INCIDENT 2026-09-07 06:32:54 trigger: php_rss=1653MB ================================================================== load: 3.29 2.26 1.95 5/704 1762773 ncpu:10 mem_avail: 8270MB/13777MB (60.0%) swap_used:2841MB swapout:793/s blocked(D):1 running:6 iowait:6.8% steal:0.0% php: 14 procs / 1653MB heaviest user: madalice (10 procs, 1629MB) apache: 39 procs tcp_estab: 57 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1716 madalice 10 1633 root 250 992 nobody 38 682 netdata 8 241 mailman 20 100 wp-toolkit 3 56 dovenull 6 56 mailnull 5 37 cpanellogin 1 31 infinium 2 28 kurri 2 24 dovecot 3 22 lowrange 1 13 zabbix 1 10 named 1 9 evolution 11 9 polkitd 1 6 nscd 1 5 rpc 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1547 root 1 23 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7258 MB Active(file): 4173 MB Inactive(file): 3150 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 601 MB CommitLimit: 10984 MB Committed_AS: 9482 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-04:10:28 4728 /usr/bin/imunify-agent-proxy 4109079 root 2-01:48:06 1820 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-01:48:06 113480 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 1757456 3.0 Ssl 1-10:56:23 /usr/sbin/mariadbd 1762678 167896 madalice 195880 48.5 R 00:07 php-fpm: pool madalice_com_au 166870 1 netdata 183080 2.6 Ssl 1-04:10:34 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1711438 167896 madalice 163864 11.6 R 13:19 php-fpm: pool madalice_com_au 1711437 167896 madalice 163476 11.7 S 13:19 php-fpm: pool madalice_com_au 1711439 167896 madalice 162888 12.5 S 13:19 php-fpm: pool madalice_com_au 1762673 167896 madalice 162852 53.7 S 00:07 php-fpm: pool madalice_com_au 1711372 167896 madalice 162824 12.1 S 13:24 php-fpm: pool madalice_com_au 1762675 167896 madalice 159256 37.7 S 00:07 php-fpm: pool madalice_com_au 167871 1 root 159244 0.0 Ss 1-04:10:27 /usr/lib/systemd/systemd-journald 1762677 167896 madalice 158408 39.5 R 00:07 php-fpm: pool madalice_com_au 923652 904997 root 145332 0.0 S 04:03:10 spamd child 1727306 167896 madalice 142648 11.9 S 10:33 php-fpm: pool madalice_com_au 904997 1 root 133308 0.0 Ss 04:09:57 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1762676 167896 madalice 119664 43.0 S 00:07 php-fpm: pool madalice_com_au 4109105 4109079 root 113480 1.5 Sl 2-01:48:06 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 923653 904997 root 55452 0.0 S 04:03:09 spamd child 1353308 1 root 42068 0.1 Ss 47-03:51:40 cpsrvd (SSL) - waiting for connections 1469 1 root 41676 0.1 Ss 69-20:23:09 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 509236 509098 root 34804 0.0 Sl 10-04:13:14 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 167562 166914 netdata 34268 0.1 Sl 1-04:10:29 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1693681 1353308 cpanellogin 32288 0.0 S 18:20 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 166645 1 wp-toolkit 31644 0.0 Ss 1-04:10:38 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29788 0.0 Ss 04:10:29 lfd - sleeping 1466 1 root 25720 0.0 Ss 69-20:23:09 dnsadmin - server mode 167896 1 root 23788 0.0 Ss 1-04:10:26 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1463 1 root 22936 0.0 Ss 69-20:23:09 tailwatchd 1728509 506832 nobody 22384 0.0 S 08:41 /usr/sbin/httpd -k start 1762071 506832 nobody 21828 0.1 S 00:55 /usr/sbin/httpd -k start 1761427 506832 nobody 21584 0.1 S 02:04 /usr/sbin/httpd -k start 1746124 506832 nobody 21340 0.0 S 03:31 /usr/sbin/httpd -k start 1745930 506832 nobody 21236 0.1 S 03:45 /usr/sbin/httpd -k start 1746119 506832 nobody 21128 0.0 S 03:31 /usr/sbin/httpd -k start 1761632 506832 nobody 21068 0.1 S 01:45 /usr/sbin/httpd -k start 1761202 506832 nobody 21024 0.0 S 02:28 /usr/sbin/httpd -k start 1761244 506832 nobody 20996 0.0 S 02:23 /usr/sbin/httpd -k start 1761238 506832 nobody 20812 0.0 S 02:24 /usr/sbin/httpd -k start 1762394 506832 nobody 20788 0.1 S 00:32 /usr/sbin/httpd -k start 1761239 506832 nobody 20764 0.0 S 02:24 /usr/sbin/httpd -k start 1762136 506832 nobody 20704 0.0 S 00:51 /usr/sbin/httpd -k start 1761234 506832 nobody 20680 0.0 S 02:25 /usr/sbin/httpd -k start 1762072 506832 nobody 20680 0.1 S 00:55 /usr/sbin/httpd -k start 1762080 506832 nobody 20612 0.1 S 00:54 /usr/sbin/httpd -k start 1762122 506832 nobody 20512 0.1 S 00:52 /usr/sbin/httpd -k start 1761855 506832 nobody 20492 0.0 S 01:19 /usr/sbin/httpd -k start 1761854 506832 nobody 20320 0.1 S 01:19 /usr/sbin/httpd -k start 1762494 506832 nobody 20256 0.1 S 00:24 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19636 0.0 Ss 1-04:10:27 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1762480 506832 nobody 19272 0.0 S 00:26 /usr/sbin/httpd -k start 1762693 506832 nobody 18732 0.0 S 00:05 /usr/sbin/httpd -k start 1762683 506832 nobody 18320 0.0 S 00:06 /usr/sbin/httpd -k start 1762719 506832 nobody 18140 0.3 S 00:03 /usr/sbin/httpd -k start 1762695 506832 nobody 18080 0.2 S 00:05 /usr/sbin/httpd -k start 1762729 506832 nobody 18056 1.0 S 00:02 /usr/sbin/httpd -k start 1762682 506832 nobody 17996 0.3 S 00:06 /usr/sbin/httpd -k start 167566 166914 netdata 17848 2.1 Sl 1-04:10:29 /usr/libexec/netdata/plugins.d/apps.plugin 1 1762730 506832 nobody 17616 0.5 S 00:02 /usr/sbin/httpd -k start 1762740 506832 nobody 17616 0.0 S 00:01 /usr/sbin/httpd -k start 1728455 506832 nobody 16904 0.1 S 08:49 /usr/sbin/httpd -k start 1762694 506832 nobody 16416 0.0 S 00:05 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 1056320 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min otter2/otterfencing.net.au-ssl_log 241 madalice/madalice.com.au-ssl_log 188 evolution/my.evolutionerp.com.au-ssl_log 178 evolution/portal.evolutionerp.com.au-ssl_log 112 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 241 34.92.25.6 167 213.35.106.249 131 203.54.180.238 101 182.239.240.254 51 103.104.164.114 16 118.127.40.55 5 34.11.238.182 5 103.104.165.99 2 40.77.167.255 --- top request paths across all vhosts (last 3 min) --- 112 GET /wp-admin/index.php 55 POST /wp-login.php 52 POST /functions.php 52 GET /app/ajax.php 33 GET /heartbeat.php 33 GET /factory_session_checker.php 27 GET /index.php 20 POST / 16 GET /factory_session_processed_qty.php 16 GET /factory_session_joiner.php 10 POST /clienteditsave.php 8 POST /app/ajax.php 7 POST /portal/register 6 POST /jobeditsave.php 6 POST /app/ajax/selectFilterSingle.php 5 POST /logsave.php 5 POST /billaddsave.php 4 POST /purchaseaddsave.php 4 POST /app/ajax/selectFilter.php 3 POST /dispatchsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == otter2/otterfencing.net.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/.env 1 GET /wp/.env 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env 1 GET /vue/.env 1 GET /vite/.env -- last 10 requests -- 34.92.25.6 - - [07/Sep/2026:06:32:51 +1000] "GET /old_phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.25.6 - - [07/Sep/2026:06:32:51 +1000] "GET /server-info.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.25.6 - - [07/Sep/2026:06:32:51 +1000] "GET /server-status.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.25.6 - - [07/Sep/2026:06:32:51 +1000] "GET /_profiler/phpinfo HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.25.6 - - [07/Sep/2026:06:32:51 +1000] "GET /_environment HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.25.6 - - [07/Sep/2026:06:32:51 +1000] "GET /webroot/index.php/_environment HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.25.6 - - [07/Sep/2026:06:32:52 +1000] "GET /mail/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.25.6 - - [07/Sep/2026:06:32:52 +1000] "GET /cpanel/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.25.6 - - [07/Sep/2026:06:32:52 +1000] "GET /hosting/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.92.25.6 - - [07/Sep/2026:06:32:52 +1000] "GET /webmail/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 112 GET /wp-admin/index.php 55 POST /wp-login.php 16 POST / 1 GET /z9x8c7v6b5-debug-trigger-madalice.com.au 1 GET /wp-json 1 GET /ssl/localhost.key 1 GET /rclone.conf 1 GET /host.key -- last 10 requests -- 213.35.106.249 - - [07/Sep/2026:06:32:43 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 6744 "https://madalice.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ 213.35.106.249 - - [07/Sep/2026:06:32:44 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 6744 "https://madalice.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ 213.35.106.249 - - [07/Sep/2026:06:32:45 +1000] "POST /wp-login.php HTTP/1.1" 503 6558 "https://madalice.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14 213.35.106.249 - - [07/Sep/2026:06:32:46 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 6744 "https://madalice.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) C 34.11.238.182 - - [07/Sep/2026:06:32:46 +1000] "GET /z9x8c7v6b5-debug-trigger-madalice.com.au HTTP/1.1" 404 36639 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot 34.11.238.182 - - [07/Sep/2026:06:32:46 +1000] "GET /wp-json HTTP/1.1" 200 51147 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 34.11.238.182 - - [07/Sep/2026:06:32:47 +1000] "GET /host.key HTTP/1.1" 404 36626 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 34.11.238.182 - - [07/Sep/2026:06:32:46 +1000] "GET /rclone.conf HTTP/1.1" 404 36680 "-" "Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)" 213.35.106.249 - - [07/Sep/2026:06:32:47 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 6744 "https://madalice.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) C 34.11.238.182 - - [07/Sep/2026:06:32:47 +1000] "GET /ssl/localhost.key HTTP/1.1" 404 36696 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 52 POST /functions.php 52 GET /app/ajax.php 20 GET /index.php 10 POST /clienteditsave.php 8 POST /app/ajax.php 6 POST /jobeditsave.php 6 POST /app/ajax/selectFilterSingle.php 5 POST /logsave.php 5 POST /billaddsave.php 4 POST /purchaseaddsave.php 4 POST /app/ajax/selectFilter.php 3 POST /dispatchsave.php -- last 10 requests -- 182.239.240.254 - - [07/Sep/2026:06:32:47 +1000] "GET /index.php?page=jobedit&id=4066 HTTP/1.1" 200 197806 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 182.239.240.254 - - [07/Sep/2026:06:32:48 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=4066" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 182.239.240.254 - - [07/Sep/2026:06:32:48 +1000] "POST /clienteditsave.php?clientid=69&call=getCategoryDiscounts HTTP/1.1" 200 25 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=4066" "Mozilla/5.0 (Windows NT 1 182.239.240.254 - - [07/Sep/2026:06:32:48 +1000] "POST /logsave.php?call=getHistory&id=4066&module=job HTTP/1.1" 200 552 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=4066" "Mozilla/5.0 (Windows NT 10.0; Win6 182.239.240.254 - - [07/Sep/2026:06:32:49 +1000] "GET /app/ajax.php?cn=tsSimpleViewCB&furi=true&uri=%2F&call=getUserSetting&caller=ajaxSubmitLocal&seq=17478892174 HTTP/1.1" 200 89 "https://my.evolutionerp.com.au/index.ph 182.239.240.254 - - [07/Sep/2026:06:32:49 +1000] "GET /app/ajax.php?cn=tsDisabledViewCB&furi=false&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=13094576303 HTTP/1.1" 200 90 "https://my.evolutionerp.com.au/index.ph 182.239.240.254 - - [07/Sep/2026:06:32:49 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=16256578582 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/inde 182.239.240.254 - - [07/Sep/2026:06:32:49 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Djobedit%26id%3D4066&call=getUserSetting&caller=ajaxSubmitLocal&seq=17722710022 HTTP/1.1" 200 111 "https://my. 182.239.240.254 - - [07/Sep/2026:06:32:49 +1000] "GET /app/ajax.php?cn=&furi=true&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=15147394852 HTTP/1.1" 200 202 "https://my.evolutionerp.com.au/index.php?page=jobedit&i 182.239.240.254 - - [07/Sep/2026:06:32:49 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=18473235452 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/ind --- last 30 samples (run-up to this incident) --- 2026-09-07 06:30:25 L1=2.15 run=2 blk=1 avail=9270 (67.3%) swpO=0 conn=4 myRSS=1721 php=9 phpRSS=690 ap=20 tcp=34 topuser=madalice 2026-09-07 06:30:33 L1=2.13 run=1 blk=1 avail=9249 (67.1%) swpO=0 conn=1 myRSS=1721 php=9 phpRSS=657 ap=27 tcp=38 topuser=madalice 2026-09-07 06:30:35 L1=2.13 run=2 blk=1 avail=9160 (66.5%) swpO=0 conn=4 myRSS=1721 php=9 phpRSS=747 ap=27 tcp=37 topuser=madalice 2026-09-07 06:30:43 L1=2.03 run=1 blk=1 avail=9273 (67.3%) swpO=0 conn=1 myRSS=1721 php=9 phpRSS=657 ap=22 tcp=33 topuser=madalice 2026-09-07 06:30:45 L1=2.03 run=2 blk=1 avail=9246 (67.1%) swpO=0 conn=4 myRSS=1722 php=9 phpRSS=677 ap=22 tcp=39 topuser=madalice 2026-09-07 06:30:53 L1=1.87 run=1 blk=1 avail=9204 (66.8%) swpO=0 conn=1 myRSS=1724 php=9 phpRSS=693 ap=24 tcp=35 topuser=madalice 2026-09-07 06:30:55 L1=1.87 run=2 blk=1 avail=9169 (66.6%) swpO=0 conn=4 myRSS=1724 php=9 phpRSS=729 ap=24 tcp=40 topuser=madalice 2026-09-07 06:31:03 L1=1.82 run=2 blk=1 avail=9252 (67.2%) swpO=0 conn=1 myRSS=1724 php=9 phpRSS=661 ap=23 tcp=32 topuser=madalice 2026-09-07 06:31:06 L1=1.82 run=3 blk=1 avail=9281 (67.4%) swpO=0 conn=4 myRSS=1725 php=9 phpRSS=631 ap=22 tcp=33 topuser=madalice 2026-09-07 06:31:13 L1=1.77 run=2 blk=1 avail=9257 (67.2%) swpO=109 conn=1 myRSS=1722 php=9 phpRSS=659 ap=23 tcp=34 topuser=madalice 2026-09-07 06:31:16 L1=1.77 run=1 blk=1 avail=9260 (67.2%) swpO=99 conn=1 myRSS=1722 php=9 phpRSS=653 ap=23 tcp=35 topuser=madalice 2026-09-07 06:31:23 L1=1.72 run=3 blk=1 avail=9219 (66.9%) swpO=0 conn=1 myRSS=1722 php=10 phpRSS=741 ap=22 tcp=34 topuser=madalice 2026-09-07 06:31:26 L1=1.72 run=1 blk=1 avail=9268 (67.3%) swpO=0 conn=1 myRSS=1722 php=9 phpRSS=657 ap=21 tcp=34 topuser=madalice 2026-09-07 06:31:33 L1=1.91 run=2 blk=1 avail=9239 (67.1%) swpO=0 conn=1 myRSS=1723 php=10 phpRSS=695 ap=23 tcp=37 topuser=madalice 2026-09-07 06:31:36 L1=1.91 run=1 blk=1 avail=9216 (66.9%) swpO=0 conn=1 myRSS=1723 php=9 phpRSS=683 ap=26 tcp=36 topuser=madalice 2026-09-07 06:31:43 L1=2.00 run=3 blk=1 avail=9260 (67.2%) swpO=0 conn=1 myRSS=1723 php=10 phpRSS=687 ap=22 tcp=34 topuser=madalice 2026-09-07 06:31:46 L1=2.00 run=2 blk=1 avail=9242 (67.1%) swpO=0 conn=1 myRSS=1723 php=10 phpRSS=710 ap=21 tcp=41 topuser=madalice 2026-09-07 06:31:53 L1=1.92 run=2 blk=1 avail=9212 (66.9%) swpO=0 conn=1 myRSS=1723 php=9 phpRSS=710 ap=21 tcp=32 topuser=madalice 2026-09-07 06:31:56 L1=1.92 run=2 blk=1 avail=9258 (67.2%) swpO=0 conn=1 myRSS=1723 php=9 phpRSS=659 ap=21 tcp=36 topuser=madalice 2026-09-07 06:32:03 L1=1.78 run=2 blk=1 avail=9118 (66.2%) swpO=0 conn=1 myRSS=1724 php=9 phpRSS=657 ap=31 tcp=44 topuser=madalice 2026-09-07 06:32:06 L1=1.78 run=1 blk=1 avail=9082 (65.9%) swpO=0 conn=1 myRSS=1724 php=9 phpRSS=691 ap=31 tcp=43 topuser=madalice 2026-09-07 06:32:13 L1=1.89 run=2 blk=1 avail=9099 (66.0%) swpO=17 conn=1 myRSS=1723 php=9 phpRSS=720 ap=27 tcp=39 topuser=madalice 2026-09-07 06:32:16 L1=1.89 run=3 blk=1 avail=9180 (66.6%) swpO=17 conn=2 myRSS=1723 php=9 phpRSS=657 ap=24 tcp=38 topuser=madalice 2026-09-07 06:32:23 L1=1.84 run=5 blk=1 avail=9026 (65.5%) swpO=93 conn=1 myRSS=1720 php=10 phpRSS=811 ap=24 tcp=44 topuser=madalice 2026-09-07 06:32:26 L1=1.84 run=4 blk=1 avail=9146 (66.4%) swpO=93 conn=2 myRSS=1720 php=10 phpRSS=707 ap=24 tcp=49 topuser=madalice 2026-09-07 06:32:34 L1=1.94 run=4 blk=1 avail=9194 (66.7%) swpO=0 conn=2 myRSS=1720 php=11 phpRSS=736 ap=26 tcp=44 topuser=madalice 2026-09-07 06:32:36 L1=1.94 run=4 blk=1 avail=9004 (65.4%) swpO=0 conn=2 myRSS=1720 php=11 phpRSS=933 ap=26 tcp=46 topuser=madalice 2026-09-07 06:32:44 L1=2.10 run=2 blk=1 avail=9149 (66.4%) swpO=30 conn=2 myRSS=1723 php=9 phpRSS=723 ap=26 tcp=53 topuser=madalice 2026-09-07 06:32:46 L1=2.10 run=2 blk=1 avail=9232 (67.0%) swpO=30 conn=2 myRSS=1723 php=9 phpRSS=643 ap=26 tcp=46 topuser=madalice 2026-09-07 06:32:54 L1=3.29 run=6 blk=1 avail=8270 (60.0%) swpO=793 conn=4 myRSS=1716 php=14 phpRSS=1653 ap=39 tcp=57 topuser=madalice