INCIDENT 2026-09-08 07:15:09 trigger: php_rss=1521MB ================================================================== load: 3.22 2.28 2.13 5/653 2853255 ncpu:10 mem_avail: 9335MB/13777MB (67.8%) swap_used:1806MB swapout:0/s blocked(D):1 running:6 iowait:8.8% steal:0.0% php: 16 procs / 1521MB heaviest user: madalice (9 procs, 1192MB) apache: 37 procs tcp_estab: 51 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1292 madalice 9 1192 root 256 621 nobody 36 597 netdata 8 239 corpkicks 1 194 evolution 14 108 cpanellogin 1 71 kurri 4 44 infinium 3 38 mailman 20 36 mailnull 4 24 aaa 2 24 dovenull 6 23 wp-toolkit 3 15 zabbix 1 12 dovecot 3 9 named 1 4 lowrange 1 4 nscd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 9 1192 corpkicks 1 196 evolution 4 97 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 8250 MB Active(file): 5021 MB Inactive(file): 3402 MB Dirty: 61 MB Writeback: 0 MB SReclaimable: 327 MB CommitLimit: 10984 MB Committed_AS: 9199 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2843413 root 00:08 1392 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : 3926885 root 7-04:52:44 5712 /usr/bin/imunify-agent-proxy 4109079 root 3-02:30:22 0 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 3-02:30:22 97032 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 1323600 5.7 Ssl 02:29:41 /usr/sbin/mariadbd 2851802 2842630 corpkicks 214092 98.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 166870 1 netdata 189736 2.8 Ssl 2-04:52:50 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1911708 1859745 root 154048 0.0 S 04:37:59 spamd child 2842471 167896 madalice 143844 17.8 S 01:11 php-fpm: pool madalice_com_au 2842478 167896 madalice 143540 18.1 R 01:11 php-fpm: pool madalice_com_au 2842595 167896 madalice 142792 18.4 S 01:07 php-fpm: pool madalice_com_au 2841304 167896 madalice 140944 9.3 S 03:09 php-fpm: pool madalice_com_au 2842472 167896 madalice 139588 17.3 S 01:11 php-fpm: pool madalice_com_au 2842474 167896 madalice 139168 19.5 S 01:11 php-fpm: pool madalice_com_au 2842533 167896 madalice 138560 15.7 S 01:10 php-fpm: pool madalice_com_au 2842476 167896 madalice 138556 17.3 S 01:11 php-fpm: pool madalice_com_au 4109105 4109079 root 97032 1.1 Sl 3-02:30:22 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2842473 167896 madalice 94920 15.8 S 01:11 php-fpm: pool madalice_com_au 2684593 1353308 cpanellogin 73424 0.0 S 49:09 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 2843434 2843408 evolution 59628 2.6 Ss 00:08 /opt/cpanel/ea-php83/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 2328754 1 root 49508 0.0 Ss 02:29:51 /usr/lib/systemd/systemd-journald 1353308 1 root 41872 0.0 Ss 48-04:33:56 cpsrvd (SSL) - waiting for connections 2853167 2842618 evolution 40628 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509236 509098 root 38188 0.0 Sl 11-04:55:30 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 167562 166914 netdata 34276 0.1 Sl 2-04:52:45 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1859745 1 root 26996 0.0 Ss 04:52:21 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2825469 506832 nobody 21980 0.0 S 06:02 /usr/sbin/httpd -k start 2840641 506832 nobody 20836 0.0 S 04:25 /usr/sbin/httpd -k start 2842445 506832 nobody 20084 0.0 S 01:18 /usr/sbin/httpd -k start 2842587 506832 nobody 20052 0.1 S 01:07 /usr/sbin/httpd -k start 2842628 506832 nobody 19776 0.0 S 01:06 /usr/sbin/httpd -k start 2842477 506832 nobody 19612 0.1 S 01:11 /usr/sbin/httpd -k start 2840644 506832 nobody 19572 0.0 S 04:25 /usr/sbin/httpd -k start 2842610 506832 nobody 19400 0.0 S 01:06 /usr/sbin/httpd -k start 2841772 506832 nobody 19332 0.0 S 02:32 /usr/sbin/httpd -k start 2842630 506832 nobody 19252 0.0 S 01:06 /usr/sbin/httpd -k start 2842447 506832 nobody 19088 0.0 S 01:18 /usr/sbin/httpd -k start 2842537 506832 nobody 18612 0.0 S 01:09 /usr/sbin/httpd -k start 2842443 506832 nobody 18580 0.0 S 01:19 /usr/sbin/httpd -k start 2825132 506832 nobody 18572 0.0 S 06:34 /usr/sbin/httpd -k start 2842635 506832 nobody 18512 0.0 S 01:06 /usr/sbin/httpd -k start 2841938 506832 nobody 18436 0.0 S 02:18 /usr/sbin/httpd -k start 2842626 506832 nobody 18324 0.0 S 01:06 /usr/sbin/httpd -k start 2842606 506832 nobody 18248 0.0 S 01:06 /usr/sbin/httpd -k start 2842613 506832 nobody 18216 0.0 S 01:06 /usr/sbin/httpd -k start 2841835 506832 nobody 18204 0.0 S 02:30 /usr/sbin/httpd -k start 167566 166914 netdata 18084 2.2 Sl 2-04:52:45 /usr/libexec/netdata/plugins.d/apps.plugin 1 2842532 506832 nobody 18064 0.0 S 01:10 /usr/sbin/httpd -k start 2824717 506832 nobody 18000 0.0 S 07:09 /usr/sbin/httpd -k start 2842549 506832 nobody 17856 0.0 S 01:08 /usr/sbin/httpd -k start 2842611 506832 nobody 17788 0.0 S 01:06 /usr/sbin/httpd -k start 2842624 506832 nobody 17680 0.0 S 01:06 /usr/sbin/httpd -k start 2842618 506832 nobody 17068 0.0 S 01:06 /usr/sbin/httpd -k start 2842636 506832 nobody 16928 0.0 S 01:06 /usr/sbin/httpd -k start 2842649 506832 nobody 16924 0.0 S 01:03 /usr/sbin/httpd -k start 2842444 506832 nobody 16864 0.0 S 01:19 /usr/sbin/httpd -k start 2842617 506832 nobody 16720 0.0 S 01:06 /usr/sbin/httpd -k start 1911709 1859745 root 16656 0.0 S 04:37:59 spamd child 2842616 506832 nobody 16596 0.0 S 01:06 /usr/sbin/httpd -k start 1471 1 root 16432 0.0 Ss 70-21:05:25 cPhulkd - processor 2842582 506832 nobody 16312 0.0 S 01:07 /usr/sbin/httpd -k start 2462240 1471 root 16076 0.0 S 01:54:23 cPhulkd - dbprocessor 2842581 506832 nobody 16064 0.0 S 01:07 /usr/sbin/httpd -k start 2843524 167382 infinium 15952 2.8 S 00:07 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 160536 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 169 evolution/portal.evolutionerp.com.au-ssl_log 139 madalice/madalice.com.au-ssl_log 82 aaa/aaadownunder.com.au-ssl_log 12 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 202 203.54.180.238 72 34.63.119.187 40 101.182.108.127 29 103.104.164.114 19 182.239.240.254 14 103.104.165.99 7 91.199.118.49 6 180.181.236.49 2 64.233.173.196 2 116.91.221.245 2 114.119.131.88 1 64.233.173.198 1 64.233.173.197 1 52.167.144.193 1 205.185.121.17 --- top request paths across all vhosts (last 3 min) --- 67 POST /functions.php 47 GET /factory_session_checker.php 38 GET /heartbeat.php 24 GET /factory_session_joiner.php 23 GET /factory_session_processed_qty.php 19 GET /app/ajax.php 14 GET /index.php 10 POST /quoteditsave.php 9 POST /app/ajax/selectFilter.php 8 POST /itemModify.php 7 POST /plugins/csvexporter/plugin.php 6 POST /app/ajax/selectFilterSingle.php 5 GET //app/ajax.php 4 POST //functions.php 4 POST /clienteditsave.php 3 GET /userlogin.php 3 GET /store/custom-nike-af1-sunflower-kids/ 3 GET //index.php 2 POST /jobeditsave.php 2 POST /invoiceaddsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 67 POST /functions.php 19 GET /app/ajax.php 12 GET /index.php 10 POST /quoteditsave.php 9 POST /app/ajax/selectFilter.php 8 POST /itemModify.php 7 POST /plugins/csvexporter/plugin.php 6 POST /app/ajax/selectFilterSingle.php 5 GET //app/ajax.php 4 POST //functions.php 4 POST /clienteditsave.php 3 GET //index.php -- last 10 requests -- 103.104.165.99 - - [08/Sep/2026:07:15:04 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 233 "https://my.evolutionerp.com.au/index.php?page=reqedit&id=6474" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 103.104.165.99 - - [08/Sep/2026:07:15:05 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 103.104.164.114 - - [08/Sep/2026:07:15:05 +1000] "POST /quoteditsave.php?call=getTheQuotes HTTP/1.1" 200 10995 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 203.54.180.238 - - [08/Sep/2026:07:15:05 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29673&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 182.239.240.254 - - [08/Sep/2026:07:15:05 +1000] "GET //index.php HTTP/1.1" 200 23341 "https://my.evolutionerp.com.au//index.php?page=purchaseadd&purchaseid=3529" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 103.104.164.114 - - [08/Sep/2026:07:15:06 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 103.104.164.114 - - [08/Sep/2026:07:15:07 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=326439&cursel=Please%20Select&curseltext=&fromMS=1&&nolimit=LIMIT%2050&include=&tid=%25%25&invjobid=0&clientid=113&r 182.239.240.254 - - [08/Sep/2026:07:15:07 +1000] "POST //functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au//index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, li 103.104.164.114 - - [08/Sep/2026:07:15:07 +1000] "GET /index.php?page=quotedit HTTP/1.1" 200 104135 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ( 103.104.164.114 - - [08/Sep/2026:07:15:08 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=16841146337 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/ind == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 47 GET /factory_session_checker.php 38 GET /heartbeat.php 24 GET /factory_session_joiner.php 23 GET /factory_session_processed_qty.php 3 GET /userlogin.php 2 GET /index.php 1 POST /portal/register 1 POST /factory_functions.php -- last 10 requests -- 203.54.180.238 - - [08/Sep/2026:07:14:54 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:07:14:56 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:07:14:59 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:07:15:00 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [08/Sep/2026:07:15:00 +1000] "GET /factory_session_joiner.php?id=35183 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [08/Sep/2026:07:14:59 +1000] "GET /heartbeat.php?sentAt=1788815699&bytes=106,159,41,83&_=1788786030047 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [08/Sep/2026:07:15:01 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:07:15:01 +1000] "GET /heartbeat.php?sentAt=1788815702&bytes=106,159,41,86&_=1788757312285 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [08/Sep/2026:07:15:02 +1000] "GET /heartbeat.php?sentAt=1788815702&bytes=106,159,41,86&_=1788815251907 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=4" 203.54.180.238 - - [08/Sep/2026:07:15:03 +1000] "GET /factory_session_joiner.php?id=35169 HTTP/1.1" 200 86 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET /store/custom-nike-af1-sunflower-kids/ 2 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 2 GET /users/login 2 GET /user/login 2 GET /signup 2 GET /signin 2 GET /sign-in 2 GET /secure 2 GET /secrets.yml 2 GET /reset-password 2 GET /register 2 GET /rclone.conf -- last 10 requests -- 34.63.119.187 - - [08/Sep/2026:07:14:23 +1000] "GET /account HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36" 34.63.119.187 - - [08/Sep/2026:07:14:24 +1000] "GET /admin HTTP/1.1" 302 1 "https://www.madalice.com.au/admin" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537 34.63.119.187 - - [08/Sep/2026:07:14:24 +1000] "GET /app HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36" 34.63.119.187 - - [08/Sep/2026:07:14:24 +1000] "GET /reset-password HTTP/1.1" 404 36692 "https://www.madalice.com.au/reset-password" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0 34.63.119.187 - - [08/Sep/2026:07:14:24 +1000] "GET /dashboard HTTP/1.1" 302 1 "https://www.madalice.com.au/dashboard" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Sa 34.63.119.187 - - [08/Sep/2026:07:14:24 +1000] "GET /admin/login HTTP/1.1" 404 36697 "https://www.madalice.com.au/admin/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 M 34.63.119.187 - - [08/Sep/2026:07:14:24 +1000] "GET /console HTTP/1.1" 404 36685 "https://www.madalice.com.au/console" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Sa 34.63.119.187 - - [08/Sep/2026:07:14:25 +1000] "GET /backoffice HTTP/1.1" 404 36685 "https://www.madalice.com.au/backoffice" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mob 34.63.119.187 - - [08/Sep/2026:07:14:25 +1000] "GET /account HTTP/1.1" 404 36683 "https://www.madalice.com.au/account" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Sa 34.63.119.187 - - [08/Sep/2026:07:14:25 +1000] "GET /portal HTTP/1.1" 404 36684 "https://www.madalice.com.au/portal" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safa --- last 30 samples (run-up to this incident) --- 2026-09-08 07:12:48 L1=1.48 run=7 blk=1 avail=10132(73.5%) swpO=3 conn=3 myRSS=1283 php=7 phpRSS=551 ap=27 tcp=45 topuser=corpkicks 2026-09-08 07:12:48 L1=1.48 run=3 blk=1 avail=10130(73.5%) swpO=3 conn=3 myRSS=1283 php=7 phpRSS=552 ap=27 tcp=45 topuser=corpkicks 2026-09-08 07:12:58 L1=1.56 run=3 blk=1 avail=10285(74.7%) swpO=6 conn=3 myRSS=1283 php=6 phpRSS=316 ap=34 tcp=47 topuser=madalice 2026-09-08 07:12:58 L1=1.56 run=2 blk=1 avail=10280(74.6%) swpO=6 conn=3 myRSS=1283 php=6 phpRSS=320 ap=34 tcp=47 topuser=madalice 2026-09-08 07:13:08 L1=1.55 run=3 blk=1 avail=10231(74.3%) swpO=0 conn=3 myRSS=1283 php=7 phpRSS=445 ap=27 tcp=43 topuser=corpkicks 2026-09-08 07:13:08 L1=1.55 run=5 blk=1 avail=10226(74.2%) swpO=0 conn=3 myRSS=1283 php=8 phpRSS=476 ap=27 tcp=44 topuser=corpkicks 2026-09-08 07:13:18 L1=1.54 run=1 blk=1 avail=10499(76.2%) swpO=0 conn=3 myRSS=1283 php=5 phpRSS=123 ap=27 tcp=43 topuser=madalice 2026-09-08 07:13:18 L1=1.54 run=2 blk=1 avail=10497(76.2%) swpO=0 conn=3 myRSS=1283 php=5 phpRSS=123 ap=27 tcp=43 topuser=madalice 2026-09-08 07:13:28 L1=1.46 run=2 blk=1 avail=10403(75.5%) swpO=0 conn=3 myRSS=1283 php=5 phpRSS=218 ap=26 tcp=39 topuser=madalice 2026-09-08 07:13:28 L1=1.46 run=2 blk=1 avail=10411(75.6%) swpO=0 conn=3 myRSS=1283 php=5 phpRSS=218 ap=26 tcp=39 topuser=madalice 2026-09-08 07:13:38 L1=1.39 run=2 blk=1 avail=10500(76.2%) swpO=0 conn=3 myRSS=1283 php=5 phpRSS=149 ap=22 tcp=34 topuser=madalice 2026-09-08 07:13:38 L1=1.39 run=3 blk=1 avail=10511(76.3%) swpO=0 conn=3 myRSS=1283 php=5 phpRSS=149 ap=22 tcp=34 topuser=madalice 2026-09-08 07:13:49 L1=1.33 run=4 blk=1 avail=10386(75.4%) swpO=0 conn=3 myRSS=1283 php=7 phpRSS=337 ap=21 tcp=39 topuser=madalice 2026-09-08 07:13:49 L1=1.33 run=5 blk=1 avail=10388(75.4%) swpO=0 conn=2 myRSS=1283 php=7 phpRSS=338 ap=21 tcp=40 topuser=madalice 2026-09-08 07:13:59 L1=1.57 run=9 blk=1 avail=9489 (68.9%) swpO=31 conn=3 myRSS=1283 php=12 phpRSS=1256 ap=34 tcp=61 topuser=madalice 2026-09-08 07:13:59 L1=1.57 run=13 blk=1 avail=9461 (68.7%) swpO=31 conn=2 myRSS=1283 php=12 phpRSS=1316 ap=34 tcp=62 topuser=madalice 2026-09-08 07:14:09 L1=2.09 run=8 blk=2 avail=8464 (61.4%) swpO=170 conn=7 myRSS=1287 php=14 phpRSS=1895 ap=97 tcp=107 topuser=madalice 2026-09-08 07:14:09 L1=2.09 run=9 blk=1 avail=8452 (61.3%) swpO=199 conn=6 myRSS=1287 php=14 phpRSS=1832 ap=97 tcp=107 topuser=madalice 2026-09-08 07:14:19 L1=2.43 run=12 blk=1 avail=8606 (62.5%) swpO=63 conn=11 myRSS=1288 php=14 phpRSS=1881 ap=88 tcp=50 topuser=madalice 2026-09-08 07:14:19 L1=3.60 run=10 blk=1 avail=8440 (61.3%) swpO=98 conn=10 myRSS=1288 php=14 phpRSS=1846 ap=87 tcp=51 topuser=madalice 2026-09-08 07:14:29 L1=4.11 run=2 blk=1 avail=8808 (63.9%) swpO=13 conn=3 myRSS=1289 php=14 phpRSS=1707 ap=77 tcp=52 topuser=madalice 2026-09-08 07:14:29 L1=4.02 run=2 blk=1 avail=8807 (63.9%) swpO=7 conn=3 myRSS=1289 php=14 phpRSS=1707 ap=77 tcp=52 topuser=madalice 2026-09-08 07:14:39 L1=3.71 run=3 blk=1 avail=8986 (65.2%) swpO=0 conn=1 myRSS=1291 php=14 phpRSS=1586 ap=67 tcp=42 topuser=madalice 2026-09-08 07:14:39 L1=3.71 run=2 blk=1 avail=8985 (65.2%) swpO=0 conn=2 myRSS=1291 php=14 phpRSS=1588 ap=67 tcp=43 topuser=madalice 2026-09-08 07:14:49 L1=3.29 run=2 blk=1 avail=9059 (65.8%) swpO=0 conn=1 myRSS=1291 php=13 phpRSS=1548 ap=57 tcp=35 topuser=madalice 2026-09-08 07:14:50 L1=3.29 run=2 blk=1 avail=9052 (65.7%) swpO=0 conn=2 myRSS=1291 php=14 phpRSS=1588 ap=57 tcp=37 topuser=madalice 2026-09-08 07:14:59 L1=3.16 run=2 blk=1 avail=9170 (66.6%) swpO=0 conn=1 myRSS=1291 php=13 phpRSS=1512 ap=47 tcp=48 topuser=madalice 2026-09-08 07:15:00 L1=3.16 run=1 blk=1 avail=9158 (66.5%) swpO=0 conn=2 myRSS=1291 php=14 phpRSS=1552 ap=47 tcp=46 topuser=madalice 2026-09-08 07:15:09 L1=3.22 run=6 blk=1 avail=9335 (67.8%) swpO=0 conn=5 myRSS=1292 php=16 phpRSS=1521 ap=37 tcp=51 topuser=madalice 2026-09-08 07:15:10 L1=3.22 run=8 blk=2 avail=9286 (67.4%) swpO=0 conn=5 myRSS=1292 php=17 phpRSS=1604 ap=37 tcp=48 topuser=madalice