INCIDENT 2026-09-07 12:39:19 trigger: php_rss=1650MB ================================================================== load: 3.92 3.83 3.57 3/715 3124665 ncpu:10 mem_avail: 7550MB/13777MB (54.8%) swap_used:2521MB swapout:0/s blocked(D):1 running:2 iowait:8.3% steal:0.0% php: 15 procs / 1650MB heaviest user: madalice (10 procs, 1587MB) apache: 54 procs tcp_estab: 56 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2388 madalice 10 1588 root 248 1019 nobody 53 941 netdata 8 243 mailman 20 98 alison 5 69 wp-toolkit 3 56 dovenull 6 55 evolution 12 49 cpanellogin 1 23 dovecot 3 22 zabbix 1 11 mailnull 1 10 kurri 1 9 named 1 8 polkitd 1 6 nscd 1 5 rpc 1 3 dbus 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1588 evolution 5 42 root 1 23 tubesupplies 1 12 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6326 MB Active(file): 3500 MB Inactive(file): 2962 MB Dirty: 4 MB Writeback: 0 MB SReclaimable: 585 MB CommitLimit: 10984 MB Committed_AS: 9927 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-10:16:54 5164 /usr/bin/imunify-agent-proxy 4109079 root 2-07:54:32 1960 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-07:54:32 72456 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 2446276 6.7 Ssl 1-17:02:49 /usr/sbin/mariadbd 166870 1 netdata 184128 2.6 Ssl 1-10:17:00 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3082701 167896 madalice 180184 14.7 R 10:05 php-fpm: pool madalice_com_au 3082876 167896 madalice 163536 14.8 S 09:57 php-fpm: pool madalice_com_au 3099827 167896 madalice 163420 9.9 S 07:08 php-fpm: pool madalice_com_au 3099837 167896 madalice 163192 10.2 S 07:07 php-fpm: pool madalice_com_au 3059435 167896 madalice 162996 20.5 S 18:19 php-fpm: pool madalice_com_au 167871 1 root 161528 0.0 Ss 1-10:16:53 /usr/lib/systemd/systemd-journald 3099833 167896 madalice 160784 10.1 S 07:08 php-fpm: pool madalice_com_au 3100181 167896 madalice 160532 9.7 S 07:03 php-fpm: pool madalice_com_au 3099826 167896 madalice 160472 10.2 S 07:08 php-fpm: pool madalice_com_au 3100180 167896 madalice 160448 9.7 S 07:03 php-fpm: pool madalice_com_au 3099828 167896 madalice 160188 9.9 S 07:08 php-fpm: pool madalice_com_au 923652 904997 root 158172 0.1 S 10:09:36 spamd child 923653 904997 root 141908 0.0 S 10:09:35 spamd child 904997 1 root 130724 0.0 Ss 10:16:23 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4109105 4109079 root 72456 1.4 Sl 2-07:54:32 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1353308 1 root 42424 0.1 Ss 47-09:58:06 cpsrvd (SSL) - waiting for connections 3124623 3100965 evolution 40424 2.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 40308 0.1 Ss 70-02:29:35 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 167562 166914 netdata 35412 0.1 Sl 1-10:16:55 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 35056 0.0 Sl 10-10:19:40 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166645 1 wp-toolkit 31496 0.0 Ss 1-10:17:04 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29764 0.0 Ss 10:16:55 lfd - sleeping 3124670 3099888 evolution 26632 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3041041 1353308 cpanellogin 24468 0.0 S 23:06 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 1463 1 root 23712 0.0 Ss 70-02:29:35 tailwatchd 167896 1 root 23688 0.0 Ss 1-10:16:52 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3120972 506832 nobody 22976 0.1 S 02:10 /usr/sbin/httpd -k start 3100919 506832 nobody 21988 0.0 S 06:21 /usr/sbin/httpd -k start 3121664 506832 nobody 21756 0.1 S 01:59 /usr/sbin/httpd -k start 3119636 506832 nobody 21120 0.0 S 03:09 /usr/sbin/httpd -k start 3099888 506832 nobody 20912 0.1 S 07:05 /usr/sbin/httpd -k start 3121671 506832 nobody 20896 0.1 S 01:59 /usr/sbin/httpd -k start 3121651 506832 nobody 20636 0.1 S 02:00 /usr/sbin/httpd -k start 3121692 506832 nobody 20516 0.0 S 01:58 /usr/sbin/httpd -k start 3100977 506832 nobody 20344 0.0 S 06:20 /usr/sbin/httpd -k start 3100965 506832 nobody 20312 0.0 S 06:20 /usr/sbin/httpd -k start 3121745 506832 nobody 20256 0.0 S 01:57 /usr/sbin/httpd -k start 3121717 506832 nobody 20204 0.0 S 01:58 /usr/sbin/httpd -k start 3121545 506832 nobody 20132 0.1 S 02:01 /usr/sbin/httpd -k start 3100940 506832 nobody 20096 0.0 S 06:21 /usr/sbin/httpd -k start 3121073 506832 nobody 20020 0.0 S 02:03 /usr/sbin/httpd -k start 3120986 506832 nobody 19964 0.0 S 02:09 /usr/sbin/httpd -k start 3121696 506832 nobody 19956 0.0 S 01:58 /usr/sbin/httpd -k start 3121778 506832 nobody 19924 0.0 S 01:56 /usr/sbin/httpd -k start 3118793 506832 nobody 19836 0.0 S 03:55 /usr/sbin/httpd -k start 3121748 506832 nobody 19820 0.0 S 01:57 /usr/sbin/httpd -k start 3121697 506832 nobody 19804 0.0 S 01:58 /usr/sbin/httpd -k start 3121747 506832 nobody 19792 0.0 S 01:57 /usr/sbin/httpd -k start 3121673 506832 nobody 19692 0.0 S 01:59 /usr/sbin/httpd -k start 3119616 506832 nobody 19684 0.0 S 03:10 /usr/sbin/httpd -k start 3121749 506832 nobody 19668 0.0 S 01:57 /usr/sbin/httpd -k start 3121546 506832 nobody 19616 0.0 S 02:01 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19568 0.0 Ss 1-10:16:53 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3121544 506832 nobody 19356 0.0 S 02:01 /usr/sbin/httpd -k start 3121715 506832 nobody 19340 0.0 S 01:58 /usr/sbin/httpd -k start 3121700 506832 nobody 19020 0.0 S 01:58 /usr/sbin/httpd -k start 3121735 506832 nobody 18940 0.0 S 01:57 /usr/sbin/httpd -k start 3121667 506832 nobody 18888 0.0 S 01:59 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3456279 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 839 whiz/whizengineering.com.au-ssl_log 261 aaa/aaadownunder.com.au-ssl_log 258 evolution/portal.evolutionerp.com.au-ssl_log 218 alison/alisonarts.com.au-ssl_log 125 evolution/app.evolutionerp.com.au-ssl_log 120 tubesupplies/tubesupplies.com.au 116 madalice/madalice.com.au-ssl_log 113 tubesupplies/tubesupplies.com.au-ssl_log 109 customc/customcentral.com.au-ssl_log 15 corpkicks/corporatekicks.com.au-ssl_log 3 (total vhosts taking traffic: 11) --- top client IPs across all vhosts (last 3 min) --- 476 203.54.180.238 358 45.148.10.12 261 34.166.204.109 223 84.17.60.251 177 1.152.23.77 120 40.115.94.245 118 116.91.221.245 92 103.104.165.99 73 185.177.72.24 56 1.145.70.156 46 182.239.240.254 42 1.144.107.82 37 2405:6e00:c12:b029:6bdc:4bbd:51cf:b89a 20 101.166.96.210 15 180.181.236.49 --- top request paths across all vhosts (last 3 min) --- 314 POST /functions.php 185 GET /app/ajax.php 113 GET /index.php 80 GET /factory_session_checker.php 49 GET /heartbeat.php 45 GET /logoff.php 44 POST / 42 POST /plugins/csvexporter/plugin.php 40 GET /factory_session_processed_qty.php 40 GET /factory_session_joiner.php 22 GET /api/getItem/LWHG2001KG 21 POST /wp/ 21 POST /wordpress/ 20 POST /app/ajax.php 19 GET / 18 POST /app/ajax/selectFilterSingle.php 15 POST /app/ajax/selectFilter.php 14 POST /wp/index.php 14 POST /wordpress/wp-json/batch/v1 14 POST /wordpress/index.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 314 POST /functions.php 185 GET /app/ajax.php 108 GET /index.php 45 GET /logoff.php 42 POST /plugins/csvexporter/plugin.php 20 POST /app/ajax.php 18 POST /app/ajax/selectFilterSingle.php 15 POST /app/ajax/selectFilter.php 12 POST /inveditsave.php 12 POST /clienteditsave.php 7 POST //functions.php 6 POST /logsave.php -- last 10 requests -- 203.54.180.238 - - [07/Sep/2026:12:39:16 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:12:39:16 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29491&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [07/Sep/2026:12:39:16 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinventory&call=getUserSetting&caller=ajaxSubmitLocal&seq=12693492436 HTTP/1.1" 200 91 "https://my.evolutionerp.com.au/index.php? 103.104.165.99 - - [07/Sep/2026:12:39:17 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 52 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37011" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 1.144.107.82 - - [07/Sep/2026:12:39:17 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=plugins&id=24&action=setting" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 203.54.180.238 - - [07/Sep/2026:12:39:17 +1000] "POST /inveditsave.php?call=fetch_inventory HTTP/1.1" 200 3000 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 203.54.180.238 - - [07/Sep/2026:12:39:18 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79170" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 116.91.221.245 - - [07/Sep/2026:12:39:18 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2039" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:15 203.54.180.238 - - [07/Sep/2026:12:39:18 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 203.166.236.147 - - [07/Sep/2026:12:39:19 +1000] "GET /modalload.php?key=quoteainotes&id=37110 HTTP/1.1" 200 4848 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37110§ionid=0" "Mozilla/5.0 (Windows N == whiz/whizengineering.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env -- last 10 requests -- 34.166.204.109 - - [07/Sep/2026:12:38:49 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.204.109 - - [07/Sep/2026:12:38:49 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.204.109 - - [07/Sep/2026:12:38:49 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.204.109 - - [07/Sep/2026:12:38:50 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.204.109 - - [07/Sep/2026:12:38:50 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.204.109 - - [07/Sep/2026:12:38:50 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.204.109 - - [07/Sep/2026:12:38:50 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.204.109 - - [07/Sep/2026:12:38:51 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.204.109 - - [07/Sep/2026:12:38:51 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.204.109 - - [07/Sep/2026:12:38:51 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 21 POST /wp/ 21 POST /wordpress/ 14 POST /wp/index.php 14 POST /wordpress/index.php 14 POST /account 10 POST /dashboard 9 GET /wp/ 8 POST /admin 7 POST /wp/wp-json/Batch/v1 7 POST /wp/wp-json/batch/v1/ 7 POST /wp/wp-json/batch/v1 7 POST /wp//wp-json/batch/v1 -- last 10 requests -- 45.148.10.12 - - [07/Sep/2026:12:39:17 +1000] "GET /wordpress/wp/v2/pages HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:12:39:17 +1000] "GET /wordpress/?rest_route=/wp/v2/pages HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537. 45.148.10.12 - - [07/Sep/2026:12:39:17 +1000] "GET /wordpress/wp/v2/media HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:12:39:18 +1000] "GET /wordpress/?rest_route=/wp/v2/media HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537. 203.54.180.238 - - [07/Sep/2026:12:39:18 +1000] "-" 408 - "-" "-" 203.54.180.238 - - [07/Sep/2026:12:39:18 +1000] "-" 408 - "-" "-" 203.54.180.238 - - [07/Sep/2026:12:39:18 +1000] "-" 408 - "-" "-" 45.148.10.12 - - [07/Sep/2026:12:39:18 +1000] "GET /wordpress/wp/v2/categories HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:12:39:18 +1000] "GET /wordpress/?rest_route=/wp/v2/categories HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari 45.148.10.12 - - [07/Sep/2026:12:39:19 +1000] "GET /wordpress/wp/v2/tags HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-07 12:36:58 L1=3.44 run=9 blk=1 avail=7441 (54.0%) swpO=0 conn=8 myRSS=2388 php=19 phpRSS=1889 ap=49 tcp=60 topuser=madalice 2026-09-07 12:36:58 L1=3.44 run=11 blk=1 avail=7447 (54.1%) swpO=0 conn=8 myRSS=2388 php=19 phpRSS=1878 ap=49 tcp=60 topuser=madalice 2026-09-07 12:37:08 L1=4.04 run=3 blk=1 avail=7532 (54.7%) swpO=0 conn=4 myRSS=2388 php=16 phpRSS=1685 ap=50 tcp=55 topuser=madalice 2026-09-07 12:37:08 L1=4.04 run=5 blk=1 avail=7530 (54.7%) swpO=0 conn=4 myRSS=2388 php=16 phpRSS=1685 ap=50 tcp=55 topuser=madalice 2026-09-07 12:37:18 L1=4.12 run=6 blk=1 avail=7182 (52.1%) swpO=0 conn=6 myRSS=2388 php=17 phpRSS=1943 ap=57 tcp=73 topuser=madalice 2026-09-07 12:37:18 L1=4.12 run=7 blk=1 avail=7173 (52.1%) swpO=0 conn=6 myRSS=2388 php=17 phpRSS=1940 ap=57 tcp=73 topuser=madalice 2026-09-07 12:37:28 L1=3.94 run=4 blk=1 avail=6812 (49.4%) swpO=273 conn=4 myRSS=2384 php=15 phpRSS=1692 ap=149 tcp=76 topuser=madalice 2026-09-07 12:37:28 L1=3.94 run=5 blk=1 avail=6818 (49.5%) swpO=273 conn=4 myRSS=2384 php=15 phpRSS=1707 ap=149 tcp=76 topuser=madalice 2026-09-07 12:37:39 L1=3.87 run=4 blk=1 avail=6868 (49.9%) swpO=188 conn=3 myRSS=2380 php=17 phpRSS=1742 ap=139 tcp=70 topuser=madalice 2026-09-07 12:37:39 L1=3.87 run=4 blk=1 avail=6862 (49.8%) swpO=188 conn=3 myRSS=2380 php=16 phpRSS=1744 ap=139 tcp=70 topuser=madalice 2026-09-07 12:37:49 L1=3.90 run=6 blk=1 avail=6812 (49.4%) swpO=0 conn=6 myRSS=2385 php=16 phpRSS=1869 ap=129 tcp=54 topuser=madalice 2026-09-07 12:37:49 L1=3.90 run=8 blk=1 avail=6810 (49.4%) swpO=0 conn=5 myRSS=2385 php=16 phpRSS=1870 ap=129 tcp=54 topuser=madalice 2026-09-07 12:37:59 L1=4.23 run=8 blk=1 avail=6878 (49.9%) swpO=26 conn=7 myRSS=2386 php=18 phpRSS=1918 ap=119 tcp=93 topuser=madalice 2026-09-07 12:37:59 L1=4.23 run=8 blk=1 avail=6878 (49.9%) swpO=26 conn=7 myRSS=2386 php=18 phpRSS=1918 ap=119 tcp=93 topuser=madalice 2026-09-07 12:38:09 L1=4.74 run=4 blk=1 avail=7140 (51.8%) swpO=0 conn=4 myRSS=2388 php=15 phpRSS=1641 ap=109 tcp=80 topuser=madalice 2026-09-07 12:38:09 L1=4.74 run=4 blk=1 avail=7140 (51.8%) swpO=0 conn=4 myRSS=2388 php=15 phpRSS=1641 ap=109 tcp=80 topuser=madalice 2026-09-07 12:38:19 L1=4.47 run=6 blk=1 avail=7089 (51.5%) swpO=0 conn=6 myRSS=2388 php=17 phpRSS=1809 ap=99 tcp=69 topuser=madalice 2026-09-07 12:38:19 L1=4.47 run=6 blk=1 avail=7088 (51.4%) swpO=0 conn=6 myRSS=2388 php=17 phpRSS=1812 ap=99 tcp=69 topuser=madalice 2026-09-07 12:38:29 L1=4.10 run=4 blk=1 avail=7240 (52.5%) swpO=0 conn=4 myRSS=2388 php=16 phpRSS=1692 ap=89 tcp=65 topuser=madalice 2026-09-07 12:38:29 L1=4.10 run=2 blk=1 avail=7191 (52.2%) swpO=0 conn=4 myRSS=2388 php=16 phpRSS=1743 ap=89 tcp=67 topuser=madalice 2026-09-07 12:38:39 L1=3.94 run=3 blk=1 avail=7339 (53.3%) swpO=0 conn=4 myRSS=2388 php=16 phpRSS=1692 ap=79 tcp=51 topuser=madalice 2026-09-07 12:38:39 L1=3.94 run=3 blk=1 avail=7288 (52.9%) swpO=0 conn=4 myRSS=2388 php=17 phpRSS=1777 ap=79 tcp=52 topuser=madalice 2026-09-07 12:38:49 L1=4.11 run=2 blk=1 avail=7463 (54.2%) swpO=0 conn=3 myRSS=2388 php=15 phpRSS=1627 ap=69 tcp=56 topuser=madalice 2026-09-07 12:38:49 L1=4.11 run=4 blk=1 avail=7443 (54.0%) swpO=0 conn=3 myRSS=2388 php=15 phpRSS=1640 ap=69 tcp=55 topuser=madalice 2026-09-07 12:38:59 L1=3.87 run=4 blk=1 avail=7376 (53.5%) swpO=0 conn=3 myRSS=2388 php=15 phpRSS=1769 ap=59 tcp=61 topuser=madalice 2026-09-07 12:38:59 L1=3.87 run=2 blk=1 avail=7525 (54.6%) swpO=0 conn=2 myRSS=2388 php=15 phpRSS=1636 ap=59 tcp=61 topuser=madalice 2026-09-07 12:39:09 L1=3.90 run=3 blk=1 avail=7566 (54.9%) swpO=0 conn=4 myRSS=2388 php=15 phpRSS=1631 ap=54 tcp=70 topuser=madalice 2026-09-07 12:39:10 L1=3.90 run=3 blk=1 avail=7475 (54.3%) swpO=0 conn=3 myRSS=2388 php=15 phpRSS=1725 ap=54 tcp=69 topuser=madalice 2026-09-07 12:39:19 L1=3.92 run=2 blk=1 avail=7550 (54.8%) swpO=0 conn=3 myRSS=2388 php=15 phpRSS=1650 ap=54 tcp=56 topuser=madalice 2026-09-07 12:39:20 L1=3.92 run=3 blk=1 avail=7514 (54.5%) swpO=0 conn=2 myRSS=2388 php=14 phpRSS=1657 ap=54 tcp=53 topuser=madalice