INCIDENT 2026-09-07 13:22:16 trigger: php_rss=1581MB ================================================================== load: 3.18 3.71 3.65 3/713 3303079 ncpu:10 mem_avail: 7628MB/13777MB (55.4%) swap_used:2615MB swapout:0/s blocked(D):1 running:1 iowait:9.3% steal:0.0% php: 14 procs / 1581MB heaviest user: madalice (10 procs, 1557MB) apache: 50 procs tcp_estab: 54 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2338 madalice 10 1557 root 252 1076 nobody 49 865 netdata 8 247 mailman 20 98 cpanellogin 1 67 wp-toolkit 3 56 dovenull 6 55 evolution 12 46 mailnull 3 31 kurri 2 24 dovecot 3 22 alison 1 14 zabbix 1 11 named 1 7 polkitd 1 6 nscd 1 5 rpc 1 3 dbus 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1557 root 1 23 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6660 MB Active(file): 2911 MB Inactive(file): 3868 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 580 MB CommitLimit: 10984 MB Committed_AS: 9786 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-10:59:51 4936 /usr/bin/imunify-agent-proxy 4109079 root 2-08:37:29 1952 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-08:37:29 52248 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 2394716 7.2 Ssl 1-17:45:46 /usr/sbin/mariadbd 166870 1 netdata 188848 2.6 Ssl 1-10:59:57 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 167871 1 root 166380 0.0 Ss 1-10:59:50 /usr/lib/systemd/systemd-journald 3277845 167896 madalice 162896 9.1 S 06:13 php-fpm: pool madalice_com_au 923652 904997 root 161684 0.1 S 10:52:33 spamd child 3223532 167896 madalice 161528 19.6 S 18:11 php-fpm: pool madalice_com_au 3277848 167896 madalice 160224 9.0 S 06:13 php-fpm: pool madalice_com_au 3277847 167896 madalice 159420 9.0 S 06:13 php-fpm: pool madalice_com_au 3257540 167896 madalice 158788 17.2 S 11:41 php-fpm: pool madalice_com_au 3277843 167896 madalice 158704 8.9 S 06:13 php-fpm: pool madalice_com_au 3257243 167896 madalice 158632 17.3 S 12:01 php-fpm: pool madalice_com_au 3277842 167896 madalice 158624 9.2 S 06:13 php-fpm: pool madalice_com_au 3277844 167896 madalice 158180 9.1 S 06:13 php-fpm: pool madalice_com_au 3277846 167896 madalice 158176 8.9 S 06:13 php-fpm: pool madalice_com_au 923653 904997 root 140184 0.0 S 10:52:32 spamd child 904997 1 root 130716 0.0 Ss 10:59:20 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3041041 1353308 cpanellogin 68956 0.0 S 01:06:03 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 4109105 4109079 root 52248 1.4 Sl 2-08:37:29 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1353308 1 root 39584 0.1 Ss 47-10:41:03 cpsrvd (SSL) - waiting for connections 3303045 1469 root 35656 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3303058 1469 root 35648 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1469 1 root 34816 0.1 Ss 70-03:12:32 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 509236 509098 root 34688 0.0 Sl 10-11:02:37 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 167562 166914 netdata 34680 0.1 Sl 1-10:59:52 /usr/libexec/netdata/plugins.d/go.d.plugin 1 166645 1 wp-toolkit 31464 0.0 Ss 1-11:00:01 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29720 0.0 Ss 10:59:52 lfd - sleeping 1463 1 root 23984 0.0 Ss 70-03:12:32 tailwatchd 167896 1 root 23644 0.0 Ss 1-10:59:49 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3283322 506832 nobody 21652 0.0 S 03:13 /usr/sbin/httpd -k start 3277882 506832 nobody 21608 0.0 S 06:10 /usr/sbin/httpd -k start 3259294 506832 nobody 21492 0.0 S 09:49 /usr/sbin/httpd -k start 3302356 506832 nobody 21204 0.1 S 00:38 /usr/sbin/httpd -k start 3284436 506832 nobody 21100 0.0 S 02:45 /usr/sbin/httpd -k start 3261810 506832 nobody 20776 0.0 S 07:47 /usr/sbin/httpd -k start 3284497 506832 nobody 20664 0.1 S 02:43 /usr/sbin/httpd -k start 3300266 506832 nobody 20580 0.0 S 01:47 /usr/sbin/httpd -k start 3284990 506832 nobody 20548 0.0 S 02:21 /usr/sbin/httpd -k start 3300211 506832 nobody 20464 0.0 S 01:49 /usr/sbin/httpd -k start 3284466 506832 nobody 20432 0.1 S 02:44 /usr/sbin/httpd -k start 3285005 506832 nobody 20340 0.1 S 02:20 /usr/sbin/httpd -k start 3285008 506832 nobody 20224 0.0 S 02:20 /usr/sbin/httpd -k start 3281446 506832 nobody 20004 0.1 S 04:07 /usr/sbin/httpd -k start 3282931 506832 nobody 19916 0.0 S 03:24 /usr/sbin/httpd -k start 3284491 506832 nobody 19900 0.1 S 02:43 /usr/sbin/httpd -k start 3285023 506832 nobody 19888 0.0 S 02:19 /usr/sbin/httpd -k start 3282937 506832 nobody 19856 0.0 S 03:24 /usr/sbin/httpd -k start 3300264 506832 nobody 19848 0.0 S 01:47 /usr/sbin/httpd -k start 3300268 506832 nobody 19712 0.0 S 01:47 /usr/sbin/httpd -k start 3299968 506832 nobody 19640 0.0 S 01:59 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19604 0.0 Ss 1-10:59:50 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3301372 506832 nobody 19564 0.0 S 01:07 /usr/sbin/httpd -k start 3302358 506832 nobody 19468 0.0 S 00:38 /usr/sbin/httpd -k start 3301461 506832 nobody 19408 0.0 S 01:03 /usr/sbin/httpd -k start 3302393 506832 nobody 19168 0.0 S 00:37 /usr/sbin/httpd -k start 3300270 506832 nobody 18704 0.1 S 01:47 /usr/sbin/httpd -k start 3302388 506832 nobody 18680 0.0 S 00:37 /usr/sbin/httpd -k start 3302334 506832 nobody 18652 0.1 S 00:39 /usr/sbin/httpd -k start 3301449 506832 nobody 18452 0.0 S 01:04 /usr/sbin/httpd -k start 3301373 506832 nobody 18304 0.0 S 01:07 /usr/sbin/httpd -k start 3302313 506832 nobody 18260 0.0 S 00:40 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3784134 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 387 corpkicks/corporatekicks.com.au-ssl_log 287 cosgrovecreative/cosgrovecreative.com.au-ssl_log 274 customc/customcentral.com.au-ssl_log 274 coscom/coscom.com.au-ssl_log 273 evolution/portal.evolutionerp.com.au-ssl_log 262 tubesupplies/tubesupplies.com.au 99 candyfabcom/candyfab.com.au-ssl_log 93 tubesupplies/tubesupplies.com.au-ssl_log 92 evolution/app.evolutionerp.com.au-ssl_log 76 madalice/madalice.com.au-ssl_log 76 evolution/legacy.evolutionerp.com.au-ssl_log 44 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 1198 45.148.10.12 426 203.54.180.238 189 84.17.60.251 82 103.104.164.114 76 40.115.94.245 64 185.177.72.24 47 103.104.165.99 44 34.174.70.164 38 182.239.240.254 21 116.91.221.245 8 165.225.233.87 7 180.181.236.49 7 1.145.70.156 5 123.50.137.21 4 40.77.167.241 --- top request paths across all vhosts (last 3 min) --- 159 POST /functions.php 104 GET /factory_session_checker.php 102 POST /blog/ 84 POST /wp/ 84 POST /wordpress/ 68 POST /blog/index.php 66 GET /app/ajax.php 56 POST /wp/index.php 56 POST /wordpress/index.php 53 GET /factory_session_processed_qty.php 53 GET /factory_session_joiner.php 44 GET /wordpress/ 41 GET /index.php 41 GET /heartbeat.php 36 GET /wp/ 34 POST /blog/wp-json/Batch/v1 34 POST /blog/wp-json/batch/v1/ 34 POST /blog/wp-json/batch/v1 34 POST /blog//wp-json/batch/v1 34 POST /blog/wordpress/wp-json/batch/v1 --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 159 POST /functions.php 66 GET /app/ajax.php 34 GET /index.php 15 POST /plugins/csvexporter/plugin.php 15 POST /app/ajax/selectFilter.php 12 POST /quoteditsave.php 12 POST /app/ajax.php 11 POST /jobeditsave.php 10 POST /app/ajax/selectFilterSingle.php 8 POST /clienteditsave.php 5 POST //functions.php 5 POST /dispatchsave.php -- last 10 requests -- 165.225.233.87 - - [07/Sep/2026:13:22:13 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=testTagUpload-2&jobFilter_required=14267%C2%A0%C2%A0%C2%A0%C2%A0Mountfo 103.104.164.114 - - [07/Sep/2026:13:22:13 +1000] "POST /invoiceaddsave.php?call=fetch HTTP/1.1" 200 11519 "https://my.evolutionerp.com.au/index.php?page=invoicereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 103.104.164.114 - - [07/Sep/2026:13:22:13 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvoicereg&call=getUserSetting&caller=ajaxSubmitLocal&seq=13264993570 HTTP/1.1" 200 92 "https://my.evolutionerp.com.au/index.ph 103.104.164.114 - - [07/Sep/2026:13:22:14 +1000] "GET /invoiceaddsave.php?cashSale=1 HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=invoicereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 116.91.221.245 - - [07/Sep/2026:13:22:14 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=4466" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0 182.239.240.254 - - [07/Sep/2026:13:22:14 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 203.54.180.238 - - [07/Sep/2026:13:22:14 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 103.104.164.114 - - [07/Sep/2026:13:22:14 +1000] "GET /index.php?page=invoiceadd&invoiceid=4953 HTTP/1.1" 200 53177 "https://my.evolutionerp.com.au/index.php?page=invoicereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Ap 103.104.164.114 - - [07/Sep/2026:13:22:14 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=17038845137 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/inde 103.104.164.114 - - [07/Sep/2026:13:22:14 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=16504997435 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/ind == corpkicks/corporatekicks.com.au-ssl_log == -- top paths -- 21 POST /wp/ 21 POST /wordpress/ 21 POST /blog/ 14 POST /wp/index.php 14 POST /wordpress/index.php 14 POST /blog/index.php 9 GET /wp/ 9 GET /wordpress/ 8 GET /blog/ 7 POST /wp/wp-json/Batch/v1 7 POST /wp/wp-json/batch/v1/ 7 POST /wp/wp-json/batch/v1 -- last 10 requests -- 45.148.10.12 - - [07/Sep/2026:13:21:49 +1000] "GET /blog/wp/v2/categories HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:21:49 +1000] "GET /blog/?rest_route=/wp/v2/categories HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 45.148.10.12 - - [07/Sep/2026:13:21:50 +1000] "GET /blog/wp/v2/tags HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:21:50 +1000] "GET /blog/?rest_route=/wp/v2/tags HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:21:50 +1000] "GET /blog/wp/v2/posts/999998 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:21:51 +1000] "GET /blog/?rest_route=/wp/v2/posts/999998 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537. 45.148.10.12 - - [07/Sep/2026:13:21:51 +1000] "GET /blog/wp/v2/posts/99999 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:21:51 +1000] "GET /blog/?rest_route=/wp/v2/posts/99999 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 45.148.10.12 - - [07/Sep/2026:13:21:52 +1000] "GET /blog/wp/v2/posts/9999999 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:21:52 +1000] "GET /blog/?rest_route=/wp/v2/posts/9999999 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537 == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 21 POST /wp/ 21 POST /wordpress/ 21 POST /blog/ 14 POST /wp/index.php 14 POST /wordpress/index.php 14 POST /blog/index.php 9 GET /wp/ 9 GET /wordpress/ 7 POST /wp/wp-json/Batch/v1 7 POST /wp/wp-json/batch/v1/ 7 POST /wp/wp-json/batch/v1 7 POST /wp//wp-json/batch/v1 -- last 10 requests -- 45.148.10.12 - - [07/Sep/2026:13:21:40 +1000] "POST /blog//wp-json/batch/v1 HTTP/1.1" 401 53 "https://cpcalendars.cosgrovecreative.com.au/blog/wp-admin/" "WordPress/6.4.3" 45.148.10.12 - - [07/Sep/2026:13:21:40 +1000] "POST /blog/wp-json/batch/v1/ HTTP/1.1" 401 53 "https://cpcalendars.cosgrovecreative.com.au/blog/wp-admin/" "WordPress/6.4.3" 45.148.10.12 - - [07/Sep/2026:13:21:41 +1000] "POST /blog/blog/wp-json/batch/v1 HTTP/1.1" 401 53 "https://cpcalendars.cosgrovecreative.com.au/blog/wp-admin/" "WordPress/6.4.3" 45.148.10.12 - - [07/Sep/2026:13:21:41 +1000] "POST /blog/wordpress/wp-json/batch/v1 HTTP/1.1" 401 53 "https://cpcalendars.cosgrovecreative.com.au/blog/wp-admin/" "WordPress/6.4.3" 45.148.10.12 - - [07/Sep/2026:13:21:41 +1000] "GET /blog/wp/v2/posts/999999 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:21:42 +1000] "GET /blog/?rest_route=/wp/v2/posts/999999 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537. 45.148.10.12 - - [07/Sep/2026:13:21:42 +1000] "GET /blog/wp/v2/pages HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:21:44 +1000] "GET /blog/?rest_route=/wp/v2/pages HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:21:44 +1000] "GET /blog/wp/v2/media HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:21:45 +1000] "GET /blog/?rest_route=/wp/v2/media HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-07 13:19:54 L1=3.64 run=2 blk=1 avail=7618 (55.3%) swpO=0 conn=3 myRSS=2342 php=15 phpRSS=1623 ap=49 tcp=60 topuser=madalice 2026-09-07 13:19:55 L1=3.64 run=4 blk=1 avail=7546 (54.8%) swpO=0 conn=4 myRSS=2342 php=16 phpRSS=1709 ap=50 tcp=59 topuser=madalice 2026-09-07 13:20:04 L1=3.39 run=5 blk=1 avail=7370 (53.5%) swpO=0 conn=5 myRSS=2342 php=16 phpRSS=1836 ap=59 tcp=57 topuser=madalice 2026-09-07 13:20:05 L1=3.39 run=4 blk=1 avail=7415 (53.8%) swpO=0 conn=2 myRSS=2342 php=15 phpRSS=1697 ap=58 tcp=61 topuser=madalice 2026-09-07 13:20:15 L1=3.78 run=6 blk=1 avail=7462 (54.2%) swpO=1 conn=5 myRSS=2342 php=17 phpRSS=1791 ap=55 tcp=51 topuser=madalice 2026-09-07 13:20:15 L1=3.78 run=6 blk=1 avail=7540 (54.7%) swpO=2 conn=4 myRSS=2342 php=16 phpRSS=1667 ap=54 tcp=52 topuser=madalice 2026-09-07 13:20:25 L1=3.74 run=2 blk=1 avail=7561 (54.9%) swpO=0 conn=2 myRSS=2342 php=15 phpRSS=1639 ap=50 tcp=49 topuser=madalice 2026-09-07 13:20:25 L1=3.74 run=2 blk=1 avail=7612 (55.3%) swpO=0 conn=2 myRSS=2342 php=14 phpRSS=1583 ap=50 tcp=49 topuser=madalice 2026-09-07 13:20:35 L1=3.62 run=7 blk=1 avail=7374 (53.5%) swpO=0 conn=3 myRSS=2342 php=15 phpRSS=1640 ap=76 tcp=60 topuser=madalice 2026-09-07 13:20:35 L1=3.62 run=5 blk=1 avail=7360 (53.4%) swpO=0 conn=3 myRSS=2342 php=17 phpRSS=1733 ap=76 tcp=60 topuser=madalice 2026-09-07 13:20:45 L1=3.53 run=2 blk=1 avail=7451 (54.1%) swpO=0 conn=2 myRSS=2342 php=14 phpRSS=1624 ap=66 tcp=51 topuser=madalice 2026-09-07 13:20:45 L1=3.53 run=5 blk=1 avail=7428 (53.9%) swpO=0 conn=2 myRSS=2342 php=14 phpRSS=1643 ap=66 tcp=51 topuser=madalice 2026-09-07 13:20:55 L1=3.61 run=2 blk=1 avail=7544 (54.8%) swpO=0 conn=1 myRSS=2342 php=14 phpRSS=1581 ap=56 tcp=57 topuser=madalice 2026-09-07 13:20:55 L1=3.61 run=4 blk=1 avail=7553 (54.8%) swpO=0 conn=2 myRSS=2342 php=14 phpRSS=1583 ap=56 tcp=59 topuser=madalice 2026-09-07 13:21:05 L1=3.52 run=9 blk=1 avail=7500 (54.4%) swpO=0 conn=2 myRSS=2342 php=15 phpRSS=1654 ap=46 tcp=57 topuser=madalice 2026-09-07 13:21:05 L1=3.52 run=3 blk=1 avail=7555 (54.8%) swpO=0 conn=2 myRSS=2342 php=15 phpRSS=1670 ap=46 tcp=56 topuser=madalice 2026-09-07 13:21:15 L1=3.84 run=2 blk=1 avail=7586 (55.1%) swpO=171 conn=2 myRSS=2338 php=15 phpRSS=1612 ap=56 tcp=62 topuser=madalice 2026-09-07 13:21:15 L1=3.84 run=4 blk=1 avail=7580 (55.0%) swpO=171 conn=2 myRSS=2338 php=14 phpRSS=1589 ap=56 tcp=62 topuser=madalice 2026-09-07 13:21:26 L1=3.55 run=6 blk=1 avail=7537 (54.7%) swpO=0 conn=3 myRSS=2338 php=15 phpRSS=1636 ap=50 tcp=54 topuser=madalice 2026-09-07 13:21:26 L1=3.55 run=3 blk=1 avail=7516 (54.6%) swpO=0 conn=3 myRSS=2338 php=15 phpRSS=1640 ap=50 tcp=54 topuser=madalice 2026-09-07 13:21:36 L1=3.38 run=2 blk=1 avail=7602 (55.2%) swpO=1 conn=2 myRSS=2338 php=14 phpRSS=1606 ap=47 tcp=79 topuser=madalice 2026-09-07 13:21:36 L1=3.38 run=2 blk=1 avail=7565 (54.9%) swpO=1 conn=2 myRSS=2338 php=14 phpRSS=1631 ap=47 tcp=75 topuser=madalice 2026-09-07 13:21:46 L1=3.33 run=3 blk=1 avail=7373 (53.5%) swpO=1 conn=3 myRSS=2338 php=15 phpRSS=1682 ap=74 tcp=71 topuser=madalice 2026-09-07 13:21:46 L1=3.33 run=5 blk=1 avail=7345 (53.3%) swpO=1 conn=3 myRSS=2338 php=15 phpRSS=1713 ap=74 tcp=73 topuser=madalice 2026-09-07 13:21:56 L1=3.43 run=4 blk=1 avail=7532 (54.7%) swpO=0 conn=2 myRSS=2338 php=14 phpRSS=1584 ap=64 tcp=58 topuser=madalice 2026-09-07 13:21:56 L1=3.43 run=2 blk=1 avail=7530 (54.7%) swpO=0 conn=2 myRSS=2338 php=14 phpRSS=1587 ap=63 tcp=52 topuser=madalice 2026-09-07 13:22:06 L1=3.30 run=2 blk=1 avail=7520 (54.6%) swpO=0 conn=1 myRSS=2338 php=14 phpRSS=1671 ap=54 tcp=58 topuser=madalice 2026-09-07 13:22:06 L1=3.30 run=1 blk=1 avail=7609 (55.2%) swpO=0 conn=1 myRSS=2338 php=14 phpRSS=1579 ap=53 tcp=58 topuser=madalice 2026-09-07 13:22:16 L1=3.18 run=1 blk=1 avail=7628 (55.4%) swpO=0 conn=1 myRSS=2338 php=14 phpRSS=1581 ap=50 tcp=54 topuser=madalice 2026-09-07 13:22:16 L1=3.18 run=2 blk=1 avail=7620 (55.3%) swpO=0 conn=1 myRSS=2338 php=15 phpRSS=1607 ap=50 tcp=54 topuser=madalice