INCIDENT 2026-09-07 02:10:40 trigger: php_rss=1733MB ================================================================== load: 2.74 1.77 1.58 10/689 869050 ncpu:10 mem_avail: 8068MB/13777MB (58.6%) swap_used:2686MB swapout:66/s blocked(D):1 running:19 iowait:8.9% steal:0.0% php: 14 procs / 1733MB heaviest user: madalice (9 procs, 1685MB) apache: 14 procs tcp_estab: 42 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 9 1748 mysql 1 1525 root 257 1064 netdata 8 249 nobody 15 248 mailman 20 99 cpanellogin 1 93 wp-toolkit 3 57 dovenull 6 55 kurri 3 37 lowrange 2 28 mailnull 3 23 dovecot 3 23 infinium 1 14 aaa 1 14 named 1 12 zabbix 1 11 evolution 11 10 polkitd 1 6 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 9 1768 root 1 23 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7054 MB Active(file): 6344 MB Inactive(file): 933 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 549 MB CommitLimit: 10984 MB Committed_AS: 9258 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 853493 root 01:48 58788 /opt/imunify360/venv/bin/python3 -m imav.run 3926885 root 5-23:48:15 5060 /usr/bin/imunify-agent-proxy 4109079 root 1-21:25:53 1788 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 1-21:25:53 143404 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 1562668 2.9 Ssl 1-06:34:10 /usr/sbin/mariadbd 869005 167896 madalice 250328 80.0 S 00:02 php-fpm: pool madalice_com_au 869007 167896 madalice 248432 74.5 R 00:02 php-fpm: pool madalice_com_au 869008 167896 madalice 246596 78.0 R 00:02 php-fpm: pool madalice_com_au 869004 167896 madalice 243784 82.0 R 00:02 php-fpm: pool madalice_com_au 869010 167896 madalice 230392 79.0 R 00:02 php-fpm: pool madalice_com_au 869006 167896 madalice 228560 77.5 R 00:02 php-fpm: pool madalice_com_au 869009 167896 madalice 222168 71.0 R 00:02 php-fpm: pool madalice_com_au 166870 1 netdata 191796 2.6 Ssl 23:48:21 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 167871 1 root 177284 0.0 Ss 23:48:14 /usr/lib/systemd/systemd-journald 854440 167896 madalice 162796 9.5 R 00:44 php-fpm: pool madalice_com_au 220207 168913 root 157220 0.0 S 23:32:23 spamd child 4109105 4109079 root 143404 1.4 Sl 1-21:25:53 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 733722 1353308 cpanellogin 95424 0.0 S 37:04 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 2902970 168913 root 76200 0.0 S 10:29:06 spamd child 168913 1 root 72272 0.0 Ss 23:47:11 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 869018 167896 madalice 61088 28.0 R 00:01 php-fpm: pool madalice_com_au 853493 1 root 58788 1.5 Ssl 01:48 /opt/imunify360/venv/bin/python3 -m imav.run 1353308 1 root 42080 0.1 Ss 46-23:29:27 cpsrvd (SSL) - waiting for connections 869059 851281 evolution 41012 3.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 167562 166914 netdata 36348 0.1 Sl 23:48:16 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 34760 0.0 Sl 9-23:51:01 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 33336 0.1 Ss 69-16:00:56 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 166645 1 wp-toolkit 32080 0.0 Ss 23:48:25 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 408919 1 root 25276 0.0 Ss 02:10:39 lfd - sleeping 1463 1 root 24204 0.0 Ss 69-16:00:56 tailwatchd 167896 1 root 23908 0.0 Ss 23:48:13 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 816504 506832 nobody 23084 0.0 S 15:07 /usr/sbin/httpd -k start 818758 506832 nobody 21636 0.0 S 12:12 /usr/sbin/httpd -k start 851322 506832 nobody 21276 0.0 S 05:04 /usr/sbin/httpd -k start 834843 506832 nobody 20720 0.1 S 09:12 /usr/sbin/httpd -k start 852219 506832 nobody 20172 0.1 S 03:30 /usr/sbin/httpd -k start 852472 506832 nobody 20072 0.0 S 03:03 /usr/sbin/httpd -k start 167845 1 wp-toolkit 20004 0.0 Ss 23:48:14 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 851280 506832 nobody 20004 0.0 S 05:06 /usr/sbin/httpd -k start 851281 506832 nobody 19872 0.1 S 05:06 /usr/sbin/httpd -k start 851319 506832 nobody 19308 0.0 S 05:04 /usr/sbin/httpd -k start 854133 506832 nobody 18380 0.0 S 01:19 /usr/sbin/httpd -k start 167566 166914 netdata 17908 2.1 Sl 23:48:16 /usr/libexec/netdata/plugins.d/apps.plugin 1 784426 1471 root 16784 0.0 S 22:11 cPhulkd - dbprocessor 166757 1 root 15560 0.0 Ss 23:48:24 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 1471 1 root 15536 0.0 Ss 69-16:00:56 cPhulkd - processor 869036 506832 nobody 15472 0.0 S 00:01 /usr/sbin/httpd -k start 869037 506832 nobody 15472 0.0 S 00:01 /usr/sbin/httpd -k start 869012 506832 nobody 15444 0.0 S 00:02 /usr/sbin/httpd -k start 3942600 167382 aaa 14840 0.0 S 05:23:54 dovecot/imap 628794 167382 lowrange 14728 0.0 S 01:07:32 dovecot/imap 817125 167382 lowrange 14684 0.0 S 14:53 dovecot/imap 799802 167382 infinium 14464 0.0 S 19:42 dovecot/imap 868975 167382 kurri 14252 0.0 S 00:03 dovecot/imap 4166196 167382 kurri 14228 0.0 S 04:16:03 dovecot/imap 853089 167382 root 12984 0.0 S 01:56 dovecot/auth -w 853088 167382 root 12924 0.0 S 01:56 dovecot/auth -w 166809 1 named 12868 0.0 Ssl 23:48:23 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 868941 1471 root 12276 0.0 S 00:10 cPhulkd - processor - http socket 506832 1 root 12084 0.0 Ss 9-23:51:34 /usr/sbin/httpd -k start 167385 167382 dovenull 11980 0.0 S 23:48:17 dovecot/imap-login 167389 167382 dovenull 11864 0.0 S 23:48:17 dovecot/imap-login 483898 1 zabbix 11404 0.2 Ssl 9-23:52:18 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 167398 167382 dovecot 11264 0.0 S 23:48:17 dovecot/auth --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 860105 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 131 coscom/coscom.com.au-ssl_log 116 madalice/madalice.com.au-ssl_log 6 alison/alisonarts.com.au-ssl_log 5 corpkicks/corporatekicks.com.au-ssl_log 2 kurri/kurrimotorinn.com.au-ssl_log 2 madalice/auction.madalice.com.au-ssl_log 2 tubesupplies/tubesupplies.com.au-ssl_log 2 vinesit/vinesit.com.au-ssl_log 2 vinesit/vinesit.com.au 1 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 131 40.115.94.245 116 20.151.10.161 5 62.60.130.230 3 157.230.46.193 2 91.92.243.248 2 74.7.241.0 2 216.73.216.6 2 114.119.131.88 1 34.196.51.17 1 198.235.24.75 1 118.127.40.55 1 114.119.159.70 1 114.119.143.14 1 114.119.140.234 --- top request paths across all vhosts (last 3 min) --- 96 GET /api/getItem/LWHG2001KG 5 POST /wp-login.php 5 GET /store/customwarriors-kids/ 4 GET /api/getItem/PWFBW3151KG 3 GET /license.txt 3 GET /admin.php 2 GET /wp-login.php 2 GET /wp-content/themes/index.php 2 GET /av.php 1 POST /wp-cron.php 1 HEAD / 1 GET /xiugai.php 1 GET /XGtTsAeF.php 1 GET /wp.php 1 GET /wp-manager.php 1 GET /wp-includes/Text/Diff/Engine/about.php 1 GET /wp-includes/js/tinymce/themes/inlite/ 1 GET /wp-includes/ID3/about.php 1 GET /wp-includes/css/dist/ 1 GET /wp-includes/blocks/audio/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 96 GET /api/getItem/LWHG2001KG 4 GET /api/getItem/PWFBW3151KG 1 GET /api/getItem/CLSGNSTD45250KK 1 GET /api/getItem/CLSGNSTD40250KK 1 GET /api/getItem/CLSGNSTD32350KK 1 GET /api/getItem/CLPGNSTD50315KK 1 GET /api/getItem/CLPGNSTD50250KK 1 GET /api/getItem/CLPGNSTD45315KK 1 GET /api/getItem/CLPGNSTD45250KK 1 GET /api/getItem/CLPGNSTD40315KK 1 GET /api/getItem/CLPGNSTD40250KK 1 GET /api/getItem/CLPGNSTD32315KK -- last 10 requests -- 40.115.94.245 - - [07/Sep/2026:02:10:31 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:02:10:32 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:02:10:32 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:02:10:32 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:02:10:33 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:02:10:33 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:02:10:33 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:02:10:34 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:02:10:34 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:02:10:35 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" == coscom/coscom.com.au-ssl_log == -- top paths -- 3 GET /admin.php 2 GET /wp-content/themes/index.php 2 GET /av.php 1 GET /xiugai.php 1 GET /XGtTsAeF.php 1 GET /wp.php 1 GET /wp-manager.php 1 GET /wp-includes/Text/Diff/Engine/about.php 1 GET /wp-includes/js/tinymce/themes/inlite/ 1 GET /wp-includes/ID3/about.php 1 GET /wp-includes/css/dist/ 1 GET /wp-includes/blocks/audio/ -- last 10 requests -- 20.151.10.161 - - [07/Sep/2026:02:09:31 +1000] "GET /fms.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [07/Sep/2026:02:09:32 +1000] "GET /0day.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [07/Sep/2026:02:09:32 +1000] "GET /cycfruf.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [07/Sep/2026:02:09:32 +1000] "GET /adminan.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [07/Sep/2026:02:09:33 +1000] "GET /wp-includes/css/dist/ HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [07/Sep/2026:02:09:33 +1000] "GET /wp-includes/js/tinymce/themes/inlite/ HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [07/Sep/2026:02:09:34 +1000] "GET /wp-content/plugins/erinyani/ HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [07/Sep/2026:02:09:34 +1000] "GET /wp-act.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [07/Sep/2026:02:09:35 +1000] "GET /tymn.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [07/Sep/2026:02:09:35 +1000] "GET /fvvff.php HTTP/1.1" 401 36 "-" "-" == madalice/madalice.com.au-ssl_log == -- top paths -- 5 GET /store/customwarriors-kids/ 1 GET /.well-known/security.txt -- last 10 requests -- 114.119.140.234 - - [07/Sep/2026:02:08:03 +1000] "GET /store/customwarriors-kids/?wcpr_image=1&wcpr_rating=4&rating=2&wcpr_page=4 HTTP/1.1" 404 36660 "https://madalice.com.au/store/customwarriors-kids/?wcpr_image=1&wcpr_ 114.119.143.14 - - [07/Sep/2026:02:08:29 +1000] "GET /store/customwarriors-kids/?wcpr_image=1&wcpr_rating=1&rating=2&wcpr_page=2 HTTP/1.1" 404 36657 "https://madalice.com.au/store/customwarriors-kids/?wcpr_image=1&wcpr_r 198.235.24.75 - - [07/Sep/2026:02:08:43 +1000] "GET /.well-known/security.txt HTTP/1.1" 404 3421 "-" "Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xp 114.119.159.70 - - [07/Sep/2026:02:08:54 +1000] "GET /store/customwarriors-kids/?rating=4&verified=1&wcpr_image=1&wcpr_rating=5 HTTP/1.1" 404 36661 "https://madalice.com.au/store/customwarriors-kids/?rating=4&verified=1& 114.119.131.88 - - [07/Sep/2026:02:09:14 +1000] "GET /store/customwarriors-kids/?amp%3Bwcpr_verified=1&rating=2&wcpr_rating=1&wcpr_image=1 HTTP/1.1" 404 36670 "https://madalice.com.au/store/customwarriors-kids/?amp%3Bwcp 114.119.131.88 - - [07/Sep/2026:02:09:34 +1000] "GET /store/customwarriors-kids/?amp%3Bwcpr_rating=3&verified=1&wcpr_rating=3 HTTP/1.1" 404 36659 "https://madalice.com.au/store/customwarriors-kids/?amp%3Bwcpr_rating=3&ve --- last 30 samples (run-up to this incident) --- 2026-09-07 02:08:17 L1=1.71 run=2 blk=1 avail=9721 (70.6%) swpO=0 conn=1 myRSS=1528 php=5 phpRSS=178 ap=13 tcp=26 topuser=madalice 2026-09-07 02:08:19 L1=1.66 run=1 blk=1 avail=9721 (70.6%) swpO=0 conn=1 myRSS=1528 php=5 phpRSS=178 ap=13 tcp=26 topuser=madalice 2026-09-07 02:08:27 L1=1.60 run=1 blk=1 avail=9851 (71.5%) swpO=0 conn=1 myRSS=1528 php=4 phpRSS=23 ap=13 tcp=29 topuser=root 2026-09-07 02:08:29 L1=1.55 run=3 blk=1 avail=9810 (71.2%) swpO=0 conn=1 myRSS=1528 php=5 phpRSS=82 ap=13 tcp=30 topuser=madalice 2026-09-07 02:08:37 L1=1.51 run=1 blk=1 avail=9739 (70.7%) swpO=0 conn=1 myRSS=1528 php=5 phpRSS=156 ap=13 tcp=29 topuser=madalice 2026-09-07 02:08:39 L1=1.47 run=1 blk=1 avail=9738 (70.7%) swpO=0 conn=1 myRSS=1528 php=5 phpRSS=156 ap=13 tcp=30 topuser=madalice 2026-09-07 02:08:47 L1=1.43 run=1 blk=1 avail=9725 (70.6%) swpO=0 conn=1 myRSS=1528 php=5 phpRSS=156 ap=13 tcp=33 topuser=madalice 2026-09-07 02:08:49 L1=1.40 run=3 blk=1 avail=9697 (70.4%) swpO=0 conn=1 myRSS=1528 php=6 phpRSS=192 ap=13 tcp=35 topuser=madalice 2026-09-07 02:08:57 L1=1.45 run=1 blk=1 avail=9832 (71.4%) swpO=0 conn=1 myRSS=1528 php=5 phpRSS=156 ap=13 tcp=35 topuser=madalice 2026-09-07 02:09:00 L1=1.41 run=2 blk=1 avail=9824 (71.3%) swpO=0 conn=1 myRSS=1528 php=6 phpRSS=197 ap=13 tcp=35 topuser=madalice 2026-09-07 02:09:07 L1=1.54 run=1 blk=1 avail=9857 (71.5%) swpO=0 conn=1 myRSS=1528 php=5 phpRSS=156 ap=13 tcp=30 topuser=madalice 2026-09-07 02:09:10 L1=1.57 run=2 blk=1 avail=9708 (70.5%) swpO=0 conn=1 myRSS=1528 php=6 phpRSS=345 ap=13 tcp=31 topuser=corpkicks 2026-09-07 02:09:17 L1=1.61 run=3 blk=0 avail=9875 (71.7%) swpO=6 conn=1 myRSS=1528 php=5 phpRSS=178 ap=13 tcp=34 topuser=madalice 2026-09-07 02:09:20 L1=1.48 run=1 blk=0 avail=9877 (71.7%) swpO=6 conn=1 myRSS=1528 php=5 phpRSS=178 ap=13 tcp=35 topuser=madalice 2026-09-07 02:09:27 L1=1.36 run=1 blk=0 avail=9868 (71.6%) swpO=0 conn=1 myRSS=1528 php=5 phpRSS=178 ap=14 tcp=35 topuser=madalice 2026-09-07 02:09:30 L1=1.25 run=2 blk=0 avail=9867 (71.6%) swpO=0 conn=1 myRSS=1528 php=5 phpRSS=178 ap=14 tcp=34 topuser=madalice 2026-09-07 02:09:37 L1=1.23 run=2 blk=0 avail=9868 (71.6%) swpO=0 conn=1 myRSS=1528 php=5 phpRSS=178 ap=14 tcp=31 topuser=madalice 2026-09-07 02:09:40 L1=1.21 run=2 blk=0 avail=9777 (71.0%) swpO=0 conn=1 myRSS=1528 php=6 phpRSS=306 ap=14 tcp=29 topuser=madalice 2026-09-07 02:09:47 L1=1.19 run=2 blk=0 avail=9877 (71.7%) swpO=0 conn=1 myRSS=1528 php=5 phpRSS=178 ap=14 tcp=27 topuser=madalice 2026-09-07 02:09:50 L1=1.26 run=2 blk=1 avail=9790 (71.1%) swpO=0 conn=1 myRSS=1528 php=6 phpRSS=298 ap=14 tcp=26 topuser=madalice 2026-09-07 02:09:57 L1=1.24 run=3 blk=0 avail=9891 (71.8%) swpO=0 conn=1 myRSS=1528 php=5 phpRSS=159 ap=14 tcp=26 topuser=madalice 2026-09-07 02:10:00 L1=1.22 run=1 blk=0 avail=9898 (71.8%) swpO=0 conn=1 myRSS=1528 php=5 phpRSS=156 ap=14 tcp=25 topuser=madalice 2026-09-07 02:10:07 L1=1.28 run=2 blk=0 avail=9905 (71.9%) swpO=0 conn=1 myRSS=1528 php=5 phpRSS=156 ap=13 tcp=24 topuser=madalice 2026-09-07 02:10:10 L1=1.34 run=2 blk=0 avail=9903 (71.9%) swpO=0 conn=1 myRSS=1528 php=5 phpRSS=156 ap=13 tcp=24 topuser=madalice 2026-09-07 02:10:17 L1=1.39 run=3 blk=1 avail=9878 (71.7%) swpO=0 conn=2 myRSS=1528 php=6 phpRSS=225 ap=13 tcp=27 topuser=madalice 2026-09-07 02:10:20 L1=1.44 run=2 blk=1 avail=9821 (71.3%) swpO=0 conn=1 myRSS=1528 php=5 phpRSS=253 ap=13 tcp=27 topuser=madalice 2026-09-07 02:10:28 L1=1.41 run=1 blk=1 avail=9885 (71.8%) swpO=0 conn=2 myRSS=1528 php=5 phpRSS=181 ap=13 tcp=27 topuser=madalice 2026-09-07 02:10:30 L1=1.37 run=2 blk=1 avail=9881 (71.7%) swpO=0 conn=1 myRSS=1528 php=6 phpRSS=216 ap=13 tcp=27 topuser=madalice 2026-09-07 02:10:38 L1=1.58 run=2 blk=1 avail=9838 (71.4%) swpO=0 conn=2 myRSS=1528 php=6 phpRSS=263 ap=13 tcp=29 topuser=madalice 2026-09-07 02:10:40 L1=2.74 run=19 blk=1 avail=8068 (58.6%) swpO=66 conn=9 myRSS=1525 php=14 phpRSS=1733 ap=14 tcp=42 topuser=madalice