INCIDENT 2026-09-07 12:38:19 trigger: php_rss=1809MB ================================================================== load: 4.47 3.91 3.58 7/767 3123029 ncpu:10 mem_avail: 7089MB/13777MB (51.5%) swap_used:2522MB swapout:0/s blocked(D):1 running:6 iowait:8.8% steal:0.0% php: 17 procs / 1809MB heaviest user: madalice (10 procs, 1634MB) apache: 99 procs tcp_estab: 69 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2388 nobody 98 1724 madalice 10 1642 root 247 1029 netdata 8 242 evolution 14 161 mailman 20 98 alison 5 69 wp-toolkit 3 56 dovenull 6 55 candyfabcom 2 28 mailnull 3 24 cpanellogin 1 23 dovecot 3 22 zabbix 1 10 kurri 1 9 named 1 8 polkitd 1 6 nscd 1 5 rpc 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1642 evolution 6 151 root 1 23 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6066 MB Active(file): 3300 MB Inactive(file): 2887 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 586 MB CommitLimit: 10984 MB Committed_AS: 11004 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-10:15:54 5164 /usr/bin/imunify-agent-proxy 4109079 root 2-07:53:32 1960 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-07:53:32 72548 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 2445384 6.7 Rsl 1-17:01:49 /usr/sbin/mariadbd 3100180 167896 madalice 246136 9.7 S 06:03 php-fpm: pool madalice_com_au 166870 1 netdata 183204 2.6 Ssl 1-10:16:00 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3099833 167896 madalice 176192 10.5 R 06:08 php-fpm: pool madalice_com_au 3099837 167896 madalice 162720 10.4 S 06:07 php-fpm: pool madalice_com_au 3082701 167896 madalice 161948 15.2 S 09:05 php-fpm: pool madalice_com_au 167871 1 root 161528 0.0 Ss 1-10:15:53 /usr/lib/systemd/systemd-journald 3059435 167896 madalice 159900 21.1 S 17:19 php-fpm: pool madalice_com_au 3099828 167896 madalice 159704 10.3 S 06:08 php-fpm: pool madalice_com_au 3100181 167896 madalice 159436 9.8 S 06:03 php-fpm: pool madalice_com_au 3099827 167896 madalice 159400 10.1 S 06:08 php-fpm: pool madalice_com_au 3082876 167896 madalice 159320 15.5 S 08:57 php-fpm: pool madalice_com_au 3099826 167896 madalice 158948 10.2 S 06:08 php-fpm: pool madalice_com_au 923652 904997 root 158172 0.1 S 10:08:36 spamd child 923653 904997 root 141908 0.0 S 10:08:35 spamd child 904997 1 root 130724 0.0 Ss 10:15:23 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4109105 4109079 root 72548 1.4 Sl 2-07:53:32 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 3122975 3121742 evolution 58076 9.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3122947 3121700 evolution 57116 4.6 S 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1353308 1 root 42424 0.1 Ss 47-09:57:06 cpsrvd (SSL) - waiting for connections 3122972 3121696 evolution 40632 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 40308 0.1 Ss 70-02:28:35 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 167562 166914 netdata 35412 0.1 Sl 1-10:15:55 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 35056 0.0 Sl 10-10:18:40 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166645 1 wp-toolkit 31496 0.0 Ss 1-10:16:04 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29764 0.0 Ss 10:15:55 lfd - sleeping 3041041 1353308 cpanellogin 24080 0.0 S 22:06 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 1463 1 root 23712 0.0 Ss 70-02:28:35 tailwatchd 167896 1 root 23688 0.0 Ss 1-10:15:52 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3098243 506832 nobody 22636 0.0 S 07:45 /usr/sbin/httpd -k start 3100219 506832 nobody 21948 0.1 S 06:03 /usr/sbin/httpd -k start 3100893 506832 nobody 21840 0.1 S 05:22 /usr/sbin/httpd -k start 3100919 506832 nobody 21720 0.0 S 05:21 /usr/sbin/httpd -k start 3121664 506832 nobody 21324 0.2 S 00:59 /usr/sbin/httpd -k start 3119635 506832 nobody 21232 0.1 S 02:09 /usr/sbin/httpd -k start 3120972 506832 nobody 20992 0.0 S 01:10 /usr/sbin/httpd -k start 3119630 506832 nobody 20828 0.0 S 02:09 /usr/sbin/httpd -k start 3099888 506832 nobody 20816 0.0 S 06:05 /usr/sbin/httpd -k start 3100913 506832 nobody 20708 0.0 S 05:21 /usr/sbin/httpd -k start 3100892 506832 nobody 20700 0.0 S 05:22 /usr/sbin/httpd -k start 3100917 506832 nobody 20668 0.0 S 05:21 /usr/sbin/httpd -k start 3100089 506832 nobody 20576 0.0 S 06:04 /usr/sbin/httpd -k start 3100977 506832 nobody 20312 0.0 S 05:20 /usr/sbin/httpd -k start 3100965 506832 nobody 20196 0.0 S 05:20 /usr/sbin/httpd -k start 3111993 506832 nobody 20124 0.0 S 03:12 /usr/sbin/httpd -k start 3119636 506832 nobody 20096 0.0 S 02:09 /usr/sbin/httpd -k start 3100940 506832 nobody 19980 0.0 S 05:21 /usr/sbin/httpd -k start 3121034 506832 nobody 19912 0.0 S 01:06 /usr/sbin/httpd -k start 3120986 506832 nobody 19784 0.0 S 01:09 /usr/sbin/httpd -k start 3119618 506832 nobody 19768 0.0 S 02:10 /usr/sbin/httpd -k start 3118758 506832 nobody 19764 0.0 S 02:58 /usr/sbin/httpd -k start 3118793 506832 nobody 19736 0.0 S 02:55 /usr/sbin/httpd -k start 3118816 506832 nobody 19692 0.2 S 02:54 /usr/sbin/httpd -k start 3111988 506832 nobody 19592 0.0 S 03:12 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19568 0.0 Ss 1-10:15:53 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3121747 506832 nobody 19468 0.0 S 00:57 /usr/sbin/httpd -k start 3121546 506832 nobody 19364 0.0 S 01:01 /usr/sbin/httpd -k start 3119616 506832 nobody 19360 0.0 S 02:10 /usr/sbin/httpd -k start 3121651 506832 nobody 19340 0.0 S 01:00 /usr/sbin/httpd -k start 3121744 506832 nobody 19300 0.0 S 00:57 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+---------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+---------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3449858 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 3449855 | root | 85-1559715131 | Execute | 0 | Sending data | SELECT sum(pickingitems.qty) as comp FROM pickingitems,picking WHERE pickingitems.jobitemid='144700' and pickingitems.pickingid=picking.id AND picking.status='2' | +---------+------+---------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 845 evolution/portal.evolutionerp.com.au-ssl_log 221 aaa/aaadownunder.com.au-ssl_log 177 whiz/whizengineering.com.au-ssl_log 127 evolution/app.evolutionerp.com.au-ssl_log 116 speedlin/speedlinefencing.com.au-ssl_log 116 madalice/madalice.com.au-ssl_log 108 tubesupplies/tubesupplies.com.au 102 alison/alisonarts.com.au-ssl_log 98 tubesupplies/tubesupplies.com.au-ssl_log 95 kurri/kurrimotorinn.com.au-ssl_log 64 customc/customcentral.com.au-ssl_log 15 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 472 203.54.180.238 241 45.148.10.12 195 84.17.60.251 193 1.152.23.77 127 34.166.204.109 116 40.115.94.245 116 34.26.229.119 99 116.91.221.245 80 1.145.70.156 76 185.177.72.24 64 35.197.254.17 59 103.104.165.99 52 101.166.96.210 44 182.239.240.254 32 103.104.164.114 --- top request paths across all vhosts (last 3 min) --- 305 POST /functions.php 177 GET /app/ajax.php 127 GET /index.php 80 GET /factory_session_checker.php 59 POST / 51 POST /plugins/csvexporter/plugin.php 47 GET /logoff.php 44 GET /heartbeat.php 41 GET /factory_session_processed_qty.php 41 GET /factory_session_joiner.php 26 GET / 22 POST /index.php 17 POST /app/ajax/selectFilterSingle.php 15 POST /app/ajax.php 14 POST /inveditsave.php 14 POST /clienteditsave.php 14 POST /account 11 POST /wp-json/batch/v1/ 11 POST /wordpress/wp-json/batch/v1 11 POST /blog/wp-json/batch/v1 --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 305 POST /functions.php 177 GET /app/ajax.php 118 GET /index.php 51 POST /plugins/csvexporter/plugin.php 47 GET /logoff.php 17 POST /app/ajax/selectFilterSingle.php 15 POST /app/ajax.php 14 POST /inveditsave.php 14 POST /clienteditsave.php 10 POST /app/ajax/selectFilter.php 8 POST //functions.php 7 POST /logsave.php -- last 10 requests -- 116.91.221.245 - - [07/Sep/2026:12:38:16 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dquotedit%26quoteid%3D2038&call=getUserSetting&caller=ajaxSubmitLocal&seq=15981267174 HTTP/1.1" 200 112 "https: 203.54.180.238 - - [07/Sep/2026:12:38:16 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=mfreqedit&id=20893" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 116.91.221.245 - - [07/Sep/2026:12:38:16 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotedit%26quoteid2038&call=getUserSetting&caller=ajaxSubmitLocal&seq=16966114912 HTTP/1.1" 200 99 "https://my.evolutionerp.com. 203.54.180.238 - - [07/Sep/2026:12:38:16 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=mfshoporderdetail&id=44045" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 1.152.23.77 - - [07/Sep/2026:12:38:16 +1000] "GET /index.php?page=register HTTP/1.1" 200 5614 "https://my.evolutionerp.com.au/index.php?page=register" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/6 116.91.221.245 - - [07/Sep/2026:12:38:16 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=14026631608 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 203.54.180.238 - - [07/Sep/2026:12:38:16 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 1.144.107.82 - - [07/Sep/2026:12:38:17 +1000] "GET /index.php?page=plugins&id=24&action=setting HTTP/1.1" 200 16950 "https://my.evolutionerp.com.au/index.php?page=plugins" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 1.152.23.77 - - [07/Sep/2026:12:38:17 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dregister&call=getUserSetting&caller=ajaxSubmitLocal&seq=12147932299 HTTP/1.1" 200 90 "https://my.evolutionerp.com.au/index.php?page 1.144.107.82 - - [07/Sep/2026:12:38:17 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dplugins%26id%3D24%26action%3Dsetting&call=getUserSetting&caller=ajaxSubmitLocal&seq=15088734692 HTTP/1.1" 200 109 "https://my.evol == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 80 GET /factory_session_checker.php 44 GET /heartbeat.php 41 GET /factory_session_processed_qty.php 41 GET /factory_session_joiner.php 7 GET /index.php 6 POST /portal/register 1 POST /login.php 1 POST /factory_functions.php -- last 10 requests -- 203.54.180.238 - - [07/Sep/2026:12:38:08 +1000] "GET /factory_session_joiner.php?id=35166 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [07/Sep/2026:12:38:08 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [07/Sep/2026:12:38:07 +1000] "GET /heartbeat.php?sentAt=1788748681&bytes=106,158,35,137&_=1788739087434 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:12:38:08 +1000] "GET /heartbeat.php?sentAt=1788748689&bytes=106,158,35,145&_=1788744364144 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:12:38:10 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:12:38:10 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:12:38:10 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:12:38:12 +1000] "GET /heartbeat.php?sentAt=1788748692&bytes=106,158,35,148&_=1788748642197 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=11 203.54.180.238 - - [07/Sep/2026:12:38:13 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [07/Sep/2026:12:38:13 +1000] "GET /factory_session_joiner.php?id=35164 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 23 POST / 14 POST /account 10 POST /dashboard 8 POST /index.php 8 POST /admin 6 POST /wp/ 6 POST /signin 6 POST /register 6 POST /auth/callback 5 GET / 4 POST /wp-json/batch/v1/ 4 POST /wp/index.php -- last 10 requests -- 45.148.10.12 - - [07/Sep/2026:12:38:15 +1000] "POST /wp/?rest_route=/batch%2Fv1 HTTP/1.1" 404 3417 "https://cpanel.aaadownunder.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, l 45.148.10.12 - - [07/Sep/2026:12:38:16 +1000] "POST /wp/?rest_route=/batch/v1 HTTP/1.1" 404 3417 "https://cpanel.aaadownunder.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, lik 45.148.10.12 - - [07/Sep/2026:12:38:16 +1000] "POST /wp/wp-json/batch/v1 HTTP/1.1" 404 3417 "https://cpanel.aaadownunder.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec 45.148.10.12 - - [07/Sep/2026:12:38:17 +1000] "POST /wp/wp-json/Batch/v1 HTTP/1.1" 404 3417 "https://cpanel.aaadownunder.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec 45.148.10.12 - - [07/Sep/2026:12:38:17 +1000] "POST /wp//wp-json/batch/v1 HTTP/1.1" 404 3417 "https://cpanel.aaadownunder.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge 45.148.10.12 - - [07/Sep/2026:12:38:17 +1000] "POST /wp/wp-json/batch/v1/ HTTP/1.1" 404 3417 "https://cpanel.aaadownunder.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge 45.148.10.12 - - [07/Sep/2026:12:38:18 +1000] "POST /wp/blog/wp-json/batch/v1 HTTP/1.1" 404 3417 "https://cpanel.aaadownunder.com.au/wp/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, lik 203.54.180.238 - - [07/Sep/2026:12:38:18 +1000] "-" 408 - "-" "-" 203.54.180.238 - - [07/Sep/2026:12:38:18 +1000] "-" 408 - "-" "-" 203.54.180.238 - - [07/Sep/2026:12:38:18 +1000] "-" 408 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-09-07 12:35:57 L1=3.52 run=4 blk=1 avail=7548 (54.8%) swpO=0 conn=3 myRSS=2387 php=15 phpRSS=1630 ap=53 tcp=63 topuser=madalice 2026-09-07 12:35:57 L1=3.52 run=9 blk=1 avail=7446 (54.0%) swpO=0 conn=5 myRSS=2387 php=18 phpRSS=1825 ap=52 tcp=64 topuser=madalice 2026-09-07 12:36:07 L1=3.37 run=3 blk=1 avail=7540 (54.7%) swpO=0 conn=3 myRSS=2387 php=15 phpRSS=1687 ap=45 tcp=62 topuser=madalice 2026-09-07 12:36:07 L1=3.37 run=3 blk=1 avail=7447 (54.1%) swpO=0 conn=4 myRSS=2387 php=16 phpRSS=1800 ap=46 tcp=62 topuser=madalice 2026-09-07 12:36:17 L1=3.55 run=4 blk=1 avail=7436 (54.0%) swpO=0 conn=4 myRSS=2387 php=19 phpRSS=1796 ap=58 tcp=76 topuser=madalice 2026-09-07 12:36:18 L1=3.55 run=13 blk=1 avail=7384 (53.6%) swpO=0 conn=5 myRSS=2387 php=21 phpRSS=1907 ap=59 tcp=79 topuser=madalice 2026-09-07 12:36:28 L1=3.69 run=3 blk=1 avail=7437 (54.0%) swpO=0 conn=3 myRSS=2388 php=16 phpRSS=1617 ap=68 tcp=70 topuser=madalice 2026-09-07 12:36:28 L1=3.69 run=4 blk=1 avail=7436 (54.0%) swpO=0 conn=3 myRSS=2388 php=16 phpRSS=1657 ap=68 tcp=70 topuser=madalice 2026-09-07 12:36:38 L1=3.66 run=3 blk=1 avail=7460 (54.1%) swpO=0 conn=3 myRSS=2388 php=17 phpRSS=1719 ap=61 tcp=66 topuser=madalice 2026-09-07 12:36:38 L1=3.66 run=4 blk=1 avail=7457 (54.1%) swpO=0 conn=3 myRSS=2388 php=17 phpRSS=1687 ap=61 tcp=65 topuser=madalice 2026-09-07 12:36:48 L1=3.70 run=4 blk=1 avail=7394 (53.7%) swpO=0 conn=4 myRSS=2388 php=16 phpRSS=1812 ap=53 tcp=55 topuser=madalice 2026-09-07 12:36:48 L1=3.70 run=5 blk=1 avail=7391 (53.6%) swpO=0 conn=4 myRSS=2388 php=16 phpRSS=1816 ap=53 tcp=54 topuser=madalice 2026-09-07 12:36:58 L1=3.44 run=9 blk=1 avail=7441 (54.0%) swpO=0 conn=8 myRSS=2388 php=19 phpRSS=1889 ap=49 tcp=60 topuser=madalice 2026-09-07 12:36:58 L1=3.44 run=11 blk=1 avail=7447 (54.1%) swpO=0 conn=8 myRSS=2388 php=19 phpRSS=1878 ap=49 tcp=60 topuser=madalice 2026-09-07 12:37:08 L1=4.04 run=3 blk=1 avail=7532 (54.7%) swpO=0 conn=4 myRSS=2388 php=16 phpRSS=1685 ap=50 tcp=55 topuser=madalice 2026-09-07 12:37:08 L1=4.04 run=5 blk=1 avail=7530 (54.7%) swpO=0 conn=4 myRSS=2388 php=16 phpRSS=1685 ap=50 tcp=55 topuser=madalice 2026-09-07 12:37:18 L1=4.12 run=6 blk=1 avail=7182 (52.1%) swpO=0 conn=6 myRSS=2388 php=17 phpRSS=1943 ap=57 tcp=73 topuser=madalice 2026-09-07 12:37:18 L1=4.12 run=7 blk=1 avail=7173 (52.1%) swpO=0 conn=6 myRSS=2388 php=17 phpRSS=1940 ap=57 tcp=73 topuser=madalice 2026-09-07 12:37:28 L1=3.94 run=4 blk=1 avail=6812 (49.4%) swpO=273 conn=4 myRSS=2384 php=15 phpRSS=1692 ap=149 tcp=76 topuser=madalice 2026-09-07 12:37:28 L1=3.94 run=5 blk=1 avail=6818 (49.5%) swpO=273 conn=4 myRSS=2384 php=15 phpRSS=1707 ap=149 tcp=76 topuser=madalice 2026-09-07 12:37:39 L1=3.87 run=4 blk=1 avail=6868 (49.9%) swpO=188 conn=3 myRSS=2380 php=17 phpRSS=1742 ap=139 tcp=70 topuser=madalice 2026-09-07 12:37:39 L1=3.87 run=4 blk=1 avail=6862 (49.8%) swpO=188 conn=3 myRSS=2380 php=16 phpRSS=1744 ap=139 tcp=70 topuser=madalice 2026-09-07 12:37:49 L1=3.90 run=6 blk=1 avail=6812 (49.4%) swpO=0 conn=6 myRSS=2385 php=16 phpRSS=1869 ap=129 tcp=54 topuser=madalice 2026-09-07 12:37:49 L1=3.90 run=8 blk=1 avail=6810 (49.4%) swpO=0 conn=5 myRSS=2385 php=16 phpRSS=1870 ap=129 tcp=54 topuser=madalice 2026-09-07 12:37:59 L1=4.23 run=8 blk=1 avail=6878 (49.9%) swpO=26 conn=7 myRSS=2386 php=18 phpRSS=1918 ap=119 tcp=93 topuser=madalice 2026-09-07 12:37:59 L1=4.23 run=8 blk=1 avail=6878 (49.9%) swpO=26 conn=7 myRSS=2386 php=18 phpRSS=1918 ap=119 tcp=93 topuser=madalice 2026-09-07 12:38:09 L1=4.74 run=4 blk=1 avail=7140 (51.8%) swpO=0 conn=4 myRSS=2388 php=15 phpRSS=1641 ap=109 tcp=80 topuser=madalice 2026-09-07 12:38:09 L1=4.74 run=4 blk=1 avail=7140 (51.8%) swpO=0 conn=4 myRSS=2388 php=15 phpRSS=1641 ap=109 tcp=80 topuser=madalice 2026-09-07 12:38:19 L1=4.47 run=6 blk=1 avail=7089 (51.5%) swpO=0 conn=6 myRSS=2388 php=17 phpRSS=1809 ap=99 tcp=69 topuser=madalice 2026-09-07 12:38:19 L1=4.47 run=6 blk=1 avail=7088 (51.4%) swpO=0 conn=6 myRSS=2388 php=17 phpRSS=1812 ap=99 tcp=69 topuser=madalice