INCIDENT 2026-09-07 04:06:53 trigger: php_rss=1638MB ================================================================== load: 4.20 3.27 2.29 3/690 1264106 ncpu:10 mem_avail: 8698MB/13777MB (63.1%) swap_used:2639MB swapout:0/s blocked(D):1 running:3 iowait:10.1% steal:0.0% php: 14 procs / 1638MB heaviest user: madalice (8 procs, 1455MB) apache: 21 procs tcp_estab: 33 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 8 1455 mysql 1 1407 root 251 1128 nobody 20 309 netdata 8 244 infinium 6 234 mailman 20 101 wp-toolkit 3 56 dovenull 6 55 lowrange 2 28 kurri 2 23 dovecot 3 23 aaa 1 15 mailnull 2 14 cpanellogin 1 13 named 1 10 evolution 11 10 zabbix 1 9 polkitd 1 6 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 8 1455 infinium 2 177 root 1 23 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6840 MB Active(file): 4297 MB Inactive(file): 2731 MB Dirty: 3 MB Writeback: 0 MB SReclaimable: 768 MB CommitLimit: 10984 MB Committed_AS: 9069 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1231276 root 06:52 2816 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 1246753 root 04:32 59672 /opt/imunify360/venv/bin/python3 -m imav.run 3926885 root 6-01:44:28 4876 /usr/bin/imunify-agent-proxy 4109079 root 1-23:22:06 1760 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 1-23:22:06 189304 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 1441744 2.9 Ssl 1-08:30:23 /usr/sbin/mariadbd 1263162 167896 madalice 293984 20.7 R 01:17 php-fpm: pool madalice_com_au 4109105 4109079 root 189304 1.5 Sl 1-23:22:06 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 166870 1 netdata 183488 2.6 Ssl 1-01:44:34 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1247079 167896 madalice 180660 14.5 S 04:20 php-fpm: pool madalice_com_au 1263166 167896 madalice 180024 27.9 S 01:16 php-fpm: pool madalice_com_au 1263163 167896 madalice 179880 35.8 S 01:17 php-fpm: pool madalice_com_au 1263164 167896 madalice 178764 37.0 S 01:17 php-fpm: pool madalice_com_au 1263165 167896 madalice 159692 16.0 S 01:17 php-fpm: pool madalice_com_au 1263167 167896 madalice 158980 15.1 S 01:16 php-fpm: pool madalice_com_au 1263161 167896 madalice 158868 16.3 S 01:17 php-fpm: pool madalice_com_au 923652 904997 root 154884 0.0 S 01:37:10 spamd child 904997 1 root 153748 0.0 Ss 01:43:57 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1264073 1263461 infinium 127916 45.0 S 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 167871 1 root 124088 0.0 Ss 1-01:44:27 /usr/lib/systemd/systemd-journald 923653 904997 root 84804 0.0 S 01:37:09 spamd child 1264077 1262987 infinium 66304 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1246753 1 root 59672 0.5 Ssl 04:32 /opt/imunify360/venv/bin/python3 -m imav.run 1353308 1 root 41684 0.1 Ss 47-01:25:40 cpsrvd (SSL) - waiting for connections 1469 1 root 41372 0.1 Ss 69-17:57:09 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 167562 166914 netdata 36224 0.1 Sl 1-01:44:29 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 34088 0.0 Sl 10-01:47:14 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166645 1 wp-toolkit 31812 0.0 Ss 1-01:44:38 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29892 0.0 Ss 01:44:29 lfd - sleeping 167896 1 root 23884 0.0 Ss 1-01:44:26 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1463 1 root 23648 0.0 Ss 69-17:57:09 tailwatchd 1245940 506832 nobody 21484 0.0 S 06:09 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19876 0.0 Ss 1-01:44:27 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1263060 506832 nobody 19684 0.2 S 01:29 /usr/sbin/httpd -k start 1263067 506832 nobody 19548 0.0 S 01:29 /usr/sbin/httpd -k start 1262996 506832 nobody 19540 0.0 S 01:31 /usr/sbin/httpd -k start 1263039 506832 nobody 19484 0.0 S 01:30 /usr/sbin/httpd -k start 1263068 506832 nobody 19372 0.0 S 01:29 /usr/sbin/httpd -k start 1263072 506832 nobody 19356 0.0 S 01:29 /usr/sbin/httpd -k start 1263029 506832 nobody 18864 0.0 S 01:30 /usr/sbin/httpd -k start 1262986 506832 nobody 18820 0.0 S 01:32 /usr/sbin/httpd -k start 1262987 506832 nobody 18560 0.0 S 01:32 /usr/sbin/httpd -k start 1263057 506832 nobody 18252 0.0 S 01:29 /usr/sbin/httpd -k start 167566 166914 netdata 17820 2.1 Sl 1-01:44:29 /usr/libexec/netdata/plugins.d/apps.plugin 1 1262999 506832 nobody 17144 0.0 S 01:31 /usr/sbin/httpd -k start 1263461 506832 nobody 17008 0.0 S 01:05 /usr/sbin/httpd -k start 1263675 506832 nobody 16796 0.0 S 00:44 /usr/sbin/httpd -k start 1263044 506832 nobody 16516 0.0 S 01:30 /usr/sbin/httpd -k start 1263031 506832 nobody 16152 0.0 S 01:30 /usr/sbin/httpd -k start 1262989 506832 nobody 16092 0.0 S 01:32 /usr/sbin/httpd -k start 1093502 167382 aaa 15928 0.0 S 50:16 dovecot/imap 166757 1 root 15476 0.0 Ss 1-01:44:37 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 1471 1 root 15456 0.0 Ss 69-17:57:09 cPhulkd - processor 817125 167382 lowrange 15264 0.0 S 02:11:06 dovecot/imap 904770 1471 root 14708 0.0 S 01:44:13 cPhulkd - dbprocessor 1263549 167382 infinium 14692 0.0 S 00:56 dovecot/imap 1024167 167382 infinium 14648 0.0 S 01:10:19 dovecot/imap 1213026 167382 infinium 14624 0.0 S 14:18 dovecot/imap 1195741 167382 infinium 14620 0.0 S 20:19 dovecot/imap 4166196 167382 kurri 14096 0.0 S 06:12:16 dovecot/imap 628794 167382 lowrange 13940 0.0 S 03:03:45 dovecot/imap 1263544 1353308 cpanellogin 13584 0.0 S 00:56 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 1263550 167382 root 12732 0.0 S 00:56 dovecot/auth -w 506832 1 root 12096 0.0 Ss 10-01:47:47 /usr/sbin/httpd -k start 167385 167382 dovenull 11852 0.0 S 1-01:44:30 dovecot/imap-login --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 917019 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 113 evolution/app.evolutionerp.com.au-ssl_log 101 corpkicks/corporatekicks.com.au-ssl_log 8 tubesupplies/tubesupplies.com.au-ssl_log 6 evolution/staging.evolutionerp.com.au 5 evolution/my.evolutionerp.com.au-ssl_log 2 infinium/infinium.net.au-ssl_log 2 otter2/otterfencing.net.au-ssl_log 2 corpkicks/corporatekicks.com.au 1 customc/customcentral.com.au 1 customkidscom/customkids.com.au-ssl_log 1 olympic/olympicfencing.com.au 1 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 101 40.115.94.245 95 207.175.223.30 17 118.127.40.55 5 182.253.194.240 4 185.104.184.230 2 91.92.243.248 2 40.77.167.42 2 13.48.45.56 2 114.119.153.72 2 114.119.146.16 2 114.119.143.14 1 91.92.243.251 1 87.58.197.202 1 43.163.96.126 1 43.134.0.23 --- top request paths across all vhosts (last 3 min) --- 90 GET /api/getItem/LWFB2001KG 11 GET /api/getItem/LWPB2001KG 7 GET /wp-admin/admin-ajax.php 6 POST /wp-cron.php 6 GET /store/barbie-pink-af1s/ 4 GET / 3 POST /wp-login.php 3 POST / 3 GET /wp-login.php 2 POST /wp-admin/admin-ajax.php 2 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 2 GET /wp-includes/ 2 GET /wp-admin/ 2 GET /users/login 2 GET /user/login 2 GET /ssl/server.key 2 GET /signup 2 GET /signin 2 GET /sign-in 2 GET /serverless.yaml --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 7 GET /wp-admin/admin-ajax.php 6 GET /store/barbie-pink-af1s/ 3 GET /wp-login.php 2 POST /wp-admin/admin-ajax.php 2 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 2 GET /wp-admin/ 2 GET /users/login 2 GET /user/login 2 GET /ssl/server.key 2 GET /signup 2 GET /signin 2 GET /sign-in -- last 10 requests -- 207.175.223.30 - - [07/Sep/2026:04:06:09 +1000] "GET /panel HTTP/1.1" 404 36615 "https://www.madalice.com.au/panel" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safar 207.175.223.30 - - [07/Sep/2026:04:06:11 +1000] "GET /wp-admin/ HTTP/1.1" 302 1 "https://madalice.com.au/admin" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/53 207.175.223.30 - - [07/Sep/2026:04:06:11 +1000] "GET /account HTTP/1.1" 404 36621 "https://www.madalice.com.au/account" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile S 207.175.223.30 - - [07/Sep/2026:04:06:11 +1000] "GET /app HTTP/1.1" 404 36621 "https://www.madalice.com.au/app" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/53 207.175.223.30 - - [07/Sep/2026:04:06:12 +1000] "GET /wp-admin/ HTTP/1.1" 302 1 "https://madalice.com.au/dashboard" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safar 207.175.223.30 - - [07/Sep/2026:04:06:13 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Fmadalice.com.au%2Fwp-admin%2F&reauth=1 HTTP/1.1" 200 4024 "https://madalice.com.au/wp-admin/" "Mozilla/5.0 (Linux; Android 10; 207.175.223.30 - - [07/Sep/2026:04:06:14 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Fmadalice.com.au%2Fwp-admin%2F&reauth=1 HTTP/1.1" 200 4024 "https://madalice.com.au/wp-admin/" "Mozilla/5.0 (Linux; Android 10; 114.119.137.101 - - [07/Sep/2026:04:06:14 +1000] "GET /store/barbie-kids-af1s/?verified=1&rating=3&image=1&wcpr_verified=1 HTTP/1.1" 404 36660 "https://madalice.com.au/store/barbie-kids-af1s/?verified=1&rating=3&image=1" 118.127.40.55 - - [07/Sep/2026:04:05:58 +1000] "GET /wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=1&scanMode=standard&cronKey=3e42d659b03bb1c88109d2d897f795c5&signature=5ef6fec725a4307bc03223645e9b0dda15d6031fd 13.48.45.56 - - [07/Sep/2026:04:06:27 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 601 "https://madalice.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1 == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 90 GET /api/getItem/LWFB2001KG 11 GET /api/getItem/LWPB2001KG -- last 10 requests -- 40.115.94.245 - - [07/Sep/2026:04:06:31 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:06:32 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:06:32 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:06:33 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:06:33 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:06:33 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:06:34 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:06:34 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:06:34 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:04:06:35 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" == corpkicks/corporatekicks.com.au-ssl_log == -- top paths -- 3 POST /wp-cron.php 1 HEAD / 1 GET /wp-includes/ 1 GET /employee-reward-sneakers/ 1 GET /customised-sneakers-for-adobe-corporate-event/ 1 GET /customised-sneakers-for-adobe-corporate-event -- last 10 requests -- 114.119.150.170 - - [07/Sep/2026:04:04:09 +1000] "GET /employee-reward-sneakers/ HTTP/1.1" 200 21122 "https://corporatekicks.com.au/employee-reward-sneakers/" "Mozilla/5.0 (Linux; Android 7.0;) AppleWebKit/537.36 (HTML, 118.127.40.55 - - [07/Sep/2026:04:04:10 +1000] "POST /wp-cron.php?doing_wp_cron=1788717850.9700300693511962890625 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://corporatekicks.com.au" 34.196.51.17 - - [07/Sep/2026:04:05:09 +1000] "HEAD / HTTP/1.1" 200 - "https://corporatekicks.com.au/" "WPMUDEV Uptime Monitor 5.0 (https://wpmudev.com)" 118.127.40.55 - - [07/Sep/2026:04:05:10 +1000] "POST /wp-cron.php?doing_wp_cron=1788717910.5656900405883789062500 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://corporatekicks.com.au" 114.119.153.72 - - [07/Sep/2026:04:05:32 +1000] "GET /customised-sneakers-for-adobe-corporate-event HTTP/1.1" 301 1 "https://corporatekicks.com.au/customised-sneakers-for-adobe-corporate-event" "Mozilla/5.0 (Linux; Andro 118.127.40.55 - - [07/Sep/2026:04:05:33 +1000] "POST /wp-cron.php?doing_wp_cron=1788717933.4199140071868896484375 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://corporatekicks.com.au" 114.119.153.72 - - [07/Sep/2026:04:05:34 +1000] "GET /customised-sneakers-for-adobe-corporate-event/ HTTP/1.1" 200 18399 "https://corporatekicks.com.au/customised-sneakers-for-adobe-corporate-event" "Mozilla/5.0 (Linux; 185.104.184.230 - - [07/Sep/2026:04:05:47 +1000] "GET /wp-includes/ HTTP/1.1" 403 6789 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-09-07 04:04:29 L1=3.79 run=2 blk=1 avail=9511 (69.0%) swpO=0 conn=3 myRSS=1432 php=7 phpRSS=650 ap=14 tcp=31 topuser=madalice 2026-09-07 04:04:32 L1=3.81 run=2 blk=1 avail=9497 (68.9%) swpO=0 conn=3 myRSS=1435 php=7 phpRSS=660 ap=14 tcp=33 topuser=madalice 2026-09-07 04:04:39 L1=3.82 run=2 blk=1 avail=9504 (69.0%) swpO=0 conn=3 myRSS=1435 php=7 phpRSS=650 ap=14 tcp=30 topuser=madalice 2026-09-07 04:04:42 L1=3.92 run=2 blk=1 avail=9503 (69.0%) swpO=0 conn=3 myRSS=1435 php=7 phpRSS=653 ap=14 tcp=30 topuser=madalice 2026-09-07 04:04:49 L1=3.92 run=3 blk=1 avail=9496 (68.9%) swpO=0 conn=3 myRSS=1435 php=7 phpRSS=660 ap=14 tcp=35 topuser=madalice 2026-09-07 04:04:52 L1=3.93 run=3 blk=1 avail=9414 (68.3%) swpO=0 conn=3 myRSS=1435 php=7 phpRSS=738 ap=14 tcp=32 topuser=madalice 2026-09-07 04:04:59 L1=3.77 run=3 blk=1 avail=9503 (69.0%) swpO=0 conn=3 myRSS=1435 php=7 phpRSS=650 ap=14 tcp=32 topuser=madalice 2026-09-07 04:05:02 L1=3.63 run=2 blk=2 avail=9483 (68.8%) swpO=0 conn=3 myRSS=1435 php=7 phpRSS=650 ap=14 tcp=32 topuser=madalice 2026-09-07 04:05:09 L1=3.74 run=4 blk=1 avail=9390 (68.2%) swpO=0 conn=3 myRSS=1435 php=8 phpRSS=773 ap=14 tcp=34 topuser=madalice 2026-09-07 04:05:12 L1=3.92 run=4 blk=1 avail=9494 (68.9%) swpO=359 conn=3 myRSS=1426 php=7 phpRSS=649 ap=14 tcp=33 topuser=madalice 2026-09-07 04:05:19 L1=3.77 run=2 blk=1 avail=9509 (69.0%) swpO=359 conn=3 myRSS=1426 php=7 phpRSS=649 ap=14 tcp=71 topuser=madalice 2026-09-07 04:05:23 L1=3.71 run=2 blk=1 avail=9439 (68.5%) swpO=0 conn=3 myRSS=1426 php=7 phpRSS=664 ap=29 tcp=72 topuser=madalice 2026-09-07 04:05:29 L1=3.81 run=3 blk=1 avail=9156 (66.5%) swpO=0 conn=3 myRSS=1428 php=7 phpRSS=656 ap=74 tcp=33 topuser=madalice 2026-09-07 04:05:33 L1=3.67 run=7 blk=1 avail=9039 (65.6%) swpO=174 conn=3 myRSS=1425 php=8 phpRSS=839 ap=70 tcp=37 topuser=madalice 2026-09-07 04:05:39 L1=3.69 run=7 blk=1 avail=8324 (60.4%) swpO=1065 conn=4 myRSS=1408 php=14 phpRSS=1670 ap=63 tcp=64 topuser=madalice 2026-09-07 04:05:43 L1=3.64 run=5 blk=1 avail=8302 (60.3%) swpO=1161 conn=5 myRSS=1404 php=14 phpRSS=1770 ap=61 tcp=78 topuser=madalice 2026-09-07 04:05:50 L1=3.99 run=5 blk=1 avail=7832 (56.8%) swpO=289 conn=7 myRSS=1403 php=19 phpRSS=2267 ap=76 tcp=92 topuser=madalice 2026-09-07 04:05:53 L1=4.39 run=2 blk=1 avail=8109 (58.9%) swpO=47 conn=3 myRSS=1403 php=15 phpRSS=1891 ap=74 tcp=74 topuser=madalice 2026-09-07 04:06:00 L1=4.44 run=3 blk=1 avail=7884 (57.2%) swpO=0 conn=5 myRSS=1406 php=16 phpRSS=2165 ap=67 tcp=44 topuser=madalice 2026-09-07 04:06:03 L1=4.40 run=4 blk=1 avail=8023 (58.2%) swpO=0 conn=5 myRSS=1406 php=16 phpRSS=2043 ap=64 tcp=45 topuser=madalice 2026-09-07 04:06:10 L1=5.95 run=11 blk=1 avail=8026 (58.3%) swpO=360 conn=10 myRSS=1402 php=14 phpRSS=2022 ap=61 tcp=80 topuser=madalice 2026-09-07 04:06:13 L1=5.95 run=4 blk=1 avail=8232 (59.8%) swpO=360 conn=3 myRSS=1402 php=14 phpRSS=1777 ap=60 tcp=79 topuser=madalice 2026-09-07 04:06:20 L1=5.41 run=2 blk=1 avail=8279 (60.1%) swpO=0 conn=2 myRSS=1402 php=14 phpRSS=1797 ap=54 tcp=43 topuser=madalice 2026-09-07 04:06:23 L1=5.41 run=2 blk=1 avail=8298 (60.2%) swpO=0 conn=2 myRSS=1402 php=14 phpRSS=1797 ap=51 tcp=33 topuser=madalice 2026-09-07 04:06:30 L1=4.97 run=2 blk=1 avail=8348 (60.6%) swpO=0 conn=2 myRSS=1402 php=14 phpRSS=1796 ap=44 tcp=36 topuser=madalice 2026-09-07 04:06:33 L1=4.97 run=4 blk=1 avail=8365 (60.7%) swpO=0 conn=2 myRSS=1405 php=15 phpRSS=1842 ap=41 tcp=37 topuser=madalice 2026-09-07 04:06:40 L1=4.51 run=2 blk=1 avail=8710 (63.2%) swpO=0 conn=2 myRSS=1405 php=12 phpRSS=1462 ap=34 tcp=40 topuser=madalice 2026-09-07 04:06:43 L1=4.51 run=3 blk=1 avail=8734 (63.4%) swpO=0 conn=2 myRSS=1405 php=12 phpRSS=1462 ap=31 tcp=37 topuser=madalice 2026-09-07 04:06:50 L1=4.20 run=2 blk=1 avail=8768 (63.6%) swpO=0 conn=2 myRSS=1407 php=12 phpRSS=1478 ap=24 tcp=33 topuser=madalice 2026-09-07 04:06:53 L1=4.20 run=3 blk=1 avail=8698 (63.1%) swpO=0 conn=3 myRSS=1407 php=14 phpRSS=1638 ap=21 tcp=33 topuser=madalice