INCIDENT 2026-09-07 12:36:17 trigger: php_rss=1796MB ================================================================== load: 3.55 3.63 3.46 3/727 3119768 ncpu:10 mem_avail: 7436MB/13777MB (54.0%) swap_used:2510MB swapout:0/s blocked(D):1 running:4 iowait:9.1% steal:0.0% php: 19 procs / 1796MB heaviest user: madalice (10 procs, 1546MB) apache: 58 procs tcp_estab: 76 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2387 madalice 10 1548 root 251 1069 nobody 57 983 netdata 8 246 evolution 15 175 mailman 20 98 alison 5 69 speedlin 1 63 wp-toolkit 3 56 dovenull 6 55 dovecot 3 22 cpanellogin 1 21 mailnull 2 17 candyfabcom 1 14 zabbix 1 10 kurri 1 9 named 1 8 polkitd 1 6 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1548 evolution 8 187 speedlin 1 64 root 1 23 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6374 MB Active(file): 3435 MB Inactive(file): 3035 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 586 MB CommitLimit: 10984 MB Committed_AS: 10096 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-10:13:52 5196 /usr/bin/imunify-agent-proxy 4109079 root 2-07:51:30 1960 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-07:51:30 78116 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 2445260 6.7 Ssl 1-16:59:47 /usr/sbin/mariadbd 166870 1 netdata 187536 2.6 Ssl 1-10:13:58 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 167871 1 root 162464 0.0 Ss 1-10:13:51 /usr/lib/systemd/systemd-journald 3099833 167896 madalice 160656 10.6 R 04:06 php-fpm: pool madalice_com_au 923652 904997 root 159216 0.1 S 10:06:34 spamd child 3099828 167896 madalice 158592 10.5 S 04:06 php-fpm: pool madalice_com_au 3082876 167896 madalice 158512 17.1 S 06:55 php-fpm: pool madalice_com_au 3059435 167896 madalice 158508 22.6 S 15:17 php-fpm: pool madalice_com_au 3082701 167896 madalice 158444 16.9 S 07:03 php-fpm: pool madalice_com_au 3100181 167896 madalice 158444 9.8 S 04:01 php-fpm: pool madalice_com_au 3100180 167896 madalice 158396 9.7 S 04:01 php-fpm: pool madalice_com_au 3099837 167896 madalice 158328 10.4 S 04:05 php-fpm: pool madalice_com_au 3099827 167896 madalice 158184 10.0 S 04:06 php-fpm: pool madalice_com_au 3099826 167896 madalice 158172 10.3 S 04:06 php-fpm: pool madalice_com_au 923653 904997 root 142048 0.0 S 10:06:33 spamd child 904997 1 root 130724 0.0 Ss 10:13:21 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4109105 4109079 root 78116 1.4 Sl 2-07:51:30 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 3119737 3119634 speedlin 72944 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3119692 3100940 evolution 59492 5.0 S 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1353308 1 root 42400 0.1 Ss 47-09:55:04 cpsrvd (SSL) - waiting for connections 3119773 3103763 evolution 40720 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 40708 0.1 Ss 70-02:26:33 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3119798 3100962 evolution 38444 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3119734 3118833 evolution 37048 3.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3119735 3118830 evolution 36972 3.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3119733 3118834 evolution 36360 2.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 167562 166914 netdata 35432 0.1 Sl 1-10:13:53 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 35056 0.0 Sl 10-10:16:38 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166645 1 wp-toolkit 31504 0.0 Ss 1-10:14:02 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29832 0.0 Ss 10:13:53 lfd - sleeping 1466 1 root 25792 0.0 Ss 70-02:26:33 dnsadmin - server mode 1463 1 root 23872 0.0 Ss 70-02:26:33 tailwatchd 167896 1 root 23688 0.0 Ss 1-10:13:50 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3041041 1353308 cpanellogin 21852 0.0 S 20:04 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 3100191 506832 nobody 21684 0.0 S 04:01 /usr/sbin/httpd -k start 3100785 506832 nobody 21464 0.0 S 03:24 /usr/sbin/httpd -k start 3100892 506832 nobody 21176 0.0 S 03:20 /usr/sbin/httpd -k start 3098243 506832 nobody 21016 0.0 S 05:43 /usr/sbin/httpd -k start 3080389 506832 nobody 20948 0.1 S 09:08 /usr/sbin/httpd -k start 3100219 506832 nobody 20564 0.0 S 04:01 /usr/sbin/httpd -k start 3100089 506832 nobody 20448 0.0 S 04:02 /usr/sbin/httpd -k start 3100965 506832 nobody 20400 0.0 S 03:18 /usr/sbin/httpd -k start 3100192 506832 nobody 20240 0.1 S 04:01 /usr/sbin/httpd -k start 3100962 506832 nobody 20228 0.0 S 03:18 /usr/sbin/httpd -k start 3100893 506832 nobody 20200 0.0 S 03:20 /usr/sbin/httpd -k start 3100913 506832 nobody 20188 0.0 S 03:19 /usr/sbin/httpd -k start 3100942 506832 nobody 19916 0.0 S 03:19 /usr/sbin/httpd -k start 3100975 506832 nobody 19912 0.0 S 03:18 /usr/sbin/httpd -k start 3100977 506832 nobody 19876 0.0 S 03:18 /usr/sbin/httpd -k start 3100940 506832 nobody 19792 0.0 S 03:19 /usr/sbin/httpd -k start 3100916 506832 nobody 19716 0.0 S 03:19 /usr/sbin/httpd -k start 3100963 506832 nobody 19688 0.0 S 03:18 /usr/sbin/httpd -k start 3118817 506832 nobody 19604 0.0 S 00:52 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19568 0.0 Ss 1-10:13:51 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3103762 506832 nobody 19544 0.1 S 01:30 /usr/sbin/httpd -k start 3111993 506832 nobody 19544 0.1 S 01:10 /usr/sbin/httpd -k start 3118397 506832 nobody 19492 0.0 S 01:03 /usr/sbin/httpd -k start 3103765 506832 nobody 19412 0.0 S 01:30 /usr/sbin/httpd -k start 3100917 506832 nobody 19400 0.0 S 03:19 /usr/sbin/httpd -k start 3100921 506832 nobody 19336 0.0 S 03:19 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+----------------+---------+------+----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+----------------+---------+------+----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3431544 | root | 108-1481181613 | Execute | 0 | Statistics | SELECT external, workshopnotes, (SELECT cost FROM inventory WHERE id = (SELECT default_cost_item fROM mfprocesses WHERE id = ?)) as cost, itemid as takeup, setupcost, setupTime, leadTime, cost as pcost FROM mfprocesses WHERE id = ? | | 3431542 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+----------------+---------+------+----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 669 speedlin/speedlinefencing.com.au-ssl_log 214 evolution/portal.evolutionerp.com.au-ssl_log 196 tubesupplies/tubesupplies.com.au 112 evolution/app.evolutionerp.com.au-ssl_log 108 tubesupplies/tubesupplies.com.au-ssl_log 107 aaa/aaadownunder.com.au-ssl_log 97 madalice/madalice.com.au-ssl_log 65 kurri/kurrimotorinn.com.au-ssl_log 46 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 415 203.54.180.238 217 84.17.60.251 214 34.26.229.119 113 116.91.221.245 108 40.115.94.245 87 101.166.96.210 83 103.104.165.99 65 185.177.72.24 60 203.166.236.147 57 45.148.10.12 50 1.145.70.156 43 35.197.254.17 41 103.104.164.114 18 182.239.240.254 16 180.181.236.49 --- top request paths across all vhosts (last 3 min) --- 238 POST /functions.php 139 GET /app/ajax.php 76 GET /index.php 66 GET /factory_session_checker.php 56 POST /plugins/csvexporter/plugin.php 45 GET /heartbeat.php 33 GET /factory_session_processed_qty.php 33 GET /factory_session_joiner.php 25 POST /inveditsave.php 24 POST / 21 POST /app/ajax/selectFilterSingle.php 21 POST /app/ajax.php 17 POST /quoteditsave.php 16 POST /plugins/fencecosting/plugin.php 11 POST /app/ajax/selectFilter.php 10 POST /index.php 10 POST /clienteditsave.php 9 POST /invaddsave.php 8 POST /purchaseaddsave.php 7 GET /modalload.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 238 POST /functions.php 139 GET /app/ajax.php 66 GET /index.php 56 POST /plugins/csvexporter/plugin.php 25 POST /inveditsave.php 21 POST /app/ajax/selectFilterSingle.php 21 POST /app/ajax.php 17 POST /quoteditsave.php 16 POST /plugins/fencecosting/plugin.php 11 POST /app/ajax/selectFilter.php 10 POST /clienteditsave.php 9 POST /invaddsave.php -- last 10 requests -- 1.145.70.156 - - [07/Sep/2026:12:36:14 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invedit&id=10364&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 1.145.70.156 - - [07/Sep/2026:12:36:14 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvedit%26id%3D10364%26tab%3Dgeneraltab&call=getUserSetting&caller=ajaxSubmitLocal&seq=17814789893 HTTP/1.1" 200 112 "https://my.e 101.166.96.210 - - [07/Sep/2026:12:36:15 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=invedit&id=7349&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 203.54.180.238 - - [07/Sep/2026:12:36:15 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29591&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 101.166.96.210 - - [07/Sep/2026:12:36:15 +1000] "GET /index.php?page=invedithist&id=7349&string= HTTP/1.1" 200 16452 "https://my.evolutionerp.com.au/index.php?page=invedit&id=7349&tab=generaltab" "Mozilla/5.0 (Windows NT 101.166.96.210 - - [07/Sep/2026:12:36:15 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invedithist&id=7349&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 180.181.236.49 - - [07/Sep/2026:12:36:15 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=6953§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win64 203.54.180.238 - - [07/Sep/2026:12:36:15 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29555" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) 101.166.96.210 - - [07/Sep/2026:12:36:15 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvedithist%26id%3D7349%26string%3D&call=getUserSetting&caller=ajaxSubmitLocal&seq=13363785450 HTTP/1.1" 200 109 "https://my.evo 1.145.70.156 - - [07/Sep/2026:12:36:15 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=invedit&id=10364&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/.env 1 GET /wp/.env 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /web/.env 1 GET /vue/.env 1 GET /vite/.env 1 GET /vendor/.env 1 GET /var/www/html/.env -- last 10 requests -- 34.26.229.119 - - [07/Sep/2026:12:36:13 +1000] "GET /preview/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:13 +1000] "GET /beta/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:14 +1000] "GET /uat/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:14 +1000] "GET /stage/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:14 +1000] "GET /development/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:14 +1000] "GET /production/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:14 +1000] "GET /config/app/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:15 +1000] "GET /phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:15 +1000] "GET /info.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.26.229.119 - - [07/Sep/2026:12:36:15 +1000] "GET /php.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 66 GET /factory_session_checker.php 45 GET /heartbeat.php 33 GET /factory_session_processed_qty.php 33 GET /factory_session_joiner.php 10 GET /index.php 5 POST /portal/register 1 POST /login.php 1 POST /factory_functions.php 1 GET /userlogin.php 1 GET /logoff.php -- last 10 requests -- 203.54.180.238 - - [07/Sep/2026:12:36:08 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:12:36:08 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:12:36:07 +1000] "GET /heartbeat.php?sentAt=1788748561&bytes=106,158,35,17&_=1788739087422 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:12:36:08 +1000] "GET /heartbeat.php?sentAt=1788748569&bytes=106,158,35,25&_=1788744364132 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:12:36:12 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [07/Sep/2026:12:36:12 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:12:36:12 +1000] "GET /factory_session_joiner.php?id=35164 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [07/Sep/2026:12:36:13 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:12:36:13 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:12:36:13 +1000] "GET /index.php?page=inventory_picking HTTP/1.1" 200 10017 "https://portal.evolutionerp.com.au/index.php" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, lik --- last 30 samples (run-up to this incident) --- 2026-09-07 12:33:56 L1=3.83 run=4 blk=1 avail=7143 (51.8%) swpO=0 conn=4 myRSS=2385 php=16 phpRSS=1706 ap=98 tcp=73 topuser=madalice 2026-09-07 12:33:57 L1=4.33 run=2 blk=1 avail=7197 (52.2%) swpO=0 conn=1 myRSS=2385 php=14 phpRSS=1576 ap=97 tcp=65 topuser=madalice 2026-09-07 12:34:06 L1=4.30 run=4 blk=1 avail=7123 (51.7%) swpO=0 conn=3 myRSS=2385 php=15 phpRSS=1800 ap=88 tcp=51 topuser=madalice 2026-09-07 12:34:07 L1=4.27 run=7 blk=1 avail=7045 (51.1%) swpO=0 conn=6 myRSS=2385 php=21 phpRSS=2055 ap=87 tcp=52 topuser=madalice 2026-09-07 12:34:16 L1=4.17 run=3 blk=1 avail=7252 (52.6%) swpO=0 conn=2 myRSS=2385 php=15 phpRSS=1741 ap=78 tcp=51 topuser=madalice 2026-09-07 12:34:17 L1=4.08 run=3 blk=1 avail=7361 (53.4%) swpO=0 conn=2 myRSS=2385 php=15 phpRSS=1627 ap=77 tcp=56 topuser=madalice 2026-09-07 12:34:26 L1=3.68 run=2 blk=1 avail=7473 (54.2%) swpO=0 conn=2 myRSS=2385 php=14 phpRSS=1571 ap=68 tcp=66 topuser=madalice 2026-09-07 12:34:27 L1=3.68 run=2 blk=1 avail=7417 (53.8%) swpO=0 conn=2 myRSS=2385 php=15 phpRSS=1665 ap=67 tcp=65 topuser=madalice 2026-09-07 12:34:36 L1=3.58 run=2 blk=1 avail=7524 (54.6%) swpO=0 conn=2 myRSS=2385 php=14 phpRSS=1574 ap=60 tcp=66 topuser=madalice 2026-09-07 12:34:37 L1=3.58 run=2 blk=1 avail=7440 (54.0%) swpO=0 conn=2 myRSS=2385 php=14 phpRSS=1660 ap=59 tcp=64 topuser=madalice 2026-09-07 12:34:46 L1=3.88 run=7 blk=1 avail=7284 (52.9%) swpO=0 conn=7 myRSS=2385 php=22 phpRSS=2038 ap=59 tcp=82 topuser=madalice 2026-09-07 12:34:47 L1=3.88 run=6 blk=1 avail=7252 (52.6%) swpO=0 conn=4 myRSS=2385 php=20 phpRSS=1920 ap=59 tcp=78 topuser=madalice 2026-09-07 12:34:56 L1=3.66 run=2 blk=1 avail=7479 (54.3%) swpO=0 conn=2 myRSS=2386 php=14 phpRSS=1652 ap=57 tcp=58 topuser=madalice 2026-09-07 12:34:57 L1=3.66 run=2 blk=1 avail=7536 (54.7%) swpO=0 conn=3 myRSS=2386 php=15 phpRSS=1614 ap=57 tcp=60 topuser=madalice 2026-09-07 12:35:06 L1=3.96 run=4 blk=1 avail=7342 (53.3%) swpO=0 conn=3 myRSS=2386 php=18 phpRSS=1943 ap=52 tcp=76 topuser=madalice 2026-09-07 12:35:07 L1=3.96 run=4 blk=1 avail=7541 (54.7%) swpO=0 conn=3 myRSS=2386 php=15 phpRSS=1630 ap=52 tcp=73 topuser=madalice 2026-09-07 12:35:16 L1=4.27 run=8 blk=1 avail=7374 (53.5%) swpO=0 conn=5 myRSS=2386 php=16 phpRSS=1800 ap=57 tcp=70 topuser=madalice 2026-09-07 12:35:17 L1=4.27 run=5 blk=1 avail=7352 (53.4%) swpO=0 conn=3 myRSS=2386 php=15 phpRSS=1795 ap=57 tcp=65 topuser=madalice 2026-09-07 12:35:27 L1=4.29 run=7 blk=1 avail=7295 (53.0%) swpO=0 conn=4 myRSS=2387 php=19 phpRSS=1851 ap=70 tcp=81 topuser=madalice 2026-09-07 12:35:27 L1=4.29 run=6 blk=1 avail=7318 (53.1%) swpO=0 conn=3 myRSS=2387 php=16 phpRSS=1751 ap=70 tcp=81 topuser=madalice 2026-09-07 12:35:37 L1=4.24 run=3 blk=1 avail=7417 (53.8%) swpO=0 conn=2 myRSS=2387 php=14 phpRSS=1600 ap=71 tcp=70 topuser=madalice 2026-09-07 12:35:37 L1=4.24 run=2 blk=1 avail=7377 (53.5%) swpO=0 conn=4 myRSS=2387 php=14 phpRSS=1650 ap=70 tcp=68 topuser=madalice 2026-09-07 12:35:47 L1=3.90 run=2 blk=1 avail=7506 (54.5%) swpO=0 conn=2 myRSS=2387 php=14 phpRSS=1570 ap=63 tcp=55 topuser=madalice 2026-09-07 12:35:47 L1=3.90 run=3 blk=1 avail=7498 (54.4%) swpO=0 conn=3 myRSS=2387 php=15 phpRSS=1615 ap=62 tcp=55 topuser=madalice 2026-09-07 12:35:57 L1=3.52 run=4 blk=1 avail=7548 (54.8%) swpO=0 conn=3 myRSS=2387 php=15 phpRSS=1630 ap=53 tcp=63 topuser=madalice 2026-09-07 12:35:57 L1=3.52 run=9 blk=1 avail=7446 (54.0%) swpO=0 conn=5 myRSS=2387 php=18 phpRSS=1825 ap=52 tcp=64 topuser=madalice 2026-09-07 12:36:07 L1=3.37 run=3 blk=1 avail=7540 (54.7%) swpO=0 conn=3 myRSS=2387 php=15 phpRSS=1687 ap=45 tcp=62 topuser=madalice 2026-09-07 12:36:07 L1=3.37 run=3 blk=1 avail=7447 (54.1%) swpO=0 conn=4 myRSS=2387 php=16 phpRSS=1800 ap=46 tcp=62 topuser=madalice 2026-09-07 12:36:17 L1=3.55 run=4 blk=1 avail=7436 (54.0%) swpO=0 conn=4 myRSS=2387 php=19 phpRSS=1796 ap=58 tcp=76 topuser=madalice 2026-09-07 12:36:18 L1=3.55 run=13 blk=1 avail=7384 (53.6%) swpO=0 conn=5 myRSS=2387 php=21 phpRSS=1907 ap=59 tcp=79 topuser=madalice