INCIDENT 2026-09-07 13:27:29 trigger: php_rss=1594MB ================================================================== load: 2.97 3.26 3.46 4/718 3324033 ncpu:10 mem_avail: 7634MB/13777MB (55.4%) swap_used:2659MB swapout:0/s blocked(D):1 running:2 iowait:9.1% steal:0.0% php: 14 procs / 1594MB heaviest user: madalice (10 procs, 1571MB) apache: 53 procs tcp_estab: 48 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2308 madalice 10 1577 root 253 1100 nobody 52 899 netdata 8 242 mailman 20 98 cpanellogin 1 67 wp-toolkit 3 56 dovenull 6 55 evolution 12 26 kurri 2 24 dovecot 3 22 alison 1 14 lowrange 1 13 zabbix 1 10 mailnull 1 10 named 1 7 polkitd 1 6 nscd 1 5 rpc 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1579 evolution 4 29 root 1 23 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6617 MB Active(file): 3254 MB Inactive(file): 3462 MB Dirty: 4 MB Writeback: 0 MB SReclaimable: 580 MB CommitLimit: 10984 MB Committed_AS: 9865 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-11:05:03 4936 /usr/bin/imunify-agent-proxy 4109079 root 2-08:42:41 1952 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-08:42:41 51804 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 2363580 7.2 Ssl 1-17:50:58 /usr/sbin/mariadbd 3277846 167896 madalice 196372 8.4 R 11:25 php-fpm: pool madalice_com_au 166870 1 netdata 184292 2.6 Ssl 1-11:05:09 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 167871 1 root 165304 0.0 Ss 1-11:05:02 /usr/lib/systemd/systemd-journald 3277845 167896 madalice 163096 8.3 S 11:25 php-fpm: pool madalice_com_au 923652 904997 root 161376 0.1 S 10:57:45 spamd child 3257243 167896 madalice 159612 14.3 S 17:13 php-fpm: pool madalice_com_au 3277847 167896 madalice 159404 8.4 S 11:25 php-fpm: pool madalice_com_au 3277843 167896 madalice 158620 8.3 S 11:25 php-fpm: pool madalice_com_au 3257540 167896 madalice 158592 14.4 S 16:53 php-fpm: pool madalice_com_au 3320986 167896 madalice 158556 7.6 S 02:18 php-fpm: pool madalice_com_au 3277842 167896 madalice 158208 8.5 S 11:25 php-fpm: pool madalice_com_au 3277848 167896 madalice 158160 8.3 S 11:25 php-fpm: pool madalice_com_au 3277844 167896 madalice 157772 8.4 S 11:25 php-fpm: pool madalice_com_au 923653 904997 root 136732 0.0 S 10:57:44 spamd child 904997 1 root 130708 0.0 Ss 11:04:32 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3041041 1353308 cpanellogin 68780 0.0 S 01:11:15 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 4109105 4109079 root 51804 1.4 Sl 2-08:42:41 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 3324033 3323695 evolution 39104 0.0 S 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1353308 1 root 37120 0.1 Ss 47-10:46:15 cpsrvd (SSL) - waiting for connections 3324000 1469 root 35168 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3324067 1469 root 35164 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3324061 1469 root 34888 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3324001 1469 root 34884 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3324068 1469 root 34884 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3324002 1469 root 34876 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 167562 166914 netdata 34648 0.1 Sl 1-11:05:04 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 34568 0.0 Sl 10-11:07:49 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 33864 0.1 Ss 70-03:17:44 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 166645 1 wp-toolkit 31464 0.0 Ss 1-11:05:13 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29788 0.0 Ss 11:05:04 lfd - sleeping 1463 1 root 23972 0.0 Ss 70-03:17:44 tailwatchd 167896 1 root 23640 0.0 Ss 1-11:05:01 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3300270 506832 nobody 22104 0.0 S 06:59 /usr/sbin/httpd -k start 3303638 506832 nobody 21460 0.0 S 04:53 /usr/sbin/httpd -k start 3303562 506832 nobody 21000 0.1 S 04:58 /usr/sbin/httpd -k start 3304871 506832 nobody 20972 0.0 S 03:44 /usr/sbin/httpd -k start 3302388 506832 nobody 20800 0.0 S 05:49 /usr/sbin/httpd -k start 3304872 506832 nobody 20748 0.1 S 03:44 /usr/sbin/httpd -k start 3304184 506832 nobody 20668 0.0 S 04:17 /usr/sbin/httpd -k start 3304177 506832 nobody 20420 0.0 S 04:18 /usr/sbin/httpd -k start 3320988 506832 nobody 20244 0.0 S 02:18 /usr/sbin/httpd -k start 3320989 506832 nobody 19960 0.0 S 02:18 /usr/sbin/httpd -k start 3321922 506832 nobody 19872 0.0 S 01:32 /usr/sbin/httpd -k start 3323040 506832 nobody 19844 0.0 S 00:41 /usr/sbin/httpd -k start 3322167 506832 nobody 19828 0.0 S 01:20 /usr/sbin/httpd -k start 3323008 506832 nobody 19820 0.1 S 00:43 /usr/sbin/httpd -k start 3322095 506832 nobody 19680 0.1 S 01:21 /usr/sbin/httpd -k start 3322166 506832 nobody 19664 0.0 S 01:20 /usr/sbin/httpd -k start 3323200 506832 nobody 19588 0.1 S 00:34 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19584 0.0 Ss 1-11:05:02 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3322165 506832 nobody 19476 0.0 S 01:20 /usr/sbin/httpd -k start 3322093 506832 nobody 19440 0.0 S 01:21 /usr/sbin/httpd -k start 3322094 506832 nobody 19440 0.0 S 01:21 /usr/sbin/httpd -k start 3323273 506832 nobody 19428 0.1 S 00:31 /usr/sbin/httpd -k start 3322162 506832 nobody 19252 0.0 S 01:20 /usr/sbin/httpd -k start 3323037 506832 nobody 19212 0.0 S 00:41 /usr/sbin/httpd -k start 3322067 506832 nobody 19168 0.0 S 01:23 /usr/sbin/httpd -k start 3323275 506832 nobody 19048 0.1 S 00:31 /usr/sbin/httpd -k start 3323039 506832 nobody 18732 0.0 S 00:41 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3821959 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 579 evolution/portal.evolutionerp.com.au-ssl_log 227 infinium/infinium.net.au-ssl_log 218 evolution/app.evolutionerp.com.au-ssl_log 158 kamcool/kamcool.com.au-ssl_log 130 lowrange/lowrange.com.au-ssl_log 104 madalice/madalice.com.au-ssl_log 76 aaa/aaadownunder.com.au-ssl_log 2 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 497 203.54.180.238 452 45.148.10.12 158 40.115.94.245 93 103.104.165.99 80 103.104.164.114 70 185.177.72.24 55 182.239.240.254 38 116.91.221.245 25 165.225.233.87 6 180.181.236.49 3 40.77.167.241 3 40.77.167.116 2 1.145.70.156 2 114.119.143.14 2 114.119.140.234 --- top request paths across all vhosts (last 3 min) --- 194 POST /functions.php 104 GET /app/ajax.php 84 GET /factory_session_checker.php 80 GET /api/getItem/LWPB2001KG 78 GET /api/getItem/LWHG2001KG 57 GET /heartbeat.php 55 POST / 53 GET /index.php 42 GET /factory_session_processed_qty.php 42 GET /factory_session_joiner.php 33 GET / 25 POST /plugins/csvexporter/plugin.php 23 POST /index.php 21 POST /wp/ 21 POST /wordpress/ 21 POST /clienteditsave.php 20 GET //app/ajax.php 19 POST /register 18 POST /wordpress/wp-json/batch/v1 17 POST /signup --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 194 POST /functions.php 104 GET /app/ajax.php 50 GET /index.php 25 POST /plugins/csvexporter/plugin.php 21 POST /clienteditsave.php 20 GET //app/ajax.php 16 POST /app/ajax/selectFilterSingle.php 15 POST /app/ajax.php 14 POST /jobeditsave.php 14 POST /app/ajax/selectFilter.php 8 POST /itemModify.php 8 POST /inveditsave.php -- last 10 requests -- 203.54.180.238 - - [07/Sep/2026:13:27:24 +1000] "POST //itemModify.php?call=getJobInvFiles HTTP/1.1" 200 335 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=29521&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; 103.104.165.99 - - [07/Sep/2026:13:27:25 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 233 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 203.54.180.238 - - [07/Sep/2026:13:27:25 +1000] "POST //itemModify.php?call=getJobInvBOM HTTP/1.1" 200 1981 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=29521&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; 203.54.180.238 - - [07/Sep/2026:13:27:25 +1000] "POST //functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=29605&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64 203.54.180.238 - - [07/Sep/2026:13:27:25 +1000] "POST //jobeditsave.php?call=finder&id=198811&dispatch=0&showNonAlloc=0 HTTP/1.1" 200 188 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=29521&tab=jobeditinv" " 203.54.180.238 - - [07/Sep/2026:13:27:27 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78933§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 203.54.180.238 - - [07/Sep/2026:13:27:27 +1000] "POST /quoteditsave.php?itemid=1046&call=getSupplier&baseprice=3.362 HTTP/1.1" 200 404 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79030" "Mozilla/5.0 ( 203.54.180.238 - - [07/Sep/2026:13:27:27 +1000] "POST /itemModify.php?call=getInvMFMeta&modifyid=1046 HTTP/1.1" 200 49 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79030" "Mozilla/5.0 (Windows NT 10.0; 203.54.180.238 - - [07/Sep/2026:13:27:27 +1000] "POST /itemModify.php?call=getBOM HTTP/1.1" 200 22 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79030" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe 103.104.164.114 - - [07/Sep/2026:13:27:27 +1000] "GET /index.php?page=inveditkit&id=41292&string= HTTP/1.1" 200 14153 "https://my.evolutionerp.com.au/index.php?page=inveditman&id=41292&string=" "Mozilla/5.0 (Windows NT 1 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 84 GET /factory_session_checker.php 57 GET /heartbeat.php 42 GET /factory_session_processed_qty.php 42 GET /factory_session_joiner.php 2 GET /index.php -- last 10 requests -- 203.54.180.238 - - [07/Sep/2026:13:27:15 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:13:27:15 +1000] "GET /factory_session_joiner.php?id=35169 HTTP/1.1" 200 86 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [07/Sep/2026:13:27:16 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 124 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [07/Sep/2026:13:27:18 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:13:27:18 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [07/Sep/2026:13:27:18 +1000] "GET /factory_session_joiner.php?id=35170 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [07/Sep/2026:13:27:17 +1000] "GET /heartbeat.php?sentAt=1788751631&bytes=106,158,47,15&_=1788739087729 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:13:27:19 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:13:27:20 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:13:27:20 +1000] "GET /heartbeat.php?sentAt=1788751640&bytes=106,158,47,24&_=1788751429982 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=7" == infinium/infinium.net.au-ssl_log == -- top paths -- 21 POST /wp/ 21 POST /wordpress/ 14 POST /wp/index.php 14 POST /wordpress/index.php 11 POST /register 10 POST /auth/callback 9 GET /wp/ 7 POST /wp/wp-json/Batch/v1 7 POST /wp/wp-json/batch/v1/ 7 POST /wp/wp-json/batch/v1 7 POST /wp//wp-json/batch/v1 7 POST /wp/wordpress/wp-json/batch/v1 -- last 10 requests -- 45.148.10.12 - - [07/Sep/2026:13:27:20 +1000] "POST /wordpress/wp-json/Batch/v1 HTTP/1.1" 401 53 "https://cpcalendars.infinium.net.au/wordpress/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KH 45.148.10.12 - - [07/Sep/2026:13:27:20 +1000] "POST /wordpress//wp-json/batch/v1 HTTP/1.1" 401 53 "https://cpcalendars.infinium.net.au/wordpress/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K 45.148.10.12 - - [07/Sep/2026:13:27:21 +1000] "POST /wordpress/wp-json/batch/v1/ HTTP/1.1" 401 53 "https://cpcalendars.infinium.net.au/wordpress/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K 45.148.10.12 - - [07/Sep/2026:13:27:21 +1000] "POST /wordpress/blog/wp-json/batch/v1 HTTP/1.1" 401 53 "https://cpcalendars.infinium.net.au/wordpress/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 45.148.10.12 - - [07/Sep/2026:13:27:24 +1000] "POST /wordpress/wordpress/wp-json/batch/v1 HTTP/1.1" 401 53 "https://cpcalendars.infinium.net.au/wordpress/wp-admin/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 45.148.10.12 - - [07/Sep/2026:13:27:24 +1000] "POST /wordpress/index.php?rest_route=/batch/v1 HTTP/1.1" 401 53 "https://cpcalendars.infinium.net.au/wordpress/wp-admin/" "WordPress/6.4.3" 45.148.10.12 - - [07/Sep/2026:13:27:24 +1000] "POST /wordpress/index.php?rest_route=%2Fbatch%2Fv1 HTTP/1.1" 401 53 "https://cpcalendars.infinium.net.au/wordpress/wp-admin/" "WordPress/6.4.3" 45.148.10.12 - - [07/Sep/2026:13:27:25 +1000] "POST /wordpress/?rest_route=%2Fbatch%2Fv1 HTTP/1.1" 401 53 "https://cpcalendars.infinium.net.au/wordpress/wp-admin/" "WordPress/6.4.3" 45.148.10.12 - - [07/Sep/2026:13:27:25 +1000] "POST /wordpress/?rest_route=/batch%2Fv1 HTTP/1.1" 401 53 "https://cpcalendars.infinium.net.au/wordpress/wp-admin/" "WordPress/6.4.3" 45.148.10.12 - - [07/Sep/2026:13:27:25 +1000] "POST /wordpress/?rest_route=/batch/v1 HTTP/1.1" 401 53 "https://cpcalendars.infinium.net.au/wordpress/wp-admin/" "WordPress/6.4.3" --- last 30 samples (run-up to this incident) --- 2026-09-07 13:25:07 L1=3.28 run=3 blk=1 avail=7638 (55.4%) swpO=100 conn=3 myRSS=2320 php=15 phpRSS=1647 ap=38 tcp=44 topuser=madalice 2026-09-07 13:25:08 L1=3.28 run=4 blk=1 avail=7574 (55.0%) swpO=91 conn=4 myRSS=2320 php=16 phpRSS=1731 ap=38 tcp=45 topuser=madalice 2026-09-07 13:25:17 L1=3.16 run=3 blk=1 avail=7803 (56.6%) swpO=233 conn=3 myRSS=2314 php=15 phpRSS=1469 ap=46 tcp=57 topuser=madalice 2026-09-07 13:25:18 L1=3.16 run=2 blk=1 avail=7794 (56.6%) swpO=233 conn=4 myRSS=2314 php=15 phpRSS=1471 ap=46 tcp=56 topuser=madalice 2026-09-07 13:25:27 L1=3.06 run=3 blk=1 avail=7607 (55.2%) swpO=0 conn=3 myRSS=2314 php=16 phpRSS=1745 ap=42 tcp=52 topuser=madalice 2026-09-07 13:25:28 L1=3.06 run=7 blk=1 avail=7695 (55.9%) swpO=0 conn=3 myRSS=2314 php=16 phpRSS=1652 ap=42 tcp=53 topuser=madalice 2026-09-07 13:25:38 L1=2.89 run=3 blk=1 avail=7677 (55.7%) swpO=0 conn=3 myRSS=2314 php=15 phpRSS=1664 ap=40 tcp=47 topuser=madalice 2026-09-07 13:25:38 L1=2.89 run=3 blk=1 avail=7643 (55.5%) swpO=0 conn=3 myRSS=2314 php=15 phpRSS=1697 ap=40 tcp=47 topuser=madalice 2026-09-07 13:25:48 L1=2.83 run=8 blk=1 avail=7730 (56.1%) swpO=0 conn=3 myRSS=2314 php=15 phpRSS=1631 ap=36 tcp=42 topuser=madalice 2026-09-07 13:25:48 L1=2.83 run=2 blk=1 avail=7691 (55.8%) swpO=0 conn=3 myRSS=2314 php=15 phpRSS=1664 ap=36 tcp=41 topuser=madalice 2026-09-07 13:25:58 L1=2.70 run=3 blk=1 avail=7699 (55.9%) swpO=0 conn=3 myRSS=2314 php=15 phpRSS=1641 ap=39 tcp=48 topuser=madalice 2026-09-07 13:25:58 L1=2.70 run=2 blk=1 avail=7669 (55.7%) swpO=0 conn=3 myRSS=2314 php=15 phpRSS=1671 ap=39 tcp=47 topuser=madalice 2026-09-07 13:26:08 L1=2.75 run=7 blk=1 avail=7532 (54.7%) swpO=0 conn=5 myRSS=2314 php=17 phpRSS=1862 ap=43 tcp=57 topuser=madalice 2026-09-07 13:26:08 L1=2.75 run=5 blk=1 avail=7477 (54.3%) swpO=0 conn=5 myRSS=2314 php=17 phpRSS=1911 ap=43 tcp=57 topuser=madalice 2026-09-07 13:26:18 L1=2.94 run=6 blk=1 avail=7615 (55.3%) swpO=9 conn=5 myRSS=2314 php=16 phpRSS=1681 ap=51 tcp=61 topuser=madalice 2026-09-07 13:26:18 L1=2.94 run=3 blk=1 avail=7632 (55.4%) swpO=9 conn=4 myRSS=2314 php=15 phpRSS=1634 ap=51 tcp=61 topuser=madalice 2026-09-07 13:26:28 L1=3.11 run=2 blk=1 avail=7590 (55.1%) swpO=1 conn=3 myRSS=2314 php=15 phpRSS=1695 ap=48 tcp=56 topuser=madalice 2026-09-07 13:26:28 L1=3.11 run=3 blk=1 avail=7588 (55.1%) swpO=1 conn=2 myRSS=2314 php=15 phpRSS=1618 ap=48 tcp=55 topuser=madalice 2026-09-07 13:26:38 L1=2.93 run=1 blk=1 avail=7696 (55.9%) swpO=0 conn=2 myRSS=2314 php=15 phpRSS=1614 ap=42 tcp=47 topuser=madalice 2026-09-07 13:26:38 L1=2.93 run=2 blk=1 avail=7696 (55.9%) swpO=0 conn=1 myRSS=2314 php=14 phpRSS=1574 ap=42 tcp=49 topuser=madalice 2026-09-07 13:26:48 L1=3.45 run=4 blk=1 avail=7655 (55.6%) swpO=0 conn=2 myRSS=2314 php=15 phpRSS=1614 ap=47 tcp=45 topuser=madalice 2026-09-07 13:26:48 L1=3.45 run=1 blk=1 avail=7685 (55.8%) swpO=0 conn=1 myRSS=2314 php=14 phpRSS=1574 ap=47 tcp=47 topuser=madalice 2026-09-07 13:26:58 L1=3.39 run=4 blk=1 avail=7598 (55.1%) swpO=0 conn=2 myRSS=2314 php=14 phpRSS=1579 ap=56 tcp=67 topuser=madalice 2026-09-07 13:26:58 L1=3.39 run=6 blk=1 avail=7606 (55.2%) swpO=0 conn=2 myRSS=2314 php=14 phpRSS=1582 ap=56 tcp=68 topuser=madalice 2026-09-07 13:27:08 L1=3.17 run=3 blk=1 avail=7605 (55.2%) swpO=44 conn=3 myRSS=2313 php=15 phpRSS=1661 ap=51 tcp=60 topuser=madalice 2026-09-07 13:27:09 L1=3.17 run=3 blk=1 avail=7558 (54.9%) swpO=40 conn=3 myRSS=2313 php=15 phpRSS=1704 ap=51 tcp=60 topuser=madalice 2026-09-07 13:27:19 L1=3.14 run=1 blk=1 avail=7585 (55.1%) swpO=192 conn=1 myRSS=2308 php=14 phpRSS=1577 ap=63 tcp=56 topuser=madalice 2026-09-07 13:27:19 L1=3.14 run=2 blk=1 avail=7578 (55.0%) swpO=211 conn=1 myRSS=2308 php=14 phpRSS=1577 ap=63 tcp=56 topuser=madalice 2026-09-07 13:27:29 L1=2.97 run=2 blk=1 avail=7634 (55.4%) swpO=0 conn=2 myRSS=2308 php=14 phpRSS=1594 ap=53 tcp=48 topuser=madalice 2026-09-07 13:27:29 L1=2.97 run=5 blk=1 avail=7589 (55.1%) swpO=0 conn=3 myRSS=2308 php=15 phpRSS=1656 ap=53 tcp=48 topuser=madalice