INCIDENT 2026-09-08 12:17:51 trigger: php_rss=2035MB ================================================================== load: 5.59 3.01 2.63 14/690 3971848 ncpu:10 mem_avail: 7671MB/13777MB (55.7%) swap_used:1954MB swapout:0/s blocked(D):1 running:16 iowait:4.2% steal:0.0% php: 15 procs / 2035MB heaviest user: madalice (10 procs, 1972MB) apache: 85 procs tcp_estab: 129 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1860 madalice 10 1830 nobody 84 1417 root 249 784 netdata 8 230 cpanellogin 1 65 alison 2 59 evolution 11 48 mailman 20 36 dovenull 6 26 kurri 2 21 mailnull 3 15 wp-toolkit 3 12 dovecot 3 9 zabbix 1 7 named 1 5 sshd 1 4 nscd 1 4 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1755 alison 1 53 evolution 3 39 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7040 MB Active(file): 6316 MB Inactive(file): 903 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 410 MB CommitLimit: 10984 MB Committed_AS: 10666 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3900632 root 17:50 3260 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 7-09:55:26 3236 /usr/bin/imunify-agent-proxy 4109079 root 3-07:33:04 40 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 3-07:33:04 112412 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 1904724 20.1 Ssl 07:32:23 /usr/sbin/mariadbd 3970572 167896 madalice 256100 45.7 S 01:03 php-fpm: pool madalice_com_au 166870 1 netdata 185820 2.8 Ssl 2-09:55:32 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3970569 167896 madalice 178144 47.8 R 01:04 php-fpm: pool madalice_com_au 1911708 1859745 root 174552 0.1 S 09:40:41 spamd child 3970519 167896 madalice 171136 48.0 R 01:08 php-fpm: pool madalice_com_au 3970518 167896 madalice 170096 44.7 R 01:08 php-fpm: pool madalice_com_au 3970577 167896 madalice 169028 48.2 S 01:03 php-fpm: pool madalice_com_au 3970517 167896 madalice 168896 44.3 R 01:08 php-fpm: pool madalice_com_au 3970026 167896 madalice 165980 31.2 R 01:55 php-fpm: pool madalice_com_au 3970579 167896 madalice 165300 47.2 R 01:03 php-fpm: pool madalice_com_au 3970525 167896 madalice 165276 48.1 R 01:08 php-fpm: pool madalice_com_au 3970578 167896 madalice 165176 47.3 R 01:03 php-fpm: pool madalice_com_au 1911709 1859745 root 143560 0.0 S 09:40:41 spamd child 2328754 1 root 118104 0.0 Ss 07:32:33 /usr/lib/systemd/systemd-journald 4109105 4109079 root 112412 1.2 Sl 3-07:33:04 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 3673446 1353308 cpanellogin 66940 0.0 S 01:19:16 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 3971841 3970565 alison 64880 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3971876 3971572 aaa 40932 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3971819 3970553 evolution 40548 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 37108 0.0 Ss 48-09:36:38 cpsrvd (SSL) - waiting for connections 509236 509098 root 35160 0.0 Sl 11-09:58:12 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 167562 166914 netdata 31756 0.1 Sl 2-09:55:27 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1859745 1 root 27808 0.0 Ss 09:55:03 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3953709 506832 nobody 23340 0.1 S 04:44 /usr/sbin/httpd -k start 3954850 506832 nobody 22164 0.1 S 02:55 /usr/sbin/httpd -k start 3970552 506832 nobody 20996 0.1 S 01:04 /usr/sbin/httpd -k start 3969937 506832 nobody 20852 0.0 S 02:03 /usr/sbin/httpd -k start 3954856 506832 nobody 20512 0.0 S 02:54 /usr/sbin/httpd -k start 3970222 506832 nobody 20488 0.0 S 01:41 /usr/sbin/httpd -k start 3970610 506832 nobody 20104 0.0 S 01:03 /usr/sbin/httpd -k start 3970452 506832 nobody 20096 0.0 S 01:14 /usr/sbin/httpd -k start 3970532 506832 nobody 20096 0.0 S 01:06 /usr/sbin/httpd -k start 3970149 506832 nobody 19960 0.0 S 01:45 /usr/sbin/httpd -k start 3971451 506832 nobody 19828 0.1 S 00:35 /usr/sbin/httpd -k start 3952989 506832 nobody 19796 0.0 S 05:42 /usr/sbin/httpd -k start 3970596 506832 nobody 19796 0.0 S 01:03 /usr/sbin/httpd -k start 3970584 506832 nobody 19708 0.0 S 01:03 /usr/sbin/httpd -k start 3953810 506832 nobody 19648 0.0 S 04:34 /usr/sbin/httpd -k start 3953803 506832 nobody 19608 0.0 S 04:35 /usr/sbin/httpd -k start 3970597 506832 nobody 19516 0.0 S 01:03 /usr/sbin/httpd -k start 3970530 506832 nobody 19492 0.0 S 01:06 /usr/sbin/httpd -k start 3970542 506832 nobody 19448 0.0 S 01:05 /usr/sbin/httpd -k start 3970563 506832 nobody 19448 0.0 S 01:04 /usr/sbin/httpd -k start 3970557 506832 nobody 19440 0.0 S 01:04 /usr/sbin/httpd -k start 3970586 506832 nobody 19392 0.0 S 01:03 /usr/sbin/httpd -k start 3970589 506832 nobody 19360 0.0 S 01:03 /usr/sbin/httpd -k start 3970611 506832 nobody 19344 0.0 S 01:03 /usr/sbin/httpd -k start 3952017 506832 nobody 19336 0.0 S 06:58 /usr/sbin/httpd -k start 3970551 506832 nobody 19320 0.0 S 01:04 /usr/sbin/httpd -k start 3970599 506832 nobody 19316 0.0 S 01:03 /usr/sbin/httpd -k start 3971462 506832 nobody 19196 0.1 S 00:33 /usr/sbin/httpd -k start 3970251 506832 nobody 19188 0.0 S 01:36 /usr/sbin/httpd -k start 3970588 506832 nobody 19176 0.0 S 01:03 /usr/sbin/httpd -k start 3970580 506832 nobody 19160 0.0 S 01:03 /usr/sbin/httpd -k start 3970582 506832 nobody 19052 0.0 S 01:03 /usr/sbin/httpd -k start 3970605 506832 nobody 19052 0.0 S 01:03 /usr/sbin/httpd -k start 3970564 506832 nobody 19048 0.0 S 01:04 /usr/sbin/httpd -k start 3971463 506832 nobody 19016 0.1 S 00:33 /usr/sbin/httpd -k start 3970561 506832 nobody 18992 0.0 S 01:04 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 2020450 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 2020449 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 382 madalice/madalice.com.au-ssl_log 239 evolution/portal.evolutionerp.com.au-ssl_log 237 vinesit/vinesit.com.au-ssl_log 8 evolution/evolutionerp.com.au-ssl_log 6 corpkicks/corporatekicks.com.au-ssl_log 3 otterfencing/otterfencing.com.au-ssl_log 3 tubesupplies/tubesupplies.com.au-ssl_log 3 aaa/aaadownunder.com.au-ssl_log 2 kamcool/kamcool.com.au 1 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 385 203.54.180.238 221 136.66.17.223 105 103.104.165.99 57 116.91.221.245 22 1.141.176.34 13 118.127.40.55 13 103.104.164.114 12 120.20.96.253 10 180.181.236.49 9 182.239.240.254 7 37.30.46.37 3 14.202.170.238 2 45.131.193.110 2 203.166.236.147 2 165.225.233.89 --- top request paths across all vhosts (last 3 min) --- 229 POST /functions.php 102 GET /factory_session_checker.php 51 GET /factory_session_processed_qty.php 51 GET /factory_session_joiner.php 42 GET /app/ajax.php 33 GET /heartbeat.php 22 POST /plugins/csvexporter/plugin.php 22 GET /index.php 11 POST /inveditsave.php 10 POST /itemModify.php 9 POST /wp-cron.php 9 POST /quoteditsave.php 9 POST / 8 POST /clienteditsave.php 8 GET / 7 POST /app/ajax/selectFilter.php 6 POST /app/ajax/selectFilterSingle.php 5 POST /logsave.php 5 POST /app/ajax.php 4 POST /wp-login.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 229 POST /functions.php 42 GET /app/ajax.php 22 POST /plugins/csvexporter/plugin.php 22 GET /index.php 11 POST /inveditsave.php 10 POST /itemModify.php 9 POST /quoteditsave.php 8 POST /clienteditsave.php 7 POST /app/ajax/selectFilter.php 6 POST /app/ajax/selectFilterSingle.php 5 POST /logsave.php 5 POST /app/ajax.php -- last 10 requests -- 203.54.180.238 - - [08/Sep/2026:12:17:45 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29068&tab=jobeditpick" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 203.54.180.238 - - [08/Sep/2026:12:17:45 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=billadd&billid=19931" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 203.54.180.238 - - [08/Sep/2026:12:17:46 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 182.239.240.254 - - [08/Sep/2026:12:17:46 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 103.104.165.99 - - [08/Sep/2026:12:17:48 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 281 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12119" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 103.104.165.99 - - [08/Sep/2026:12:17:48 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 281 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12130&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 116.91.221.245 - - [08/Sep/2026:12:17:49 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=inventory&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 103.104.165.99 - - [08/Sep/2026:12:17:50 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=reqedit&id=6461&from=jobedit" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 103.104.164.114 - - [08/Sep/2026:12:17:49 +1000] "GET /index.php HTTP/1.1" 200 24894 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4978%2Findex.php%3Fpage%3Dinvoiceadd&invoiceid=4978&tab=maintab" "M 103.104.165.99 - - [08/Sep/2026:12:17:51 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invedit&id=6622&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x == madalice/madalice.com.au-ssl_log == -- top paths -- 9 POST / 4 GET /store/hand-painted-nike-cartoonsketchy/ 4 GET /@fs/proc/self/environ 2 GET /wp-config.php.old 2 GET /wp-config.php.bak 2 GET /@vite/env 2 GET /v1/graphql 2 GET /server.key 2 GET /privatekey.key 2 GET /private-key 2 GET /.kube/config 2 GET /key.pem -- last 10 requests -- 136.66.17.223 - - [08/Sep/2026:12:17:45 +1000] "GET /wp-config.php.old HTTP/1.1" 404 36643 "https://www.madalice.com.au/wp-config.php.old" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1. 136.66.17.223 - - [08/Sep/2026:12:17:45 +1000] "GET /api/graphql HTTP/1.1" 404 36647 "https://www.madalice.com.au/api/graphql" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109. 136.66.17.223 - - [08/Sep/2026:12:17:45 +1000] "GET /application.yml HTTP/1.1" 404 36642 "https://www.madalice.com.au/application.yml" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; T 136.66.17.223 - - [08/Sep/2026:12:17:45 +1000] "GET /config/database.yml HTTP/1.1" 404 36644 "https://www.madalice.com.au/config/database.yml" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Google-Extend 136.66.17.223 - - [08/Sep/2026:12:17:45 +1000] "GET /v1/graphql HTTP/1.1" 404 36645 "https://www.madalice.com.au/v1/graphql" "Mozilla/5.0 (compatible; GPTBot/1.4; +https://openai.com/gptbot)" 136.66.17.223 - - [08/Sep/2026:12:17:45 +1000] "GET /docker-compose.yaml HTTP/1.1" 404 36645 "https://www.madalice.com.au/docker-compose.yaml" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, l 136.66.17.223 - - [08/Sep/2026:12:17:46 +1000] "GET /config.php HTTP/1.1" 404 36644 "https://www.madalice.com.au/config.php" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 136.66.17.223 - - [08/Sep/2026:12:17:46 +1000] "GET /actuator/env HTTP/1.1" 404 36648 "https://www.madalice.com.au/actuator/env" "Mozilla/5.0 (compatible; LinkedInBot/1.0; +http://www.linkedin.com)" 136.66.17.223 - - [08/Sep/2026:12:17:46 +1000] "GET /docker-compose.yml HTTP/1.1" 404 36646 "https://www.madalice.com.au/docker-compose.yml" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GrokBot/1.0; +h 136.66.17.223 - - [08/Sep/2026:12:17:46 +1000] "GET /.hermes/config.yaml HTTP/1.1" 404 36648 "https://www.madalice.com.au/.hermes/config.yaml" "Mozilla/5.0 (compatible; GPTBot/1.2; +https://openai.com/gptbot)" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 102 GET /factory_session_checker.php 51 GET /factory_session_processed_qty.php 51 GET /factory_session_joiner.php 33 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [08/Sep/2026:12:17:47 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 127 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [08/Sep/2026:12:17:47 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:12:17:47 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [08/Sep/2026:12:17:47 +1000] "GET /factory_session_joiner.php?id=35199 HTTP/1.1" 200 115 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleW 203.54.180.238 - - [08/Sep/2026:12:17:47 +1000] "GET /factory_session_joiner.php?id=35197 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [08/Sep/2026:12:17:48 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:12:17:50 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 123 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [08/Sep/2026:12:17:50 +1000] "GET /factory_session_joiner.php?id=35192 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [08/Sep/2026:12:17:50 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:12:17:52 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 --- last 30 samples (run-up to this incident) --- 2026-09-08 12:15:29 L1=1.48 run=1 blk=0 avail=9897 (71.8%) swpO=0 conn=1 myRSS=1851 php=3 phpRSS=2 ap=31 tcp=73 topuser=root 2026-09-08 12:15:29 L1=1.48 run=5 blk=0 avail=9860 (71.6%) swpO=0 conn=1 myRSS=1851 php=5 phpRSS=87 ap=30 tcp=78 topuser=madalice 2026-09-08 12:15:39 L1=1.65 run=3 blk=0 avail=9647 (70.0%) swpO=0 conn=1 myRSS=1863 php=5 phpRSS=300 ap=28 tcp=73 topuser=otterfencing 2026-09-08 12:15:39 L1=1.65 run=1 blk=0 avail=9775 (71.0%) swpO=0 conn=1 myRSS=1863 php=5 phpRSS=175 ap=28 tcp=73 topuser=madalice 2026-09-08 12:15:49 L1=1.40 run=3 blk=0 avail=9680 (70.3%) swpO=0 conn=1 myRSS=1863 php=4 phpRSS=134 ap=35 tcp=81 topuser=madalice 2026-09-08 12:15:49 L1=1.40 run=3 blk=0 avail=9706 (70.5%) swpO=0 conn=2 myRSS=1863 php=5 phpRSS=175 ap=35 tcp=81 topuser=madalice 2026-09-08 12:15:59 L1=1.18 run=1 blk=0 avail=9750 (70.8%) swpO=0 conn=1 myRSS=1863 php=4 phpRSS=140 ap=33 tcp=76 topuser=madalice 2026-09-08 12:16:00 L1=1.18 run=2 blk=0 avail=9718 (70.5%) swpO=0 conn=2 myRSS=1863 php=5 phpRSS=180 ap=33 tcp=76 topuser=madalice 2026-09-08 12:16:09 L1=1.07 run=1 blk=0 avail=9764 (70.9%) swpO=0 conn=1 myRSS=1863 php=4 phpRSS=140 ap=30 tcp=80 topuser=madalice 2026-09-08 12:16:10 L1=1.07 run=2 blk=0 avail=9752 (70.8%) swpO=0 conn=2 myRSS=1863 php=5 phpRSS=180 ap=30 tcp=79 topuser=madalice 2026-09-08 12:16:19 L1=1.22 run=3 blk=1 avail=9718 (70.5%) swpO=0 conn=1 myRSS=1863 php=5 phpRSS=199 ap=33 tcp=80 topuser=madalice 2026-09-08 12:16:20 L1=1.22 run=3 blk=1 avail=9707 (70.5%) swpO=0 conn=2 myRSS=1863 php=5 phpRSS=204 ap=33 tcp=77 topuser=madalice 2026-09-08 12:16:29 L1=1.33 run=1 blk=1 avail=9747 (70.7%) swpO=0 conn=1 myRSS=1863 php=4 phpRSS=160 ap=31 tcp=74 topuser=madalice 2026-09-08 12:16:30 L1=1.33 run=1 blk=1 avail=9741 (70.7%) swpO=0 conn=2 myRSS=1863 php=5 phpRSS=201 ap=30 tcp=73 topuser=madalice 2026-09-08 12:16:39 L1=1.51 run=1 blk=1 avail=9763 (70.9%) swpO=0 conn=1 myRSS=1863 php=4 phpRSS=159 ap=29 tcp=72 topuser=madalice 2026-09-08 12:16:40 L1=1.51 run=1 blk=1 avail=9749 (70.8%) swpO=0 conn=2 myRSS=1863 php=5 phpRSS=200 ap=29 tcp=72 topuser=madalice 2026-09-08 12:16:49 L1=2.22 run=13 blk=1 avail=8142 (59.1%) swpO=167 conn=8 myRSS=1861 php=13 phpRSS=1729 ap=91 tcp=113 topuser=madalice 2026-09-08 12:16:50 L1=2.22 run=10 blk=2 avail=8036 (58.3%) swpO=167 conn=7 myRSS=1861 php=15 phpRSS=1772 ap=90 tcp=113 topuser=madalice 2026-09-08 12:17:00 L1=3.06 run=14 blk=1 avail=7686 (55.8%) swpO=66 conn=10 myRSS=1860 php=14 phpRSS=2115 ap=80 tcp=109 topuser=madalice 2026-09-08 12:17:01 L1=3.06 run=16 blk=0 avail=8144 (59.1%) swpO=60 conn=11 myRSS=1860 php=14 phpRSS=1657 ap=79 tcp=121 topuser=madalice 2026-09-08 12:17:10 L1=4.23 run=1 blk=1 avail=8196 (59.5%) swpO=22 conn=2 myRSS=1860 php=14 phpRSS=1604 ap=75 tcp=96 topuser=madalice 2026-09-08 12:17:11 L1=4.23 run=1 blk=1 avail=8214 (59.6%) swpO=20 conn=1 myRSS=1860 php=13 phpRSS=1563 ap=74 tcp=91 topuser=madalice 2026-09-08 12:17:20 L1=4.05 run=6 blk=1 avail=8098 (58.8%) swpO=0 conn=6 myRSS=1860 php=14 phpRSS=1636 ap=85 tcp=103 topuser=madalice 2026-09-08 12:17:21 L1=4.05 run=6 blk=1 avail=7976 (57.9%) swpO=0 conn=4 myRSS=1860 php=13 phpRSS=1748 ap=84 tcp=102 topuser=madalice 2026-09-08 12:17:30 L1=4.54 run=14 blk=1 avail=8093 (58.7%) swpO=0 conn=12 myRSS=1860 php=14 phpRSS=1691 ap=80 tcp=129 topuser=madalice 2026-09-08 12:17:31 L1=4.54 run=15 blk=1 avail=7709 (56.0%) swpO=0 conn=8 myRSS=1860 php=13 phpRSS=2067 ap=84 tcp=121 topuser=madalice 2026-09-08 12:17:41 L1=5.57 run=3 blk=1 avail=8124 (59.0%) swpO=0 conn=3 myRSS=1860 php=15 phpRSS=1697 ap=75 tcp=87 topuser=madalice 2026-09-08 12:17:41 L1=5.57 run=3 blk=1 avail=8066 (58.5%) swpO=0 conn=3 myRSS=1860 php=16 phpRSS=1781 ap=75 tcp=86 topuser=madalice 2026-09-08 12:17:51 L1=5.59 run=16 blk=1 avail=7671 (55.7%) swpO=0 conn=10 myRSS=1860 php=15 phpRSS=2035 ap=85 tcp=129 topuser=madalice 2026-09-08 12:17:51 L1=5.59 run=18 blk=1 avail=7899 (57.3%) swpO=0 conn=14 myRSS=1860 php=16 phpRSS=1846 ap=85 tcp=127 topuser=madalice