INCIDENT 2026-09-07 04:05:39 trigger: php_rss=1670MB ================================================================== load: 3.69 2.79 2.05 4/733 1263198 ncpu:10 mem_avail: 8324MB/13777MB (60.4%) swap_used:2639MB swapout:1065/s blocked(D):1 running:7 iowait:9.2% steal:0.0% php: 14 procs / 1670MB heaviest user: madalice (10 procs, 1647MB) apache: 63 procs tcp_estab: 64 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 10 1658 mysql 1 1408 root 252 1124 nobody 62 951 netdata 8 246 mailman 20 101 wp-toolkit 3 56 dovenull 6 55 infinium 3 42 kurri 3 37 lowrange 2 28 mailnull 4 27 dovecot 3 23 aaa 1 15 named 1 10 evolution 11 10 zabbix 1 9 polkitd 1 6 nscd 1 5 rpc 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1661 root 1 23 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7330 MB Active(file): 4436 MB Inactive(file): 3098 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 773 MB CommitLimit: 10984 MB Committed_AS: 9939 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1231276 root 05:38 2816 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 1246753 root 03:18 59780 /opt/imunify360/venv/bin/python3 -m imav.run 3926885 root 6-01:43:14 4876 /usr/bin/imunify-agent-proxy 4109079 root 1-23:20:52 1760 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 1-23:20:52 190748 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 1441932 2.9 Ssl 1-08:29:09 /usr/sbin/mariadbd 1232558 167896 madalice 299864 45.1 R 05:36 php-fpm: pool madalice_com_au 1263161 167896 madalice 251244 75.0 R 00:03 php-fpm: pool madalice_com_au 4109105 4109079 root 190748 1.5 Sl 1-23:20:52 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 166870 1 netdata 185104 2.6 Ssl 1-01:43:20 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1263162 167896 madalice 185036 62.0 R 00:03 php-fpm: pool madalice_com_au 1231195 167896 madalice 181504 41.5 S 05:42 php-fpm: pool madalice_com_au 904997 1 root 158708 0.0 Ss 01:42:43 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1247079 167896 madalice 158308 7.0 S 03:06 php-fpm: pool madalice_com_au 923652 904997 root 155420 0.0 S 01:35:56 spamd child 1263163 167896 madalice 127068 37.6 S 00:03 php-fpm: pool madalice_com_au 1263164 167896 madalice 127068 40.0 S 00:03 php-fpm: pool madalice_com_au 1263167 167896 madalice 127064 58.5 S 00:02 php-fpm: pool madalice_com_au 1263166 167896 madalice 127056 63.0 S 00:02 php-fpm: pool madalice_com_au 1263165 167896 madalice 127052 42.6 S 00:03 php-fpm: pool madalice_com_au 167871 1 root 124676 0.0 Ss 1-01:43:13 /usr/lib/systemd/systemd-journald 923653 904997 root 89868 0.0 S 01:35:55 spamd child 1246753 1 root 59780 0.7 Ssl 03:18 /opt/imunify360/venv/bin/python3 -m imav.run 1469 1 root 41776 0.1 Ss 69-17:55:55 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 167562 166914 netdata 36632 0.1 Sl 1-01:43:15 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 34284 0.0 Sl 10-01:46:00 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166645 1 wp-toolkit 31840 0.0 Ss 1-01:43:24 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29900 0.0 Ss 01:43:15 lfd - sleeping 167896 1 root 23920 0.0 Ss 1-01:43:12 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1463 1 root 23880 0.0 Ss 69-17:55:55 tailwatchd 1231244 506832 nobody 21180 0.0 S 05:38 /usr/sbin/httpd -k start 1245940 506832 nobody 20660 0.0 S 04:55 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19896 0.0 Ss 1-01:43:13 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1246292 506832 nobody 19448 0.0 S 04:13 /usr/sbin/httpd -k start 1247097 506832 nobody 18444 0.1 S 03:04 /usr/sbin/httpd -k start 1262995 506832 nobody 18292 0.0 S 00:17 /usr/sbin/httpd -k start 1263055 506832 nobody 17932 0.0 S 00:15 /usr/sbin/httpd -k start 1247098 506832 nobody 17924 0.0 S 03:04 /usr/sbin/httpd -k start 167566 166914 netdata 17832 2.1 Sl 1-01:43:15 /usr/libexec/netdata/plugins.d/apps.plugin 1 1263063 506832 nobody 16688 0.0 S 00:15 /usr/sbin/httpd -k start 1263050 506832 nobody 16616 0.0 S 00:15 /usr/sbin/httpd -k start 1263073 506832 nobody 16608 0.0 S 00:15 /usr/sbin/httpd -k start 1263074 506832 nobody 16608 0.0 S 00:15 /usr/sbin/httpd -k start 1263052 506832 nobody 16580 0.0 S 00:15 /usr/sbin/httpd -k start 1263072 506832 nobody 16572 0.0 S 00:15 /usr/sbin/httpd -k start 1263075 506832 nobody 16572 0.0 S 00:15 /usr/sbin/httpd -k start 1263065 506832 nobody 16548 0.0 S 00:15 /usr/sbin/httpd -k start 1263071 506832 nobody 16548 0.0 S 00:15 /usr/sbin/httpd -k start 1263066 506832 nobody 16512 0.0 S 00:15 /usr/sbin/httpd -k start 1263062 506832 nobody 16412 0.0 S 00:15 /usr/sbin/httpd -k start 1262999 506832 nobody 16388 0.0 S 00:17 /usr/sbin/httpd -k start 1262988 506832 nobody 16264 0.0 S 00:18 /usr/sbin/httpd -k start 1263001 506832 nobody 16264 0.0 S 00:17 /usr/sbin/httpd -k start 1263002 506832 nobody 16224 0.0 S 00:17 /usr/sbin/httpd -k start 1263041 506832 nobody 16216 0.0 S 00:16 /usr/sbin/httpd -k start 1262986 506832 nobody 16200 0.0 S 00:18 /usr/sbin/httpd -k start 1263030 506832 nobody 16196 0.0 S 00:16 /usr/sbin/httpd -k start 1263061 506832 nobody 16164 0.0 S 00:15 /usr/sbin/httpd -k start 1263031 506832 nobody 16160 0.0 S 00:16 /usr/sbin/httpd -k start 1262980 506832 nobody 16156 0.0 S 00:19 /usr/sbin/httpd -k start 1263032 506832 nobody 16156 0.0 S 00:16 /usr/sbin/httpd -k start 1263033 506832 nobody 16152 0.0 S 00:16 /usr/sbin/httpd -k start 1263000 506832 nobody 16136 0.0 S 00:17 /usr/sbin/httpd -k start 1263060 506832 nobody 16136 0.0 S 00:15 /usr/sbin/httpd -k start 1262996 506832 nobody 16128 0.0 S 00:17 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 916402 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 109 madalice/madalice.com.au-ssl_log 32 kamcool/kamcool.com.au 14 alison/alisonarts.com.au-ssl_log 2 evolution/my.evolutionerp.com.au-ssl_log 1 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 109 40.115.94.245 14 85.25.43.199 11 207.175.223.30 10 118.127.40.55 2 213.209.159.84 2 114.119.146.16 2 114.119.140.234 1 52.5.232.250 1 40.77.167.42 1 23.23.103.31 1 198.235.24.163 1 13.48.45.56 1 114.119.159.70 1 114.119.143.14 1 114.119.137.101 --- top request paths across all vhosts (last 3 min) --- 42 GET /api/getItem/LWPB2001KG 37 GET /api/getItem/LWFB2001KG 14 GET / 8 GET /wp-admin/admin-ajax.php 7 GET /store/barbie-pink-af1s/ 2 POST /wp-admin/admin-ajax.php 2 GET /.git/config 1 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 1 GET /.ssh/known_hosts 1 GET /.ssh/id_rsa 1 GET /.ssh/id_ed25519 1 GET /.ssh/id_ecdsa 1 GET /.ssh/id_dsa 1 GET /.ssh/config 1 GET /.ssh/authorized_keys 1 GET /serverless.yaml 1 GET /robots.txt 1 GET /index.php 1 GET /.idea/WebServers.xml 1 GET /custom-trotting-helmet/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 42 GET /api/getItem/LWPB2001KG 37 GET /api/getItem/LWFB2001KG 1 GET /api/getItem/SGC-100 1 GET /api/getItem/RGW100T 1 GET /api/getItem/PC7550 1 GET /api/getItem/PC5025BL 1 GET /api/getItem/PC19 1 GET /api/getItem/PC16 1 GET /api/getItem/PC15050 1 GET /api/getItem/PC1212 1 GET /api/getItem/PC10050 1 GET /api/getItem/L2 -- last 10 requests -- 40.115.94.245 - - [07/Sep/2026:04:05:12 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:05:12 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:05:12 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:05:13 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:05:13 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:05:14 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:05:14 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:05:14 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:05:15 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:05:15 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" == madalice/madalice.com.au-ssl_log == -- top paths -- 8 GET /wp-admin/admin-ajax.php 7 GET /store/barbie-pink-af1s/ 2 POST /wp-admin/admin-ajax.php 2 GET /.git/config 2 GET / 1 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 1 GET /.ssh/known_hosts 1 GET /.ssh/id_rsa 1 GET /.ssh/id_ed25519 1 GET /.ssh/id_ecdsa 1 GET /.ssh/id_dsa 1 GET /.ssh/config -- last 10 requests -- 207.175.223.30 - - [07/Sep/2026:04:05:37 +1000] "GET /config/env/aws_credentials.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)" 207.175.223.30 - - [07/Sep/2026:04:05:37 +1000] "GET /.ssh/id_ecdsa HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)" 207.175.223.30 - - [07/Sep/2026:04:05:37 +1000] "GET /.ssh/id_dsa HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)" 207.175.223.30 - - [07/Sep/2026:04:05:38 +1000] "GET /.ssh/id_ed25519 HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 207.175.223.30 - - [07/Sep/2026:04:05:37 +1000] "GET /serverless.yaml HTTP/1.1" 301 1 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)" 207.175.223.30 - - [07/Sep/2026:04:05:37 +1000] "GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au HTTP/1.1" 301 1 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)" 13.48.45.56 - - [07/Sep/2026:04:05:37 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chr 207.175.223.30 - - [07/Sep/2026:04:05:38 +1000] "GET /.ssh/authorized_keys HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)" 207.175.223.30 - - [07/Sep/2026:04:05:38 +1000] "GET /.ssh/config HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)" 207.175.223.30 - - [07/Sep/2026:04:05:38 +1000] "GET /.ssh/known_hosts HTTP/1.1" 403 13 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" == kamcool/kamcool.com.au == -- top paths -- 12 GET / 1 GET /robots.txt 1 GET /cgi-bin/ -- last 10 requests -- 85.25.43.199 - - [07/Sep/2026:04:03:14 +1000] "GET /?C=S;O=A HTTP/1.1" 200 658 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/114.0.0." 85.25.43.199 - - [07/Sep/2026:04:03:16 +1000] "GET /?C=D%3BO=A HTTP/1.1" 200 658 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/114.0.0." 85.25.43.199 - - [07/Sep/2026:04:03:18 +1000] "GET /?C=D;O=A HTTP/1.1" 200 658 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/114.0.0." 85.25.43.199 - - [07/Sep/2026:04:03:20 +1000] "GET /?C=N%3BO=A HTTP/1.1" 200 658 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/114.0.0." 85.25.43.199 - - [07/Sep/2026:04:03:22 +1000] "GET /?C=N;O=A HTTP/1.1" 200 658 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/114.0.0." 85.25.43.199 - - [07/Sep/2026:04:03:24 +1000] "GET /?C=M;O=D HTTP/1.1" 200 658 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/114.0.0." 85.25.43.199 - - [07/Sep/2026:04:03:26 +1000] "GET /?C=S;O=D HTTP/1.1" 200 658 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/114.0.0." 85.25.43.199 - - [07/Sep/2026:04:03:28 +1000] "GET /?C=D%3BO=D HTTP/1.1" 200 658 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/114.0.0." 85.25.43.199 - - [07/Sep/2026:04:03:30 +1000] "GET /?C=D;O=D HTTP/1.1" 200 658 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/114.0.0." 85.25.43.199 - - [07/Sep/2026:04:03:32 +1000] "GET /cgi-bin/?C=N%3BO=D HTTP/1.1" 200 639 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/114.0.0." --- last 30 samples (run-up to this incident) --- 2026-09-07 04:03:12 L1=2.99 run=3 blk=1 avail=9281 (67.4%) swpO=36 conn=3 myRSS=1433 php=8 phpRSS=878 ap=18 tcp=37 topuser=madalice 2026-09-07 04:03:19 L1=3.07 run=3 blk=1 avail=9478 (68.8%) swpO=36 conn=2 myRSS=1433 php=7 phpRSS=650 ap=18 tcp=35 topuser=madalice 2026-09-07 04:03:22 L1=3.14 run=2 blk=1 avail=9481 (68.8%) swpO=0 conn=3 myRSS=1433 php=7 phpRSS=650 ap=17 tcp=31 topuser=madalice 2026-09-07 04:03:29 L1=3.13 run=3 blk=1 avail=9493 (68.9%) swpO=0 conn=2 myRSS=1436 php=7 phpRSS=650 ap=15 tcp=32 topuser=madalice 2026-09-07 04:03:32 L1=3.12 run=4 blk=1 avail=9490 (68.9%) swpO=0 conn=2 myRSS=1436 php=7 phpRSS=650 ap=15 tcp=32 topuser=madalice 2026-09-07 04:03:39 L1=3.11 run=3 blk=1 avail=9493 (68.9%) swpO=0 conn=2 myRSS=1436 php=7 phpRSS=650 ap=15 tcp=32 topuser=madalice 2026-09-07 04:03:42 L1=3.10 run=5 blk=2 avail=9135 (66.3%) swpO=63 conn=2 myRSS=1434 php=8 phpRSS=1036 ap=15 tcp=37 topuser=madalice 2026-09-07 04:03:49 L1=3.09 run=4 blk=2 avail=9410 (68.3%) swpO=107 conn=3 myRSS=1434 php=10 phpRSS=820 ap=15 tcp=36 topuser=madalice 2026-09-07 04:03:52 L1=3.33 run=3 blk=1 avail=9386 (68.1%) swpO=43 conn=2 myRSS=1434 php=8 phpRSS=779 ap=15 tcp=36 topuser=madalice 2026-09-07 04:03:59 L1=3.38 run=2 blk=1 avail=9491 (68.9%) swpO=0 conn=3 myRSS=1434 php=7 phpRSS=650 ap=15 tcp=34 topuser=madalice 2026-09-07 04:04:02 L1=3.51 run=3 blk=1 avail=9488 (68.9%) swpO=0 conn=2 myRSS=1434 php=7 phpRSS=649 ap=15 tcp=32 topuser=madalice 2026-09-07 04:04:09 L1=3.71 run=2 blk=1 avail=9488 (68.9%) swpO=0 conn=3 myRSS=1434 php=7 phpRSS=650 ap=15 tcp=31 topuser=madalice 2026-09-07 04:04:12 L1=3.81 run=2 blk=1 avail=9493 (68.9%) swpO=167 conn=2 myRSS=1431 php=7 phpRSS=650 ap=15 tcp=30 topuser=madalice 2026-09-07 04:04:19 L1=3.75 run=3 blk=1 avail=9511 (69.0%) swpO=167 conn=3 myRSS=1432 php=7 phpRSS=650 ap=14 tcp=31 topuser=madalice 2026-09-07 04:04:22 L1=3.77 run=3 blk=1 avail=9508 (69.0%) swpO=0 conn=2 myRSS=1432 php=7 phpRSS=650 ap=14 tcp=32 topuser=madalice 2026-09-07 04:04:29 L1=3.79 run=2 blk=1 avail=9511 (69.0%) swpO=0 conn=3 myRSS=1432 php=7 phpRSS=650 ap=14 tcp=31 topuser=madalice 2026-09-07 04:04:32 L1=3.81 run=2 blk=1 avail=9497 (68.9%) swpO=0 conn=3 myRSS=1435 php=7 phpRSS=660 ap=14 tcp=33 topuser=madalice 2026-09-07 04:04:39 L1=3.82 run=2 blk=1 avail=9504 (69.0%) swpO=0 conn=3 myRSS=1435 php=7 phpRSS=650 ap=14 tcp=30 topuser=madalice 2026-09-07 04:04:42 L1=3.92 run=2 blk=1 avail=9503 (69.0%) swpO=0 conn=3 myRSS=1435 php=7 phpRSS=653 ap=14 tcp=30 topuser=madalice 2026-09-07 04:04:49 L1=3.92 run=3 blk=1 avail=9496 (68.9%) swpO=0 conn=3 myRSS=1435 php=7 phpRSS=660 ap=14 tcp=35 topuser=madalice 2026-09-07 04:04:52 L1=3.93 run=3 blk=1 avail=9414 (68.3%) swpO=0 conn=3 myRSS=1435 php=7 phpRSS=738 ap=14 tcp=32 topuser=madalice 2026-09-07 04:04:59 L1=3.77 run=3 blk=1 avail=9503 (69.0%) swpO=0 conn=3 myRSS=1435 php=7 phpRSS=650 ap=14 tcp=32 topuser=madalice 2026-09-07 04:05:02 L1=3.63 run=2 blk=2 avail=9483 (68.8%) swpO=0 conn=3 myRSS=1435 php=7 phpRSS=650 ap=14 tcp=32 topuser=madalice 2026-09-07 04:05:09 L1=3.74 run=4 blk=1 avail=9390 (68.2%) swpO=0 conn=3 myRSS=1435 php=8 phpRSS=773 ap=14 tcp=34 topuser=madalice 2026-09-07 04:05:12 L1=3.92 run=4 blk=1 avail=9494 (68.9%) swpO=359 conn=3 myRSS=1426 php=7 phpRSS=649 ap=14 tcp=33 topuser=madalice 2026-09-07 04:05:19 L1=3.77 run=2 blk=1 avail=9509 (69.0%) swpO=359 conn=3 myRSS=1426 php=7 phpRSS=649 ap=14 tcp=71 topuser=madalice 2026-09-07 04:05:23 L1=3.71 run=2 blk=1 avail=9439 (68.5%) swpO=0 conn=3 myRSS=1426 php=7 phpRSS=664 ap=29 tcp=72 topuser=madalice 2026-09-07 04:05:29 L1=3.81 run=3 blk=1 avail=9156 (66.5%) swpO=0 conn=3 myRSS=1428 php=7 phpRSS=656 ap=74 tcp=33 topuser=madalice 2026-09-07 04:05:33 L1=3.67 run=7 blk=1 avail=9039 (65.6%) swpO=174 conn=3 myRSS=1425 php=8 phpRSS=839 ap=70 tcp=37 topuser=madalice 2026-09-07 04:05:39 L1=3.69 run=7 blk=1 avail=8324 (60.4%) swpO=1065 conn=4 myRSS=1408 php=14 phpRSS=1670 ap=63 tcp=64 topuser=madalice