INCIDENT 2026-09-06 19:09:23 trigger: php_rss=1522MB ================================================================== load: 1.78 1.63 1.62 3/688 3602333 ncpu:10 mem_avail: 8787MB/13777MB (63.8%) swap_used:2343MB swapout:0/s blocked(D):1 running:2 iowait:9.7% steal:0.0% php: 15 procs / 1522MB heaviest user: madalice (10 procs, 1429MB) apache: 29 procs tcp_estab: 31 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1464 madalice 10 1429 root 254 882 nobody 27 441 netdata 8 238 mailman 20 121 alison 1 73 wp-toolkit 3 56 dovenull 6 55 evolution 12 50 mailnull 3 35 dovecot 3 23 cpanellogin 1 20 vinesit 1 14 corpkicks 1 14 named 1 13 zabbix 1 10 polkitd 1 9 kurri 1 9 cpanelphpmyadmin 1 8 --- php workers by user --- USER PROCS RSS_MB madalice 10 1429 alison 1 73 root 1 23 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7784 MB Active(file): 4311 MB Inactive(file): 3674 MB Dirty: 2 MB Writeback: 0 MB SReclaimable: 527 MB CommitLimit: 10984 MB Committed_AS: 9119 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3568467 root 09:22 1240 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 5-16:46:58 5620 /usr/bin/imunify-agent-proxy 4109079 root 1-14:24:36 1752 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 1-14:24:36 110560 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 1500152 2.8 Ssl 23:32:53 /usr/sbin/mariadbd 166870 1 netdata 182640 2.6 Ssl 16:47:04 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3601854 167896 madalice 160204 27.1 S 00:39 php-fpm: pool madalice_com_au 3601936 167896 madalice 159588 27.9 S 00:29 php-fpm: pool madalice_com_au 3601949 167896 madalice 159256 23.5 S 00:26 php-fpm: pool madalice_com_au 3601933 167896 madalice 159220 26.2 S 00:29 php-fpm: pool madalice_com_au 3601932 167896 madalice 159204 25.3 S 00:29 php-fpm: pool madalice_com_au 3601937 167896 madalice 159152 25.4 S 00:28 php-fpm: pool madalice_com_au 220207 168913 root 156184 0.0 S 16:31:06 spamd child 3602079 167896 madalice 127044 6.5 S 00:18 php-fpm: pool madalice_com_au 3602077 167896 madalice 127008 6.2 S 00:18 php-fpm: pool madalice_com_au 3602080 167896 madalice 127004 6.6 S 00:18 php-fpm: pool madalice_com_au 3602078 167896 madalice 126384 6.6 S 00:18 php-fpm: pool madalice_com_au 4109105 4109079 root 110560 1.5 Sl 1-14:24:36 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 168913 1 root 94940 0.0 Ss 16:45:54 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2902970 168913 root 84200 0.0 S 03:27:49 spamd child 167871 1 root 83772 0.0 Ss 16:46:57 /usr/lib/systemd/systemd-journald 3602303 3601153 alison 78796 44.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353308 1 root 41840 0.1 Ss 46-16:28:10 cpsrvd (SSL) - waiting for connections 1469 1 root 37852 0.1 Ss 69-08:59:39 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 509236 509098 root 34948 0.0 Sl 9-16:49:44 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 167562 166914 netdata 34704 0.1 Sl 16:46:59 /usr/libexec/netdata/plugins.d/go.d.plugin 1 166645 1 wp-toolkit 31792 0.0 Ss 16:47:08 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1463 1 root 24272 0.0 Ss 69-08:59:39 tailwatchd 167896 1 root 23944 0.0 Ss 16:46:56 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3583084 506832 nobody 23176 0.0 S 08:46 /usr/sbin/httpd -k start 3585308 506832 nobody 22368 0.0 S 05:05 /usr/sbin/httpd -k start 3600536 506832 nobody 21560 0.0 S 03:10 /usr/sbin/httpd -k start 3583388 1353308 cpanellogin 21104 0.0 S 08:09 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 3585326 506832 nobody 20852 0.0 S 05:04 /usr/sbin/httpd -k start 3585323 506832 nobody 20204 0.0 S 05:04 /usr/sbin/httpd -k start 3600736 506832 nobody 19960 0.2 S 02:48 /usr/sbin/httpd -k start 3600685 506832 nobody 19944 0.0 S 02:53 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19684 0.0 Ss 16:46:57 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3601153 506832 nobody 18972 0.0 S 02:00 /usr/sbin/httpd -k start 3601154 506832 nobody 18844 0.0 S 02:00 /usr/sbin/httpd -k start 3601427 506832 nobody 18780 0.0 S 01:27 /usr/sbin/httpd -k start 3601988 506832 nobody 18600 0.0 S 00:24 /usr/sbin/httpd -k start 3601958 506832 nobody 18592 0.1 S 00:26 /usr/sbin/httpd -k start 3601945 506832 nobody 18404 0.0 S 00:27 /usr/sbin/httpd -k start 3601941 506832 nobody 18396 0.0 S 00:28 /usr/sbin/httpd -k start 3601942 506832 nobody 18332 0.0 S 00:28 /usr/sbin/httpd -k start 3601948 506832 nobody 18280 0.0 S 00:27 /usr/sbin/httpd -k start 3601957 506832 nobody 18272 0.0 S 00:26 /usr/sbin/httpd -k start 167566 166914 netdata 17356 2.1 Sl 16:46:59 /usr/libexec/netdata/plugins.d/apps.plugin 1 3601935 506832 nobody 17268 0.0 S 00:29 /usr/sbin/httpd -k start 3601956 506832 nobody 17036 0.0 S 00:26 /usr/sbin/httpd -k start 3601952 506832 nobody 16876 0.0 S 00:26 /usr/sbin/httpd -k start 3601951 506832 nobody 16852 0.0 S 00:26 /usr/sbin/httpd -k start 3602036 506832 nobody 16752 0.0 S 00:22 /usr/sbin/httpd -k start 3601953 506832 nobody 16076 0.0 S 00:26 /usr/sbin/httpd -k start 166757 1 root 15748 0.0 Ss 16:47:07 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 167814 1 root 15364 0.0 Ss 16:46:57 lfd - sleeping 3602041 167382 vinesit 14768 0.0 S 00:21 dovecot/imap 3602073 167382 corpkicks 14508 0.0 S 00:19 dovecot/imap 508720 1 mailnull 14344 0.0 Ss 9-16:49:51 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 166809 1 named 13888 0.0 Ssl 16:47:06 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 167017 1 root 13548 0.1 Ssl 16:47:03 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 3601376 167382 root 13004 0.0 S 01:32 dovecot/auth -w 3602042 1471 root 12884 0.0 S 00:21 cPhulkd - processor - http socket --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 652932 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 104 madalice/madalice.com.au-ssl_log 53 evolution/my.evolutionerp.com.au-ssl_log 52 alison/alisonarts.com.au-ssl_log 2 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 104 40.115.94.245 48 115.129.56.130 47 34.62.101.245 2 207.46.13.92 1 77.236.2.249 1 40.77.167.76 1 40.77.167.38 1 40.77.167.132 1 2406:2d40:4ddb:d908:f5a9:634:a92c:364f 1 114.119.146.16 1 114.119.143.14 1 114.119.143.104 1 114.119.137.101 1 114.119.130.40 --- top request paths across all vhosts (last 3 min) --- 72 GET /api/getItem/LWPG2001KG 32 GET /api/getItem/LWFB2001KG 29 POST /app/ajax/selectFilter.php 9 POST /itemModify.php 6 POST /functions.php 5 POST /quoteditsave.php 2 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 2 GET /terraform.tfstate 2 GET /.svn/entries 2 GET /store/custom-brisbane-broncos-shoes/ 2 GET /serverless.yml 2 GET /serverless.yaml 2 GET /.s3cfg 2 GET /rclone.conf 2 GET /index.php 2 GET /.github/.env 2 GET /docker-compose.yml 2 GET /docker-compose.yaml 2 GET /.boto 1 POST /v1/graphql --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 72 GET /api/getItem/LWPG2001KG 32 GET /api/getItem/LWFB2001KG -- last 10 requests -- 40.115.94.245 - - [06/Sep/2026:19:08:20 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:19:08:20 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:19:08:20 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:19:08:21 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:19:08:21 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:19:08:22 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:19:08:22 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:19:08:22 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:19:08:23 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:19:09:23 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" == madalice/madalice.com.au-ssl_log == -- top paths -- 2 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 2 GET /terraform.tfstate 2 GET /.svn/entries 2 GET /store/custom-brisbane-broncos-shoes/ 2 GET /serverless.yml 2 GET /serverless.yaml 2 GET /.s3cfg 2 GET /rclone.conf 2 GET /.github/.env 2 GET /docker-compose.yml 2 GET /docker-compose.yaml 2 GET /.boto -- last 10 requests -- 34.62.101.245 - - [06/Sep/2026:19:09:05 +1000] "GET /.ssh/authorized_keys HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.62.101.245 - - [06/Sep/2026:19:09:05 +1000] "GET /id_rsa HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.62.101.245 - - [06/Sep/2026:19:09:05 +1000] "GET /id_dsa HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.62.101.245 - - [06/Sep/2026:19:09:05 +1000] "POST /v1/graphql HTTP/1.1" 404 36638 "https://www.madalice.com.au" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari 34.62.101.245 - - [06/Sep/2026:19:09:06 +1000] "GET /key.pem HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.62.101.245 - - [06/Sep/2026:19:09:06 +1000] "GET /server.key HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.62.101.245 - - [06/Sep/2026:19:09:06 +1000] "GET /id_ed25519 HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.62.101.245 - - [06/Sep/2026:19:09:06 +1000] "GET /pi.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.62.101.245 - - [06/Sep/2026:19:09:06 +1000] "GET /api/v1/models HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 34.62.101.245 - - [06/Sep/2026:19:09:06 +1000] "GET /test.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 29 POST /app/ajax/selectFilter.php 9 POST /itemModify.php 6 POST /functions.php 5 POST /quoteditsave.php 2 GET /index.php 1 GET /app/ajax.php -- last 10 requests -- 115.129.56.130 - - [06/Sep/2026:19:08:36 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=TOUCH%20UP HTTP/1.1" 200 4637 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79157§ionid=0" "Moz 115.129.56.130 - - [06/Sep/2026:19:08:38 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter= HTTP/1.1" 200 23546 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79157§ionid=0" "Mozilla/5.0 115.129.56.130 - - [06/Sep/2026:19:08:45 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=BLUE%20 HTTP/1.1" 200 4446 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79157§ionid=0" "Mozill 115.129.56.130 - - [06/Sep/2026:19:08:47 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter= HTTP/1.1" 200 23546 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79157§ionid=0" "Mozilla/5.0 115.129.56.130 - - [06/Sep/2026:19:08:49 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=SKIP HTTP/1.1" 200 2848 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79157§ionid=0" "Mozilla/5 115.129.56.130 - - [06/Sep/2026:19:08:51 +1000] "POST /itemModify.php?call=getInvMFMeta&modifyid=141414 HTTP/1.1" 200 49 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79157§ionid=0" "Mozilla/5.0 (Wi 115.129.56.130 - - [06/Sep/2026:19:08:51 +1000] "POST /itemModify.php?call=getBOM HTTP/1.1" 200 22 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79157§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win64; 115.129.56.130 - - [06/Sep/2026:19:08:54 +1000] "POST /quoteditsave.php?call=addLineItem HTTP/1.1" 200 286 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79157§ionid=0" "Mozilla/5.0 (Windows NT 10.0; 115.129.56.130 - - [06/Sep/2026:19:08:57 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=TEREX HTTP/1.1" 200 1128 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79157§ionid=0" "Mozilla/ 115.129.56.130 - - [06/Sep/2026:19:08:59 +1000] "POST /itemModify.php?call=getInvMFMeta&modifyid=6928 HTTP/1.1" 200 49 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79157§ionid=0" "Mozilla/5.0 (Wind --- last 30 samples (run-up to this incident) --- 2026-09-06 19:06:58 L1=1.66 run=1 blk=1 avail=9988 (72.5%) swpO=0 conn=1 myRSS=1485 php=5 phpRSS=176 ap=17 tcp=21 topuser=madalice 2026-09-06 19:07:02 L1=1.61 run=2 blk=1 avail=9823 (71.3%) swpO=0 conn=1 myRSS=1485 php=6 phpRSS=392 ap=14 tcp=22 topuser=corpkicks 2026-09-06 19:07:08 L1=1.64 run=1 blk=1 avail=10008(72.6%) swpO=0 conn=1 myRSS=1485 php=5 phpRSS=176 ap=14 tcp=20 topuser=madalice 2026-09-06 19:07:13 L1=1.59 run=1 blk=1 avail=10005(72.6%) swpO=0 conn=1 myRSS=1485 php=5 phpRSS=176 ap=14 tcp=23 topuser=madalice 2026-09-06 19:07:18 L1=1.62 run=1 blk=1 avail=10134(73.6%) swpO=0 conn=1 myRSS=1485 php=4 phpRSS=23 ap=14 tcp=24 topuser=root 2026-09-06 19:07:23 L1=1.57 run=2 blk=1 avail=9991 (72.5%) swpO=0 conn=1 myRSS=1485 php=6 phpRSS=216 ap=14 tcp=29 topuser=madalice 2026-09-06 19:07:28 L1=1.61 run=2 blk=1 avail=9924 (72.0%) swpO=0 conn=1 myRSS=1485 php=6 phpRSS=265 ap=17 tcp=29 topuser=madalice 2026-09-06 19:07:33 L1=1.64 run=1 blk=1 avail=9976 (72.4%) swpO=0 conn=1 myRSS=1485 php=5 phpRSS=178 ap=17 tcp=26 topuser=madalice 2026-09-06 19:07:38 L1=1.59 run=1 blk=1 avail=9974 (72.4%) swpO=0 conn=1 myRSS=1485 php=5 phpRSS=177 ap=17 tcp=31 topuser=madalice 2026-09-06 19:07:43 L1=1.54 run=1 blk=1 avail=9973 (72.4%) swpO=0 conn=1 myRSS=1485 php=5 phpRSS=177 ap=17 tcp=30 topuser=madalice 2026-09-06 19:07:48 L1=1.50 run=1 blk=1 avail=9987 (72.5%) swpO=0 conn=1 myRSS=1485 php=5 phpRSS=177 ap=16 tcp=28 topuser=madalice 2026-09-06 19:07:53 L1=1.46 run=2 blk=1 avail=9979 (72.4%) swpO=0 conn=1 myRSS=1485 php=5 phpRSS=177 ap=17 tcp=31 topuser=madalice 2026-09-06 19:07:58 L1=1.58 run=1 blk=1 avail=9965 (72.3%) swpO=0 conn=1 myRSS=1485 php=5 phpRSS=179 ap=19 tcp=28 topuser=madalice 2026-09-06 19:08:03 L1=1.53 run=1 blk=1 avail=9969 (72.4%) swpO=0 conn=1 myRSS=1485 php=5 phpRSS=179 ap=18 tcp=25 topuser=madalice 2026-09-06 19:08:09 L1=1.49 run=2 blk=1 avail=10000(72.6%) swpO=0 conn=1 myRSS=1485 php=5 phpRSS=179 ap=16 tcp=26 topuser=madalice 2026-09-06 19:08:13 L1=1.45 run=3 blk=1 avail=9989 (72.5%) swpO=0 conn=1 myRSS=1485 php=6 phpRSS=219 ap=16 tcp=26 topuser=madalice 2026-09-06 19:08:19 L1=1.41 run=1 blk=1 avail=10129(73.5%) swpO=0 conn=1 myRSS=1485 php=4 phpRSS=23 ap=16 tcp=26 topuser=root 2026-09-06 19:08:23 L1=1.38 run=1 blk=1 avail=10013(72.7%) swpO=0 conn=1 myRSS=1485 php=5 phpRSS=156 ap=16 tcp=26 topuser=madalice 2026-09-06 19:08:29 L1=1.35 run=1 blk=1 avail=10010(72.7%) swpO=0 conn=1 myRSS=1485 php=5 phpRSS=156 ap=16 tcp=27 topuser=madalice 2026-09-06 19:08:33 L1=1.32 run=3 blk=1 avail=10011(72.7%) swpO=0 conn=1 myRSS=1485 php=5 phpRSS=156 ap=16 tcp=26 topuser=madalice 2026-09-06 19:08:39 L1=1.30 run=1 blk=1 avail=10005(72.6%) swpO=0 conn=1 myRSS=1485 php=5 phpRSS=156 ap=16 tcp=26 topuser=madalice 2026-09-06 19:08:43 L1=1.27 run=1 blk=1 avail=10118(73.4%) swpO=0 conn=1 myRSS=1485 php=4 phpRSS=23 ap=16 tcp=26 topuser=root 2026-09-06 19:08:49 L1=1.25 run=1 blk=1 avail=10010(72.7%) swpO=0 conn=1 myRSS=1485 php=5 phpRSS=156 ap=16 tcp=26 topuser=madalice 2026-09-06 19:08:53 L1=1.23 run=3 blk=1 avail=9523 (69.1%) swpO=33 conn=2 myRSS=1484 php=7 phpRSS=701 ap=17 tcp=31 topuser=corpkicks 2026-09-06 19:08:59 L1=1.21 run=2 blk=1 avail=9212 (66.9%) swpO=33 conn=1 myRSS=1484 php=10 phpRSS=936 ap=34 tcp=43 topuser=madalice 2026-09-06 19:09:03 L1=1.43 run=6 blk=2 avail=8786 (63.8%) swpO=240 conn=2 myRSS=1476 php=11 phpRSS=1265 ap=41 tcp=50 topuser=madalice 2026-09-06 19:09:09 L1=1.74 run=1 blk=1 avail=8715 (63.3%) swpO=811 conn=1 myRSS=1464 php=14 phpRSS=1453 ap=42 tcp=48 topuser=madalice 2026-09-06 19:09:13 L1=1.74 run=1 blk=1 avail=8743 (63.5%) swpO=571 conn=2 myRSS=1464 php=14 phpRSS=1453 ap=39 tcp=29 topuser=madalice 2026-09-06 19:09:19 L1=1.78 run=3 blk=1 avail=8804 (63.9%) swpO=0 conn=1 myRSS=1464 php=14 phpRSS=1453 ap=33 tcp=28 topuser=madalice 2026-09-06 19:09:23 L1=1.78 run=2 blk=1 avail=8787 (63.8%) swpO=0 conn=2 myRSS=1464 php=15 phpRSS=1522 ap=29 tcp=31 topuser=madalice