INCIDENT 2026-09-06 23:50:59 trigger: php_rss=1502MB ================================================================== load: 2.23 1.52 1.51 11/719 388493 ncpu:10 mem_avail: 8555MB/13777MB (62.1%) swap_used:2532MB swapout:447/s blocked(D):1 running:4 iowait:9.1% steal:0.0% php: 14 procs / 1502MB heaviest user: madalice (10 procs, 1479MB) apache: 52 procs tcp_estab: 46 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 10 1506 mysql 1 1437 root 251 1019 nobody 51 773 netdata 8 245 mailman 20 105 wp-toolkit 3 55 dovenull 6 55 mailnull 5 51 cpanellogin 1 48 kurri 3 38 lowrange 2 29 dovecot 3 23 alison 1 15 aaa 1 15 infinium 1 14 named 1 11 zabbix 1 10 evolution 11 10 polkitd 1 7 --- php workers by user --- USER PROCS RSS_MB madalice 10 1514 root 1 23 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7852 MB Active(file): 5024 MB Inactive(file): 2955 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 522 MB CommitLimit: 10984 MB Committed_AS: 9614 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 5-21:28:33 5268 /usr/bin/imunify-agent-proxy 4109079 root 1-19:06:11 1824 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 1-19:06:11 112668 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 1471732 3.0 Ssl 1-04:14:28 /usr/sbin/mariadbd 388421 167896 madalice 228296 78.0 R 00:03 php-fpm: pool madalice_com_au 388450 167896 madalice 227992 107 R 00:02 php-fpm: pool madalice_com_au 166870 1 netdata 189308 2.6 Ssl 21:28:39 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 167871 1 root 159132 0.0 Ss 21:28:32 /usr/lib/systemd/systemd-journald 220207 168913 root 156332 0.0 S 21:12:41 spamd child 388422 167896 madalice 156072 72.3 S 00:03 php-fpm: pool madalice_com_au 2902970 168913 root 153300 0.0 S 08:09:24 spamd child 388454 167896 madalice 127032 67.5 R 00:02 php-fpm: pool madalice_com_au 388455 167896 madalice 126988 59.0 S 00:02 php-fpm: pool madalice_com_au 388452 167896 madalice 126972 59.0 S 00:02 php-fpm: pool madalice_com_au 388451 167896 madalice 126724 69.0 R 00:02 php-fpm: pool madalice_com_au 388458 167896 madalice 125368 56.0 S 00:02 php-fpm: pool madalice_com_au 388459 167896 madalice 125208 57.0 S 00:02 php-fpm: pool madalice_com_au 388457 167896 madalice 125132 59.0 S 00:02 php-fpm: pool madalice_com_au 4109105 4109079 root 112668 1.4 Sl 1-19:06:11 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 168913 1 root 72552 0.0 Ss 21:27:29 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 182429 1353308 cpanellogin 49196 0.0 S 59:20 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 1469 1 root 41940 0.1 Ss 69-13:41:14 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 41012 0.1 Ss 46-21:09:45 cpsrvd (SSL) - waiting for connections 388516 388235 evolution 40236 0.0 S 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 167562 166914 netdata 35740 0.1 Sl 21:28:34 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 35180 0.0 Sl 9-21:31:19 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166645 1 wp-toolkit 31284 0.0 Ss 21:28:43 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1463 1 root 24188 0.0 Ss 69-13:41:14 tailwatchd 167896 1 root 23912 0.0 Ss 21:28:31 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 370671 506832 nobody 22500 0.0 S 05:41 /usr/sbin/httpd -k start 370631 506832 nobody 21620 0.1 S 05:42 /usr/sbin/httpd -k start 388498 387989 root 21400 0.0 R 00:00 /usr/sbin/exim -Mc 1x3DGm-00000001cvt-3Q1a 372737 506832 nobody 21256 0.0 S 02:41 /usr/sbin/httpd -k start 370687 506832 nobody 21244 0.0 S 05:40 /usr/sbin/httpd -k start 356247 506832 nobody 20736 0.0 S 06:00 /usr/sbin/httpd -k start 370707 506832 nobody 20736 0.1 S 05:39 /usr/sbin/httpd -k start 356246 506832 nobody 20648 0.0 S 06:00 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19484 0.0 Ss 21:28:32 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 372612 506832 nobody 18208 0.0 S 02:53 /usr/sbin/httpd -k start 370715 506832 nobody 18152 0.1 S 05:39 /usr/sbin/httpd -k start 388217 506832 nobody 18148 0.0 S 00:27 /usr/sbin/httpd -k start 388242 506832 nobody 18084 0.0 S 00:27 /usr/sbin/httpd -k start 388163 506832 nobody 18008 0.0 S 00:30 /usr/sbin/httpd -k start 167566 166914 netdata 17452 2.1 Sl 21:28:34 /usr/libexec/netdata/plugins.d/apps.plugin 1 388051 506832 nobody 17388 0.0 S 00:41 /usr/sbin/httpd -k start 388245 506832 nobody 16820 0.0 S 00:27 /usr/sbin/httpd -k start 388152 506832 nobody 16788 0.0 S 00:32 /usr/sbin/httpd -k start 388095 506832 nobody 16744 0.0 S 00:38 /usr/sbin/httpd -k start 388157 506832 nobody 16640 0.0 S 00:31 /usr/sbin/httpd -k start 285110 1471 root 16436 0.0 S 30:26 cPhulkd - dbprocessor 388216 506832 nobody 16364 0.0 S 00:27 /usr/sbin/httpd -k start 388218 506832 nobody 16240 0.0 S 00:27 /usr/sbin/httpd -k start 387989 508720 mailnull 16184 0.0 S 00:49 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 388164 506832 nobody 16068 0.0 S 00:30 /usr/sbin/httpd -k start 388162 506832 nobody 16020 0.0 S 00:30 /usr/sbin/httpd -k start 388246 506832 nobody 15664 0.0 S 00:27 /usr/sbin/httpd -k start 166757 1 root 15648 0.0 Ss 21:28:42 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 388235 506832 nobody 15628 0.2 S 00:27 /usr/sbin/httpd -k start 3942600 167382 aaa 15436 0.0 S 03:04:12 dovecot/imap 216505 167382 alison 15412 0.0 S 50:04 dovecot/imap 1471 1 root 15352 0.0 Ss 69-13:41:14 cPhulkd - processor 4112099 167382 lowrange 15208 0.0 S 02:15:08 dovecot/imap 4166196 167382 kurri 15164 0.0 S 01:56:21 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 796370 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 796353 | madalice_wp | madalice_wp | Query | 0 | Statistics | SELECT *, CASE WHEN `type` = 3 THEN 0 WHEN `type` = 4 THEN 1 WHEN `type` = 7 THEN 2 WHEN `type` = 6 THEN 3 WHEN `type` = 5 THEN 4 WHEN `type` = 9 THEN 5 WHEN `type` = 8 THEN 6 WHEN `type` = 2 THEN 7 WHEN `type` = 1 THEN 8 ELSE 9999 END AS `typeSort`, CASE WHEN `type` = 3 THEN `parameters` WHEN `ty | +--------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min cosgrovecreative/cosgrovecreative.com.au-ssl_log 298 coscom/coscom.com.au-ssl_log 260 evolution/app.evolutionerp.com.au-ssl_log 140 customc/customcentral.com.au-ssl_log 51 madalice/madalice.com.au-ssl_log 15 evolution/my.evolutionerp.com.au-ssl_log 1 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 484 34.166.156.174 140 40.115.94.245 125 45.148.10.12 5 34.11.194.113 2 114.119.131.88 1 66.249.73.167 1 52.167.144.215 1 144.76.72.24 1 114.119.159.70 1 114.119.146.16 1 114.119.143.14 1 114.119.143.104 1 114.119.140.234 1 114.119.130.40 --- top request paths across all vhosts (last 3 min) --- 36 POST /wordpress/ 22 POST /wordpress/index.php 12 POST /wordpress/wp-json/Batch/v1 12 POST /wordpress/wp-json/batch/v1 11 POST /wordpress//wp-json/batch/v1 11 POST /wordpress/wordpress/wp-json/batch/v1 11 POST /wordpress/blog/wp-json/batch/v1 10 POST /wordpress/wp-json/batch/v1/ 8 GET /store/hand-painted-nike-af1-wildroses/ 4 POST / 2 GET /zend/.env 2 GET /yii/.env 2 GET /www/phpinfo.php 2 GET /www/.env 2 GET /wp/.env 2 GET /wp-admin/phpinfo.php 2 GET /worker/.env 2 GET /wordpress/.env 2 GET /webroot/index.php/_environment 2 GET /webmail/phpinfo.php --- busiest 3 vhosts: top paths + last 10 requests --- == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 10 POST /wordpress/ 6 POST /wordpress/index.php 4 POST /wordpress/wp-json/Batch/v1 4 POST /wordpress/wp-json/batch/v1 4 POST /wordpress//wp-json/batch/v1 4 POST / 3 POST /wordpress/wp-json/batch/v1/ 3 POST /wordpress/wordpress/wp-json/batch/v1 3 POST /wordpress/blog/wp-json/batch/v1 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php -- last 10 requests -- 34.166.156.174 - - [06/Sep/2026:23:50:21 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:50:22 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:50:22 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:50:22 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:50:22 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:50:23 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:50:23 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:50:23 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:50:23 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:50:24 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == coscom/coscom.com.au-ssl_log == -- top paths -- 11 POST /wordpress/ 6 POST /wordpress/index.php 4 POST /wordpress/wp-json/Batch/v1 4 POST /wordpress/wp-json/batch/v1 3 POST /wordpress/wp-json/batch/v1/ 3 POST /wordpress//wp-json/batch/v1 3 POST /wordpress/wordpress/wp-json/batch/v1 3 POST /wordpress/blog/wp-json/batch/v1 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env -- last 10 requests -- 34.166.156.174 - - [06/Sep/2026:23:48:54 +1000] "GET /beta/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:48:54 +1000] "GET /uat/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:48:54 +1000] "GET /qa/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:48:54 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:48:55 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:48:55 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:48:55 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:48:55 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:48:56 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:48:56 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 2 GET /api/getItem/SHSG656520 2 GET /api/getItem/SHSG656516 2 GET /api/getItem/SHSG3030208 2 GET /api/getItem/SHSG125125508 2 GET /api/getItem/SHSG125125408 2 GET /api/getItem/SHSG10010050 2 GET /api/getItem/SHSG10010040 -- last 10 requests -- 40.115.94.245 - - [06/Sep/2026:23:50:51 +1000] "GET /api/getItem/RHSG1005050 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:23:50:51 +1000] "GET /api/getItem/RHSG1257530 HTTP/1.1" 200 1508 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:23:50:52 +1000] "GET /api/getItem/RHSG12575308 HTTP/1.1" 200 1470 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:23:50:52 +1000] "GET /api/getItem/RHSG1257530 HTTP/1.1" 200 1508 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:23:50:52 +1000] "GET /api/getItem/RHSG12575408 HTTP/1.1" 200 1350 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:23:50:53 +1000] "GET /api/getItem/RHSG12575508 HTTP/1.1" 404 114 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:23:50:53 +1000] "GET /api/getItem/RHSP12575608 HTTP/1.1" 404 114 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:23:50:53 +1000] "GET /api/getItem/RHSG15050208 HTTP/1.1" 200 2045 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:23:50:54 +1000] "GET /api/getItem/RHSG15050258 HTTP/1.1" 404 114 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:23:50:54 +1000] "GET /api/getItem/RHSG15050308 HTTP/1.1" 200 1343 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-06 23:48:36 L1=1.36 run=1 blk=0 avail=9974 (72.4%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=180 ap=16 tcp=34 topuser=madalice 2026-09-06 23:48:38 L1=1.41 run=2 blk=1 avail=9969 (72.4%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=181 ap=16 tcp=36 topuser=madalice 2026-09-06 23:48:46 L1=1.38 run=2 blk=1 avail=9964 (72.3%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=180 ap=16 tcp=35 topuser=madalice 2026-09-06 23:48:48 L1=1.35 run=1 blk=1 avail=9971 (72.4%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=180 ap=16 tcp=36 topuser=madalice 2026-09-06 23:48:56 L1=1.32 run=2 blk=1 avail=9970 (72.4%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=180 ap=15 tcp=34 topuser=madalice 2026-09-06 23:48:58 L1=1.37 run=6 blk=1 avail=9962 (72.3%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=180 ap=15 tcp=34 topuser=madalice 2026-09-06 23:49:06 L1=1.42 run=1 blk=1 avail=9890 (71.8%) swpO=0 conn=1 myRSS=1442 php=6 phpRSS=287 ap=14 tcp=32 topuser=madalice 2026-09-06 23:49:08 L1=1.39 run=1 blk=1 avail=9892 (71.8%) swpO=0 conn=1 myRSS=1442 php=6 phpRSS=287 ap=14 tcp=30 topuser=madalice 2026-09-06 23:49:16 L1=1.52 run=2 blk=1 avail=9870 (71.6%) swpO=14 conn=1 myRSS=1442 php=6 phpRSS=311 ap=13 tcp=30 topuser=madalice 2026-09-06 23:49:18 L1=1.48 run=1 blk=1 avail=9870 (71.6%) swpO=14 conn=1 myRSS=1442 php=6 phpRSS=311 ap=13 tcp=32 topuser=madalice 2026-09-06 23:49:26 L1=1.44 run=4 blk=1 avail=9839 (71.4%) swpO=0 conn=1 myRSS=1442 php=6 phpRSS=332 ap=13 tcp=32 topuser=madalice 2026-09-06 23:49:28 L1=1.40 run=1 blk=1 avail=9849 (71.5%) swpO=0 conn=1 myRSS=1442 php=6 phpRSS=332 ap=13 tcp=32 topuser=madalice 2026-09-06 23:49:36 L1=1.37 run=1 blk=1 avail=9987 (72.5%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=177 ap=13 tcp=30 topuser=madalice 2026-09-06 23:49:38 L1=1.42 run=1 blk=1 avail=9998 (72.6%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=177 ap=13 tcp=30 topuser=madalice 2026-09-06 23:49:46 L1=1.39 run=2 blk=2 avail=9985 (72.5%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=180 ap=13 tcp=32 topuser=customc 2026-09-06 23:49:48 L1=1.36 run=2 blk=1 avail=9950 (72.2%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=218 ap=13 tcp=31 topuser=madalice 2026-09-06 23:49:56 L1=1.33 run=1 blk=1 avail=10010(72.7%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=154 ap=13 tcp=29 topuser=madalice 2026-09-06 23:49:58 L1=1.30 run=1 blk=1 avail=10009(72.7%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=154 ap=13 tcp=29 topuser=madalice 2026-09-06 23:50:06 L1=1.36 run=2 blk=1 avail=10003(72.6%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=154 ap=13 tcp=29 topuser=madalice 2026-09-06 23:50:08 L1=1.41 run=2 blk=1 avail=10004(72.6%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=154 ap=13 tcp=29 topuser=madalice 2026-09-06 23:50:16 L1=1.46 run=1 blk=1 avail=9799 (71.1%) swpO=0 conn=1 myRSS=1442 php=8 phpRSS=447 ap=13 tcp=37 topuser=evolution 2026-09-06 23:50:18 L1=1.58 run=1 blk=1 avail=9994 (72.5%) swpO=11 conn=1 myRSS=1442 php=5 phpRSS=155 ap=14 tcp=36 topuser=madalice 2026-09-06 23:50:26 L1=1.53 run=1 blk=1 avail=9989 (72.5%) swpO=11 conn=1 myRSS=1442 php=5 phpRSS=155 ap=15 tcp=126 topuser=madalice 2026-09-06 23:50:28 L1=1.49 run=1 blk=1 avail=9944 (72.2%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=155 ap=22 tcp=80 topuser=madalice 2026-09-06 23:50:36 L1=1.53 run=1 blk=1 avail=9579 (69.5%) swpO=33 conn=1 myRSS=1441 php=5 phpRSS=177 ap=75 tcp=67 topuser=madalice 2026-09-06 23:50:38 L1=1.49 run=1 blk=1 avail=9593 (69.6%) swpO=33 conn=1 myRSS=1441 php=5 phpRSS=177 ap=72 tcp=68 topuser=madalice 2026-09-06 23:50:46 L1=1.45 run=2 blk=1 avail=9635 (69.9%) swpO=0 conn=1 myRSS=1441 php=5 phpRSS=177 ap=65 tcp=69 topuser=madalice 2026-09-06 23:50:49 L1=1.41 run=1 blk=1 avail=9656 (70.1%) swpO=0 conn=1 myRSS=1441 php=5 phpRSS=177 ap=62 tcp=67 topuser=madalice 2026-09-06 23:50:56 L1=1.38 run=3 blk=1 avail=9711 (70.5%) swpO=0 conn=1 myRSS=1441 php=6 phpRSS=132 ap=55 tcp=37 topuser=madalice 2026-09-06 23:50:59 L1=2.23 run=4 blk=1 avail=8555 (62.1%) swpO=447 conn=4 myRSS=1437 php=14 phpRSS=1502 ap=52 tcp=46 topuser=madalice