INCIDENT 2026-09-07 13:38:35 trigger: php_rss=1575MB ================================================================== load: 3.36 3.31 3.37 3/703 3366595 ncpu:10 mem_avail: 7765MB/13777MB (56.4%) swap_used:2647MB swapout:0/s blocked(D):1 running:4 iowait:9.2% steal:0.0% php: 14 procs / 1575MB heaviest user: madalice (10 procs, 1552MB) apache: 34 procs tcp_estab: 45 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2331 madalice 10 1553 root 256 1059 nobody 33 604 netdata 8 243 mailman 20 98 cpanellogin 1 66 wp-toolkit 3 55 dovenull 6 55 evolution 12 44 mailnull 4 32 kurri 2 24 dovecot 3 22 alison 1 14 zabbix 1 10 named 1 7 polkitd 1 6 nscd 1 5 rpc 1 3 dbus 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1553 root 1 22 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6847 MB Active(file): 3313 MB Inactive(file): 3628 MB Dirty: 2 MB Writeback: 0 MB SReclaimable: 580 MB CommitLimit: 10984 MB Committed_AS: 9498 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-11:16:10 4936 /usr/bin/imunify-agent-proxy 4109079 root 2-08:53:48 1952 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-08:53:48 50988 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 2387800 7.3 Ssl 1-18:02:05 /usr/sbin/mariadbd 166870 1 netdata 185052 2.6 Ssl 1-11:16:16 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 167871 1 root 167172 0.0 Ss 1-11:16:09 /usr/lib/systemd/systemd-journald 3257540 167896 madalice 163068 11.9 R 28:00 php-fpm: pool madalice_com_au 3277845 167896 madalice 160696 8.0 S 22:32 php-fpm: pool madalice_com_au 3320986 167896 madalice 160400 8.0 S 13:25 php-fpm: pool madalice_com_au 3277842 167896 madalice 159648 8.3 S 22:32 php-fpm: pool madalice_com_au 3277843 167896 madalice 158148 8.2 S 22:32 php-fpm: pool madalice_com_au 3277846 167896 madalice 158148 8.3 S 22:32 php-fpm: pool madalice_com_au 3257243 167896 madalice 158120 12.0 S 28:20 php-fpm: pool madalice_com_au 923652 904997 root 158056 0.1 S 11:08:52 spamd child 3277848 167896 madalice 157896 8.1 S 22:32 php-fpm: pool madalice_com_au 3277847 167896 madalice 157828 8.2 S 22:32 php-fpm: pool madalice_com_au 3277844 167896 madalice 157536 8.4 S 22:32 php-fpm: pool madalice_com_au 923653 904997 root 135236 0.0 S 11:08:51 spamd child 904997 1 root 130684 0.0 Ss 11:15:39 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3041041 1353308 cpanellogin 68492 0.0 S 01:22:22 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 4109105 4109079 root 50988 1.4 Sl 2-08:53:48 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 3366620 3345868 evolution 40236 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 35000 0.1 Ss 47-10:57:22 cpsrvd (SSL) - waiting for connections 3366563 1469 root 34744 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3366592 1469 root 34732 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 167562 166914 netdata 34640 0.1 Sl 1-11:16:11 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 34404 0.0 Sl 10-11:18:56 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 33300 0.1 Ss 70-03:28:51 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 166645 1 wp-toolkit 31464 0.0 Ss 1-11:16:20 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29840 0.0 Ss 11:16:11 lfd - sleeping 1463 1 root 23904 0.0 Ss 70-03:28:51 tailwatchd 167896 1 root 23376 0.0 Ss 1-11:16:08 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3360845 506832 nobody 22412 0.1 S 03:24 /usr/sbin/httpd -k start 3360846 506832 nobody 22068 0.0 S 03:24 /usr/sbin/httpd -k start 3348280 506832 nobody 21804 0.0 S 03:39 /usr/sbin/httpd -k start 3345868 506832 nobody 21588 0.1 S 05:25 /usr/sbin/httpd -k start 3344873 506832 nobody 21356 0.1 S 06:24 /usr/sbin/httpd -k start 3347235 506832 nobody 21340 0.1 S 04:21 /usr/sbin/httpd -k start 3365235 506832 nobody 21324 0.1 S 01:20 /usr/sbin/httpd -k start 3347286 506832 nobody 21292 0.1 S 04:13 /usr/sbin/httpd -k start 3365060 506832 nobody 20808 0.0 S 01:31 /usr/sbin/httpd -k start 3358291 506832 nobody 20516 0.0 S 03:26 /usr/sbin/httpd -k start 3363848 506832 nobody 20352 0.1 S 02:38 /usr/sbin/httpd -k start 3364214 506832 nobody 20336 0.0 S 02:12 /usr/sbin/httpd -k start 3348257 506832 nobody 20144 0.0 S 03:40 /usr/sbin/httpd -k start 3345909 506832 nobody 20120 0.0 S 05:24 /usr/sbin/httpd -k start 3364205 506832 nobody 20092 0.0 S 02:13 /usr/sbin/httpd -k start 3365313 506832 nobody 20012 0.0 S 01:17 /usr/sbin/httpd -k start 3364066 506832 nobody 19976 0.0 S 02:23 /usr/sbin/httpd -k start 3365135 506832 nobody 19864 0.1 S 01:26 /usr/sbin/httpd -k start 3348279 506832 nobody 19696 0.0 S 03:39 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19576 0.0 Ss 1-11:16:09 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3365314 506832 nobody 19328 0.1 S 01:17 /usr/sbin/httpd -k start 3366203 506832 nobody 19192 0.1 S 00:29 /usr/sbin/httpd -k start 3365872 506832 nobody 18952 0.0 S 00:50 /usr/sbin/httpd -k start 3348288 506832 nobody 18764 0.0 S 03:38 /usr/sbin/httpd -k start 3365143 506832 nobody 18720 0.1 S 01:25 /usr/sbin/httpd -k start 3365142 506832 nobody 18692 0.0 S 01:25 /usr/sbin/httpd -k start 3366204 506832 nobody 18532 0.0 S 00:29 /usr/sbin/httpd -k start 3365459 506832 nobody 18388 0.0 S 01:01 /usr/sbin/httpd -k start 3366188 506832 nobody 18220 0.0 S 00:30 /usr/sbin/httpd -k start 167566 166914 netdata 18124 2.1 Sl 1-11:16:11 /usr/libexec/netdata/plugins.d/apps.plugin 1 3366189 506832 nobody 18056 0.1 S 00:30 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3890957 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 527 evolution/portal.evolutionerp.com.au-ssl_log 178 evolution/app.evolutionerp.com.au-ssl_log 104 madalice/madalice.com.au-ssl_log 88 vinesit/vinesit.com.au-ssl_log 62 otterfencing/otterfencing.com.au-ssl_log 29 evolution/pdev.evolutionerp.com.au-ssl_log 3 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 383 203.54.180.238 195 182.239.240.254 104 40.115.94.245 79 185.177.72.24 69 103.104.165.99 55 45.148.10.12 29 116.91.221.245 28 34.88.205.132 11 103.104.164.114 8 180.181.236.49 6 195.178.110.48 3 1.145.70.156 2 52.167.144.193 2 216.73.216.230 2 165.225.233.87 --- top request paths across all vhosts (last 3 min) --- 215 POST /functions.php 103 GET /app/ajax.php 78 GET /heartbeat.php 52 GET /api/getItem/LWPG2001KG 46 GET /factory_session_checker.php 41 GET /index.php 25 POST /jobeditsave.php 24 GET /factory_session_processed_qty.php 23 GET /factory_session_joiner.php 22 POST /clienteditsave.php 18 POST /app/ajax.php 17 POST / 15 POST /plugins/csvexporter/plugin.php 15 GET //app/ajax.php 14 POST /app/ajax/selectFilterSingle.php 10 POST /index.php 8 POST //functions.php 7 POST /logsave.php 6 POST /quoteditsave.php 6 POST /api/session/reset_password --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 215 POST /functions.php 103 GET /app/ajax.php 40 GET /index.php 25 POST /jobeditsave.php 22 POST /clienteditsave.php 18 POST /app/ajax.php 15 POST /plugins/csvexporter/plugin.php 15 GET //app/ajax.php 14 POST /app/ajax/selectFilterSingle.php 8 POST //functions.php 7 POST /logsave.php 6 POST /quoteditsave.php -- last 10 requests -- 203.54.180.238 - - [07/Sep/2026:13:38:28 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 10160 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 116.91.221.245 - - [07/Sep/2026:13:38:32 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=4466" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0 203.54.180.238 - - [07/Sep/2026:13:38:32 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 285 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29594&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [07/Sep/2026:13:38:28 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 10160 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 203.54.180.238 - - [07/Sep/2026:13:38:30 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 635 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 182.239.240.254 - - [07/Sep/2026:13:38:33 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 983 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=4059" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 203.54.180.238 - - [07/Sep/2026:13:38:29 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 635 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 203.54.180.238 - - [07/Sep/2026:13:38:29 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 4496 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:13:38:33 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 934 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 203.54.180.238 - - [07/Sep/2026:13:38:34 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 635 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 78 GET /heartbeat.php 46 GET /factory_session_checker.php 24 GET /factory_session_processed_qty.php 23 GET /factory_session_joiner.php 3 POST /portal/register 2 GET / 1 GET /userlogin.php 1 GET /logoff.php -- last 10 requests -- 203.54.180.238 - - [07/Sep/2026:13:38:25 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [07/Sep/2026:13:38:25 +1000] "GET /factory_session_joiner.php?id=35170 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [07/Sep/2026:13:38:28 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:13:38:27 +1000] "GET /heartbeat.php?sentAt=1788752301&bytes=106,158,49,173&_=1788739087796 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:13:38:28 +1000] "GET /heartbeat.php?sentAt=1788752308&bytes=106,158,49,180&_=1788751718522 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=8" 203.54.180.238 - - [07/Sep/2026:13:38:30 +1000] "GET /heartbeat.php?sentAt=1788752310&bytes=106,158,49,182&_=1788751430049 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=7" 203.54.180.238 - - [07/Sep/2026:13:38:31 +1000] "GET /heartbeat.php?sentAt=1788752311&bytes=106,158,49,183&_=1788751215622 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:13:38:33 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [07/Sep/2026:13:38:34 +1000] "GET /heartbeat.php?sentAt=1788752307&bytes=106,158,49,179&_=1788749672874 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [07/Sep/2026:13:38:35 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 52 GET /api/getItem/LWPG2001KG 3 GET /api/getItem/SHSG404016-DP25-24-DI-110 1 GET /api/getItem/SHSG909020-8 1 GET /api/getItem/SHSG898950-8 1 GET /api/getItem/SHSG898935-8 1 GET /api/getItem/SHSG898930-8 1 GET /api/getItem/SHSG898920-8 1 GET /api/getItem/SHSG757550-8 1 GET /api/getItem/SHSG757540-8 1 GET /api/getItem/SHSG757530-8 1 GET /api/getItem/SHSG757525-8 1 GET /api/getItem/SHSG757520-SP25-8 -- last 10 requests -- 40.115.94.245 - - [07/Sep/2026:13:38:04 +1000] "GET /api/getItem/SHSG757520-DP25-8 HTTP/1.1" 200 1551 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:13:38:04 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:13:38:04 +1000] "GET /api/getItem/SHSG757520-DP25-8-DI HTTP/1.1" 200 1403 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:13:38:04 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:13:38:05 +1000] "GET /api/getItem/SHSG757520-SP25-8 HTTP/1.1" 200 1547 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:13:38:05 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:13:38:05 +1000] "GET /api/getItem/CLSGNSTD50250KK HTTP/1.1" 200 1553 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:13:38:05 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:13:38:06 +1000] "GET /api/getItem/CLPBNSTD50250KK HTTP/1.1" 200 1539 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:13:38:06 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-07 13:36:14 L1=2.98 run=5 blk=1 avail=7680 (55.7%) swpO=0 conn=4 myRSS=2311 php=16 phpRSS=1712 ap=44 tcp=53 topuser=madalice 2026-09-07 13:36:14 L1=2.98 run=3 blk=1 avail=7673 (55.7%) swpO=0 conn=4 myRSS=2311 php=16 phpRSS=1717 ap=44 tcp=48 topuser=madalice 2026-09-07 13:36:24 L1=2.98 run=2 blk=1 avail=7662 (55.6%) swpO=0 conn=3 myRSS=2311 php=16 phpRSS=1651 ap=45 tcp=52 topuser=madalice 2026-09-07 13:36:24 L1=2.98 run=4 blk=1 avail=7612 (55.3%) swpO=0 conn=3 myRSS=2311 php=16 phpRSS=1699 ap=45 tcp=52 topuser=madalice 2026-09-07 13:36:34 L1=2.98 run=3 blk=1 avail=7655 (55.6%) swpO=0 conn=3 myRSS=2311 php=16 phpRSS=1739 ap=41 tcp=47 topuser=madalice 2026-09-07 13:36:34 L1=2.98 run=3 blk=1 avail=7652 (55.5%) swpO=0 conn=3 myRSS=2311 php=16 phpRSS=1740 ap=41 tcp=48 topuser=madalice 2026-09-07 13:36:44 L1=3.27 run=4 blk=1 avail=7631 (55.4%) swpO=0 conn=5 myRSS=2328 php=17 phpRSS=1812 ap=37 tcp=41 topuser=madalice 2026-09-07 13:36:44 L1=3.27 run=3 blk=1 avail=7630 (55.4%) swpO=0 conn=4 myRSS=2328 php=16 phpRSS=1771 ap=37 tcp=41 topuser=madalice 2026-09-07 13:36:54 L1=3.23 run=4 blk=1 avail=7723 (56.1%) swpO=0 conn=4 myRSS=2328 php=16 phpRSS=1699 ap=33 tcp=50 topuser=madalice 2026-09-07 13:36:54 L1=3.23 run=3 blk=1 avail=7698 (55.9%) swpO=0 conn=4 myRSS=2328 php=16 phpRSS=1721 ap=34 tcp=47 topuser=madalice 2026-09-07 13:37:04 L1=3.81 run=3 blk=1 avail=7766 (56.4%) swpO=0 conn=3 myRSS=2329 php=15 phpRSS=1622 ap=34 tcp=46 topuser=madalice 2026-09-07 13:37:04 L1=3.81 run=3 blk=1 avail=7737 (56.2%) swpO=0 conn=3 myRSS=2329 php=15 phpRSS=1647 ap=35 tcp=46 topuser=madalice 2026-09-07 13:37:14 L1=4.16 run=5 blk=1 avail=7611 (55.2%) swpO=2 conn=5 myRSS=2329 php=17 phpRSS=1805 ap=39 tcp=43 topuser=madalice 2026-09-07 13:37:15 L1=4.16 run=7 blk=1 avail=7573 (55.0%) swpO=1 conn=5 myRSS=2329 php=17 phpRSS=1838 ap=39 tcp=45 topuser=madalice 2026-09-07 13:37:24 L1=4.57 run=4 blk=1 avail=7637 (55.4%) swpO=0 conn=3 myRSS=2330 php=15 phpRSS=1614 ap=44 tcp=40 topuser=madalice 2026-09-07 13:37:25 L1=4.57 run=3 blk=1 avail=7635 (55.4%) swpO=0 conn=3 myRSS=2330 php=15 phpRSS=1616 ap=44 tcp=40 topuser=madalice 2026-09-07 13:37:35 L1=4.32 run=4 blk=1 avail=7522 (54.6%) swpO=0 conn=4 myRSS=2330 php=17 phpRSS=1830 ap=39 tcp=54 topuser=madalice 2026-09-07 13:37:35 L1=4.32 run=7 blk=1 avail=7472 (54.2%) swpO=0 conn=5 myRSS=2330 php=17 phpRSS=1886 ap=39 tcp=54 topuser=madalice 2026-09-07 13:37:45 L1=4.12 run=3 blk=1 avail=7552 (54.8%) swpO=0 conn=3 myRSS=2331 php=16 phpRSS=1740 ap=40 tcp=51 topuser=madalice 2026-09-07 13:37:45 L1=4.12 run=3 blk=1 avail=7547 (54.8%) swpO=0 conn=3 myRSS=2331 php=16 phpRSS=1756 ap=40 tcp=48 topuser=madalice 2026-09-07 13:37:55 L1=3.80 run=2 blk=1 avail=7671 (55.7%) swpO=0 conn=2 myRSS=2331 php=14 phpRSS=1576 ap=39 tcp=49 topuser=madalice 2026-09-07 13:37:55 L1=3.80 run=2 blk=1 avail=7668 (55.7%) swpO=0 conn=2 myRSS=2331 php=14 phpRSS=1580 ap=39 tcp=46 topuser=madalice 2026-09-07 13:38:05 L1=3.60 run=6 blk=1 avail=7637 (55.4%) swpO=4 conn=4 myRSS=2331 php=17 phpRSS=1704 ap=39 tcp=56 topuser=madalice 2026-09-07 13:38:05 L1=3.60 run=3 blk=1 avail=7628 (55.4%) swpO=4 conn=3 myRSS=2331 php=16 phpRSS=1674 ap=39 tcp=54 topuser=madalice 2026-09-07 13:38:15 L1=3.51 run=6 blk=1 avail=7444 (54.0%) swpO=28 conn=4 myRSS=2331 php=16 phpRSS=1831 ap=44 tcp=46 topuser=madalice 2026-09-07 13:38:15 L1=3.51 run=4 blk=1 avail=7512 (54.5%) swpO=28 conn=3 myRSS=2331 php=15 phpRSS=1735 ap=44 tcp=46 topuser=madalice 2026-09-07 13:38:25 L1=3.43 run=4 blk=1 avail=7644 (55.5%) swpO=25 conn=1 myRSS=2331 php=16 phpRSS=1737 ap=36 tcp=42 topuser=madalice 2026-09-07 13:38:25 L1=3.43 run=1 blk=1 avail=7742 (56.2%) swpO=25 conn=1 myRSS=2331 php=14 phpRSS=1570 ap=36 tcp=44 topuser=madalice 2026-09-07 13:38:35 L1=3.36 run=4 blk=1 avail=7765 (56.4%) swpO=0 conn=2 myRSS=2331 php=14 phpRSS=1575 ap=34 tcp=45 topuser=madalice 2026-09-07 13:38:35 L1=3.36 run=6 blk=1 avail=7746 (56.2%) swpO=0 conn=2 myRSS=2331 php=14 phpRSS=1577 ap=34 tcp=46 topuser=madalice