INCIDENT 2026-09-06 23:52:00 trigger: php_rss=1683MB ================================================================== load: 2.81 1.90 1.64 2/694 389343 ncpu:10 mem_avail: 8594MB/13777MB (62.4%) swap_used:2531MB swapout:0/s blocked(D):2 running:1 iowait:9.8% steal:0.0% php: 15 procs / 1683MB heaviest user: madalice (10 procs, 1566MB) apache: 31 procs tcp_estab: 28 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 10 1566 mysql 1 1435 root 250 1001 nobody 29 486 netdata 8 245 mailman 20 105 wp-toolkit 3 55 dovenull 6 55 cpanellogin 1 48 kurri 3 39 lowrange 2 29 mailnull 3 24 dovecot 3 23 alison 1 15 infinium 1 14 aaa 1 14 zabbix 1 10 named 1 10 evolution 11 10 polkitd 1 7 --- php workers by user --- USER PROCS RSS_MB madalice 10 1566 root 1 23 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7545 MB Active(file): 4818 MB Inactive(file): 2838 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 521 MB CommitLimit: 10984 MB Committed_AS: 9204 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 5-21:29:34 5268 /usr/bin/imunify-agent-proxy 4109079 root 1-19:07:12 1824 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 1-19:07:12 110940 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 1469704 3.0 Ssl 1-04:15:29 /usr/sbin/mariadbd 166870 1 netdata 188856 2.6 Ssl 21:29:40 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 388454 167896 madalice 163296 19.9 S 01:03 php-fpm: pool madalice_com_au 388421 167896 madalice 163120 19.2 S 01:04 php-fpm: pool madalice_com_au 388457 167896 madalice 160252 17.8 S 01:03 php-fpm: pool madalice_com_au 388451 167896 madalice 160168 20.1 S 01:03 php-fpm: pool madalice_com_au 388452 167896 madalice 159908 20.1 S 01:03 php-fpm: pool madalice_com_au 388455 167896 madalice 159812 19.5 S 01:03 php-fpm: pool madalice_com_au 388422 167896 madalice 159752 17.5 S 01:04 php-fpm: pool madalice_com_au 388459 167896 madalice 159736 16.9 S 01:03 php-fpm: pool madalice_com_au 388450 167896 madalice 159072 20.4 S 01:03 php-fpm: pool madalice_com_au 388458 167896 madalice 158980 16.0 S 01:03 php-fpm: pool madalice_com_au 167871 1 root 158576 0.0 Ss 21:29:33 /usr/lib/systemd/systemd-journald 220207 168913 root 156332 0.0 S 21:13:42 spamd child 2902970 168913 root 153300 0.0 S 08:10:25 spamd child 4109105 4109079 root 110940 1.4 Sl 1-19:07:12 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 168913 1 root 72552 0.0 Ss 21:28:30 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 182429 1353308 cpanellogin 49252 0.0 S 01:00:21 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 1469 1 root 41940 0.1 Ss 69-13:42:15 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 41012 0.1 Ss 46-21:10:46 cpsrvd (SSL) - waiting for connections 167562 166914 netdata 35608 0.1 Sl 21:29:35 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 35180 0.0 Sl 9-21:32:20 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166645 1 wp-toolkit 31268 0.0 Ss 21:29:44 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1463 1 root 24104 0.0 Ss 69-13:42:15 tailwatchd 167896 1 root 23912 0.0 Ss 21:29:32 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 370671 506832 nobody 23620 0.0 S 06:42 /usr/sbin/httpd -k start 370687 506832 nobody 21252 0.0 S 06:41 /usr/sbin/httpd -k start 388190 506832 nobody 20524 0.0 S 01:30 /usr/sbin/httpd -k start 388192 506832 nobody 20280 0.0 S 01:30 /usr/sbin/httpd -k start 388203 506832 nobody 20184 0.0 S 01:29 /usr/sbin/httpd -k start 388208 506832 nobody 20180 0.0 S 01:29 /usr/sbin/httpd -k start 388051 506832 nobody 20080 0.0 S 01:42 /usr/sbin/httpd -k start 388973 506832 nobody 20036 0.0 S 00:38 /usr/sbin/httpd -k start 388218 506832 nobody 19584 0.0 S 01:28 /usr/sbin/httpd -k start 388095 506832 nobody 19524 0.0 S 01:39 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19444 0.0 Ss 21:29:33 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 388189 506832 nobody 19288 0.0 S 01:30 /usr/sbin/httpd -k start 388152 506832 nobody 18868 0.0 S 01:33 /usr/sbin/httpd -k start 389000 506832 nobody 18864 0.0 S 00:35 /usr/sbin/httpd -k start 388242 506832 nobody 18684 0.0 S 01:28 /usr/sbin/httpd -k start 388198 506832 nobody 18612 0.0 S 01:29 /usr/sbin/httpd -k start 389043 506832 nobody 18592 0.0 S 00:33 /usr/sbin/httpd -k start 389008 506832 nobody 18368 0.0 S 00:34 /usr/sbin/httpd -k start 389042 506832 nobody 18352 0.0 S 00:33 /usr/sbin/httpd -k start 388991 506832 nobody 18244 0.0 S 00:37 /usr/sbin/httpd -k start 388211 506832 nobody 17712 0.0 S 01:29 /usr/sbin/httpd -k start 388201 506832 nobody 17704 0.0 S 01:29 /usr/sbin/httpd -k start 167566 166914 netdata 17452 2.1 Sl 21:29:35 /usr/libexec/netdata/plugins.d/apps.plugin 1 388967 506832 nobody 17260 0.0 S 00:39 /usr/sbin/httpd -k start 388990 506832 nobody 17180 0.0 S 00:37 /usr/sbin/httpd -k start 388984 506832 nobody 16860 0.0 S 00:37 /usr/sbin/httpd -k start 388988 506832 nobody 16752 0.0 S 00:37 /usr/sbin/httpd -k start 388989 506832 nobody 16692 0.0 S 00:37 /usr/sbin/httpd -k start 285110 1471 root 16360 0.0 S 31:27 cPhulkd - dbprocessor 166757 1 root 15648 0.0 Ss 21:29:43 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 216505 167382 alison 15408 0.0 S 51:05 dovecot/imap 3942600 167382 aaa 15348 0.0 S 03:05:13 dovecot/imap 1471 1 root 15304 0.0 Ss 69-13:42:15 cPhulkd - processor 388439 167382 kurri 15244 0.0 S 01:03 dovecot/imap 4112099 167382 lowrange 15200 0.0 S 02:16:09 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 796990 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min cosgrovecreative/cosgrovecreative.com.au-ssl_log 93 madalice/madalice.com.au-ssl_log 89 evolution/app.evolutionerp.com.au-ssl_log 83 aaa/aaadownunder.com.au-ssl_log 41 infinium/infinium.net.au-ssl_log 28 alison/alisonarts.com.au-ssl_log 2 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 93 34.166.156.174 85 34.11.194.113 83 40.115.94.245 38 136.113.184.148 28 45.148.10.12 1 220.181.108.111 1 216.73.217.19 1 193.36.224.56 1 118.127.40.55 1 114.119.159.70 1 114.119.143.14 1 114.119.137.101 1 114.119.130.40 1 110.238.111.218 --- top request paths across all vhosts (last 3 min) --- 10 POST / 6 POST /index.php 4 GET /store/hand-painted-nike-af1-wildroses/ 2 POST /wp-json/Batch/v1 2 POST /wp-json/batch/v1/ 2 POST /wp-json/batch/v1 2 POST //wp-json/batch/v1 2 POST /wordpress/wp-json/batch/v1 2 POST /blog/wp-json/batch/v1 2 GET /.zshrc 2 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 2 GET /wp-admin/ 2 GET /users/login 2 GET /user/login 2 GET /ssl/server.key 2 GET /ssl/localhost.key 2 GET /signup 2 GET /signin 2 GET /sign-in 2 GET /secure --- busiest 3 vhosts: top paths + last 10 requests --- == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 1 GET /www/phpinfo.php 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /uat/phpinfo.php 1 GET /uat/.env 1 GET /travis/.env 1 GET /transactional/.env 1 GET /tmp/phpinfo.php 1 GET /test/phpinfo.php 1 GET /test.php -- last 10 requests -- 34.166.156.174 - - [06/Sep/2026:23:50:21 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:50:22 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:50:22 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:50:22 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:50:22 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:50:23 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:50:23 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:50:23 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:50:23 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.156.174 - - [06/Sep/2026:23:50:24 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 4 GET /store/hand-painted-nike-af1-wildroses/ 2 GET /.zshrc 2 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 2 GET /wp-admin/ 2 GET /users/login 2 GET /user/login 2 GET /ssl/server.key 2 GET /ssl/localhost.key 2 GET /signup 2 GET /signin 2 GET /sign-in 2 GET /secure -- last 10 requests -- 34.11.194.113 - - [06/Sep/2026:23:51:23 +1000] "GET /portal HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36" 34.11.194.113 - - [06/Sep/2026:23:51:23 +1000] "GET /account HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36" 34.11.194.113 - - [06/Sep/2026:23:51:26 +1000] "GET /console HTTP/1.1" 404 36640 "https://www.madalice.com.au/console" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Sa 34.11.194.113 - - [06/Sep/2026:23:51:25 +1000] "GET /wp-admin/ HTTP/1.1" 302 1 "https://madalice.com.au/dashboard" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari 34.11.194.113 - - [06/Sep/2026:23:51:26 +1000] "GET /app HTTP/1.1" 404 36638 "https://www.madalice.com.au/app" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537 34.11.194.113 - - [06/Sep/2026:23:51:26 +1000] "GET /backoffice HTTP/1.1" 404 36644 "https://www.madalice.com.au/backoffice" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mob 34.11.194.113 - - [06/Sep/2026:23:51:26 +1000] "GET /admin/login HTTP/1.1" 404 36639 "https://www.madalice.com.au/admin/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 M 34.11.194.113 - - [06/Sep/2026:23:51:27 +1000] "GET /wp-admin/ HTTP/1.1" 302 1 "https://madalice.com.au/admin" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537 34.11.194.113 - - [06/Sep/2026:23:51:27 +1000] "GET /portal HTTP/1.1" 404 36640 "https://www.madalice.com.au/portal" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safa 34.11.194.113 - - [06/Sep/2026:23:51:27 +1000] "GET /account HTTP/1.1" 404 36640 "https://www.madalice.com.au/account" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Sa == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /api/getItem/SHSG252516-8 2 GET /api/getItem/SHSG252516-6.5 2 GET /api/getItem/RHSG15050308 2 GET /api/getItem/RHSG15050208 2 GET /api/getItem/RHSG150100408 2 GET /api/getItem/RHSG12575408 2 GET /api/getItem/RHSG12575308 2 GET /api/getItem/RHSG1257530 2 GET /api/getItem/RHSG10050208 2 GET /api/getItem/19R-8000 2 GET /api/getItem/19R-7320 1 GET /api/getItem/SHSG10010050-8 -- last 10 requests -- 40.115.94.245 - - [06/Sep/2026:23:51:17 +1000] "GET /api/getItem/SHSG10010020-SP25-8 HTTP/1.1" 200 1541 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:23:51:17 +1000] "GET /api/getItem/SHSG10010025-RDP25-8-DI HTTP/1.1" 200 1472 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:23:51:18 +1000] "GET /api/getItem/SHSG10010030-8 HTTP/1.1" 200 1988 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:23:51:18 +1000] "GET /api/getItem/SHSG10010030-DP25-8 HTTP/1.1" 200 1534 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:23:51:19 +1000] "GET /api/getItem/SHSG10010030-DP25-8-DI HTTP/1.1" 200 1405 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:23:51:19 +1000] "GET /api/getItem/SHSG10010030-SP25-8 HTTP/1.1" 200 1409 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:23:51:19 +1000] "GET /api/getItem/SHSG10010040-12 HTTP/1.1" 200 1294 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:23:51:20 +1000] "GET /api/getItem/SHSG10010040-8 HTTP/1.1" 200 1867 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:23:51:21 +1000] "GET /api/getItem/SHSG10010050-12 HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:23:51:21 +1000] "GET /api/getItem/SHSG10010050-8 HTTP/1.1" 200 1838 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-06 23:49:36 L1=1.37 run=1 blk=1 avail=9987 (72.5%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=177 ap=13 tcp=30 topuser=madalice 2026-09-06 23:49:38 L1=1.42 run=1 blk=1 avail=9998 (72.6%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=177 ap=13 tcp=30 topuser=madalice 2026-09-06 23:49:46 L1=1.39 run=2 blk=2 avail=9985 (72.5%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=180 ap=13 tcp=32 topuser=customc 2026-09-06 23:49:48 L1=1.36 run=2 blk=1 avail=9950 (72.2%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=218 ap=13 tcp=31 topuser=madalice 2026-09-06 23:49:56 L1=1.33 run=1 blk=1 avail=10010(72.7%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=154 ap=13 tcp=29 topuser=madalice 2026-09-06 23:49:58 L1=1.30 run=1 blk=1 avail=10009(72.7%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=154 ap=13 tcp=29 topuser=madalice 2026-09-06 23:50:06 L1=1.36 run=2 blk=1 avail=10003(72.6%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=154 ap=13 tcp=29 topuser=madalice 2026-09-06 23:50:08 L1=1.41 run=2 blk=1 avail=10004(72.6%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=154 ap=13 tcp=29 topuser=madalice 2026-09-06 23:50:16 L1=1.46 run=1 blk=1 avail=9799 (71.1%) swpO=0 conn=1 myRSS=1442 php=8 phpRSS=447 ap=13 tcp=37 topuser=evolution 2026-09-06 23:50:18 L1=1.58 run=1 blk=1 avail=9994 (72.5%) swpO=11 conn=1 myRSS=1442 php=5 phpRSS=155 ap=14 tcp=36 topuser=madalice 2026-09-06 23:50:26 L1=1.53 run=1 blk=1 avail=9989 (72.5%) swpO=11 conn=1 myRSS=1442 php=5 phpRSS=155 ap=15 tcp=126 topuser=madalice 2026-09-06 23:50:28 L1=1.49 run=1 blk=1 avail=9944 (72.2%) swpO=0 conn=1 myRSS=1442 php=5 phpRSS=155 ap=22 tcp=80 topuser=madalice 2026-09-06 23:50:36 L1=1.53 run=1 blk=1 avail=9579 (69.5%) swpO=33 conn=1 myRSS=1441 php=5 phpRSS=177 ap=75 tcp=67 topuser=madalice 2026-09-06 23:50:38 L1=1.49 run=1 blk=1 avail=9593 (69.6%) swpO=33 conn=1 myRSS=1441 php=5 phpRSS=177 ap=72 tcp=68 topuser=madalice 2026-09-06 23:50:46 L1=1.45 run=2 blk=1 avail=9635 (69.9%) swpO=0 conn=1 myRSS=1441 php=5 phpRSS=177 ap=65 tcp=69 topuser=madalice 2026-09-06 23:50:49 L1=1.41 run=1 blk=1 avail=9656 (70.1%) swpO=0 conn=1 myRSS=1441 php=5 phpRSS=177 ap=62 tcp=67 topuser=madalice 2026-09-06 23:50:56 L1=1.38 run=3 blk=1 avail=9711 (70.5%) swpO=0 conn=1 myRSS=1441 php=6 phpRSS=132 ap=55 tcp=37 topuser=madalice 2026-09-06 23:50:59 L1=2.23 run=4 blk=1 avail=8555 (62.1%) swpO=447 conn=4 myRSS=1437 php=14 phpRSS=1502 ap=52 tcp=46 topuser=madalice 2026-09-06 23:51:06 L1=2.53 run=8 blk=1 avail=8466 (61.5%) swpO=533 conn=6 myRSS=1435 php=15 phpRSS=1705 ap=45 tcp=53 topuser=madalice 2026-09-06 23:51:09 L1=2.65 run=8 blk=1 avail=8541 (62.0%) swpO=86 conn=8 myRSS=1435 php=14 phpRSS=1626 ap=42 tcp=56 topuser=madalice 2026-09-06 23:51:16 L1=2.60 run=2 blk=1 avail=8607 (62.5%) swpO=0 conn=2 myRSS=1435 php=14 phpRSS=1592 ap=36 tcp=30 topuser=madalice 2026-09-06 23:51:19 L1=3.59 run=17 blk=1 avail=8517 (61.8%) swpO=0 conn=13 myRSS=1435 php=16 phpRSS=1765 ap=33 tcp=55 topuser=madalice 2026-09-06 23:51:26 L1=3.62 run=7 blk=1 avail=8303 (60.3%) swpO=19 conn=7 myRSS=1435 php=14 phpRSS=1817 ap=49 tcp=71 topuser=madalice 2026-09-06 23:51:29 L1=3.89 run=1 blk=1 avail=8348 (60.6%) swpO=19 conn=2 myRSS=1435 php=14 phpRSS=1678 ap=61 tcp=56 topuser=madalice 2026-09-06 23:51:37 L1=3.66 run=1 blk=1 avail=8481 (61.6%) swpO=0 conn=1 myRSS=1435 php=14 phpRSS=1589 ap=54 tcp=27 topuser=madalice 2026-09-06 23:51:39 L1=3.53 run=1 blk=1 avail=8506 (61.7%) swpO=0 conn=1 myRSS=1435 php=14 phpRSS=1589 ap=51 tcp=26 topuser=madalice 2026-09-06 23:51:47 L1=3.33 run=1 blk=1 avail=8564 (62.2%) swpO=0 conn=1 myRSS=1435 php=14 phpRSS=1590 ap=43 tcp=27 topuser=madalice 2026-09-06 23:51:50 L1=3.14 run=1 blk=1 avail=8578 (62.3%) swpO=0 conn=1 myRSS=1435 php=14 phpRSS=1590 ap=41 tcp=30 topuser=madalice 2026-09-06 23:51:57 L1=2.97 run=1 blk=1 avail=8640 (62.7%) swpO=0 conn=1 myRSS=1435 php=14 phpRSS=1590 ap=33 tcp=27 topuser=madalice 2026-09-06 23:52:00 L1=2.81 run=1 blk=2 avail=8594 (62.4%) swpO=0 conn=1 myRSS=1435 php=15 phpRSS=1683 ap=31 tcp=28 topuser=madalice