INCIDENT 2026-09-07 13:37:35 trigger: php_rss=1830MB ================================================================== load: 4.32 3.43 3.42 3/714 3365493 ncpu:10 mem_avail: 7522MB/13777MB (54.6%) swap_used:2645MB swapout:0/s blocked(D):1 running:4 iowait:8.2% steal:0.0% php: 17 procs / 1830MB heaviest user: madalice (10 procs, 1598MB) apache: 39 procs tcp_estab: 54 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2330 madalice 10 1603 root 252 993 nobody 38 686 netdata 8 242 infinium 4 152 otterfencing 1 139 mailman 20 98 cpanellogin 1 66 wp-toolkit 3 55 dovenull 6 55 evolution 12 49 candyfabcom 2 27 kurri 2 24 dovecot 3 22 alison 1 14 zabbix 1 10 mailnull 1 10 named 1 7 polkitd 1 6 --- php workers by user --- USER PROCS RSS_MB madalice 10 1605 otterfencing 1 141 evolution 5 54 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6881 MB Active(file): 3329 MB Inactive(file): 3570 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 580 MB CommitLimit: 10984 MB Committed_AS: 10012 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-11:15:09 4936 /usr/bin/imunify-agent-proxy 4109079 root 2-08:52:47 1952 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-08:52:47 51136 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 2386812 7.3 Ssl 1-18:01:04 /usr/sbin/mariadbd 3257540 167896 madalice 221860 12.1 R 26:59 php-fpm: pool madalice_com_au 166870 1 netdata 184312 2.6 Ssl 1-11:15:15 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 167871 1 root 166908 0.0 Ss 1-11:15:08 /usr/lib/systemd/systemd-journald 3277845 167896 madalice 161080 8.1 S 21:31 php-fpm: pool madalice_com_au 3320986 167896 madalice 160592 8.0 S 12:24 php-fpm: pool madalice_com_au 3277848 167896 madalice 159596 8.1 S 21:31 php-fpm: pool madalice_com_au 3277846 167896 madalice 158544 8.3 S 21:31 php-fpm: pool madalice_com_au 3257243 167896 madalice 158256 12.1 S 27:19 php-fpm: pool madalice_com_au 3277843 167896 madalice 158232 8.2 S 21:31 php-fpm: pool madalice_com_au 923652 904997 root 158076 0.1 S 11:07:51 spamd child 3277847 167896 madalice 158044 8.2 S 21:31 php-fpm: pool madalice_com_au 3277842 167896 madalice 157972 8.4 S 21:31 php-fpm: pool madalice_com_au 3277844 167896 madalice 157672 8.4 S 21:31 php-fpm: pool madalice_com_au 3365451 3360845 otterfencing 149380 124 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 923653 904997 root 136120 0.0 S 11:07:50 spamd child 904997 1 root 130684 0.0 Ss 11:14:38 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3041041 1353308 cpanellogin 68500 0.0 S 01:21:21 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 3365280 1353308 infinium 53188 0.8 S 00:17 webmaild - serving 1.41.252.211 3365295 1353308 infinium 53092 0.8 S 00:17 webmaild - serving 1.41.252.211 4109105 4109079 root 51136 1.4 Sl 2-08:52:47 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 3365503 3348306 evolution 46284 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3365454 3345873 evolution 40724 2.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 35448 0.1 Ss 47-10:56:21 cpsrvd (SSL) - waiting for connections 167562 166914 netdata 34640 0.1 Sl 1-11:15:10 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 34452 0.0 Sl 10-11:17:55 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 33448 0.1 Ss 70-03:27:50 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 166645 1 wp-toolkit 31464 0.0 Ss 1-11:15:19 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29832 0.0 Ss 11:15:10 lfd - sleeping 3365285 1542095 infinium 29416 1.0 S 00:17 php-fpm: pool user_infinium 1463 1 root 23908 0.0 Ss 70-03:27:50 tailwatchd 167896 1 root 23516 0.0 Ss 1-11:15:07 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3347235 506832 nobody 22836 0.1 S 03:20 /usr/sbin/httpd -k start 3360845 506832 nobody 22268 0.1 S 02:23 /usr/sbin/httpd -k start 3360846 506832 nobody 22044 0.0 S 02:23 /usr/sbin/httpd -k start 3348280 506832 nobody 21708 0.0 S 02:38 /usr/sbin/httpd -k start 3344873 506832 nobody 21344 0.1 S 05:23 /usr/sbin/httpd -k start 3348306 506832 nobody 21256 0.1 S 02:36 /usr/sbin/httpd -k start 3347286 506832 nobody 21224 0.1 S 03:12 /usr/sbin/httpd -k start 3345851 506832 nobody 21220 0.0 S 04:25 /usr/sbin/httpd -k start 3345852 506832 nobody 20916 0.0 S 04:25 /usr/sbin/httpd -k start 3345868 506832 nobody 20804 0.1 S 04:24 /usr/sbin/httpd -k start 3359593 506832 nobody 20780 0.1 S 02:24 /usr/sbin/httpd -k start 3348289 506832 nobody 20768 0.0 S 02:37 /usr/sbin/httpd -k start 3365312 1542095 infinium 20676 0.2 S 00:16 php-fpm: pool user_infinium 3345873 506832 nobody 20464 0.1 S 04:24 /usr/sbin/httpd -k start 3358291 506832 nobody 20416 0.0 S 02:25 /usr/sbin/httpd -k start 3345909 506832 nobody 20116 0.0 S 04:23 /usr/sbin/httpd -k start 3348257 506832 nobody 20088 0.0 S 02:39 /usr/sbin/httpd -k start 3363848 506832 nobody 19972 0.1 S 01:37 /usr/sbin/httpd -k start 3364205 506832 nobody 19888 0.0 S 01:12 /usr/sbin/httpd -k start 3363837 506832 nobody 19820 0.1 S 01:38 /usr/sbin/httpd -k start 3348288 506832 nobody 19672 0.1 S 02:37 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19576 0.0 Ss 1-11:15:08 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3363927 506832 nobody 19460 0.0 S 01:33 /usr/sbin/httpd -k start 3365235 506832 nobody 19356 0.5 S 00:19 /usr/sbin/httpd -k start 3363846 506832 nobody 19304 0.0 S 01:37 /usr/sbin/httpd -k start 3365135 506832 nobody 19200 0.0 S 00:25 /usr/sbin/httpd -k start 3362252 506832 nobody 18744 0.1 S 02:22 /usr/sbin/httpd -k start 3364066 506832 nobody 18552 0.0 S 01:22 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3884225 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 521 evolution/portal.evolutionerp.com.au-ssl_log 183 evolution/app.evolutionerp.com.au-ssl_log 102 madalice/madalice.com.au-ssl_log 95 otterfencing/otterfencing.com.au-ssl_log 67 corpkicks/corporatekicks.com.au-ssl_log 11 evolution/pdev.evolutionerp.com.au-ssl_log 8 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 432 203.54.180.238 194 182.239.240.254 102 40.115.94.245 82 185.177.72.24 60 34.88.205.132 29 116.91.221.245 26 103.104.165.99 9 54.157.112.104 8 180.181.236.49 8 103.104.164.114 5 157.55.39.60 4 216.73.216.230 4 118.127.40.55 4 107.21.1.152 3 52.167.144.193 --- top request paths across all vhosts (last 3 min) --- 203 POST /functions.php 112 GET /app/ajax.php 72 GET /heartbeat.php 55 GET /factory_session_checker.php 45 GET /index.php 43 GET /api/getItem/LWPG2001KG 28 GET /factory_session_processed_qty.php 28 GET /factory_session_joiner.php 24 POST /clienteditsave.php 21 POST /app/ajax.php 19 POST / 16 POST /plugins/csvexporter/plugin.php 16 POST /app/ajax/selectFilterSingle.php 15 POST /jobeditsave.php 14 GET //app/ajax.php 8 POST /logsave.php 8 GET /api/getItem/LWFB2001KG 7 POST //functions.php 5 POST /invoiceaddsave.php 5 POST /app/ajax/selectFilter.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 203 POST /functions.php 112 GET /app/ajax.php 43 GET /index.php 24 POST /clienteditsave.php 21 POST /app/ajax.php 16 POST /plugins/csvexporter/plugin.php 16 POST /app/ajax/selectFilterSingle.php 15 POST /jobeditsave.php 14 GET //app/ajax.php 8 POST /logsave.php 7 POST //functions.php 5 POST /invoiceaddsave.php -- last 10 requests -- 103.104.165.99 - - [07/Sep/2026:13:37:32 +1000] "GET /index.php?page=quotereg HTTP/1.1" 200 47409 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Geck 203.54.180.238 - - [07/Sep/2026:13:37:32 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 585 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 203.54.180.238 - - [07/Sep/2026:13:37:32 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 103.104.165.99 - - [07/Sep/2026:13:37:32 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 203.54.180.238 - - [07/Sep/2026:13:37:33 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobregister&call=getUserSetting&caller=ajaxSubmitLocal&seq=16701394669 HTTP/1.1" 200 93 "https://my.evolutionerp.com.au/index.ph 103.104.165.99 - - [07/Sep/2026:13:37:33 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotereg&call=getUserSetting&caller=ajaxSubmitLocal&seq=12641413406 HTTP/1.1" 200 90 "https://my.evolutionerp.com.au/index.php?p 182.239.240.254 - - [07/Sep/2026:13:37:33 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 116.91.221.245 - - [07/Sep/2026:13:37:33 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2035§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win64 103.104.165.99 - - [07/Sep/2026:13:37:33 +1000] "POST /quoteditsave.php?call=getTheQuotes HTTP/1.1" 200 13543 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 182.239.240.254 - - [07/Sep/2026:13:37:33 +1000] "GET //index.php?page=mfreqedit&id=4653 HTTP/1.1" 200 21644 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=4209&tab=jobeditmf" "Mozilla/5.0 (Windows NT 10.0; W == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 72 GET /heartbeat.php 55 GET /factory_session_checker.php 28 GET /factory_session_processed_qty.php 28 GET /factory_session_joiner.php -- last 10 requests -- 203.54.180.238 - - [07/Sep/2026:13:37:14 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [07/Sep/2026:13:37:14 +1000] "GET /factory_session_joiner.php?id=35170 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [07/Sep/2026:13:37:14 +1000] "GET /heartbeat.php?sentAt=1788752227&bytes=106,158,49,99&_=1788749672866 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:13:37:16 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:13:37:17 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:13:37:17 +1000] "GET /heartbeat.php?sentAt=1788752231&bytes=106,158,49,103&_=1788739087789 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:13:37:18 +1000] "GET /heartbeat.php?sentAt=1788752238&bytes=106,158,49,110&_=1788751718515 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=8" 203.54.180.238 - - [07/Sep/2026:13:37:20 +1000] "GET /heartbeat.php?sentAt=1788752240&bytes=106,158,49,112&_=1788751430042 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=7" 203.54.180.238 - - [07/Sep/2026:13:37:22 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:13:37:21 +1000] "GET /heartbeat.php?sentAt=1788752241&bytes=106,158,49,113&_=1788751215615 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 43 GET /api/getItem/LWPG2001KG 8 GET /api/getItem/LWFB2001KG 2 GET /api/getItem/SHSG303016-8 1 GET /api/getItem/SHSG757530-8 1 GET /api/getItem/SHSG757525-8 1 GET /api/getItem/SHSG757520-9 1 GET /api/getItem/SHSG757520-8 1 GET /api/getItem/SHSG656540-8 1 GET /api/getItem/SHSG656530-8 1 GET /api/getItem/SHSG656525-8 1 GET /api/getItem/SHSG656525-12 1 GET /api/getItem/SHSG656520-8 -- last 10 requests -- 40.115.94.245 - - [07/Sep/2026:13:36:52 +1000] "GET /api/getItem/SHSG656540-8 HTTP/1.1" 200 1501 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:13:36:52 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:13:36:52 +1000] "GET /api/getItem/SHSG757520-8 HTTP/1.1" 200 2215 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:13:36:52 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:13:36:53 +1000] "GET /api/getItem/SHSG757520-9 HTTP/1.1" 200 1353 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:13:36:53 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:13:36:53 +1000] "GET /api/getItem/SHSG757525-8 HTTP/1.1" 200 1980 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:13:36:53 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:13:36:53 +1000] "GET /api/getItem/SHSG757530-8 HTTP/1.1" 200 2120 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:13:36:53 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-07 13:35:13 L1=3.23 run=4 blk=1 avail=7611 (55.2%) swpO=2 conn=3 myRSS=2310 php=15 phpRSS=1647 ap=58 tcp=59 topuser=madalice 2026-09-07 13:35:13 L1=3.23 run=1 blk=1 avail=7665 (55.6%) swpO=2 conn=1 myRSS=2310 php=14 phpRSS=1575 ap=58 tcp=58 topuser=madalice 2026-09-07 13:35:23 L1=2.96 run=2 blk=1 avail=7634 (55.4%) swpO=0 conn=2 myRSS=2310 php=14 phpRSS=1666 ap=50 tcp=44 topuser=madalice 2026-09-07 13:35:24 L1=2.96 run=2 blk=1 avail=7726 (56.1%) swpO=0 conn=2 myRSS=2310 php=14 phpRSS=1579 ap=49 tcp=45 topuser=madalice 2026-09-07 13:35:33 L1=2.81 run=3 blk=1 avail=7635 (55.4%) swpO=0 conn=3 myRSS=2310 php=15 phpRSS=1765 ap=40 tcp=42 topuser=madalice 2026-09-07 13:35:34 L1=2.81 run=5 blk=1 avail=7697 (55.9%) swpO=0 conn=3 myRSS=2310 php=15 phpRSS=1706 ap=39 tcp=42 topuser=madalice 2026-09-07 13:35:44 L1=2.84 run=4 blk=1 avail=7699 (55.9%) swpO=0 conn=4 myRSS=2310 php=16 phpRSS=1712 ap=38 tcp=51 topuser=madalice 2026-09-07 13:35:44 L1=2.84 run=5 blk=1 avail=7665 (55.6%) swpO=0 conn=5 myRSS=2310 php=18 phpRSS=1804 ap=38 tcp=51 topuser=madalice 2026-09-07 13:35:54 L1=2.71 run=5 blk=1 avail=7675 (55.7%) swpO=0 conn=4 myRSS=2310 php=16 phpRSS=1764 ap=37 tcp=45 topuser=madalice 2026-09-07 13:35:54 L1=2.71 run=3 blk=1 avail=7670 (55.7%) swpO=0 conn=4 myRSS=2310 php=16 phpRSS=1769 ap=37 tcp=45 topuser=madalice 2026-09-07 13:36:04 L1=3.06 run=4 blk=1 avail=7582 (55.0%) swpO=10 conn=3 myRSS=2311 php=16 phpRSS=1798 ap=43 tcp=60 topuser=madalice 2026-09-07 13:36:04 L1=3.06 run=5 blk=1 avail=7685 (55.8%) swpO=10 conn=3 myRSS=2311 php=15 phpRSS=1664 ap=43 tcp=59 topuser=madalice 2026-09-07 13:36:14 L1=2.98 run=5 blk=1 avail=7680 (55.7%) swpO=0 conn=4 myRSS=2311 php=16 phpRSS=1712 ap=44 tcp=53 topuser=madalice 2026-09-07 13:36:14 L1=2.98 run=3 blk=1 avail=7673 (55.7%) swpO=0 conn=4 myRSS=2311 php=16 phpRSS=1717 ap=44 tcp=48 topuser=madalice 2026-09-07 13:36:24 L1=2.98 run=2 blk=1 avail=7662 (55.6%) swpO=0 conn=3 myRSS=2311 php=16 phpRSS=1651 ap=45 tcp=52 topuser=madalice 2026-09-07 13:36:24 L1=2.98 run=4 blk=1 avail=7612 (55.3%) swpO=0 conn=3 myRSS=2311 php=16 phpRSS=1699 ap=45 tcp=52 topuser=madalice 2026-09-07 13:36:34 L1=2.98 run=3 blk=1 avail=7655 (55.6%) swpO=0 conn=3 myRSS=2311 php=16 phpRSS=1739 ap=41 tcp=47 topuser=madalice 2026-09-07 13:36:34 L1=2.98 run=3 blk=1 avail=7652 (55.5%) swpO=0 conn=3 myRSS=2311 php=16 phpRSS=1740 ap=41 tcp=48 topuser=madalice 2026-09-07 13:36:44 L1=3.27 run=4 blk=1 avail=7631 (55.4%) swpO=0 conn=5 myRSS=2328 php=17 phpRSS=1812 ap=37 tcp=41 topuser=madalice 2026-09-07 13:36:44 L1=3.27 run=3 blk=1 avail=7630 (55.4%) swpO=0 conn=4 myRSS=2328 php=16 phpRSS=1771 ap=37 tcp=41 topuser=madalice 2026-09-07 13:36:54 L1=3.23 run=4 blk=1 avail=7723 (56.1%) swpO=0 conn=4 myRSS=2328 php=16 phpRSS=1699 ap=33 tcp=50 topuser=madalice 2026-09-07 13:36:54 L1=3.23 run=3 blk=1 avail=7698 (55.9%) swpO=0 conn=4 myRSS=2328 php=16 phpRSS=1721 ap=34 tcp=47 topuser=madalice 2026-09-07 13:37:04 L1=3.81 run=3 blk=1 avail=7766 (56.4%) swpO=0 conn=3 myRSS=2329 php=15 phpRSS=1622 ap=34 tcp=46 topuser=madalice 2026-09-07 13:37:04 L1=3.81 run=3 blk=1 avail=7737 (56.2%) swpO=0 conn=3 myRSS=2329 php=15 phpRSS=1647 ap=35 tcp=46 topuser=madalice 2026-09-07 13:37:14 L1=4.16 run=5 blk=1 avail=7611 (55.2%) swpO=2 conn=5 myRSS=2329 php=17 phpRSS=1805 ap=39 tcp=43 topuser=madalice 2026-09-07 13:37:15 L1=4.16 run=7 blk=1 avail=7573 (55.0%) swpO=1 conn=5 myRSS=2329 php=17 phpRSS=1838 ap=39 tcp=45 topuser=madalice 2026-09-07 13:37:24 L1=4.57 run=4 blk=1 avail=7637 (55.4%) swpO=0 conn=3 myRSS=2330 php=15 phpRSS=1614 ap=44 tcp=40 topuser=madalice 2026-09-07 13:37:25 L1=4.57 run=3 blk=1 avail=7635 (55.4%) swpO=0 conn=3 myRSS=2330 php=15 phpRSS=1616 ap=44 tcp=40 topuser=madalice 2026-09-07 13:37:35 L1=4.32 run=4 blk=1 avail=7522 (54.6%) swpO=0 conn=4 myRSS=2330 php=17 phpRSS=1830 ap=39 tcp=54 topuser=madalice 2026-09-07 13:37:35 L1=4.32 run=7 blk=1 avail=7472 (54.2%) swpO=0 conn=5 myRSS=2330 php=17 phpRSS=1886 ap=39 tcp=54 topuser=madalice