INCIDENT 2026-09-07 12:33:15 trigger: php_rss=1629MB ================================================================== load: 3.47 3.49 3.38 3/815 3101366 ncpu:10 mem_avail: 6925MB/13777MB (50.3%) swap_used:2513MB swapout:50/s blocked(D):1 running:4 iowait:7.1% steal:0.0% php: 15 procs / 1629MB heaviest user: madalice (10 procs, 1566MB) apache: 139 procs tcp_estab: 61 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2384 nobody 138 2291 madalice 10 1567 root 256 1127 netdata 8 247 mailman 20 98 alison 5 69 infinium 2 64 wp-toolkit 3 56 dovenull 6 55 mailnull 2 23 dovecot 3 22 cpanellogin 1 20 vinesit 1 14 lowrange 1 14 corpkicks 1 14 candyfabcom 1 14 zabbix 1 10 kurri 1 9 evolution 11 9 --- php workers by user --- USER PROCS RSS_MB madalice 10 1567 infinium 1 52 root 1 23 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5823 MB Active(file): 3310 MB Inactive(file): 2623 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 586 MB CommitLimit: 10984 MB Committed_AS: 11573 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-10:10:50 5196 /usr/bin/imunify-agent-proxy 4109079 root 2-07:48:28 1960 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-07:48:28 78132 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 2441888 6.6 Ssl 1-16:56:45 /usr/sbin/mariadbd 166870 1 netdata 188680 2.6 Ssl 1-10:10:56 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3100180 167896 madalice 167184 17.5 R 00:59 php-fpm: pool madalice_com_au 167871 1 root 161096 0.0 Ss 1-10:10:49 /usr/lib/systemd/systemd-journald 3099828 167896 madalice 160164 20.9 S 01:04 php-fpm: pool madalice_com_au 3082876 167896 madalice 160144 24.4 S 03:53 php-fpm: pool madalice_com_au 3059435 167896 madalice 160032 26.5 S 12:15 php-fpm: pool madalice_com_au 3082701 167896 madalice 159996 24.0 S 04:01 php-fpm: pool madalice_com_au 3100181 167896 madalice 159968 18.1 S 00:59 php-fpm: pool madalice_com_au 3099837 167896 madalice 159876 20.9 S 01:03 php-fpm: pool madalice_com_au 3099833 167896 madalice 159816 20.7 S 01:04 php-fpm: pool madalice_com_au 3099826 167896 madalice 159696 20.4 S 01:04 php-fpm: pool madalice_com_au 3099827 167896 madalice 159688 19.0 S 01:04 php-fpm: pool madalice_com_au 923652 904997 root 159216 0.1 S 10:03:32 spamd child 923653 904997 root 142048 0.0 S 10:03:31 spamd child 904997 1 root 130724 0.0 Ss 10:10:19 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4109105 4109079 root 78132 1.4 Sl 2-07:48:28 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 3101337 3100975 infinium 67972 18.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1353308 1 root 42400 0.1 Ss 47-09:52:02 cpsrvd (SSL) - waiting for connections 1469 1 root 40708 0.1 Ss 70-02:23:31 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3101371 1469 root 38488 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3101400 3100201 tubesupplies 35572 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 167562 166914 netdata 35432 0.1 Sl 1-10:10:51 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 35056 0.0 Sl 10-10:13:36 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166645 1 wp-toolkit 31504 0.0 Ss 1-10:11:00 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29824 0.0 Ss 10:10:51 lfd - sleeping 1466 1 root 25792 0.0 Ss 70-02:23:31 dnsadmin - server mode 1463 1 root 23872 0.0 Ss 70-02:23:31 tailwatchd 167896 1 root 23688 0.0 Ss 1-10:10:48 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3081419 506832 nobody 22856 0.1 S 05:07 /usr/sbin/httpd -k start 3080389 506832 nobody 22200 0.1 S 06:06 /usr/sbin/httpd -k start 3063497 506832 nobody 21292 0.0 S 08:48 /usr/sbin/httpd -k start 3041041 1353308 cpanellogin 21236 0.0 S 17:02 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 3082620 506832 nobody 21144 0.1 S 04:05 /usr/sbin/httpd -k start 3098243 506832 nobody 20652 0.0 S 02:41 /usr/sbin/httpd -k start 3098001 506832 nobody 20204 0.0 S 02:58 /usr/sbin/httpd -k start 3100960 506832 nobody 20200 0.1 S 00:16 /usr/sbin/httpd -k start 3063185 506832 nobody 20104 0.0 S 09:09 /usr/sbin/httpd -k start 3097980 506832 nobody 20036 0.0 S 02:59 /usr/sbin/httpd -k start 3100094 506832 nobody 19980 0.0 S 01:00 /usr/sbin/httpd -k start 3098244 506832 nobody 19968 0.0 S 02:41 /usr/sbin/httpd -k start 3098683 506832 nobody 19920 0.0 S 02:11 /usr/sbin/httpd -k start 3100201 506832 nobody 19808 0.0 S 00:59 /usr/sbin/httpd -k start 3100098 506832 nobody 19804 0.0 S 01:00 /usr/sbin/httpd -k start 3099010 506832 nobody 19680 0.0 S 01:55 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19568 0.0 Ss 1-10:10:49 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3099847 506832 nobody 19480 0.0 S 01:02 /usr/sbin/httpd -k start 3100202 506832 nobody 19460 0.0 S 00:59 /usr/sbin/httpd -k start 3098988 506832 nobody 19448 0.1 S 01:56 /usr/sbin/httpd -k start 3100089 506832 nobody 19444 0.0 S 01:00 /usr/sbin/httpd -k start 3100199 506832 nobody 19424 0.1 S 00:59 /usr/sbin/httpd -k start 3100215 506832 nobody 19396 0.0 S 00:59 /usr/sbin/httpd -k start 3100074 506832 nobody 19340 0.1 S 01:00 /usr/sbin/httpd -k start 3100092 506832 nobody 19284 0.0 S 01:00 /usr/sbin/httpd -k start 3100191 506832 nobody 19276 0.0 S 00:59 /usr/sbin/httpd -k start 3100958 506832 nobody 19252 0.1 S 00:16 /usr/sbin/httpd -k start 3100769 506832 nobody 19216 0.0 S 00:23 /usr/sbin/httpd -k start 3100214 506832 nobody 19060 0.0 S 00:59 /usr/sbin/httpd -k start 3100219 506832 nobody 19028 0.0 S 00:59 /usr/sbin/httpd -k start 3098825 506832 nobody 19016 0.0 S 02:02 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3408959 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 569 evolution/portal.evolutionerp.com.au-ssl_log 168 madalice/madalice.com.au-ssl_log 155 tubesupplies/tubesupplies.com.au 100 tubesupplies/tubesupplies.com.au-ssl_log 100 olytis/tis.com.au-ssl_log 50 speedlin/speedlinefencing.com.au-ssl_log 39 whiz/whizengineering.com.au-ssl_log 26 evolution/app.evolutionerp.com.au-ssl_log 3 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 388 203.54.180.238 197 84.17.60.251 87 116.91.221.245 83 185.177.72.24 70 103.104.165.99 69 103.104.164.114 63 34.187.199.90 49 101.166.96.210 46 93.152.221.156 39 20.151.10.161 25 180.181.236.49 24 45.148.10.9 17 1.144.107.82 12 182.239.240.254 5 203.166.236.147 --- top request paths across all vhosts (last 3 min) --- 200 POST /functions.php 128 GET /app/ajax.php 64 GET /index.php 52 GET /heartbeat.php 39 GET /factory_session_checker.php 31 POST /plugins/csvexporter/plugin.php 22 POST /app/ajax.php 20 POST /app/ajax/selectFilterSingle.php 19 GET /factory_session_processed_qty.php 19 GET /factory_session_joiner.php 17 POST /quoteditsave.php 17 POST /factory_functions.php 14 POST /clienteditsave.php 12 POST /purchaseaddsave.php 11 POST /app/ajax/selectFilter.php 10 POST /portal/register 10 POST /inveditsave.php 9 POST /billaddsave.php 7 POST /support_releasenotes.php 7 POST /logsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 200 POST /functions.php 128 GET /app/ajax.php 52 GET /index.php 31 POST /plugins/csvexporter/plugin.php 22 POST /app/ajax.php 20 POST /app/ajax/selectFilterSingle.php 17 POST /quoteditsave.php 14 POST /clienteditsave.php 12 POST /purchaseaddsave.php 11 POST /app/ajax/selectFilter.php 10 POST /inveditsave.php 9 POST /billaddsave.php -- last 10 requests -- 203.54.180.238 - - [07/Sep/2026:12:33:09 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 51 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=19122&tab=clienteditcontacts" "Mozilla/5.0 (Windows 203.54.180.238 - - [07/Sep/2026:12:33:09 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:12:33:09 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 203.54.180.238 - - [07/Sep/2026:12:33:09 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=reqedit&id=9960" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 203.54.180.238 - - [07/Sep/2026:12:33:09 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=invedithist&id=475&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 203.54.180.238 - - [07/Sep/2026:12:33:09 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79170§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 203.54.180.238 - - [07/Sep/2026:12:33:09 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=40732&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; 203.54.180.238 - - [07/Sep/2026:12:33:09 +1000] "POST /inveditsave.php?call=fetch_inventory HTTP/1.1" 200 2730 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 203.54.180.238 - - [07/Sep/2026:12:33:10 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79170" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 1.145.70.156 - - [07/Sep/2026:12:33:10 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=activities&date=07-09-2026" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Ap == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 52 GET /heartbeat.php 39 GET /factory_session_checker.php 19 GET /factory_session_processed_qty.php 19 GET /factory_session_joiner.php 17 POST /factory_functions.php 12 GET /index.php 10 POST /portal/register -- last 10 requests -- 103.104.165.99 - - [07/Sep/2026:12:33:03 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php?page=inventory_picking" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, 203.54.180.238 - - [07/Sep/2026:12:33:03 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 103.104.165.99 - - [07/Sep/2026:12:33:03 +1000] "GET /index.php?page=inventory_picking_goods&pickid=16445&seq=8063212968030 HTTP/1.1" 200 10958 "https://portal.evolutionerp.com.au/index.php?page=inventory_picking" "Mozil 203.54.180.238 - - [07/Sep/2026:12:33:04 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 103.104.165.99 - - [07/Sep/2026:12:33:04 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php?page=inventory_picking_goods&pickid=16445&seq=8063212968030" "Mozilla/5.0 (Linux; Andro 203.54.180.238 - - [07/Sep/2026:12:33:03 +1000] "GET /heartbeat.php?sentAt=1788748377&bytes=106,158,34,89&_=1788747731839 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 103.104.165.99 - - [07/Sep/2026:12:33:06 +1000] "GET /index.php?page=inventory_picking HTTP/1.1" 200 8572 "https://portal.evolutionerp.com.au/index.php" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like 103.104.165.99 - - [07/Sep/2026:12:33:06 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php?page=inventory_picking" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, 103.104.165.99 - - [07/Sep/2026:12:33:08 +1000] "GET /index.php?page=inventory_picking_goods&pickid=16456&seq=6682647310725 HTTP/1.1" 200 10726 "https://portal.evolutionerp.com.au/index.php?page=inventory_picking" "Mozil 203.54.180.238 - - [07/Sep/2026:12:33:08 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET /store/design-your-own-send-in/ 2 GET /.zshrc 2 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 2 GET /users/login 2 GET /user/login 2 GET /signup 2 GET /signin 2 GET /sign-in 2 GET /secure 2 GET /register 2 GET /rclone.conf 2 GET /.profile -- last 10 requests -- 34.187.199.90 - - [07/Sep/2026:12:32:59 +1000] "GET /admin HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36" 34.187.199.90 - - [07/Sep/2026:12:32:59 +1000] "GET /portal HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36" 34.187.199.90 - - [07/Sep/2026:12:32:59 +1000] "GET /wp-login.php HTTP/1.1" 200 4024 "https://madalice.com.au/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safa 2001:8004:1ef0:585e:98f6:f930:251b:18d1 - - [07/Sep/2026:12:33:00 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 601 "https://madalice.com.au/product-category/customised-shoes/wedding/?srsltid=AfmBOopOQBSYG 185.177.72.24 - - [07/Sep/2026:12:33:00 +1000] "GET /.env.swp HTTP/1.1" 404 36649 "-" "curl/8.7.1" 185.177.72.24 - - [07/Sep/2026:12:33:02 +1000] "GET /.env.swo HTTP/1.1" 403 12 "-" "curl/8.7.1" 185.177.72.24 - - [07/Sep/2026:12:33:02 +1000] "GET /.env~ HTTP/1.1" 404 36647 "-" "curl/8.7.1" 185.177.72.24 - - [07/Sep/2026:12:33:04 +1000] "GET /env HTTP/1.1" 404 36643 "-" "curl/8.7.1" 114.119.131.88 - - [07/Sep/2026:12:33:06 +1000] "GET /store/hand-painted-vans-slip-on-shoes-joker/?rating=3&image=1 HTTP/1.1" 404 36659 "https://madalice.com.au/store/hand-painted-vans-slip-on-shoes-joker/?wcpr_image=1&w 185.177.72.24 - - [07/Sep/2026:12:33:10 +1000] "GET /env.yaml HTTP/1.1" 404 36649 "-" "curl/8.7.1" --- last 30 samples (run-up to this incident) --- 2026-09-07 12:30:45 L1=3.13 run=2 blk=1 avail=8564 (62.2%) swpO=0 conn=4 myRSS=2380 php=7 phpRSS=487 ap=47 tcp=49 topuser=madalice 2026-09-07 12:30:54 L1=3.11 run=4 blk=1 avail=8457 (61.4%) swpO=13 conn=3 myRSS=2380 php=8 phpRSS=619 ap=46 tcp=49 topuser=madalice 2026-09-07 12:30:55 L1=3.11 run=2 blk=1 avail=8574 (62.2%) swpO=13 conn=4 myRSS=2380 php=7 phpRSS=491 ap=45 tcp=47 topuser=madalice 2026-09-07 12:31:04 L1=2.94 run=3 blk=1 avail=8547 (62.0%) swpO=0 conn=3 myRSS=2380 php=9 phpRSS=594 ap=41 tcp=56 topuser=madalice 2026-09-07 12:31:05 L1=2.94 run=4 blk=1 avail=8379 (60.8%) swpO=0 conn=3 myRSS=2380 php=8 phpRSS=733 ap=43 tcp=57 topuser=madalice 2026-09-07 12:31:14 L1=3.48 run=4 blk=1 avail=8250 (59.9%) swpO=19 conn=3 myRSS=2382 php=11 phpRSS=859 ap=49 tcp=64 topuser=madalice 2026-09-07 12:31:15 L1=3.48 run=7 blk=0 avail=8348 (60.6%) swpO=19 conn=3 myRSS=2382 php=11 phpRSS=766 ap=57 tcp=61 topuser=madalice 2026-09-07 12:31:24 L1=3.40 run=3 blk=1 avail=8367 (60.7%) swpO=38 conn=3 myRSS=2381 php=10 phpRSS=611 ap=70 tcp=63 topuser=madalice 2026-09-07 12:31:25 L1=3.40 run=10 blk=1 avail=8268 (60.0%) swpO=38 conn=3 myRSS=2381 php=10 phpRSS=694 ap=69 tcp=66 topuser=madalice 2026-09-07 12:31:34 L1=3.27 run=3 blk=1 avail=8342 (60.5%) swpO=0 conn=3 myRSS=2381 php=9 phpRSS=637 ap=60 tcp=67 topuser=madalice 2026-09-07 12:31:35 L1=3.27 run=6 blk=1 avail=8414 (61.1%) swpO=0 conn=3 myRSS=2381 php=11 phpRSS=675 ap=59 tcp=62 topuser=madalice 2026-09-07 12:31:44 L1=3.16 run=5 blk=1 avail=8438 (61.2%) swpO=0 conn=3 myRSS=2381 php=14 phpRSS=796 ap=50 tcp=58 topuser=madalice 2026-09-07 12:31:45 L1=3.16 run=5 blk=1 avail=8371 (60.8%) swpO=0 conn=3 myRSS=2381 php=13 phpRSS=834 ap=49 tcp=55 topuser=madalice 2026-09-07 12:31:54 L1=3.06 run=2 blk=1 avail=8546 (62.0%) swpO=0 conn=3 myRSS=2382 php=7 phpRSS=542 ap=44 tcp=45 topuser=madalice 2026-09-07 12:31:55 L1=3.06 run=5 blk=1 avail=8577 (62.3%) swpO=0 conn=3 myRSS=2382 php=8 phpRSS=539 ap=43 tcp=44 topuser=madalice 2026-09-07 12:32:04 L1=3.27 run=5 blk=1 avail=8387 (60.9%) swpO=0 conn=3 myRSS=2382 php=10 phpRSS=746 ap=38 tcp=51 topuser=madalice 2026-09-07 12:32:05 L1=3.27 run=5 blk=1 avail=8556 (62.1%) swpO=0 conn=2 myRSS=2382 php=8 phpRSS=531 ap=38 tcp=50 topuser=madalice 2026-09-07 12:32:14 L1=3.38 run=10 blk=1 avail=7844 (56.9%) swpO=17 conn=3 myRSS=2382 php=16 phpRSS=1384 ap=42 tcp=80 topuser=madalice 2026-09-07 12:32:15 L1=3.38 run=14 blk=1 avail=7640 (55.5%) swpO=38 conn=9 myRSS=2382 php=17 phpRSS=1561 ap=50 tcp=80 topuser=madalice 2026-09-07 12:32:25 L1=3.82 run=4 blk=1 avail=7205 (52.3%) swpO=127 conn=3 myRSS=2382 php=14 phpRSS=1631 ap=92 tcp=70 topuser=madalice 2026-09-07 12:32:26 L1=3.82 run=4 blk=1 avail=7194 (52.2%) swpO=108 conn=3 myRSS=2382 php=14 phpRSS=1657 ap=90 tcp=66 topuser=madalice 2026-09-07 12:32:35 L1=3.86 run=2 blk=1 avail=7285 (52.9%) swpO=0 conn=2 myRSS=2382 php=14 phpRSS=1672 ap=82 tcp=65 topuser=madalice 2026-09-07 12:32:36 L1=3.86 run=2 blk=1 avail=7338 (53.3%) swpO=0 conn=2 myRSS=2382 php=14 phpRSS=1634 ap=80 tcp=60 topuser=madalice 2026-09-07 12:32:45 L1=3.64 run=2 blk=1 avail=7425 (53.9%) swpO=0 conn=2 myRSS=2382 php=15 phpRSS=1639 ap=72 tcp=56 topuser=madalice 2026-09-07 12:32:46 L1=3.67 run=6 blk=1 avail=7360 (53.4%) swpO=0 conn=4 myRSS=2382 php=18 phpRSS=1797 ap=70 tcp=57 topuser=madalice 2026-09-07 12:32:55 L1=3.54 run=1 blk=1 avail=7455 (54.1%) swpO=0 conn=1 myRSS=2383 php=14 phpRSS=1585 ap=67 tcp=169 topuser=madalice 2026-09-07 12:32:56 L1=3.41 run=1 blk=1 avail=7379 (53.6%) swpO=0 conn=1 myRSS=2383 php=14 phpRSS=1585 ap=79 tcp=172 topuser=madalice 2026-09-07 12:33:05 L1=3.54 run=3 blk=1 avail=6838 (49.6%) swpO=26 conn=2 myRSS=2384 php=15 phpRSS=1677 ap=149 tcp=85 topuser=madalice 2026-09-07 12:33:06 L1=3.42 run=8 blk=1 avail=6749 (49.0%) swpO=26 conn=4 myRSS=2385 php=16 phpRSS=1811 ap=147 tcp=67 topuser=madalice 2026-09-07 12:33:15 L1=3.47 run=4 blk=1 avail=6925 (50.3%) swpO=50 conn=2 myRSS=2384 php=15 phpRSS=1629 ap=139 tcp=61 topuser=madalice