INCIDENT 2026-09-07 01:55:42 trigger: php_rss=1694MB ================================================================== load: 1.75 1.47 1.41 5/738 816624 ncpu:10 mem_avail: 8051MB/13777MB (58.4%) swap_used:2697MB swapout:221/s blocked(D):1 running:10 iowait:8.8% steal:0.0% php: 13 procs / 1694MB heaviest user: madalice (9 procs, 1670MB) apache: 71 procs tcp_estab: 59 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 9 1677 mysql 1 1528 nobody 70 1098 root 252 973 netdata 8 250 mailman 20 99 wp-toolkit 3 57 dovenull 6 55 cpanellogin 1 47 infinium 3 42 kurri 3 38 lowrange 2 28 mailnull 3 23 dovecot 3 23 candyfabcom 1 14 aaa 1 14 named 1 12 zabbix 1 10 evolution 11 10 polkitd 1 6 --- php workers by user --- USER PROCS RSS_MB madalice 9 1637 root 1 23 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7391 MB Active(file): 6232 MB Inactive(file): 1346 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 554 MB CommitLimit: 10984 MB Committed_AS: 10034 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 5-23:33:17 4740 /usr/bin/imunify-agent-proxy 4109079 root 1-21:10:55 1788 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 1-21:10:55 126384 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 1564784 3.0 Ssl 1-06:19:12 /usr/sbin/mariadbd 816448 167896 madalice 251500 43.5 R 00:12 php-fpm: pool madalice_com_au 166870 1 netdata 192904 2.6 Ssl 23:33:23 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 816449 167896 madalice 186568 42.2 R 00:12 php-fpm: pool madalice_com_au 167871 1 root 170876 0.0 Ss 23:33:16 /usr/lib/systemd/systemd-journald 816446 167896 madalice 159680 42.8 S 00:12 php-fpm: pool madalice_com_au 816447 167896 madalice 159540 43.4 S 00:12 php-fpm: pool madalice_com_au 816459 167896 madalice 159516 36.1 S 00:11 php-fpm: pool madalice_com_au 816463 167896 madalice 159492 34.7 S 00:11 php-fpm: pool madalice_com_au 816464 167896 madalice 159476 34.0 S 00:11 php-fpm: pool madalice_com_au 816456 167896 madalice 159460 36.8 S 00:11 php-fpm: pool madalice_com_au 816454 167896 madalice 159408 34.6 S 00:12 php-fpm: pool madalice_com_au 220207 168913 root 157272 0.0 S 23:17:25 spamd child 4109105 4109079 root 126384 1.4 Sl 1-21:10:55 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2902970 168913 root 76384 0.0 S 10:14:08 spamd child 168913 1 root 72288 0.0 Ss 23:32:13 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 733722 1353308 cpanellogin 48616 0.0 S 22:06 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 1353308 1 root 42056 0.1 Ss 46-23:14:29 cpsrvd (SSL) - waiting for connections 167562 166914 netdata 36608 0.1 Sl 23:33:18 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 34616 0.0 Sl 9-23:36:03 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 33476 0.1 Ss 69-15:45:58 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 166645 1 wp-toolkit 32184 0.0 Ss 23:33:27 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 408919 1 root 25480 0.0 Ss 01:55:41 lfd - sleeping 1463 1 root 23948 0.0 Ss 69-15:45:58 tailwatchd 167896 1 root 23916 0.0 Ss 23:33:15 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 800276 506832 nobody 21632 0.0 S 03:53 /usr/sbin/httpd -k start 800250 506832 nobody 20828 0.0 S 03:54 /usr/sbin/httpd -k start 800246 506832 nobody 20544 0.0 S 03:54 /usr/sbin/httpd -k start 167845 1 wp-toolkit 20004 0.0 Ss 23:33:16 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 800230 506832 nobody 19316 0.0 S 03:55 /usr/sbin/httpd -k start 800245 506832 nobody 19224 0.0 S 03:54 /usr/sbin/httpd -k start 816521 506832 nobody 19216 0.5 S 00:08 /usr/sbin/httpd -k start 816577 506832 nobody 19192 0.4 S 00:07 /usr/sbin/httpd -k start 816580 506832 nobody 19188 0.2 S 00:07 /usr/sbin/httpd -k start 816492 506832 nobody 18264 0.1 S 00:10 /usr/sbin/httpd -k start 816514 506832 nobody 18200 0.1 S 00:08 /usr/sbin/httpd -k start 816461 506832 nobody 18196 0.0 S 00:11 /usr/sbin/httpd -k start 816576 506832 nobody 18196 0.1 S 00:07 /usr/sbin/httpd -k start 816582 506832 nobody 18144 0.1 S 00:07 /usr/sbin/httpd -k start 816513 506832 nobody 18140 0.1 S 00:08 /usr/sbin/httpd -k start 816583 506832 nobody 18140 0.1 S 00:07 /usr/sbin/httpd -k start 816512 506832 nobody 18136 0.1 S 00:08 /usr/sbin/httpd -k start 816511 506832 nobody 18132 0.1 S 00:08 /usr/sbin/httpd -k start 816575 506832 nobody 18132 0.1 S 00:07 /usr/sbin/httpd -k start 816462 506832 nobody 18108 0.0 S 00:11 /usr/sbin/httpd -k start 816490 506832 nobody 18104 0.1 S 00:10 /usr/sbin/httpd -k start 800222 506832 nobody 17940 0.0 S 03:57 /usr/sbin/httpd -k start 800221 506832 nobody 17932 0.0 S 03:57 /usr/sbin/httpd -k start 167566 166914 netdata 17908 2.1 Sl 23:33:18 /usr/libexec/netdata/plugins.d/apps.plugin 1 816503 506832 nobody 17736 0.0 S 00:09 /usr/sbin/httpd -k start 784426 1471 root 16708 0.0 S 07:13 cPhulkd - dbprocessor 816579 506832 nobody 16196 0.0 S 00:07 /usr/sbin/httpd -k start 816568 506832 nobody 16164 0.0 S 00:07 /usr/sbin/httpd -k start 816515 506832 nobody 16160 0.0 S 00:08 /usr/sbin/httpd -k start 816524 506832 nobody 16160 0.0 S 00:08 /usr/sbin/httpd -k start 816562 506832 nobody 16160 0.0 S 00:07 /usr/sbin/httpd -k start 816553 506832 nobody 16148 0.0 S 00:07 /usr/sbin/httpd -k start 816557 506832 nobody 16144 0.0 S 00:07 /usr/sbin/httpd -k start 816560 506832 nobody 16144 0.0 S 00:07 /usr/sbin/httpd -k start 816519 506832 nobody 16136 0.0 S 00:08 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 855172 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min kamcool/kamcool.com.au-ssl_log 261 evolution/app.evolutionerp.com.au-ssl_log 116 madalice/madalice.com.au-ssl_log 25 (total vhosts taking traffic: 3) --- top client IPs across all vhosts (last 3 min) --- 261 34.165.27.218 114 40.115.94.245 22 35.252.125.63 2 136.66.253.140 1 169.58.114.123 1 114.119.159.70 1 114.119.143.14 --- top request paths across all vhosts (last 3 min) --- 114 GET /api/getItem/LWPG2001KG 4 POST / 3 GET / 2 GET /store/design-your-own-send-in/ 1 POST /graphql 1 POST /api/graphql 1 GET /zend/.env 1 GET /z9x8c7v6b5-debug-trigger-madalice.com.au 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env 1 GET /vue/.env 1 GET /vite/.env --- busiest 3 vhosts: top paths + last 10 requests --- == kamcool/kamcool.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env -- last 10 requests -- 34.165.27.218 - - [07/Sep/2026:01:55:11 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.27.218 - - [07/Sep/2026:01:55:12 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.27.218 - - [07/Sep/2026:01:55:12 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.27.218 - - [07/Sep/2026:01:55:13 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.27.218 - - [07/Sep/2026:01:55:13 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.27.218 - - [07/Sep/2026:01:55:13 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.27.218 - - [07/Sep/2026:01:55:14 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.27.218 - - [07/Sep/2026:01:55:14 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.27.218 - - [07/Sep/2026:01:55:14 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.165.27.218 - - [07/Sep/2026:01:55:15 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 114 GET /api/getItem/LWPG2001KG 2 GET / -- last 10 requests -- 40.115.94.245 - - [07/Sep/2026:01:54:39 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:01:54:39 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:01:54:40 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:01:54:40 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:01:54:40 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:01:54:41 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:01:54:41 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:01:54:42 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:01:54:42 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:01:54:42 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" == madalice/madalice.com.au-ssl_log == -- top paths -- 2 GET /store/design-your-own-send-in/ 1 POST /graphql 1 POST /api/graphql 1 GET /z9x8c7v6b5-debug-trigger-madalice.com.au 1 GET /.ssh/known_hosts 1 GET /.ssh/id_rsa 1 GET /.ssh/id_ed25519 1 GET /.ssh/id_ecdsa 1 GET /.ssh/id_dsa 1 GET /.ssh/config 1 GET /.ssh/authorized_keys 1 GET /serverless.yml -- last 10 requests -- 35.252.125.63 - - [07/Sep/2026:01:55:35 +1000] "GET /.ssh/config HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot)" 35.252.125.63 - - [07/Sep/2026:01:55:35 +1000] "GET /.ssh/known_hosts HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 35.252.125.63 - - [07/Sep/2026:01:55:35 +1000] "GET /.ssh/authorized_keys HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)" 35.252.125.63 - - [07/Sep/2026:01:55:35 +1000] "GET /.ssh/id_dsa HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 35.252.125.63 - - [07/Sep/2026:01:55:35 +1000] "GET /id_rsa HTTP/1.1" 404 36625 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 35.252.125.63 - - [07/Sep/2026:01:55:35 +1000] "GET /id_ed25519 HTTP/1.1" 404 36627 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)" 35.252.125.63 - - [07/Sep/2026:01:55:35 +1000] "GET /id_ecdsa HTTP/1.1" 404 36625 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1)" 35.252.125.63 - - [07/Sep/2026:01:55:35 +1000] "GET /id_dsa HTTP/1.1" 404 36644 "-" "Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)" 35.252.125.63 - - [07/Sep/2026:01:55:36 +1000] "POST /graphql HTTP/1.1" 404 36643 "https://madalice.com.au" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 35.252.125.63 - - [07/Sep/2026:01:55:38 +1000] "POST /api/graphql HTTP/1.1" 404 36644 "https://madalice.com.au" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/53 --- last 30 samples (run-up to this incident) --- 2026-09-07 01:53:15 L1=1.29 run=1 blk=1 avail=10097(73.3%) swpO=0 conn=2 myRSS=1534 php=4 phpRSS=23 ap=14 tcp=28 topuser=root 2026-09-07 01:53:22 L1=1.43 run=1 blk=1 avail=9979 (72.4%) swpO=0 conn=2 myRSS=1534 php=5 phpRSS=155 ap=14 tcp=32 topuser=madalice 2026-09-07 01:53:25 L1=1.40 run=1 blk=1 avail=9981 (72.4%) swpO=0 conn=2 myRSS=1534 php=5 phpRSS=155 ap=14 tcp=31 topuser=madalice 2026-09-07 01:53:32 L1=1.44 run=2 blk=1 avail=9881 (71.7%) swpO=0 conn=2 myRSS=1534 php=6 phpRSS=286 ap=14 tcp=31 topuser=madalice 2026-09-07 01:53:35 L1=1.41 run=1 blk=1 avail=9986 (72.5%) swpO=0 conn=2 myRSS=1534 php=5 phpRSS=155 ap=14 tcp=28 topuser=madalice 2026-09-07 01:53:42 L1=1.38 run=2 blk=0 avail=10102(73.3%) swpO=0 conn=2 myRSS=1534 php=4 phpRSS=23 ap=13 tcp=34 topuser=root 2026-09-07 01:53:45 L1=1.35 run=1 blk=1 avail=10005(72.6%) swpO=0 conn=2 myRSS=1534 php=5 phpRSS=155 ap=13 tcp=33 topuser=madalice 2026-09-07 01:53:52 L1=1.32 run=1 blk=1 avail=9997 (72.6%) swpO=0 conn=2 myRSS=1534 php=5 phpRSS=155 ap=13 tcp=31 topuser=madalice 2026-09-07 01:53:55 L1=1.29 run=1 blk=1 avail=9999 (72.6%) swpO=0 conn=1 myRSS=1534 php=5 phpRSS=155 ap=13 tcp=32 topuser=madalice 2026-09-07 01:54:02 L1=1.27 run=2 blk=0 avail=9995 (72.5%) swpO=0 conn=2 myRSS=1534 php=5 phpRSS=155 ap=13 tcp=31 topuser=madalice 2026-09-07 01:54:05 L1=1.33 run=1 blk=0 avail=9997 (72.6%) swpO=0 conn=1 myRSS=1534 php=5 phpRSS=155 ap=13 tcp=32 topuser=madalice 2026-09-07 01:54:12 L1=1.30 run=1 blk=0 avail=10107(73.4%) swpO=0 conn=1 myRSS=1534 php=4 phpRSS=23 ap=13 tcp=31 topuser=root 2026-09-07 01:54:15 L1=1.28 run=1 blk=1 avail=10110(73.4%) swpO=0 conn=1 myRSS=1534 php=4 phpRSS=23 ap=13 tcp=31 topuser=root 2026-09-07 01:54:22 L1=1.25 run=3 blk=0 avail=10107(73.4%) swpO=0 conn=1 myRSS=1534 php=4 phpRSS=23 ap=13 tcp=31 topuser=root 2026-09-07 01:54:25 L1=1.23 run=1 blk=0 avail=10106(73.4%) swpO=0 conn=1 myRSS=1534 php=4 phpRSS=23 ap=13 tcp=31 topuser=root 2026-09-07 01:54:32 L1=1.29 run=1 blk=0 avail=10108(73.4%) swpO=0 conn=1 myRSS=1534 php=4 phpRSS=23 ap=13 tcp=31 topuser=root 2026-09-07 01:54:35 L1=1.35 run=2 blk=0 avail=10108(73.4%) swpO=0 conn=1 myRSS=1534 php=4 phpRSS=23 ap=13 tcp=31 topuser=root 2026-09-07 01:54:42 L1=1.32 run=3 blk=1 avail=9862 (71.6%) swpO=0 conn=1 myRSS=1534 php=5 phpRSS=299 ap=13 tcp=32 topuser=corpkicks 2026-09-07 01:54:45 L1=1.30 run=1 blk=1 avail=10099(73.3%) swpO=0 conn=1 myRSS=1534 php=4 phpRSS=23 ap=13 tcp=31 topuser=root 2026-09-07 01:54:52 L1=1.35 run=2 blk=1 avail=10098(73.3%) swpO=0 conn=1 myRSS=1534 php=4 phpRSS=23 ap=13 tcp=32 topuser=root 2026-09-07 01:54:55 L1=1.41 run=1 blk=1 avail=10096(73.3%) swpO=0 conn=1 myRSS=1534 php=4 phpRSS=23 ap=13 tcp=30 topuser=root 2026-09-07 01:55:02 L1=1.37 run=2 blk=1 avail=10088(73.2%) swpO=0 conn=1 myRSS=1534 php=4 phpRSS=23 ap=13 tcp=32 topuser=root 2026-09-07 01:55:06 L1=1.50 run=3 blk=1 avail=10100(73.3%) swpO=0 conn=1 myRSS=1534 php=4 phpRSS=23 ap=13 tcp=29 topuser=root 2026-09-07 01:55:12 L1=1.62 run=1 blk=1 avail=10091(73.2%) swpO=0 conn=1 myRSS=1534 php=4 phpRSS=23 ap=13 tcp=31 topuser=root 2026-09-07 01:55:16 L1=1.57 run=1 blk=1 avail=10090(73.2%) swpO=0 conn=1 myRSS=1534 php=4 phpRSS=23 ap=13 tcp=30 topuser=root 2026-09-07 01:55:22 L1=1.53 run=1 blk=1 avail=10093(73.3%) swpO=0 conn=1 myRSS=1534 php=4 phpRSS=23 ap=13 tcp=30 topuser=root 2026-09-07 01:55:26 L1=1.48 run=1 blk=1 avail=10092(73.2%) swpO=0 conn=1 myRSS=1534 php=4 phpRSS=23 ap=13 tcp=31 topuser=root 2026-09-07 01:55:32 L1=1.53 run=11 blk=1 avail=9026 (65.5%) swpO=128 conn=1 myRSS=1532 php=14 phpRSS=1285 ap=16 tcp=46 topuser=madalice 2026-09-07 01:55:36 L1=1.72 run=6 blk=1 avail=8693 (63.1%) swpO=288 conn=1 myRSS=1528 php=15 phpRSS=1471 ap=44 tcp=66 topuser=madalice 2026-09-07 01:55:42 L1=1.75 run=10 blk=1 avail=8051 (58.4%) swpO=221 conn=5 myRSS=1528 php=13 phpRSS=1694 ap=71 tcp=59 topuser=madalice