INCIDENT 2026-09-07 02:35:55 trigger: php_rss=1631MB ================================================================== load: 1.84 1.49 1.53 4/693 955383 ncpu:10 mem_avail: 8451MB/13777MB (61.3%) swap_used:2362MB swapout:109/s blocked(D):1 running:10 iowait:8.1% steal:0.0% php: 14 procs / 1631MB heaviest user: madalice (10 procs, 1608MB) apache: 30 procs tcp_estab: 43 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 10 1624 mysql 1 1541 root 251 1213 nobody 29 458 netdata 8 247 mailman 20 102 wp-toolkit 3 56 dovenull 6 55 kurri 3 37 lowrange 2 28 dovecot 3 23 cpanellogin 1 20 mailnull 2 15 infinium 1 14 aaa 1 14 named 1 12 zabbix 1 11 evolution 11 10 polkitd 1 6 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1626 root 1 23 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7476 MB Active(file): 6839 MB Inactive(file): 869 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 630 MB CommitLimit: 10984 MB Committed_AS: 9184 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-00:13:29 5060 /usr/bin/imunify-agent-proxy 4109079 root 1-21:51:07 1788 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 1-21:51:07 211028 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 1578848 2.9 Ssl 1-06:59:24 /usr/sbin/mariadbd 955326 167896 madalice 244136 49.2 S 00:05 php-fpm: pool madalice_com_au 955327 167896 madalice 232572 47.6 R 00:05 php-fpm: pool madalice_com_au 4109105 4109079 root 211028 1.5 Sl 1-21:51:07 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 923652 904997 root 186996 0.1 S 06:11 spamd child 166870 1 netdata 185808 2.6 Ssl 1-00:13:35 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 904997 1 root 176012 0.5 Ss 12:58 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 923653 904997 root 167864 0.0 S 06:10 spamd child 955229 167896 madalice 160296 26.5 S 00:18 php-fpm: pool madalice_com_au 955321 167896 madalice 159496 40.1 S 00:06 php-fpm: pool madalice_com_au 955325 167896 madalice 159416 51.2 S 00:05 php-fpm: pool madalice_com_au 955320 167896 madalice 159288 43.0 S 00:06 php-fpm: pool madalice_com_au 955323 167896 madalice 159288 51.4 S 00:05 php-fpm: pool madalice_com_au 955324 167896 madalice 140288 35.8 R 00:05 php-fpm: pool madalice_com_au 955329 167896 madalice 136012 28.6 S 00:05 php-fpm: pool madalice_com_au 955330 167896 madalice 136008 28.0 S 00:05 php-fpm: pool madalice_com_au 167871 1 root 106792 0.0 Ss 1-00:13:28 /usr/lib/systemd/systemd-journald 1353308 1 root 41800 0.1 Ss 46-23:54:41 cpsrvd (SSL) - waiting for connections 904447 1 root 36652 0.0 Ss 13:30 lfd - sleeping 167562 166914 netdata 35668 0.1 Sl 1-00:13:30 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 34760 0.0 Sl 10-00:16:15 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 32372 0.1 Ss 69-16:26:10 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 166645 1 wp-toolkit 31920 0.0 Ss 1-00:13:39 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1463 1 root 26032 0.0 Ss 69-16:26:10 tailwatchd 167896 1 root 23964 0.0 Ss 1-00:13:27 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 905975 506832 nobody 23024 0.0 S 11:39 /usr/sbin/httpd -k start 938443 506832 nobody 21500 0.0 S 05:09 /usr/sbin/httpd -k start 919662 1353308 cpanellogin 21412 0.0 S 10:43 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 938499 506832 nobody 21232 0.0 S 05:04 /usr/sbin/httpd -k start 938504 506832 nobody 20860 0.0 S 05:03 /usr/sbin/httpd -k start 939638 506832 nobody 20824 0.1 S 03:06 /usr/sbin/httpd -k start 938503 506832 nobody 20580 0.0 S 05:03 /usr/sbin/httpd -k start 938439 506832 nobody 20508 0.0 S 05:09 /usr/sbin/httpd -k start 922147 506832 nobody 20280 0.1 S 08:52 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19996 0.0 Ss 1-00:13:28 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 938502 506832 nobody 19440 0.0 S 05:03 /usr/sbin/httpd -k start 938430 506832 nobody 19196 0.0 S 05:10 /usr/sbin/httpd -k start 940423 506832 nobody 18912 0.0 S 01:30 /usr/sbin/httpd -k start 940177 506832 nobody 18480 0.0 S 01:57 /usr/sbin/httpd -k start 167566 166914 netdata 18308 2.1 Sl 1-00:13:30 /usr/libexec/netdata/plugins.d/apps.plugin 1 955338 506832 nobody 18304 0.3 S 00:03 /usr/sbin/httpd -k start 955334 506832 nobody 18200 0.2 S 00:04 /usr/sbin/httpd -k start 955336 506832 nobody 18116 0.3 S 00:03 /usr/sbin/httpd -k start 955328 506832 nobody 18112 0.2 S 00:05 /usr/sbin/httpd -k start 955337 506832 nobody 18108 0.3 S 00:03 /usr/sbin/httpd -k start 955333 506832 nobody 17648 0.0 S 00:04 /usr/sbin/httpd -k start 904770 1471 root 16696 0.0 S 13:14 cPhulkd - dbprocessor 955339 506832 nobody 16020 0.0 S 00:03 /usr/sbin/httpd -k start 1471 1 root 15936 0.0 Ss 69-16:26:10 cPhulkd - processor 166757 1 root 15560 0.0 Ss 1-00:13:38 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 955342 506832 nobody 15416 0.0 S 00:02 /usr/sbin/httpd -k start 799802 167382 infinium 14868 0.0 S 44:56 dovecot/imap 3942600 167382 aaa 14840 0.0 S 05:49:08 dovecot/imap 628794 167382 lowrange 14728 0.0 S 01:32:46 dovecot/imap 817125 167382 lowrange 14684 0.0 S 40:07 dovecot/imap 955341 167382 kurri 14416 0.0 S 00:02 dovecot/imap 4166196 167382 kurri 14108 0.0 S 04:41:17 dovecot/imap 940545 1471 root 13824 0.0 S 01:13 cPhulkd - processor - http socket 166809 1 named 13108 0.0 Ssl 1-00:13:37 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 506832 1 root 12084 0.0 Ss 10-00:16:48 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 870453 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/auction.madalice.com.au-ssl_log 261 tubesupplies/tubesupplies.com.au-ssl_log 210 evolution/app.evolutionerp.com.au-ssl_log 118 madalice/madalice.com.au-ssl_log 8 evolution/my.evolutionerp.com.au-ssl_log 3 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 261 34.155.219.205 210 34.17.101.43 118 40.115.94.245 2 114.119.159.70 1 52.167.144.145 1 40.77.167.235 1 34.234.197.175 1 34.202.88.37 1 207.46.13.7 1 114.119.146.16 1 114.119.143.104 1 114.119.130.40 1 100.29.160.53 --- top request paths across all vhosts (last 3 min) --- 47 GET /api/getItem/LWPB2001KG 27 GET /api/getItem/LWFB2001KG 5 GET /store/custom-nike-af1-sunflower-kids/ 4 POST / 3 GET /index.php 2 GET /zend/.env 2 GET /yii/.env 2 GET /www/phpinfo.php 2 GET /www/.env 2 GET /wp/.env 2 GET /wp-admin/phpinfo.php 2 GET /worker/.env 2 GET /wordpress/.env 2 GET /webroot/index.php/_environment 2 GET /webmail/phpinfo.php 2 GET /vue/.env 2 GET /vite/.env 2 GET /vendor/.env 2 GET /var/www/html/.env 2 GET /var/www/.env --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/auction.madalice.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env -- last 10 requests -- 34.155.219.205 - - [07/Sep/2026:02:35:20 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.155.219.205 - - [07/Sep/2026:02:35:21 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.155.219.205 - - [07/Sep/2026:02:35:21 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.155.219.205 - - [07/Sep/2026:02:35:21 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.155.219.205 - - [07/Sep/2026:02:35:22 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.155.219.205 - - [07/Sep/2026:02:35:22 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.155.219.205 - - [07/Sep/2026:02:35:22 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.155.219.205 - - [07/Sep/2026:02:35:23 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.155.219.205 - - [07/Sep/2026:02:35:23 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.155.219.205 - - [07/Sep/2026:02:35:23 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /vue/.env 1 GET /vite/.env -- last 10 requests -- 34.17.101.43 - - [07/Sep/2026:02:34:06 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.101.43 - - [07/Sep/2026:02:34:06 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.101.43 - - [07/Sep/2026:02:34:06 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.101.43 - - [07/Sep/2026:02:34:07 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.101.43 - - [07/Sep/2026:02:34:07 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.101.43 - - [07/Sep/2026:02:34:07 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.101.43 - - [07/Sep/2026:02:34:07 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.101.43 - - [07/Sep/2026:02:34:08 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.101.43 - - [07/Sep/2026:02:34:08 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.101.43 - - [07/Sep/2026:02:34:08 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 47 GET /api/getItem/LWPB2001KG 27 GET /api/getItem/LWFB2001KG 2 GET /api/getItem/PC10050 1 GET /api/getItem/SGC-100 1 GET /api/getItem/RGW90-HC 1 GET /api/getItem/RGW%2CBM80 1 GET /api/getItem/RGW%2CBM117T 1 GET /api/getItem/RGW160 1 GET /api/getItem/RGW120 1 GET /api/getItem/RGW100T 1 GET /api/getItem/RGW100 1 GET /api/getItem/PC7550 -- last 10 requests -- 40.115.94.245 - - [07/Sep/2026:02:35:10 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:02:35:10 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:02:35:11 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:02:35:11 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:02:35:12 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:02:35:12 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:02:35:12 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:02:35:13 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:02:35:13 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:02:35:13 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-07 02:33:27 L1=1.48 run=1 blk=1 avail=9828 (71.3%) swpO=0 conn=1 myRSS=1542 php=5 phpRSS=178 ap=14 tcp=30 topuser=madalice 2026-09-07 02:33:34 L1=1.33 run=1 blk=0 avail=9828 (71.3%) swpO=0 conn=1 myRSS=1542 php=5 phpRSS=178 ap=14 tcp=30 topuser=madalice 2026-09-07 02:33:37 L1=1.33 run=2 blk=0 avail=9766 (70.9%) swpO=0 conn=1 myRSS=1542 php=6 phpRSS=270 ap=14 tcp=30 topuser=madalice 2026-09-07 02:33:44 L1=1.12 run=2 blk=0 avail=9850 (71.5%) swpO=0 conn=1 myRSS=1543 php=5 phpRSS=156 ap=14 tcp=31 topuser=madalice 2026-09-07 02:33:47 L1=1.12 run=3 blk=0 avail=9852 (71.5%) swpO=0 conn=1 myRSS=1543 php=5 phpRSS=156 ap=14 tcp=32 topuser=madalice 2026-09-07 02:33:54 L1=1.02 run=2 blk=0 avail=9856 (71.5%) swpO=0 conn=1 myRSS=1543 php=5 phpRSS=156 ap=14 tcp=28 topuser=madalice 2026-09-07 02:33:57 L1=1.02 run=1 blk=0 avail=9856 (71.5%) swpO=0 conn=1 myRSS=1543 php=5 phpRSS=156 ap=15 tcp=30 topuser=madalice 2026-09-07 02:34:04 L1=0.95 run=3 blk=0 avail=9721 (70.6%) swpO=0 conn=1 myRSS=1543 php=6 phpRSS=298 ap=15 tcp=30 topuser=madalice 2026-09-07 02:34:07 L1=0.95 run=1 blk=0 avail=9693 (70.4%) swpO=0 conn=1 myRSS=1543 php=6 phpRSS=331 ap=15 tcp=29 topuser=madalice 2026-09-07 02:34:14 L1=0.80 run=2 blk=0 avail=9688 (70.3%) swpO=0 conn=1 myRSS=1543 php=6 phpRSS=331 ap=15 tcp=27 topuser=madalice 2026-09-07 02:34:17 L1=0.80 run=1 blk=0 avail=9696 (70.4%) swpO=0 conn=1 myRSS=1543 php=6 phpRSS=331 ap=14 tcp=25 topuser=madalice 2026-09-07 02:34:24 L1=0.91 run=3 blk=0 avail=9346 (67.8%) swpO=59 conn=5 myRSS=1543 php=9 phpRSS=791 ap=14 tcp=33 topuser=corpkicks 2026-09-07 02:34:28 L1=0.91 run=2 blk=0 avail=9954 (72.2%) swpO=58 conn=1 myRSS=1543 php=4 phpRSS=23 ap=15 tcp=29 topuser=root 2026-09-07 02:34:34 L1=1.09 run=2 blk=1 avail=9743 (70.7%) swpO=4 conn=5 myRSS=1543 php=6 phpRSS=285 ap=15 tcp=30 topuser=madalice 2026-09-07 02:34:38 L1=1.09 run=1 blk=1 avail=9841 (71.4%) swpO=0 conn=1 myRSS=1543 php=5 phpRSS=156 ap=15 tcp=27 topuser=madalice 2026-09-07 02:34:44 L1=1.15 run=1 blk=1 avail=9826 (71.3%) swpO=0 conn=5 myRSS=1543 php=5 phpRSS=156 ap=15 tcp=29 topuser=madalice 2026-09-07 02:34:48 L1=1.15 run=1 blk=1 avail=9797 (71.1%) swpO=0 conn=1 myRSS=1543 php=5 phpRSS=178 ap=15 tcp=29 topuser=madalice 2026-09-07 02:34:54 L1=1.13 run=1 blk=1 avail=9797 (71.1%) swpO=0 conn=5 myRSS=1543 php=5 phpRSS=178 ap=15 tcp=29 topuser=madalice 2026-09-07 02:34:58 L1=1.13 run=2 blk=1 avail=9800 (71.1%) swpO=0 conn=1 myRSS=1543 php=5 phpRSS=178 ap=15 tcp=30 topuser=madalice 2026-09-07 02:35:04 L1=1.34 run=2 blk=1 avail=9784 (71.0%) swpO=0 conn=5 myRSS=1543 php=5 phpRSS=178 ap=15 tcp=31 topuser=madalice 2026-09-07 02:35:08 L1=1.34 run=3 blk=1 avail=9879 (71.7%) swpO=0 conn=2 myRSS=1543 php=5 phpRSS=88 ap=15 tcp=31 topuser=madalice 2026-09-07 02:35:14 L1=1.44 run=1 blk=1 avail=9820 (71.3%) swpO=0 conn=5 myRSS=1543 php=5 phpRSS=156 ap=15 tcp=31 topuser=madalice 2026-09-07 02:35:18 L1=1.44 run=1 blk=1 avail=9818 (71.3%) swpO=0 conn=2 myRSS=1543 php=5 phpRSS=156 ap=15 tcp=30 topuser=madalice 2026-09-07 02:35:24 L1=1.45 run=2 blk=1 avail=9817 (71.3%) swpO=0 conn=1 myRSS=1543 php=5 phpRSS=156 ap=15 tcp=30 topuser=madalice 2026-09-07 02:35:28 L1=1.45 run=2 blk=1 avail=9815 (71.2%) swpO=0 conn=2 myRSS=1543 php=5 phpRSS=156 ap=15 tcp=29 topuser=madalice 2026-09-07 02:35:34 L1=1.54 run=2 blk=1 avail=9901 (71.9%) swpO=0 conn=1 myRSS=1543 php=5 phpRSS=81 ap=15 tcp=29 topuser=infinium 2026-09-07 02:35:38 L1=1.54 run=5 blk=1 avail=9593 (69.6%) swpO=0 conn=2 myRSS=1543 php=7 phpRSS=440 ap=15 tcp=33 topuser=madalice 2026-09-07 02:35:45 L1=1.45 run=1 blk=1 avail=9813 (71.2%) swpO=0 conn=1 myRSS=1543 php=5 phpRSS=156 ap=15 tcp=28 topuser=madalice 2026-09-07 02:35:48 L1=1.45 run=1 blk=1 avail=9788 (71.0%) swpO=0 conn=2 myRSS=1543 php=5 phpRSS=177 ap=15 tcp=29 topuser=madalice 2026-09-07 02:35:55 L1=1.84 run=10 blk=1 avail=8451 (61.3%) swpO=109 conn=4 myRSS=1541 php=14 phpRSS=1631 ap=30 tcp=43 topuser=madalice