INCIDENT 2026-09-08 12:16:49 trigger: php_rss=1729MB ================================================================== load: 2.22 2.00 2.31 12/699 3970647 ncpu:10 mem_avail: 8142MB/13777MB (59.1%) swap_used:1950MB swapout:167/s blocked(D):1 running:13 iowait:9.4% steal:0.0% php: 13 procs / 1729MB heaviest user: madalice (10 procs, 1727MB) apache: 91 procs tcp_estab: 113 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1861 madalice 10 1619 nobody 89 1085 root 251 818 netdata 8 230 cpanellogin 1 66 evolution 11 57 alison 5 56 mailman 20 36 dovenull 6 26 kurri 2 21 mailnull 3 15 wp-toolkit 3 12 lowrange 1 12 zabbix 1 9 dovecot 3 9 named 1 5 sshd 1 4 nscd 1 4 dbus 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1633 evolution 3 55 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7532 MB Active(file): 6752 MB Inactive(file): 970 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 409 MB CommitLimit: 10984 MB Committed_AS: 10133 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3900632 root 16:48 3260 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 7-09:54:24 3244 /usr/bin/imunify-agent-proxy 4109079 root 3-07:32:02 40 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 3-07:32:02 112204 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 1906340 20.1 Ssl 07:31:21 /usr/sbin/mariadbd 3970517 167896 madalice 254080 40.0 S 00:06 php-fpm: pool madalice_com_au 3970572 167896 madalice 196188 94.0 R 00:01 php-fpm: pool madalice_com_au 166870 1 netdata 186756 2.8 Ssl 2-09:54:30 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1911708 1859745 root 175640 0.1 S 09:39:39 spamd child 3970026 167896 madalice 162348 14.1 S 00:53 php-fpm: pool madalice_com_au 3970519 167896 madalice 159212 41.1 S 00:06 php-fpm: pool madalice_com_au 3970518 167896 madalice 158936 53.1 S 00:06 php-fpm: pool madalice_com_au 3970525 167896 madalice 158756 39.8 S 00:06 php-fpm: pool madalice_com_au 1911709 1859745 root 143720 0.0 S 09:39:39 spamd child 3970578 167896 madalice 143448 66.0 R 00:01 php-fpm: pool madalice_com_au 3970569 167896 madalice 137972 72.5 R 00:02 php-fpm: pool madalice_com_au 3970579 167896 madalice 135628 62.0 R 00:01 php-fpm: pool madalice_com_au 3970577 167896 madalice 125016 55.0 R 00:01 php-fpm: pool madalice_com_au 2328754 1 root 118552 0.0 Ss 07:31:31 /usr/lib/systemd/systemd-journald 4109105 4109079 root 112204 1.2 Sl 3-07:32:02 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 3673446 1353308 cpanellogin 67972 0.0 S 01:18:14 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 3970634 3970222 evolution 57108 0.0 S 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1353308 1 root 37292 0.0 Ss 48-09:35:36 cpsrvd (SSL) - waiting for connections 509236 509098 root 35280 0.0 Sl 11-09:57:10 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 167562 166914 netdata 31756 0.1 Sl 2-09:54:25 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1859745 1 root 27808 0.0 Ss 09:54:01 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3953709 506832 nobody 22536 0.1 S 03:42 /usr/sbin/httpd -k start 3970615 1469 root 22132 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3954850 506832 nobody 21116 0.2 S 01:53 /usr/sbin/httpd -k start 3953417 506832 nobody 20236 0.0 S 04:09 /usr/sbin/httpd -k start 3969937 506832 nobody 19324 0.0 S 01:01 /usr/sbin/httpd -k start 3953810 506832 nobody 19312 0.0 S 03:32 /usr/sbin/httpd -k start 3953366 506832 nobody 19164 0.0 S 04:11 /usr/sbin/httpd -k start 3969939 506832 nobody 18948 0.0 S 01:01 /usr/sbin/httpd -k start 3954856 506832 nobody 18624 0.0 S 01:52 /usr/sbin/httpd -k start 3969931 506832 nobody 18408 0.0 S 01:02 /usr/sbin/httpd -k start 3969517 506832 nobody 18312 0.0 S 01:32 /usr/sbin/httpd -k start 3953407 506832 nobody 18268 0.0 S 04:10 /usr/sbin/httpd -k start 3952017 506832 nobody 18244 0.0 S 05:56 /usr/sbin/httpd -k start 3970234 506832 nobody 18120 0.0 S 00:37 /usr/sbin/httpd -k start 3954857 506832 nobody 17920 0.0 S 01:52 /usr/sbin/httpd -k start 3952989 506832 nobody 17788 0.0 S 04:40 /usr/sbin/httpd -k start 3970558 506832 nobody 17724 1.0 S 00:02 /usr/sbin/httpd -k start 3970560 506832 nobody 17724 0.5 S 00:02 /usr/sbin/httpd -k start 3970557 506832 nobody 17700 0.5 S 00:02 /usr/sbin/httpd -k start 3970563 506832 nobody 17696 0.5 S 00:02 /usr/sbin/httpd -k start 3970251 506832 nobody 17684 0.0 S 00:34 /usr/sbin/httpd -k start 3970561 506832 nobody 17660 0.5 S 00:02 /usr/sbin/httpd -k start 3953803 506832 nobody 17468 0.0 S 03:33 /usr/sbin/httpd -k start 3970552 506832 nobody 17464 0.5 S 00:02 /usr/sbin/httpd -k start 3970581 506832 nobody 17348 0.0 S 00:01 /usr/sbin/httpd -k start 3970149 506832 nobody 17324 0.0 S 00:43 /usr/sbin/httpd -k start 3970222 506832 nobody 16512 0.0 S 00:39 /usr/sbin/httpd -k start 3970154 506832 nobody 16368 0.0 S 00:42 /usr/sbin/httpd -k start 3970452 506832 nobody 16328 0.0 S 00:12 /usr/sbin/httpd -k start 3970545 506832 nobody 16096 0.0 S 00:03 /usr/sbin/httpd -k start 3970317 506832 nobody 16092 0.0 S 00:29 /usr/sbin/httpd -k start 3970451 506832 nobody 16056 0.0 S 00:12 /usr/sbin/httpd -k start 3970521 506832 nobody 15872 0.1 S 00:06 /usr/sbin/httpd -k start 167566 166914 netdata 15728 2.2 Sl 2-09:54:25 /usr/libexec/netdata/plugins.d/apps.plugin 1 3970445 506832 nobody 15692 0.0 S 00:13 /usr/sbin/httpd -k start 3970551 506832 nobody 15512 0.0 S 00:02 /usr/sbin/httpd -k start 3970564 506832 nobody 15312 0.0 S 00:02 /usr/sbin/httpd -k start 3970531 506832 nobody 15228 0.0 S 00:04 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+---------------+---------+------+----------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+---------------+---------+------+----------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 2018120 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 2018119 | root | 85-1559715131 | Execute | 0 | Sending data | UPDATE quotes set total = (select SUM(round(cast(quoteitems.adjPrice as decimal(15,4))*quoteitems.qty,2)) from quoteitems where quoteitems.quoteid = quotes.id and quoteitems.status=1) where quotes.id = ? | +---------+------+---------------+---------+------+----------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 373 evolution/portal.evolutionerp.com.au-ssl_log 221 madalice/madalice.com.au-ssl_log 47 evolution/evolutionerp.com.au-ssl_log 8 vinesit/vinesit.com.au-ssl_log 8 aaa/aaadownunder.com.au-ssl_log 5 tubesupplies/tubesupplies.com.au-ssl_log 4 alison/alisonarts.com.au-ssl_log 3 corpkicks/corporatekicks.com.au-ssl_log 3 olympic/olympicfencing.com.au-ssl_log 3 otterfencing/otterfencing.com.au-ssl_log 3 kurri/kurrimotorinn.com.au-ssl_log 2 lowrange/lowrange.com.au-ssl_log 2 olytis/tis.com.au-ssl_log 2 coscom/coscom.com.au 1 (total vhosts taking traffic: 17) --- top client IPs across all vhosts (last 3 min) --- 387 203.54.180.238 62 103.104.165.99 54 116.91.221.245 48 136.66.17.223 37 1.141.176.34 13 103.104.164.114 11 203.166.236.147 11 180.181.236.49 9 182.239.240.254 9 118.127.40.55 8 120.20.96.253 7 37.30.46.37 4 165.225.233.89 2 93.91.156.82 2 91.92.243.248 --- top request paths across all vhosts (last 3 min) --- 212 POST /functions.php 94 GET /factory_session_checker.php 48 GET /factory_session_processed_qty.php 48 GET /factory_session_joiner.php 40 GET /app/ajax.php 31 GET /heartbeat.php 22 POST /plugins/csvexporter/plugin.php 22 GET /index.php 10 POST /quoteditsave.php 9 POST /wp-cron.php 9 POST /app/ajax/selectFilter.php 9 GET / 8 POST /wp-login.php 8 POST /itemModify.php 8 POST /clienteditsave.php 7 POST /inveditsave.php 7 GET /quoteditsave.php 6 POST /app/ajax/selectFilterSingle.php 6 POST /app/ajax.php 5 POST /logsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 212 POST /functions.php 40 GET /app/ajax.php 22 POST /plugins/csvexporter/plugin.php 22 GET /index.php 10 POST /quoteditsave.php 9 POST /app/ajax/selectFilter.php 8 POST /itemModify.php 8 POST /clienteditsave.php 7 POST /inveditsave.php 7 GET /quoteditsave.php 6 POST /app/ajax/selectFilterSingle.php 6 POST /app/ajax.php -- last 10 requests -- 203.54.180.238 - - [08/Sep/2026:12:16:34 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=27120&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 116.91.221.245 - - [08/Sep/2026:12:16:34 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=inventory&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 1.141.176.34 - - [08/Sep/2026:12:16:34 +1000] "POST /quoteditsave.php?itemid=5254&call=getKit&mode=true&discount=35 HTTP/1.1" 200 972 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37154§ionid=32995" 103.104.165.99 - - [08/Sep/2026:12:16:34 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 1.141.176.34 - - [08/Sep/2026:12:16:34 +1000] "POST /itemModify.php?call=getInvMFMeta&modifyid=5254 HTTP/1.1" 200 49 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37154§ionid=32995" "Mozilla/5.0 (Wi 1.141.176.34 - - [08/Sep/2026:12:16:34 +1000] "POST /itemModify.php?call=getBOM HTTP/1.1" 200 22 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37154§ionid=32995" "Mozilla/5.0 (Windows NT 10.0; Win64 203.54.180.238 - - [08/Sep/2026:12:16:35 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 233 "https://my.evolutionerp.com.au/index.php?page=invedit&id=4749&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 1.141.176.34 - - [08/Sep/2026:12:16:36 +1000] "GET /quoteditsave.php?itemid=3771&call=getKit&mode=true&discount=35&level=1 HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37154§ionid= 203.54.180.238 - - [08/Sep/2026:12:16:36 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 116.91.221.245 - - [08/Sep/2026:12:16:37 +1000] "POST /inveditsave.php?call=fetch_inventory HTTP/1.1" 200 11383 "https://my.evolutionerp.com.au/index.php?page=inventory&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 94 GET /factory_session_checker.php 48 GET /factory_session_processed_qty.php 48 GET /factory_session_joiner.php 31 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [08/Sep/2026:12:16:33 +1000] "GET /heartbeat.php?sentAt=1788833793&bytes=106,159,112,1&_=1788832683771 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=13" 203.54.180.238 - - [08/Sep/2026:12:16:36 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 127 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [08/Sep/2026:12:16:36 +1000] "GET /factory_session_joiner.php?id=35199 HTTP/1.1" 200 115 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleW 203.54.180.238 - - [08/Sep/2026:12:16:36 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [08/Sep/2026:12:16:36 +1000] "GET /factory_session_joiner.php?id=35197 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [08/Sep/2026:12:16:37 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:12:16:37 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:12:16:38 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:12:16:39 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 123 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [08/Sep/2026:12:16:39 +1000] "GET /factory_session_joiner.php?id=35192 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe == madalice/madalice.com.au-ssl_log == -- top paths -- 2 GET /store/harley-davidson-hand-painted-vans-sz11/ 2 GET /store/hand-painted-nike-cartoonsketchy/ 2 GET /@fs/root/rootkey.csv 2 GET /@fs/root/.aws/credentials.bak 2 GET /@fs/proc/self/environ 2 GET /@fs/etc/passwd 2 GET /@fs/app/rootkey.csv 2 GET /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ 1 POST / 1 GET /store/pink-lemonade-nike-af1/ 1 GET /store/hand-painted-vans-old-skool-roses/ 1 GET /store/hand-painted-rainbow/ -- last 10 requests -- 136.66.17.223 - - [08/Sep/2026:12:16:48 +1000] "GET /@fs/usr/src/app/.env?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; rv:121.11) Gecko/20100101 Firefox/121.11; compatible; Perplexity-User/1.0; +https://perp 136.66.17.223 - - [08/Sep/2026:12:16:49 +1000] "GET /@fs/app/.env.local?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:127.5) Gecko/20100101 Firefox/127.5; compatible; TelegramBot/1.0" 136.66.17.223 - - [08/Sep/2026:12:16:48 +1000] "GET /@fs/app/rootkey.csv?raw?? HTTP/1.1" 404 36621 "https://www.madalice.com.au/@fs/app/rootkey.csv?raw??" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; 136.66.17.223 - - [08/Sep/2026:12:16:48 +1000] "GET /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw?? HTTP/1.1" 404 36644 "https://www.madalice.com.au/@fs/..%252f..%252f..%252f..%252f..%252fproc/self/enviro 136.66.17.223 - - [08/Sep/2026:12:16:48 +1000] "GET /@fs/proc/self/environ?raw?? HTTP/1.1" 404 36619 "https://www.madalice.com.au/@fs/proc/self/environ?raw??" "Mozilla/5.0 (compatible; TelegramBot/1.0)" 136.66.17.223 - - [08/Sep/2026:12:16:48 +1000] "GET /@fs/root/.aws/credentials.bak?raw?? HTTP/1.1" 404 36624 "https://www.madalice.com.au/@fs/root/.aws/credentials.bak?raw??" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like 136.66.17.223 - - [08/Sep/2026:12:16:48 +1000] "GET /@fs/etc/passwd?raw?? HTTP/1.1" 404 36614 "https://www.madalice.com.au/@fs/etc/passwd?raw??" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Google-Ext 136.66.17.223 - - [08/Sep/2026:12:16:48 +1000] "GET /@fs/root/rootkey.csv?raw?? HTTP/1.1" 404 36619 "https://www.madalice.com.au/@fs/root/rootkey.csv?raw??" "Mozilla/5.0 (compatible; Discordbot/2.0; +https://discordapp.c 136.66.17.223 - - [08/Sep/2026:12:16:48 +1000] "GET /@fs/app/terraform.tfstate?raw?? HTTP/1.1" 301 1 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; meta-externalagent/1.1; 136.66.17.223 - - [08/Sep/2026:12:16:48 +1000] "GET /@fs/root/terraform.tfstate?raw?? HTTP/1.1" 301 1 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" --- last 30 samples (run-up to this incident) --- 2026-09-08 12:14:29 L1=1.92 run=1 blk=1 avail=9787 (71.0%) swpO=0 conn=1 myRSS=1851 php=4 phpRSS=134 ap=30 tcp=46 topuser=madalice 2026-09-08 12:14:29 L1=1.92 run=3 blk=1 avail=9785 (71.0%) swpO=0 conn=1 myRSS=1851 php=4 phpRSS=134 ap=30 tcp=46 topuser=madalice 2026-09-08 12:14:39 L1=1.63 run=2 blk=0 avail=9781 (71.0%) swpO=0 conn=1 myRSS=1851 php=4 phpRSS=134 ap=30 tcp=37 topuser=madalice 2026-09-08 12:14:39 L1=1.63 run=1 blk=0 avail=9789 (71.1%) swpO=0 conn=1 myRSS=1851 php=4 phpRSS=134 ap=30 tcp=37 topuser=madalice 2026-09-08 12:14:49 L1=1.38 run=2 blk=0 avail=9813 (71.2%) swpO=0 conn=1 myRSS=1851 php=4 phpRSS=134 ap=25 tcp=37 topuser=madalice 2026-09-08 12:14:49 L1=1.38 run=2 blk=0 avail=9813 (71.2%) swpO=0 conn=1 myRSS=1851 php=4 phpRSS=134 ap=25 tcp=37 topuser=madalice 2026-09-08 12:14:59 L1=1.24 run=2 blk=0 avail=9880 (71.7%) swpO=0 conn=1 myRSS=1851 php=4 phpRSS=60 ap=28 tcp=39 topuser=evolution 2026-09-08 12:14:59 L1=1.24 run=3 blk=0 avail=9850 (71.5%) swpO=0 conn=1 myRSS=1851 php=5 phpRSS=117 ap=28 tcp=38 topuser=evolution 2026-09-08 12:15:09 L1=1.59 run=3 blk=0 avail=9730 (70.6%) swpO=0 conn=1 myRSS=1851 php=5 phpRSS=193 ap=32 tcp=76 topuser=madalice 2026-09-08 12:15:09 L1=1.59 run=3 blk=0 avail=9731 (70.6%) swpO=0 conn=1 myRSS=1851 php=5 phpRSS=193 ap=32 tcp=75 topuser=madalice 2026-09-08 12:15:19 L1=1.66 run=2 blk=0 avail=9705 (70.4%) swpO=0 conn=1 myRSS=1851 php=5 phpRSS=193 ap=37 tcp=87 topuser=madalice 2026-09-08 12:15:19 L1=1.66 run=1 blk=0 avail=9702 (70.4%) swpO=0 conn=1 myRSS=1851 php=6 phpRSS=209 ap=37 tcp=85 topuser=madalice 2026-09-08 12:15:29 L1=1.48 run=1 blk=0 avail=9897 (71.8%) swpO=0 conn=1 myRSS=1851 php=3 phpRSS=2 ap=31 tcp=73 topuser=root 2026-09-08 12:15:29 L1=1.48 run=5 blk=0 avail=9860 (71.6%) swpO=0 conn=1 myRSS=1851 php=5 phpRSS=87 ap=30 tcp=78 topuser=madalice 2026-09-08 12:15:39 L1=1.65 run=3 blk=0 avail=9647 (70.0%) swpO=0 conn=1 myRSS=1863 php=5 phpRSS=300 ap=28 tcp=73 topuser=otterfencing 2026-09-08 12:15:39 L1=1.65 run=1 blk=0 avail=9775 (71.0%) swpO=0 conn=1 myRSS=1863 php=5 phpRSS=175 ap=28 tcp=73 topuser=madalice 2026-09-08 12:15:49 L1=1.40 run=3 blk=0 avail=9680 (70.3%) swpO=0 conn=1 myRSS=1863 php=4 phpRSS=134 ap=35 tcp=81 topuser=madalice 2026-09-08 12:15:49 L1=1.40 run=3 blk=0 avail=9706 (70.5%) swpO=0 conn=2 myRSS=1863 php=5 phpRSS=175 ap=35 tcp=81 topuser=madalice 2026-09-08 12:15:59 L1=1.18 run=1 blk=0 avail=9750 (70.8%) swpO=0 conn=1 myRSS=1863 php=4 phpRSS=140 ap=33 tcp=76 topuser=madalice 2026-09-08 12:16:00 L1=1.18 run=2 blk=0 avail=9718 (70.5%) swpO=0 conn=2 myRSS=1863 php=5 phpRSS=180 ap=33 tcp=76 topuser=madalice 2026-09-08 12:16:09 L1=1.07 run=1 blk=0 avail=9764 (70.9%) swpO=0 conn=1 myRSS=1863 php=4 phpRSS=140 ap=30 tcp=80 topuser=madalice 2026-09-08 12:16:10 L1=1.07 run=2 blk=0 avail=9752 (70.8%) swpO=0 conn=2 myRSS=1863 php=5 phpRSS=180 ap=30 tcp=79 topuser=madalice 2026-09-08 12:16:19 L1=1.22 run=3 blk=1 avail=9718 (70.5%) swpO=0 conn=1 myRSS=1863 php=5 phpRSS=199 ap=33 tcp=80 topuser=madalice 2026-09-08 12:16:20 L1=1.22 run=3 blk=1 avail=9707 (70.5%) swpO=0 conn=2 myRSS=1863 php=5 phpRSS=204 ap=33 tcp=77 topuser=madalice 2026-09-08 12:16:29 L1=1.33 run=1 blk=1 avail=9747 (70.7%) swpO=0 conn=1 myRSS=1863 php=4 phpRSS=160 ap=31 tcp=74 topuser=madalice 2026-09-08 12:16:30 L1=1.33 run=1 blk=1 avail=9741 (70.7%) swpO=0 conn=2 myRSS=1863 php=5 phpRSS=201 ap=30 tcp=73 topuser=madalice 2026-09-08 12:16:39 L1=1.51 run=1 blk=1 avail=9763 (70.9%) swpO=0 conn=1 myRSS=1863 php=4 phpRSS=159 ap=29 tcp=72 topuser=madalice 2026-09-08 12:16:40 L1=1.51 run=1 blk=1 avail=9749 (70.8%) swpO=0 conn=2 myRSS=1863 php=5 phpRSS=200 ap=29 tcp=72 topuser=madalice 2026-09-08 12:16:49 L1=2.22 run=13 blk=1 avail=8142 (59.1%) swpO=167 conn=8 myRSS=1861 php=13 phpRSS=1729 ap=91 tcp=113 topuser=madalice 2026-09-08 12:16:50 L1=2.22 run=10 blk=2 avail=8036 (58.3%) swpO=167 conn=7 myRSS=1861 php=15 phpRSS=1772 ap=90 tcp=113 topuser=madalice