INCIDENT 2026-09-07 13:26:28 trigger: php_rss=1695MB ================================================================== load: 3.11 3.31 3.49 2/714 3322497 ncpu:10 mem_avail: 7590MB/13777MB (55.1%) swap_used:2648MB swapout:1/s blocked(D):1 running:2 iowait:8.9% steal:0.0% php: 15 procs / 1695MB heaviest user: madalice (10 procs, 1631MB) apache: 48 procs tcp_estab: 56 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2314 madalice 10 1641 root 250 1007 nobody 47 831 netdata 8 243 mailman 20 98 cpanellogin 1 67 wp-toolkit 3 56 dovenull 6 55 evolution 12 50 candyfabcom 2 28 kurri 2 24 dovecot 3 22 mailnull 2 17 alison 1 14 lowrange 1 13 zabbix 1 10 named 1 7 polkitd 1 6 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1641 evolution 4 40 root 1 23 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6921 MB Active(file): 3372 MB Inactive(file): 3651 MB Dirty: 2 MB Writeback: 0 MB SReclaimable: 580 MB CommitLimit: 10984 MB Committed_AS: 9874 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-11:04:03 4936 /usr/bin/imunify-agent-proxy 4109079 root 2-08:41:41 1952 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-08:41:41 52112 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 2369820 7.2 Ssl 1-17:49:58 /usr/sbin/mariadbd 3257243 167896 madalice 251760 14.8 S 16:13 php-fpm: pool madalice_com_au 166870 1 netdata 184760 2.6 Ssl 1-11:04:09 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 167871 1 root 165304 0.0 Ss 1-11:04:02 /usr/lib/systemd/systemd-journald 3277845 167896 madalice 163456 8.3 S 10:25 php-fpm: pool madalice_com_au 923652 904997 root 161580 0.1 S 10:56:45 spamd child 3320986 167896 madalice 159704 7.4 S 01:18 php-fpm: pool madalice_com_au 3277844 167896 madalice 159452 8.5 S 10:25 php-fpm: pool madalice_com_au 3277843 167896 madalice 158656 8.3 S 10:25 php-fpm: pool madalice_com_au 3277848 167896 madalice 158568 8.3 S 10:25 php-fpm: pool madalice_com_au 3257540 167896 madalice 158564 14.8 S 15:53 php-fpm: pool madalice_com_au 3277847 167896 madalice 158544 8.4 S 10:25 php-fpm: pool madalice_com_au 3277842 167896 madalice 158256 8.6 S 10:25 php-fpm: pool madalice_com_au 3277846 167896 madalice 158044 8.5 S 10:25 php-fpm: pool madalice_com_au 923653 904997 root 136764 0.0 S 10:56:44 spamd child 904997 1 root 130716 0.0 Ss 11:03:32 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3041041 1353308 cpanellogin 68788 0.0 S 01:10:15 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 4109105 4109079 root 52112 1.4 Sl 2-08:41:41 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 3322461 3322075 evolution 41460 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 38064 0.1 Ss 47-10:45:15 cpsrvd (SSL) - waiting for connections 3322530 1469 root 35292 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 167562 166914 netdata 34672 0.1 Sl 1-11:04:04 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 34636 0.0 Sl 10-11:06:49 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 34328 0.1 Ss 70-03:16:44 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 166645 1 wp-toolkit 31464 0.0 Ss 1-11:04:13 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29800 0.0 Ss 11:04:04 lfd - sleeping 1463 1 root 23976 0.0 Ss 70-03:16:44 tailwatchd 167896 1 root 23640 0.0 Ss 1-11:04:01 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3284466 506832 nobody 22412 0.1 S 06:56 /usr/sbin/httpd -k start 3303710 506832 nobody 21444 0.1 S 03:51 /usr/sbin/httpd -k start 3304890 506832 nobody 21352 0.2 S 02:43 /usr/sbin/httpd -k start 3303603 506832 nobody 21336 0.0 S 03:55 /usr/sbin/httpd -k start 3300270 506832 nobody 21284 0.0 S 05:59 /usr/sbin/httpd -k start 3303562 506832 nobody 20992 0.1 S 03:58 /usr/sbin/httpd -k start 3261810 506832 nobody 20896 0.0 S 11:59 /usr/sbin/httpd -k start 3301318 506832 nobody 20896 0.0 S 05:21 /usr/sbin/httpd -k start 3304871 506832 nobody 20772 0.0 S 02:44 /usr/sbin/httpd -k start 3302388 506832 nobody 20696 0.0 S 04:49 /usr/sbin/httpd -k start 3304872 506832 nobody 20636 0.1 S 02:44 /usr/sbin/httpd -k start 3304825 506832 nobody 20372 0.0 S 02:48 /usr/sbin/httpd -k start 3304177 506832 nobody 20308 0.0 S 03:18 /usr/sbin/httpd -k start 3306212 506832 nobody 20104 0.1 S 01:51 /usr/sbin/httpd -k start 3321053 506832 nobody 20088 0.0 S 01:14 /usr/sbin/httpd -k start 3304824 506832 nobody 20040 0.0 S 02:48 /usr/sbin/httpd -k start 3303638 506832 nobody 19924 0.0 S 03:53 /usr/sbin/httpd -k start 3320988 506832 nobody 19912 0.1 S 01:18 /usr/sbin/httpd -k start 3306724 506832 nobody 19876 0.0 S 01:27 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19600 0.0 Ss 1-11:04:02 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3304184 506832 nobody 19560 0.0 S 03:17 /usr/sbin/httpd -k start 3320989 506832 nobody 19472 0.1 S 01:18 /usr/sbin/httpd -k start 3321037 506832 nobody 19368 0.1 S 01:15 /usr/sbin/httpd -k start 3321921 506832 nobody 19368 0.1 S 00:32 /usr/sbin/httpd -k start 3304853 506832 nobody 19260 0.0 S 02:46 /usr/sbin/httpd -k start 3321000 506832 nobody 18956 0.0 S 01:17 /usr/sbin/httpd -k start 3322162 506832 nobody 18628 0.1 S 00:20 /usr/sbin/httpd -k start 3322164 506832 nobody 18172 0.1 S 00:20 /usr/sbin/httpd -k start 167566 166914 netdata 18124 2.1 Sl 1-11:04:04 /usr/libexec/netdata/plugins.d/apps.plugin 1 3322165 506832 nobody 18112 0.1 S 00:20 /usr/sbin/httpd -k start 3322166 506832 nobody 18068 0.1 S 00:20 /usr/sbin/httpd -k start 3307428 506832 nobody 17980 0.1 S 01:26 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3814366 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 563 evolution/portal.evolutionerp.com.au-ssl_log 224 infinium/infinium.net.au-ssl_log 156 kamcool/kamcool.com.au-ssl_log 135 evolution/app.evolutionerp.com.au-ssl_log 120 madalice/madalice.com.au-ssl_log 94 aaa/aaadownunder.com.au-ssl_log 10 customc/customcentral.com.au-ssl_log 4 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 442 203.54.180.238 291 45.148.10.12 120 40.115.94.245 117 103.104.165.99 86 185.177.72.24 83 103.104.164.114 80 116.91.221.245 53 182.239.240.254 6 180.181.236.49 4 45.148.10.9 4 114.119.143.14 3 1.145.70.156 2 40.77.167.116 2 207.46.13.14 2 165.225.233.87 --- top request paths across all vhosts (last 3 min) --- 209 POST /functions.php 118 GET /api/getItem/LWHG2001KG 114 GET /app/ajax.php 83 GET /factory_session_checker.php 72 POST / 56 GET /heartbeat.php 52 GET /index.php 42 GET /factory_session_processed_qty.php 42 GET /factory_session_joiner.php 34 GET / 31 POST /plugins/csvexporter/plugin.php 25 POST /clienteditsave.php 24 POST /index.php 19 POST /app/ajax/selectFilterSingle.php 18 POST /app/ajax.php 15 POST /login 15 POST /invaddsave.php 13 POST /wp-json/batch/v1 12 POST /wordpress/wp-json/batch/v1 12 POST /app/ajax/selectFilter.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 209 POST /functions.php 114 GET /app/ajax.php 49 GET /index.php 31 POST /plugins/csvexporter/plugin.php 25 POST /clienteditsave.php 19 POST /app/ajax/selectFilterSingle.php 18 POST /app/ajax.php 15 POST /invaddsave.php 12 POST /app/ajax/selectFilter.php 11 POST /logsave.php 8 POST /jobeditsave.php 6 POST /purchaseaddsave.php -- last 10 requests -- 203.54.180.238 - - [07/Sep/2026:13:26:24 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 9757 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:13:26:25 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 491 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 203.54.180.238 - - [07/Sep/2026:13:26:22 +1000] "GET //index.php?page=jobedit&id=29605&tab=quotestab HTTP/1.1" 200 183266 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29605&tab=quotestab" "Mozilla/5.0 (Windo 203.54.180.238 - - [07/Sep/2026:13:26:24 +1000] "POST //clienteditsave.php?clientid=14039&call=getCategoryDiscounts HTTP/1.1" 200 208 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=29605&tab=quotestab" "Mozil 203.54.180.238 - - [07/Sep/2026:13:26:23 +1000] "POST //logsave.php?call=getHistory&id=29605&module=job HTTP/1.1" 200 518 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=29605&tab=quotestab" "Mozilla/5.0 (Wind 103.104.165.99 - - [07/Sep/2026:13:26:27 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities&branch=1&date=28-09-2026&focus=12004" "Mozilla/5.0 (Windows 203.54.180.238 - - [07/Sep/2026:13:26:24 +1000] "POST //clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=29605&tab=quotestab" "Mozilla/5.0 (Windows NT 10.0; 203.54.180.238 - - [07/Sep/2026:13:26:25 +1000] "POST //app/ajax/selectFilterSingle.php HTTP/1.1" 200 29309 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=29605&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; 203.54.180.238 - - [07/Sep/2026:13:26:27 +1000] "POST //plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=29605&tab=quotestab" "Mozilla/5.0 (Windows NT 10.0; Win64 203.54.180.238 - - [07/Sep/2026:13:26:27 +1000] "GET //app/ajax.php?cn=&furi=true&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=10515769891 HTTP/1.1" 200 248 "https://my.evolutionerp.com.au//index.php?page=jobedit& == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 83 GET /factory_session_checker.php 56 GET /heartbeat.php 42 GET /factory_session_processed_qty.php 42 GET /factory_session_joiner.php 1 GET /index.php -- last 10 requests -- 203.54.180.238 - - [07/Sep/2026:13:26:14 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:13:26:14 +1000] "GET /heartbeat.php?sentAt=1788751567&bytes=106,158,46,207&_=1788749672800 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:13:26:15 +1000] "GET /factory_session_joiner.php?id=35169 HTTP/1.1" 200 86 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [07/Sep/2026:13:26:15 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 124 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [07/Sep/2026:13:26:16 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:13:26:17 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [07/Sep/2026:13:26:17 +1000] "GET /factory_session_joiner.php?id=35170 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [07/Sep/2026:13:26:18 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:13:26:17 +1000] "GET /heartbeat.php?sentAt=1788751571&bytes=106,158,46,211&_=1788739087723 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:13:26:19 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == infinium/infinium.net.au-ssl_log == -- top paths -- 31 POST / 17 GET / 11 POST /register 10 POST /auth/callback 8 POST /index.php 7 POST /login 7 POST /api/auth/signin 6 POST /signup 6 POST /admin 6 POST /account 5 POST /wordpress/wp-json/batch/v1 4 POST /wp-json/Batch/v1 -- last 10 requests -- 45.148.10.12 - - [07/Sep/2026:13:26:17 +1000] "GET / HTTP/1.1" 401 53 "http://cpcalendars.infinium.net.au" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0" 45.148.10.12 - - [07/Sep/2026:13:26:20 +1000] "GET / HTTP/1.1" 401 53 "http://cpcalendars.infinium.net.au" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0" 45.148.10.12 - - [07/Sep/2026:13:26:22 +1000] "GET / HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:26:23 +1000] "POST /wp/index.php?rest_route=/batch/v1 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 45.148.10.12 - - [07/Sep/2026:13:26:23 +1000] "POST /wp/index.php?rest_route=%2Fbatch%2Fv1 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/53 45.148.10.12 - - [07/Sep/2026:13:26:24 +1000] "POST /wp/?rest_route=%2Fbatch%2Fv1 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:26:24 +1000] "POST /wp/?rest_route=/batch%2Fv1 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:26:24 +1000] "POST /wp/?rest_route=/batch/v1 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:26:25 +1000] "POST /wp/wp-json/batch/v1 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 45.148.10.12 - - [07/Sep/2026:13:26:25 +1000] "POST /wp/wp-json/Batch/v1 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-07 13:24:07 L1=3.41 run=5 blk=1 avail=7635 (55.4%) swpO=96 conn=2 myRSS=2322 php=15 phpRSS=1641 ap=48 tcp=60 topuser=madalice 2026-09-07 13:24:07 L1=3.41 run=2 blk=1 avail=7603 (55.2%) swpO=96 conn=2 myRSS=2322 php=14 phpRSS=1633 ap=48 tcp=60 topuser=madalice 2026-09-07 13:24:17 L1=3.58 run=3 blk=1 avail=7459 (54.1%) swpO=11 conn=2 myRSS=2322 php=16 phpRSS=1831 ap=52 tcp=57 topuser=madalice 2026-09-07 13:24:17 L1=3.58 run=5 blk=1 avail=7649 (55.5%) swpO=11 conn=2 myRSS=2322 php=14 phpRSS=1578 ap=51 tcp=55 topuser=madalice 2026-09-07 13:24:27 L1=3.49 run=2 blk=1 avail=7681 (55.8%) swpO=0 conn=1 myRSS=2322 php=14 phpRSS=1577 ap=47 tcp=55 topuser=madalice 2026-09-07 13:24:27 L1=3.49 run=1 blk=1 avail=7681 (55.8%) swpO=0 conn=2 myRSS=2322 php=15 phpRSS=1604 ap=47 tcp=55 topuser=madalice 2026-09-07 13:24:37 L1=3.19 run=2 blk=1 avail=7570 (55.0%) swpO=0 conn=2 myRSS=2322 php=14 phpRSS=1672 ap=48 tcp=59 topuser=madalice 2026-09-07 13:24:37 L1=3.19 run=3 blk=1 avail=7644 (55.5%) swpO=0 conn=2 myRSS=2322 php=15 phpRSS=1620 ap=48 tcp=59 topuser=madalice 2026-09-07 13:24:47 L1=3.00 run=2 blk=1 avail=7678 (55.7%) swpO=0 conn=2 myRSS=2322 php=14 phpRSS=1585 ap=47 tcp=43 topuser=madalice 2026-09-07 13:24:47 L1=3.00 run=2 blk=1 avail=7652 (55.5%) swpO=0 conn=3 myRSS=2322 php=15 phpRSS=1638 ap=47 tcp=43 topuser=madalice 2026-09-07 13:24:57 L1=3.24 run=3 blk=1 avail=7677 (55.7%) swpO=0 conn=3 myRSS=2322 php=19 phpRSS=1771 ap=38 tcp=56 topuser=madalice 2026-09-07 13:24:57 L1=3.24 run=3 blk=1 avail=7663 (55.6%) swpO=0 conn=4 myRSS=2322 php=19 phpRSS=1778 ap=38 tcp=58 topuser=madalice 2026-09-07 13:25:07 L1=3.28 run=3 blk=1 avail=7638 (55.4%) swpO=100 conn=3 myRSS=2320 php=15 phpRSS=1647 ap=38 tcp=44 topuser=madalice 2026-09-07 13:25:08 L1=3.28 run=4 blk=1 avail=7574 (55.0%) swpO=91 conn=4 myRSS=2320 php=16 phpRSS=1731 ap=38 tcp=45 topuser=madalice 2026-09-07 13:25:17 L1=3.16 run=3 blk=1 avail=7803 (56.6%) swpO=233 conn=3 myRSS=2314 php=15 phpRSS=1469 ap=46 tcp=57 topuser=madalice 2026-09-07 13:25:18 L1=3.16 run=2 blk=1 avail=7794 (56.6%) swpO=233 conn=4 myRSS=2314 php=15 phpRSS=1471 ap=46 tcp=56 topuser=madalice 2026-09-07 13:25:27 L1=3.06 run=3 blk=1 avail=7607 (55.2%) swpO=0 conn=3 myRSS=2314 php=16 phpRSS=1745 ap=42 tcp=52 topuser=madalice 2026-09-07 13:25:28 L1=3.06 run=7 blk=1 avail=7695 (55.9%) swpO=0 conn=3 myRSS=2314 php=16 phpRSS=1652 ap=42 tcp=53 topuser=madalice 2026-09-07 13:25:38 L1=2.89 run=3 blk=1 avail=7677 (55.7%) swpO=0 conn=3 myRSS=2314 php=15 phpRSS=1664 ap=40 tcp=47 topuser=madalice 2026-09-07 13:25:38 L1=2.89 run=3 blk=1 avail=7643 (55.5%) swpO=0 conn=3 myRSS=2314 php=15 phpRSS=1697 ap=40 tcp=47 topuser=madalice 2026-09-07 13:25:48 L1=2.83 run=8 blk=1 avail=7730 (56.1%) swpO=0 conn=3 myRSS=2314 php=15 phpRSS=1631 ap=36 tcp=42 topuser=madalice 2026-09-07 13:25:48 L1=2.83 run=2 blk=1 avail=7691 (55.8%) swpO=0 conn=3 myRSS=2314 php=15 phpRSS=1664 ap=36 tcp=41 topuser=madalice 2026-09-07 13:25:58 L1=2.70 run=3 blk=1 avail=7699 (55.9%) swpO=0 conn=3 myRSS=2314 php=15 phpRSS=1641 ap=39 tcp=48 topuser=madalice 2026-09-07 13:25:58 L1=2.70 run=2 blk=1 avail=7669 (55.7%) swpO=0 conn=3 myRSS=2314 php=15 phpRSS=1671 ap=39 tcp=47 topuser=madalice 2026-09-07 13:26:08 L1=2.75 run=7 blk=1 avail=7532 (54.7%) swpO=0 conn=5 myRSS=2314 php=17 phpRSS=1862 ap=43 tcp=57 topuser=madalice 2026-09-07 13:26:08 L1=2.75 run=5 blk=1 avail=7477 (54.3%) swpO=0 conn=5 myRSS=2314 php=17 phpRSS=1911 ap=43 tcp=57 topuser=madalice 2026-09-07 13:26:18 L1=2.94 run=6 blk=1 avail=7615 (55.3%) swpO=9 conn=5 myRSS=2314 php=16 phpRSS=1681 ap=51 tcp=61 topuser=madalice 2026-09-07 13:26:18 L1=2.94 run=3 blk=1 avail=7632 (55.4%) swpO=9 conn=4 myRSS=2314 php=15 phpRSS=1634 ap=51 tcp=61 topuser=madalice 2026-09-07 13:26:28 L1=3.11 run=2 blk=1 avail=7590 (55.1%) swpO=1 conn=3 myRSS=2314 php=15 phpRSS=1695 ap=48 tcp=56 topuser=madalice 2026-09-07 13:26:28 L1=3.11 run=3 blk=1 avail=7588 (55.1%) swpO=1 conn=2 myRSS=2314 php=15 phpRSS=1618 ap=48 tcp=55 topuser=madalice