 php=6 phpRSS=316 ap=14 tcp=24 topuser=madalice 2026-09-06 15:09:01 L1=1.51 run=2 blk=1 avail=9932 (72.1%) swpO=0 conn=1 myRSS=1302 php=7 phpRSS=487 ap=17 tcp=29 topuser=madalice 2026-09-06 15:09:05 L1=1.63 run=2 blk=2 avail=9874 (71.7%) swpO=1 conn=1 myRSS=1302 php=8 phpRSS=491 ap=17 tcp=29 topuser=madalice 2026-09-06 15:09:11 L1=1.74 run=1 blk=1 avail=10055(73.0%) swpO=1 conn=1 myRSS=1302 php=6 phpRSS=340 ap=16 tcp=27 topuser=madalice 2026-09-06 15:09:16 L1=1.68 run=1 blk=1 avail=10057(73.0%) swpO=0 conn=1 myRSS=1303 php=6 phpRSS=340 ap=15 tcp=25 topuser=madalice 2026-09-06 15:09:21 L1=1.63 run=1 blk=1 avail=10053(73.0%) swpO=0 conn=1 myRSS=1303 php=6 phpRSS=341 ap=15 tcp=29 topuser=madalice 2026-09-06 15:09:26 L1=1.58 run=1 blk=1 avail=10191(74.0%) swpO=0 conn=1 myRSS=1303 php=5 phpRSS=182 ap=15 tcp=25 topuser=madalice 2026-09-06 15:09:31 L1=1.53 run=2 blk=1 avail=10193(74.0%) swpO=0 conn=1 myRSS=1303 php=5 phpRSS=182 ap=15 tcp=22 topuser=madalice 2026-09-06 15:09:36 L1=1.49 run=1 blk=1 avail=10202(74.0%) swpO=0 conn=1 myRSS=1303 php=5 phpRSS=182 ap=13 tcp=23 topuser=madalice 2026-09-06 15:09:41 L1=1.45 run=2 blk=1 avail=10204(74.1%) swpO=0 conn=1 myRSS=1303 php=5 phpRSS=182 ap=13 tcp=23 topuser=madalice 2026-09-06 15:09:46 L1=1.41 run=2 blk=1 avail=10161(73.8%) swpO=0 conn=1 myRSS=1303 php=6 phpRSS=251 ap=13 tcp=25 topuser=madalice 2026-09-06 15:09:51 L1=1.46 run=1 blk=1 avail=10226(74.2%) swpO=0 conn=1 myRSS=1303 php=5 phpRSS=146 ap=14 tcp=29 topuser=madalice 2026-09-06 15:09:56 L1=1.42 run=1 blk=1 avail=10230(74.3%) swpO=0 conn=1 myRSS=1303 php=5 phpRSS=146 ap=14 tcp=22 topuser=madalice 2026-09-06 15:10:01 L1=1.39 run=5 blk=1 avail=9962 (72.3%) swpO=0 conn=1 myRSS=1303 php=6 phpRSS=369 ap=21 tcp=114 topuser=madalice 2026-09-06 15:10:06 L1=1.76 run=19 blk=1 avail=8258 (59.9%) swpO=0 conn=13 myRSS=1305 php=16 phpRSS=1714 ap=109 tcp=163 topuser=madalice