INCIDENT 2026-09-08 06:50:41 trigger: php_rss=1559MB ================================================================== load: 2.40 2.18 1.99 10/627 2770696 ncpu:10 mem_avail: 9399MB/13777MB (68.2%) swap_used:1790MB swapout:13/s blocked(D):1 running:9 iowait:8.1% steal:0.0% php: 14 procs / 1559MB heaviest user: madalice (4 procs, 486MB) apache: 27 procs tcp_estab: 43 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1242 root 249 571 madalice 4 494 corpkicks 2 442 nobody 26 427 infinium 4 261 netdata 8 244 olympic 2 224 evolution 11 189 aaa 4 46 mailman 20 36 cpanellogin 1 36 mailnull 4 23 dovenull 6 23 kurri 2 22 lowrange 2 17 wp-toolkit 3 15 zabbix 1 12 dovecot 3 9 named 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 4 496 corpkicks 2 444 infinium 2 240 olympic 2 225 evolution 3 185 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 9024 MB Active(file): 5721 MB Inactive(file): 3478 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 332 MB CommitLimit: 10984 MB Committed_AS: 8995 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 7-04:28:16 6044 /usr/bin/imunify-agent-proxy 4109079 root 3-02:05:54 0 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 3-02:05:54 100484 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 1271928 5.0 Ssl 02:05:13 /usr/sbin/mariadbd 2770649 2754642 corpkicks 284764 51.3 S 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2770656 2754197 evolution 192640 120 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 166870 1 netdata 191936 2.8 Ssl 2-04:28:22 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2770662 2755276 corpkicks 179248 89.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2754469 167896 madalice 178544 10.9 S 03:20 php-fpm: pool madalice_com_au 1911708 1859745 root 156000 0.0 S 04:13:31 spamd child 2770648 2755793 olympic 133868 54.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2770664 2770629 infinium 126452 63.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 2770642 2754739 infinium 125716 38.5 S 00:04 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 2755275 167896 madalice 124500 3.7 R 01:44 php-fpm: pool madalice_com_au 2755278 167896 madalice 114728 5.1 S 01:44 php-fpm: pool madalice_com_au 2770663 2770542 olympic 100800 73.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4109105 4109079 root 100484 1.1 Sl 3-02:05:54 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2755271 167896 madalice 98576 5.0 S 01:45 php-fpm: pool madalice_com_au 1353308 1 root 42248 0.0 Ss 48-04:09:28 cpsrvd (SSL) - waiting for connections 2328754 1 root 41892 0.0 Ss 02:05:23 /usr/lib/systemd/systemd-journald 509236 509098 root 39664 0.0 Sl 11-04:31:02 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 2684593 1353308 cpanellogin 37472 0.0 S 24:41 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 167562 166914 netdata 36360 0.1 Sl 2-04:28:17 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1859745 1 root 27240 0.0 Ss 04:27:53 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2754197 506832 nobody 22048 0.1 S 03:50 /usr/sbin/httpd -k start 2755016 506832 nobody 21820 0.1 S 02:15 /usr/sbin/httpd -k start 2753397 506832 nobody 21096 0.1 S 05:14 /usr/sbin/httpd -k start 2754739 506832 nobody 20768 0.1 S 02:49 /usr/sbin/httpd -k start 2755276 506832 nobody 20188 0.1 S 01:44 /usr/sbin/httpd -k start 2755277 506832 nobody 19592 0.1 S 01:44 /usr/sbin/httpd -k start 2754642 506832 nobody 19308 0.1 S 02:59 /usr/sbin/httpd -k start 2755463 506832 nobody 19024 0.0 S 01:28 /usr/sbin/httpd -k start 2755417 506832 nobody 18696 0.1 S 01:30 /usr/sbin/httpd -k start 167566 166914 netdata 18108 2.2 Sl 2-04:28:17 /usr/libexec/netdata/plugins.d/apps.plugin 1 2755416 506832 nobody 17760 0.0 S 01:30 /usr/sbin/httpd -k start 2755794 506832 nobody 17608 0.0 S 00:44 /usr/sbin/httpd -k start 2755795 506832 nobody 17532 0.2 S 00:44 /usr/sbin/httpd -k start 2755793 506832 nobody 17428 0.0 S 00:44 /usr/sbin/httpd -k start 2755777 506832 nobody 17284 0.0 S 00:46 /usr/sbin/httpd -k start 1911709 1859745 root 16956 0.0 S 04:13:31 spamd child 1471 1 root 16912 0.0 Ss 70-20:40:57 cPhulkd - processor 2755797 506832 nobody 16888 0.1 S 00:44 /usr/sbin/httpd -k start 2755781 506832 nobody 16884 0.0 S 00:45 /usr/sbin/httpd -k start 2755798 506832 nobody 16780 0.0 S 00:44 /usr/sbin/httpd -k start 2770629 506832 nobody 16760 0.1 S 00:06 /usr/sbin/httpd -k start 2462240 1471 root 16476 0.0 S 01:29:55 cPhulkd - dbprocessor 2770542 506832 nobody 16328 0.1 S 00:17 /usr/sbin/httpd -k start 2770473 506832 nobody 16248 0.0 S 00:22 /usr/sbin/httpd -k start 2770652 506832 nobody 16172 0.5 S 00:02 /usr/sbin/httpd -k start 2770645 506832 nobody 15836 0.0 S 00:03 /usr/sbin/httpd -k start 2770653 506832 nobody 15636 0.0 S 00:02 /usr/sbin/httpd -k start 2755782 506832 nobody 15460 0.0 S 00:45 /usr/sbin/httpd -k start 1463 1 root 13164 0.0 Ss 70-20:40:57 tailwatchd 2738505 167382 lowrange 12940 0.0 S 06:20 dovecot/pop3 483898 1 zabbix 12784 0.2 Ssl 11-04:32:19 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1469 1 root 12560 0.1 Ss 70-20:40:57 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2753399 167382 kurri 12192 0.0 S 05:14 dovecot/imap 2737800 167382 aaa 11964 0.0 S 07:37 dovecot/imap 2737934 167382 aaa 11948 0.0 S 07:22 dovecot/imap 2737979 167382 aaa 11872 0.0 S 07:14 dovecot/imap 2754663 167382 infinium 11836 0.0 S 02:56 dovecot/imap 2737700 167382 aaa 11756 0.0 S 07:46 dovecot/imap 2755258 167382 infinium 11752 0.0 S 01:49 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+--------------------+--------------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+--------------------+--------------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 112020 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 112012 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Sending data | SELECT QpCIPREUS_posts.* FROM QpCIPREUS_posts LEFT JOIN QpCIPREUS_term_relationships ON (QpCIPREUS_posts.ID = QpCIPREUS_term_relationships.object_id) WHERE 1=1 AND ( QpCIPREUS_term_relationships.term_taxonomy_id IN (9) ) AND QpCIPREUS_posts.post_type = 'nav_menu_item' AND ((QpCIPR | | 112005 | olympic_wp | olympic_wp | Query | 0 | Statistics | SELECT a.*, g.slug AS `group` FROM nqNZ24_actionscheduler_actions a LEFT JOIN nqNZ24_actionscheduler_groups g ON a.group_id=g.group_id WHERE a.action_id=42681 | +--------+--------------------+--------------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min olytis/tis.com.au-ssl_log 261 evolution/my.evolutionerp.com.au-ssl_log 179 candyfabcom/candyfab.com.au-ssl_log 119 madalice/madalice.com.au-ssl_log 77 evolution/portal.evolutionerp.com.au-ssl_log 43 speedlin/speedlinefencing.com.au-ssl_log 16 corpkicks/corporatekicks.com.au-ssl_log 1 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 261 34.166.250.101 118 34.118.111.161 71 203.54.180.238 68 91.199.118.49 66 182.239.240.254 26 101.182.108.127 24 103.104.165.99 18 116.91.221.245 9 146.70.178.252 7 141.98.11.42 7 103.104.164.114 4 40.77.167.72 2 52.167.144.147 2 136.243.146.219 2 120.150.225.142 --- top request paths across all vhosts (last 3 min) --- 67 POST /functions.php 39 GET /heartbeat.php 34 GET /app/ajax.php 22 GET /index.php 13 POST /app/ajax.php 11 GET / 9 POST / 8 POST /app/ajax/selectFilter.php 6 POST /plugins/csvexporter/plugin.php 6 POST /clienteditsave.php 6 POST /app/ajax/selectFilterSingle.php 3 POST /php/php.exe 3 POST /php/php-cgi.exe 3 POST /php-cgi/php-cgi.exe 3 POST /logsave.php 3 POST /jobaddsave.php 3 POST /cgi/php 3 POST /cgi-bin/php-cgi.exe 3 POST /cgi-bin/php-cgi 3 POST /cgi-bin/php8.exe --- busiest 3 vhosts: top paths + last 10 requests --- == olytis/tis.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env -- last 10 requests -- 34.166.250.101 - - [08/Sep/2026:06:50:14 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.250.101 - - [08/Sep/2026:06:50:14 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.250.101 - - [08/Sep/2026:06:50:14 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.250.101 - - [08/Sep/2026:06:50:15 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.250.101 - - [08/Sep/2026:06:50:15 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.250.101 - - [08/Sep/2026:06:50:15 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.250.101 - - [08/Sep/2026:06:50:16 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.250.101 - - [08/Sep/2026:06:50:16 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.250.101 - - [08/Sep/2026:06:50:16 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.166.250.101 - - [08/Sep/2026:06:50:16 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 67 POST /functions.php 34 GET /app/ajax.php 20 GET /index.php 13 POST /app/ajax.php 8 POST /app/ajax/selectFilter.php 6 POST /plugins/csvexporter/plugin.php 6 POST /clienteditsave.php 6 POST /app/ajax/selectFilterSingle.php 3 POST /logsave.php 3 POST /jobaddsave.php 3 GET / 2 POST /itemModify.php -- last 10 requests -- 203.54.180.238 - - [08/Sep/2026:06:50:25 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 203.54.180.238 - - [08/Sep/2026:06:50:25 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=purchasereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 182.239.240.254 - - [08/Sep/2026:06:50:25 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=STUB HTTP/1.1" 200 1035 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=4267&tab=jobeditinv" "Mozilla/5.0 116.91.221.245 - - [08/Sep/2026:06:50:26 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 280 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=70&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 182.239.240.254 - - [08/Sep/2026:06:50:28 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter= HTTP/1.1" 200 12302 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=4267&tab=jobeditinv" "Mozilla/5.0 (Wi 203.54.180.238 - - [08/Sep/2026:06:50:28 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 182.239.240.254 - - [08/Sep/2026:06:50:31 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=BL HTTP/1.1" 200 14203 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=4267&tab=jobeditinv" "Mozilla/5.0 ( 182.239.240.254 - - [08/Sep/2026:06:50:32 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=BLANKET HTTP/1.1" 200 1329 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=4267&tab=jobeditinv" "Mozilla/5 182.239.240.254 - - [08/Sep/2026:06:50:34 +1000] "POST /itemModify.php?call=getInvMFMeta&modifyid=1854 HTTP/1.1" 200 256 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=4267&tab=jobeditinv" "Mozilla/5.0 (Window 182.239.240.254 - - [08/Sep/2026:06:50:34 +1000] "POST /itemModify.php?call=getBOM HTTP/1.1" 200 22 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=4267&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 5 GET / 3 POST /php/php.exe 3 POST /php/php-cgi.exe 3 POST /php-cgi/php-cgi.exe 3 POST /cgi/php 3 POST /cgi-bin/php-cgi.exe 3 POST /cgi-bin/php-cgi 3 POST /cgi-bin/php8.exe 3 POST /cgi-bin/php8 3 POST /cgi-bin/php5 3 POST /cgi-bin/php 3 POST / -- last 10 requests -- 34.118.111.161 - - [08/Sep/2026:06:49:52 +1000] "POST /cgi-bin/php5?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM 34.118.111.161 - - [08/Sep/2026:06:49:54 +1000] "POST /cgi-bin/php5?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp://input HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, l 34.118.111.161 - - [08/Sep/2026:06:49:57 +1000] "POST /cgi-bin/php5 HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.118.111.161 - - [08/Sep/2026:06:49:58 +1000] "POST /cgi-bin/php8?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM 34.118.111.161 - - [08/Sep/2026:06:50:00 +1000] "POST /cgi-bin/php8?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp://input HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, l 34.118.111.161 - - [08/Sep/2026:06:50:02 +1000] "POST /cgi-bin/php8 HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.118.111.161 - - [08/Sep/2026:06:50:03 +1000] "POST /cgi/php?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, li 34.118.111.161 - - [08/Sep/2026:06:50:05 +1000] "POST /cgi/php?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp://input HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G 34.118.111.161 - - [08/Sep/2026:06:50:06 +1000] "POST /cgi/php HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.118.111.161 - - [08/Sep/2026:06:50:08 +1000] "POST /cgi/php-cgi?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML --- last 30 samples (run-up to this incident) --- 2026-09-08 06:48:20 L1=3.16 run=2 blk=1 avail=10362(75.2%) swpO=0 conn=3 myRSS=1232 php=6 phpRSS=353 ap=22 tcp=44 topuser=madalice 2026-09-08 06:48:21 L1=3.16 run=4 blk=1 avail=10368(75.3%) swpO=0 conn=1 myRSS=1232 php=6 phpRSS=356 ap=22 tcp=45 topuser=madalice 2026-09-08 06:48:30 L1=3.43 run=1 blk=1 avail=10322(74.9%) swpO=0 conn=3 myRSS=1232 php=6 phpRSS=353 ap=29 tcp=47 topuser=madalice 2026-09-08 06:48:31 L1=3.43 run=1 blk=1 avail=10331(75.0%) swpO=0 conn=1 myRSS=1232 php=5 phpRSS=314 ap=29 tcp=48 topuser=madalice 2026-09-08 06:48:40 L1=3.37 run=3 blk=1 avail=10341(75.1%) swpO=0 conn=3 myRSS=1232 php=6 phpRSS=353 ap=27 tcp=47 topuser=madalice 2026-09-08 06:48:41 L1=3.37 run=2 blk=1 avail=10345(75.1%) swpO=0 conn=1 myRSS=1232 php=5 phpRSS=318 ap=27 tcp=47 topuser=madalice 2026-09-08 06:48:50 L1=3.00 run=1 blk=1 avail=10391(75.4%) swpO=0 conn=3 myRSS=1232 php=6 phpRSS=353 ap=22 tcp=36 topuser=madalice 2026-09-08 06:48:51 L1=3.00 run=1 blk=1 avail=10397(75.5%) swpO=0 conn=1 myRSS=1232 php=5 phpRSS=314 ap=21 tcp=35 topuser=madalice 2026-09-08 06:49:00 L1=2.77 run=1 blk=1 avail=10036(72.8%) swpO=9 conn=3 myRSS=1233 php=8 phpRSS=708 ap=22 tcp=44 topuser=madalice 2026-09-08 06:49:01 L1=2.77 run=1 blk=1 avail=10047(72.9%) swpO=9 conn=1 myRSS=1233 php=8 phpRSS=708 ap=22 tcp=43 topuser=madalice 2026-09-08 06:49:11 L1=2.81 run=2 blk=1 avail=9770 (70.9%) swpO=0 conn=3 myRSS=1233 php=10 phpRSS=1051 ap=22 tcp=49 topuser=madalice 2026-09-08 06:49:11 L1=2.81 run=10 blk=1 avail=9650 (70.0%) swpO=3 conn=1 myRSS=1233 php=13 phpRSS=1213 ap=26 tcp=53 topuser=madalice 2026-09-08 06:49:21 L1=2.53 run=2 blk=1 avail=10440(75.8%) swpO=3 conn=3 myRSS=1233 php=8 phpRSS=321 ap=26 tcp=37 topuser=madalice 2026-09-08 06:49:21 L1=2.53 run=1 blk=1 avail=10458(75.9%) swpO=0 conn=1 myRSS=1233 php=8 phpRSS=309 ap=25 tcp=38 topuser=madalice 2026-09-08 06:49:31 L1=2.30 run=1 blk=1 avail=10538(76.5%) swpO=0 conn=3 myRSS=1233 php=8 phpRSS=252 ap=22 tcp=42 topuser=madalice 2026-09-08 06:49:31 L1=2.30 run=2 blk=1 avail=10537(76.5%) swpO=0 conn=1 myRSS=1233 php=8 phpRSS=250 ap=22 tcp=41 topuser=madalice 2026-09-08 06:49:41 L1=2.10 run=1 blk=1 avail=10448(75.8%) swpO=0 conn=1 myRSS=1233 php=8 phpRSS=341 ap=22 tcp=39 topuser=madalice 2026-09-08 06:49:41 L1=2.10 run=1 blk=1 avail=10448(75.8%) swpO=0 conn=1 myRSS=1233 php=8 phpRSS=341 ap=22 tcp=39 topuser=madalice 2026-09-08 06:49:51 L1=1.93 run=1 blk=1 avail=10517(76.3%) swpO=0 conn=1 myRSS=1238 php=8 phpRSS=268 ap=22 tcp=34 topuser=madalice 2026-09-08 06:49:51 L1=1.93 run=2 blk=1 avail=10518(76.3%) swpO=0 conn=1 myRSS=1238 php=8 phpRSS=268 ap=22 tcp=34 topuser=madalice 2026-09-08 06:50:01 L1=1.78 run=3 blk=1 avail=10399(75.5%) swpO=0 conn=1 myRSS=1240 php=9 phpRSS=317 ap=35 tcp=46 topuser=madalice 2026-09-08 06:50:01 L1=1.78 run=2 blk=1 avail=10370(75.3%) swpO=0 conn=2 myRSS=1240 php=9 phpRSS=351 ap=35 tcp=46 topuser=madalice 2026-09-08 06:50:11 L1=1.97 run=2 blk=1 avail=10114(73.4%) swpO=0 conn=1 myRSS=1241 php=8 phpRSS=538 ap=26 tcp=39 topuser=madalice 2026-09-08 06:50:11 L1=1.97 run=2 blk=1 avail=10121(73.5%) swpO=0 conn=2 myRSS=1241 php=8 phpRSS=538 ap=25 tcp=41 topuser=madalice 2026-09-08 06:50:21 L1=1.90 run=2 blk=1 avail=10308(74.8%) swpO=0 conn=1 myRSS=1241 php=8 phpRSS=494 ap=22 tcp=41 topuser=madalice 2026-09-08 06:50:21 L1=1.90 run=1 blk=1 avail=10309(74.8%) swpO=0 conn=2 myRSS=1241 php=8 phpRSS=494 ap=22 tcp=41 topuser=madalice 2026-09-08 06:50:31 L1=1.99 run=2 blk=1 avail=10154(73.7%) swpO=0 conn=1 myRSS=1241 php=8 phpRSS=663 ap=23 tcp=43 topuser=madalice 2026-09-08 06:50:31 L1=1.99 run=2 blk=1 avail=10091(73.2%) swpO=0 conn=2 myRSS=1241 php=8 phpRSS=725 ap=23 tcp=42 topuser=madalice 2026-09-08 06:50:41 L1=2.40 run=9 blk=1 avail=9399 (68.2%) swpO=13 conn=9 myRSS=1242 php=14 phpRSS=1559 ap=27 tcp=43 topuser=madalice 2026-09-08 06:50:41 L1=2.40 run=8 blk=1 avail=9577 (69.5%) swpO=13 conn=2 myRSS=1242 php=13 phpRSS=1356 ap=27 tcp=44 topuser=madalice