INCIDENT 2026-09-07 07:49:06 trigger: php_rss=1582MB ================================================================== load: 2.71 2.50 2.40 1/729 2034322 ncpu:10 mem_avail: 8035MB/13777MB (58.3%) swap_used:2796MB swapout:330/s blocked(D):1 running:1 iowait:6.2% steal:0.0% php: 14 procs / 1582MB heaviest user: madalice (10 procs, 1559MB) apache: 66 procs tcp_estab: 75 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1926 madalice 10 1559 nobody 65 1059 root 253 981 netdata 8 241 mailman 20 98 wp-toolkit 3 56 dovenull 6 55 kurri 2 24 dovecot 3 22 mailnull 3 21 cpanellogin 1 18 lowrange 1 13 zabbix 1 11 evolution 11 9 named 1 8 polkitd 1 6 nscd 1 5 rpc 1 3 dbus 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1559 root 1 23 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7124 MB Active(file): 3911 MB Inactive(file): 3363 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 592 MB CommitLimit: 10984 MB Committed_AS: 9915 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-05:26:41 5256 /usr/bin/imunify-agent-proxy 4109079 root 2-03:04:19 1808 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-03:04:19 111328 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 1973104 3.4 Ssl 1-12:12:36 /usr/sbin/mariadbd 166870 1 netdata 181684 2.6 Ssl 1-05:26:47 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 167871 1 root 165392 0.0 Ss 1-05:26:40 /usr/lib/systemd/systemd-journald 2032165 167896 madalice 163404 10.6 S 02:41 php-fpm: pool madalice_com_au 2034176 167896 madalice 159936 58.1 S 00:06 php-fpm: pool madalice_com_au 2034175 167896 madalice 159916 56.8 S 00:06 php-fpm: pool madalice_com_au 2034180 167896 madalice 159916 56.6 S 00:06 php-fpm: pool madalice_com_au 2034177 167896 madalice 159616 59.0 S 00:06 php-fpm: pool madalice_com_au 2034173 167896 madalice 159540 59.0 S 00:06 php-fpm: pool madalice_com_au 2034174 167896 madalice 158720 57.5 S 00:06 php-fpm: pool madalice_com_au 2034215 167896 madalice 158512 39.0 S 00:06 php-fpm: pool madalice_com_au 2034182 167896 madalice 158436 39.6 S 00:06 php-fpm: pool madalice_com_au 2034214 167896 madalice 158436 39.0 S 00:06 php-fpm: pool madalice_com_au 923652 904997 root 154024 0.0 S 05:19:23 spamd child 904997 1 root 130812 0.0 Ss 05:26:10 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4109105 4109079 root 111328 1.5 Sl 2-03:04:19 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 923653 904997 root 54824 0.0 S 05:19:22 spamd child 1353308 1 root 41708 0.1 Ss 47-05:07:53 cpsrvd (SSL) - waiting for connections 1469 1 root 40288 0.1 Ss 69-21:39:22 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 167562 166914 netdata 35840 0.1 Sl 1-05:26:42 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 34180 0.0 Sl 10-05:29:27 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166645 1 wp-toolkit 31680 0.0 Ss 1-05:26:51 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29724 0.0 Ss 05:26:42 lfd - sleeping 167896 1 root 23804 0.0 Ss 1-05:26:39 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1463 1 root 23520 0.0 Ss 69-21:39:22 tailwatchd 2032795 506832 nobody 20476 0.1 S 01:54 /usr/sbin/httpd -k start 2032958 506832 nobody 20304 0.0 S 01:41 /usr/sbin/httpd -k start 2033623 506832 nobody 20236 0.0 S 00:51 /usr/sbin/httpd -k start 2032803 506832 nobody 20192 0.0 S 01:54 /usr/sbin/httpd -k start 2032990 506832 nobody 19908 0.0 S 01:40 /usr/sbin/httpd -k start 2032138 506832 nobody 19832 0.0 S 02:42 /usr/sbin/httpd -k start 2032775 506832 nobody 19768 0.0 S 01:55 /usr/sbin/httpd -k start 2032748 506832 nobody 19644 0.1 S 01:57 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19628 0.0 Ss 1-05:26:40 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2034016 506832 nobody 19368 0.0 S 00:17 /usr/sbin/httpd -k start 2033000 506832 nobody 19260 0.0 S 01:39 /usr/sbin/httpd -k start 2032794 506832 nobody 18848 0.1 S 01:54 /usr/sbin/httpd -k start 2033610 506832 nobody 18764 0.0 S 00:52 /usr/sbin/httpd -k start 2033820 506832 nobody 18736 0.0 S 00:31 /usr/sbin/httpd -k start 2032757 1353308 cpanellogin 18672 0.0 S 01:57 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 2033795 506832 nobody 18428 0.1 S 00:37 /usr/sbin/httpd -k start 2034264 506832 nobody 18176 0.5 S 00:02 /usr/sbin/httpd -k start 2034266 506832 nobody 18116 0.5 S 00:02 /usr/sbin/httpd -k start 2034236 506832 nobody 18084 0.6 S 00:03 /usr/sbin/httpd -k start 2034237 506832 nobody 18044 0.3 S 00:03 /usr/sbin/httpd -k start 2034230 506832 nobody 18024 0.2 S 00:04 /usr/sbin/httpd -k start 2034263 506832 nobody 18024 1.0 S 00:02 /usr/sbin/httpd -k start 2034238 506832 nobody 18020 0.3 S 00:03 /usr/sbin/httpd -k start 2034231 506832 nobody 17988 0.2 S 00:04 /usr/sbin/httpd -k start 2034229 506832 nobody 17960 0.2 S 00:04 /usr/sbin/httpd -k start 2034239 506832 nobody 17956 0.3 S 00:03 /usr/sbin/httpd -k start 2034240 506832 nobody 17952 0.3 S 00:03 /usr/sbin/httpd -k start 2032777 506832 nobody 17756 0.0 S 01:55 /usr/sbin/httpd -k start 167566 166914 netdata 17712 2.1 Sl 1-05:26:42 /usr/libexec/netdata/plugins.d/apps.plugin 1 2013782 506832 nobody 17612 0.0 S 07:57 /usr/sbin/httpd -k start 2032998 506832 nobody 17504 0.0 S 01:39 /usr/sbin/httpd -k start 2032793 506832 nobody 17260 0.0 S 01:54 /usr/sbin/httpd -k start 2032562 506832 nobody 17052 0.0 S 02:10 /usr/sbin/httpd -k start 2032797 506832 nobody 17020 0.0 S 01:54 /usr/sbin/httpd -k start 2033622 506832 nobody 16992 0.0 S 00:51 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 1366600 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 348 evolution/portal.evolutionerp.com.au-ssl_log 170 evolution/app.evolutionerp.com.au-ssl_log 102 madalice/madalice.com.au-ssl_log 12 corpkicks/corporatekicks.com.au-ssl_log 9 alison/alisonarts.com.au-ssl_log 3 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 251 203.54.180.238 111 182.239.240.254 102 40.115.94.245 58 103.104.164.114 25 165.225.233.87 25 103.104.165.99 22 101.166.96.210 14 180.181.236.49 7 54.157.112.104 6 34.81.107.244 4 116.91.221.245 3 52.167.144.21 2 34.58.17.83 2 114.119.137.101 1 54.236.1.216 --- top request paths across all vhosts (last 3 min) --- 107 POST /functions.php 89 GET /app/ajax.php 72 GET /factory_session_checker.php 51 GET /api/getItem/LWPB2001KG 36 GET /index.php 36 GET /factory_session_processed_qty.php 36 GET /factory_session_joiner.php 26 POST /app/ajax/selectFilter.php 20 POST /app/ajax/selectFilterSingle.php 19 POST /app/ajax.php 16 POST /purchaseaddsave.php 13 GET /heartbeat.php 10 POST /clienteditsave.php 7 POST /plugins/csvexporter/plugin.php 7 POST / 5 POST /portal/register 5 POST /logsave.php 4 POST /plugins/fencecosting/plugin.php 4 POST /jobeditsave.php 3 POST /quoteditsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 107 POST /functions.php 89 GET /app/ajax.php 30 GET /index.php 26 POST /app/ajax/selectFilter.php 20 POST /app/ajax/selectFilterSingle.php 19 POST /app/ajax.php 16 POST /purchaseaddsave.php 10 POST /clienteditsave.php 7 POST /plugins/csvexporter/plugin.php 5 POST /logsave.php 4 POST /plugins/fencecosting/plugin.php 4 POST /jobeditsave.php -- last 10 requests -- 203.54.180.238 - - [07/Sep/2026:07:49:04 +1000] "GET /app/ajax.php?cn=&furi=true&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=10057546845 HTTP/1.1" 200 248 "https://my.evolutionerp.com.au/index.php?page=jobedit&id 103.104.164.114 - - [07/Sep/2026:07:49:04 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 203.54.180.238 - - [07/Sep/2026:07:49:04 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=12371734152 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 203.54.180.238 - - [07/Sep/2026:07:49:04 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=10425838571 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 203.54.180.238 - - [07/Sep/2026:07:49:04 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Djobedit%26id%3D29585%26tab%3Dfilestab&call=getUserSetting&caller=ajaxSubmitLocal&seq=14790235376 HTTP/1.1" 200 203.54.180.238 - - [07/Sep/2026:07:49:05 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobedit%26id%3D29585%26tab%3Dfilestab&call=getUserSetting&caller=ajaxSubmitLocal&seq=15513225545 HTTP/1.1" 200 108 "https://my.e 203.54.180.238 - - [07/Sep/2026:07:49:05 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 23916 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29585&tab=filestab" "Mozilla/5.0 (Windows NT 10.0; Win6 103.104.164.114 - - [07/Sep/2026:07:49:05 +1000] "GET /reqSave.php?call=fetchVendorPOs&vendor=1096 HTTP/1.1" 200 22 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=183&tab=jobeditinv" "Mozilla/5.0 (Windows NT 1 203.54.180.238 - - [07/Sep/2026:07:49:06 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 5888 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29585&tab=filestab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 203.54.180.238 - - [07/Sep/2026:07:49:06 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=25858&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 72 GET /factory_session_checker.php 36 GET /factory_session_processed_qty.php 36 GET /factory_session_joiner.php 13 GET /heartbeat.php 6 GET /index.php 5 POST /portal/register 2 POST /factory_functions.php -- last 10 requests -- 203.54.180.238 - - [07/Sep/2026:07:48:57 +1000] "GET /factory_session_joiner.php?id=35151 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [07/Sep/2026:07:48:57 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [07/Sep/2026:07:48:59 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:07:48:59 +1000] "GET /factory_session_joiner.php?id=35150 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [07/Sep/2026:07:48:59 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [07/Sep/2026:07:48:59 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:07:49:00 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:07:49:01 +1000] "GET /heartbeat.php?sentAt=1788731341&bytes=106,157,223,205&_=1788724968542 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [07/Sep/2026:07:49:00 +1000] "POST /factory_functions.php?factory_session_create HTTP/1.1" 302 20 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=19" "Mozilla/5.0 (Linux; 203.54.180.238 - - [07/Sep/2026:07:49:03 +1000] "GET /index.php?page=factory_workbench HTTP/1.1" 200 12670 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=19" "Mozilla/5.0 (Linux; Android 10 == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 51 GET /api/getItem/LWPB2001KG 2 GET /api/getItem/K150MSGB 2 GET /api/getItem/IPC2525 1 GET /api/getItem/SGC-100 1 GET /api/getItem/RGW90-HC 1 GET /api/getItem/RGW%2CBM80 1 GET /api/getItem/RGW%2CBM117T 1 GET /api/getItem/RGW160 1 GET /api/getItem/RGW120 1 GET /api/getItem/RGW100 1 GET /api/getItem/PT75M 1 GET /api/getItem/PT65M -- last 10 requests -- 40.115.94.245 - - [07/Sep/2026:07:48:52 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:07:48:52 +1000] "GET /api/getItem/IPC32NB HTTP/1.1" 200 1491 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:07:48:52 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:07:48:53 +1000] "GET /api/getItem/IPC3825 HTTP/1.1" 200 1467 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:07:48:53 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:07:48:53 +1000] "GET /api/getItem/IPC4040-1 HTTP/1.1" 404 111 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:07:48:53 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:07:48:53 +1000] "GET /api/getItem/IPC40NB HTTP/1.1" 200 1342 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:07:48:53 +1000] "GET /api/getItem/LWPB2001KG HTTP/1.1" 200 1336 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:07:48:54 +1000] "GET /api/getItem/IPC5050 HTTP/1.1" 200 1740 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-07 07:46:37 L1=2.15 run=3 blk=1 avail=9469 (68.7%) swpO=0 conn=3 myRSS=1809 php=7 phpRSS=348 ap=38 tcp=46 topuser=evolution 2026-09-07 07:46:46 L1=2.29 run=2 blk=1 avail=9591 (69.6%) swpO=4 conn=2 myRSS=1809 php=5 phpRSS=180 ap=38 tcp=42 topuser=madalice 2026-09-07 07:46:47 L1=2.29 run=2 blk=1 avail=9548 (69.3%) swpO=4 conn=3 myRSS=1809 php=6 phpRSS=253 ap=38 tcp=42 topuser=madalice 2026-09-07 07:46:56 L1=2.25 run=1 blk=0 avail=9612 (69.8%) swpO=0 conn=1 myRSS=1810 php=5 phpRSS=178 ap=33 tcp=48 topuser=madalice 2026-09-07 07:46:57 L1=2.25 run=2 blk=1 avail=9575 (69.5%) swpO=0 conn=3 myRSS=1810 php=6 phpRSS=235 ap=34 tcp=45 topuser=madalice 2026-09-07 07:47:06 L1=2.37 run=6 blk=1 avail=9573 (69.5%) swpO=0 conn=1 myRSS=1810 php=9 phpRSS=311 ap=32 tcp=43 topuser=madalice 2026-09-07 07:47:07 L1=2.37 run=2 blk=1 avail=9620 (69.8%) swpO=0 conn=3 myRSS=1810 php=6 phpRSS=207 ap=31 tcp=44 topuser=madalice 2026-09-07 07:47:16 L1=2.83 run=3 blk=1 avail=9377 (68.1%) swpO=47 conn=1 myRSS=1809 php=6 phpRSS=238 ap=60 tcp=48 topuser=madalice 2026-09-07 07:47:17 L1=2.83 run=2 blk=1 avail=9384 (68.1%) swpO=47 conn=3 myRSS=1809 php=6 phpRSS=239 ap=58 tcp=49 topuser=madalice 2026-09-07 07:47:26 L1=2.79 run=2 blk=1 avail=9205 (66.8%) swpO=1 conn=1 myRSS=1924 php=6 phpRSS=330 ap=52 tcp=69 topuser=madalice 2026-09-07 07:47:27 L1=2.79 run=2 blk=1 avail=9278 (67.3%) swpO=2 conn=3 myRSS=1925 php=6 phpRSS=220 ap=58 tcp=69 topuser=madalice 2026-09-07 07:47:36 L1=2.66 run=2 blk=1 avail=9298 (67.5%) swpO=7 conn=1 myRSS=1925 php=7 phpRSS=279 ap=52 tcp=45 topuser=madalice 2026-09-07 07:47:37 L1=2.66 run=4 blk=1 avail=9261 (67.2%) swpO=6 conn=2 myRSS=1925 php=7 phpRSS=335 ap=50 tcp=45 topuser=madalice 2026-09-07 07:47:46 L1=2.78 run=1 blk=1 avail=9409 (68.3%) swpO=0 conn=1 myRSS=1925 php=6 phpRSS=206 ap=42 tcp=41 topuser=madalice 2026-09-07 07:47:47 L1=2.78 run=1 blk=1 avail=9422 (68.4%) swpO=0 conn=2 myRSS=1925 php=5 phpRSS=182 ap=40 tcp=40 topuser=madalice 2026-09-07 07:47:56 L1=3.05 run=5 blk=1 avail=9349 (67.9%) swpO=0 conn=2 myRSS=1925 php=7 phpRSS=348 ap=33 tcp=47 topuser=madalice 2026-09-07 07:47:57 L1=3.05 run=2 blk=1 avail=9250 (67.1%) swpO=0 conn=2 myRSS=1926 php=7 phpRSS=461 ap=33 tcp=47 topuser=otterfencing 2026-09-07 07:48:06 L1=3.12 run=1 blk=1 avail=9491 (68.9%) swpO=0 conn=2 myRSS=1926 php=5 phpRSS=182 ap=30 tcp=38 topuser=madalice 2026-09-07 07:48:07 L1=3.12 run=4 blk=1 avail=9492 (68.9%) swpO=0 conn=2 myRSS=1926 php=5 phpRSS=182 ap=29 tcp=36 topuser=madalice 2026-09-07 07:48:16 L1=2.95 run=2 blk=1 avail=9491 (68.9%) swpO=0 conn=2 myRSS=1927 php=6 phpRSS=223 ap=29 tcp=42 topuser=madalice 2026-09-07 07:48:18 L1=2.95 run=5 blk=1 avail=9429 (68.4%) swpO=0 conn=2 myRSS=1927 php=6 phpRSS=275 ap=29 tcp=43 topuser=madalice 2026-09-07 07:48:26 L1=2.80 run=1 blk=1 avail=9521 (69.1%) swpO=0 conn=2 myRSS=1927 php=5 phpRSS=182 ap=26 tcp=39 topuser=madalice 2026-09-07 07:48:28 L1=2.80 run=2 blk=1 avail=9521 (69.1%) swpO=0 conn=2 myRSS=1927 php=5 phpRSS=182 ap=26 tcp=42 topuser=madalice 2026-09-07 07:48:36 L1=2.53 run=1 blk=1 avail=9498 (68.9%) swpO=0 conn=2 myRSS=1927 php=5 phpRSS=182 ap=29 tcp=46 topuser=madalice 2026-09-07 07:48:38 L1=2.40 run=1 blk=1 avail=9470 (68.7%) swpO=0 conn=1 myRSS=1927 php=5 phpRSS=182 ap=33 tcp=48 topuser=madalice 2026-09-07 07:48:46 L1=2.29 run=2 blk=1 avail=9484 (68.8%) swpO=0 conn=2 myRSS=1927 php=5 phpRSS=187 ap=29 tcp=45 topuser=madalice 2026-09-07 07:48:48 L1=2.19 run=1 blk=1 avail=9490 (68.9%) swpO=0 conn=1 myRSS=1927 php=6 phpRSS=192 ap=29 tcp=45 topuser=madalice 2026-09-07 07:48:56 L1=2.17 run=8 blk=1 avail=9368 (68.0%) swpO=0 conn=3 myRSS=1927 php=9 phpRSS=392 ap=32 tcp=48 topuser=madalice 2026-09-07 07:48:58 L1=2.16 run=2 blk=1 avail=9395 (68.2%) swpO=0 conn=1 myRSS=1927 php=6 phpRSS=282 ap=33 tcp=48 topuser=madalice 2026-09-07 07:49:06 L1=2.71 run=1 blk=1 avail=8035 (58.3%) swpO=330 conn=1 myRSS=1926 php=14 phpRSS=1582 ap=66 tcp=75 topuser=madalice