INCIDENT 2026-09-08 15:48:17 trigger: php_rss=1684MB ================================================================== load: 3.35 2.26 2.11 3/705 571393 ncpu:10 mem_avail: 8334MB/13777MB (60.5%) swap_used:2362MB swapout:312/s blocked(D):1 running:1 iowait:6.5% steal:0.0% php: 14 procs / 1684MB heaviest user: madalice (10 procs, 1641MB) apache: 91 procs tcp_estab: 94 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 10 1645 mysql 1 1640 nobody 90 1347 root 247 689 netdata 8 227 evolution 12 83 aaa 3 39 mailman 20 35 cpanellogin 1 32 dovenull 6 25 alison 1 12 wp-toolkit 3 11 lowrange 1 11 kurri 1 10 dovecot 3 9 zabbix 1 8 mailnull 2 7 named 1 5 nscd 1 4 dbus 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1641 evolution 4 77 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7527 MB Active(file): 5182 MB Inactive(file): 2500 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 436 MB CommitLimit: 10984 MB Committed_AS: 10439 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 7-13:25:52 2940 /usr/bin/imunify-agent-proxy 4109079 root 3-11:03:30 0 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 3-11:03:30 146308 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 1679460 22.9 Ssl 11:02:49 /usr/sbin/mariadbd 571262 167896 madalice 245320 49.8 S 00:06 php-fpm: pool madalice_com_au 166870 1 netdata 184088 2.8 Ssl 2-13:25:58 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 570518 167896 madalice 161864 15.2 S 01:06 php-fpm: pool madalice_com_au 569316 167896 madalice 161604 13.4 S 03:03 php-fpm: pool madalice_com_au 571227 167896 madalice 159476 67.5 S 00:08 php-fpm: pool madalice_com_au 571288 167896 madalice 159380 67.7 S 00:04 php-fpm: pool madalice_com_au 571228 167896 madalice 159244 69.8 S 00:08 php-fpm: pool madalice_com_au 571273 167896 madalice 159220 63.2 S 00:05 php-fpm: pool madalice_com_au 571230 167896 madalice 158744 65.4 R 00:07 php-fpm: pool madalice_com_au 571274 167896 madalice 158716 60.0 S 00:05 php-fpm: pool madalice_com_au 571267 167896 madalice 157820 56.4 S 00:05 php-fpm: pool madalice_com_au 1911709 1859745 root 156796 0.0 S 13:11:07 spamd child 4109105 4109079 root 146308 1.2 Sl 3-11:03:30 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2328754 1 root 130888 0.0 Ss 11:02:59 /usr/lib/systemd/systemd-journald 571361 571336 evolution 40748 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 40472 0.0 Ss 48-13:07:04 cpsrvd (SSL) - waiting for connections 509236 509098 root 34904 0.0 Sl 11-13:28:38 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 392897 1353308 cpanellogin 32840 0.0 S 51:17 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 167562 166914 netdata 31572 0.1 Sl 2-13:25:53 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1859745 1 root 24676 0.0 Ss 13:25:29 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4101451 1859745 root 23380 0.0 S 02:57:24 spamd child 571426 1469 root 21604 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 553942 506832 nobody 20832 0.0 S 04:41 /usr/sbin/httpd -k start 554732 506832 nobody 20656 0.0 S 03:16 /usr/sbin/httpd -k start 570454 506832 nobody 20452 0.1 S 01:11 /usr/sbin/httpd -k start 570371 506832 nobody 19772 0.1 S 01:16 /usr/sbin/httpd -k start 570128 506832 nobody 19596 0.0 S 01:42 /usr/sbin/httpd -k start 570105 506832 nobody 19496 0.0 S 01:44 /usr/sbin/httpd -k start 570445 506832 nobody 19460 0.1 S 01:12 /usr/sbin/httpd -k start 569784 506832 nobody 19236 0.0 S 02:17 /usr/sbin/httpd -k start 570443 506832 nobody 19208 0.0 S 01:12 /usr/sbin/httpd -k start 570125 506832 nobody 19128 0.0 S 01:42 /usr/sbin/httpd -k start 570955 506832 nobody 19068 0.0 S 00:33 /usr/sbin/httpd -k start 570127 506832 nobody 19012 0.0 S 01:42 /usr/sbin/httpd -k start 554533 506832 nobody 18976 0.0 S 03:34 /usr/sbin/httpd -k start 570446 506832 nobody 18860 0.1 S 01:12 /usr/sbin/httpd -k start 570946 506832 nobody 18712 0.0 S 00:34 /usr/sbin/httpd -k start 571148 506832 nobody 18316 0.0 S 00:15 /usr/sbin/httpd -k start 570956 506832 nobody 18264 0.2 S 00:33 /usr/sbin/httpd -k start 570444 506832 nobody 18228 0.0 S 01:12 /usr/sbin/httpd -k start 569782 506832 nobody 18152 0.0 S 02:17 /usr/sbin/httpd -k start 570455 506832 nobody 17908 0.0 S 01:11 /usr/sbin/httpd -k start 571280 506832 nobody 17664 0.2 S 00:04 /usr/sbin/httpd -k start 571281 506832 nobody 17636 0.2 S 00:04 /usr/sbin/httpd -k start 571287 506832 nobody 17596 0.5 S 00:04 /usr/sbin/httpd -k start 571308 506832 nobody 17572 0.3 S 00:03 /usr/sbin/httpd -k start 571310 506832 nobody 17564 0.3 S 00:03 /usr/sbin/httpd -k start 571312 506832 nobody 17556 0.3 S 00:03 /usr/sbin/httpd -k start 571309 506832 nobody 17528 0.3 S 00:03 /usr/sbin/httpd -k start 571307 506832 nobody 17504 0.3 S 00:03 /usr/sbin/httpd -k start 571269 506832 nobody 17468 0.4 S 00:05 /usr/sbin/httpd -k start 571320 506832 nobody 17448 1.0 S 00:02 /usr/sbin/httpd -k start 570997 506832 nobody 17088 0.0 S 00:29 /usr/sbin/httpd -k start 570960 506832 nobody 16980 0.1 S 00:31 /usr/sbin/httpd -k start 571007 167382 aaa 16384 5.0 S 00:28 dovecot/imap 570408 506832 nobody 16352 0.0 S 01:14 /usr/sbin/httpd -k start 537547 506832 nobody 15936 0.0 S 08:15 /usr/sbin/httpd -k start 571258 506832 nobody 15828 0.1 S 00:06 /usr/sbin/httpd -k start 571272 506832 nobody 15828 0.2 S 00:05 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3486257 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 359 lowrange/lowrange.com.au-ssl_log 224 madalice/madalice.com.au-ssl_log 34 evolution/portal.evolutionerp.com.au-ssl_log 26 evolution/staging.evolutionerp.com.au-ssl_log 15 aaa/aaadownunder.com.au-ssl_log 5 corpkicks/corporatekicks.com.au-ssl_log 3 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 224 34.168.153.15 175 203.54.180.238 101 1.144.107.82 68 103.104.165.99 31 116.91.221.245 17 34.63.127.157 13 182.239.240.254 9 103.104.164.114 5 2001:8004:14b3:854f:d854:7d73:d053:9f39 4 180.181.236.49 3 120.21.154.188 3 118.127.40.55 2 66.249.73.165 2 66.249.69.99 2 115.128.106.35 --- top request paths across all vhosts (last 3 min) --- 165 POST /functions.php 66 GET /app/ajax.php 41 GET /index.php 31 POST /plugins/csvexporter/plugin.php 20 GET /heartbeat.php 12 POST /clienteditsave.php 10 POST /inveditsave.php 9 POST /app/ajax/selectFilterSingle.php 9 POST /app/ajax.php 8 HEAD /index.php 6 POST /wp-admin/admin-ajax.php 6 POST /logsave.php 6 POST /jobeditsave.php 5 POST / 5 GET /store/hand-painted-nike-af1-sunflower/ 4 POST /uploadsave.php 4 GET /plugins/fensa/fensa-ajax.php 3 POST /pickingsave.php 3 POST /app/ajax/selectFilter.php 3 GET /index.php/our-services/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 150 POST /functions.php 66 GET /app/ajax.php 36 GET /index.php 31 POST /plugins/csvexporter/plugin.php 12 POST /clienteditsave.php 10 POST /inveditsave.php 9 POST /app/ajax/selectFilterSingle.php 9 POST /app/ajax.php 8 HEAD /index.php 6 POST /logsave.php 6 POST /jobeditsave.php 4 POST /uploadsave.php -- last 10 requests -- 203.54.180.238 - - [08/Sep/2026:15:48:14 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29605&tab=filestab" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 116.91.221.245 - - [08/Sep/2026:15:48:15 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 233 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2328§ionid=590" "Mozilla/5.0 (Windows NT 10.0; Win 116.91.221.245 - - [08/Sep/2026:15:48:15 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invedit&id=4473&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 1.144.107.82 - - [08/Sep/2026:15:48:15 +1000] "GET /index.php?page=invedit&id=7951 HTTP/1.1" 200 37731 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 103.104.165.99 - - [08/Sep/2026:15:48:15 +1000] "POST /jobeditsave.php?call=fetch_callup&id=11064 HTTP/1.1" 200 2649 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12157&tab=jobeditinv" "Mozilla/5.0 (Windows N 1.144.107.82 - - [08/Sep/2026:15:48:15 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invedit&id=7951&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 182.239.240.254 - - [08/Sep/2026:15:48:16 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 1.144.107.82 - - [08/Sep/2026:15:48:16 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvedit%26id%3D7951%26tab%3Dgeneraltab&call=getUserSetting&caller=ajaxSubmitLocal&seq=18929384591 HTTP/1.1" 200 109 "https://my.ev 1.144.107.82 - - [08/Sep/2026:15:48:17 +1000] "GET /index.php?page=inveditspecs&id=3891&string= HTTP/1.1" 200 13863 "https://my.evolutionerp.com.au/index.php?page=invedit&id=3891&tab=generaltab" "Mozilla/5.0 (Windows NT 1.144.107.82 - - [08/Sep/2026:15:48:17 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=inveditspecs&id=3891&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) == lowrange/lowrange.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/.env 1 GET /wp/.env 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /web/.env 1 GET /vue/.env 1 GET /vite/.env 1 GET /vendor/.env 1 GET /var/www/html/.env -- last 10 requests -- 34.168.153.15 - - [08/Sep/2026:15:48:11 +1000] "GET /i.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.168.153.15 - - [08/Sep/2026:15:48:11 +1000] "GET /pi.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.168.153.15 - - [08/Sep/2026:15:48:11 +1000] "GET /pinfo.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.168.153.15 - - [08/Sep/2026:15:48:12 +1000] "GET /test.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.168.153.15 - - [08/Sep/2026:15:48:12 +1000] "GET /phpinfo HTTP/1.1" 401 53 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.168.153.15 - - [08/Sep/2026:15:48:12 +1000] "GET /p.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.168.153.15 - - [08/Sep/2026:15:48:12 +1000] "GET /debug.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.168.153.15 - - [08/Sep/2026:15:48:13 +1000] "GET /admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.168.153.15 - - [08/Sep/2026:15:48:13 +1000] "GET /test/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.168.153.15 - - [08/Sep/2026:15:48:13 +1000] "GET /dev/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 6 POST /wp-admin/admin-ajax.php 5 GET /store/hand-painted-nike-af1-sunflower/ 2 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 2 GET /terms-and-conditions/ 2 GET /rclone.conf 2 GET /.git/HEAD 2 GET /.git-credentials 2 GET /.gitconfig 2 GET /.git/config 1 POST / 1 GET /product-category/custom-shoes/page/4/ 1 GET /product-category/customised-shoes/cartoon/ -- last 10 requests -- 2001:8004:14b3:854f:d854:7d73:d053:9f39 - - [08/Sep/2026:15:48:11 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 51 "https://madalice.com.au/wp-admin/edit.php?post_type=shop_order" "Mozilla/5.0 (Windows NT 10.0; Win 34.63.127.157 - - [08/Sep/2026:15:48:12 +1000] "GET /.gitconfig HTTP/1.1" 301 1 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; +claudebot@anthropic.com)" 34.63.127.157 - - [08/Sep/2026:15:48:12 +1000] "GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au HTTP/1.1" 404 36621 "https://www.madalice.com.au/z9x8c7v6b5-debug-trigger-www.madalice.com.au" "Mozilla/5.0 AppleWebKit/53 34.63.127.157 - - [08/Sep/2026:15:48:12 +1000] "GET /.git/HEAD HTTP/1.1" 404 36611 "https://www.madalice.com.au/.git/HEAD" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/w 34.63.127.157 - - [08/Sep/2026:15:48:13 +1000] "GET /rclone.conf HTTP/1.1" 404 36609 "https://www.madalice.com.au/rclone.conf" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; +claude 34.63.127.157 - - [08/Sep/2026:15:48:13 +1000] "GET /.git/config HTTP/1.1" 404 36610 "https://www.madalice.com.au/.git/config" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)" 34.63.127.157 - - [08/Sep/2026:15:48:14 +1000] "GET /.git-credentials HTTP/1.1" 404 36614 "https://www.madalice.com.au/.git-credentials" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)" 34.63.127.157 - - [08/Sep/2026:15:48:16 +1000] "GET /.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot)" 34.63.127.157 - - [08/Sep/2026:15:48:14 +1000] "GET /.gitconfig HTTP/1.1" 404 36605 "https://www.madalice.com.au/.gitconfig" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; +claudebo 34.63.127.157 - - [08/Sep/2026:15:48:16 +1000] "GET /.env.example HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; +claudebot@anthropic.com)" --- last 30 samples (run-up to this incident) --- 2026-09-08 15:45:50 L1=2.25 run=2 blk=1 avail=9990 (72.5%) swpO=0 conn=6 myRSS=1659 php=10 phpRSS=393 ap=27 tcp=30 topuser=evolution 2026-09-08 15:45:56 L1=2.06 run=2 blk=1 avail=10081(73.2%) swpO=0 conn=1 myRSS=1659 php=4 phpRSS=156 ap=28 tcp=39 topuser=madalice 2026-09-08 15:46:00 L1=2.06 run=6 blk=1 avail=9954 (72.3%) swpO=0 conn=3 myRSS=1659 php=6 phpRSS=267 ap=35 tcp=48 topuser=madalice 2026-09-08 15:46:07 L1=2.20 run=2 blk=1 avail=9989 (72.5%) swpO=0 conn=1 myRSS=1659 php=4 phpRSS=158 ap=40 tcp=33 topuser=madalice 2026-09-08 15:46:10 L1=2.20 run=1 blk=1 avail=10018(72.7%) swpO=0 conn=3 myRSS=1659 php=4 phpRSS=158 ap=36 tcp=37 topuser=madalice 2026-09-08 15:46:17 L1=2.01 run=1 blk=1 avail=10040(72.9%) swpO=0 conn=1 myRSS=1659 php=4 phpRSS=158 ap=33 tcp=38 topuser=madalice 2026-09-08 15:46:20 L1=2.01 run=1 blk=1 avail=10057(73.0%) swpO=0 conn=3 myRSS=1659 php=4 phpRSS=157 ap=30 tcp=37 topuser=madalice 2026-09-08 15:46:27 L1=1.86 run=1 blk=1 avail=10097(73.3%) swpO=0 conn=1 myRSS=1659 php=4 phpRSS=157 ap=25 tcp=27 topuser=madalice 2026-09-08 15:46:30 L1=1.86 run=1 blk=1 avail=10123(73.5%) swpO=0 conn=3 myRSS=1659 php=4 phpRSS=157 ap=21 tcp=35 topuser=madalice 2026-09-08 15:46:37 L1=1.96 run=5 blk=1 avail=9720 (70.6%) swpO=0 conn=5 myRSS=1660 php=7 phpRSS=548 ap=35 tcp=45 topuser=corpkicks 2026-09-08 15:46:40 L1=1.96 run=3 blk=1 avail=9975 (72.4%) swpO=0 conn=3 myRSS=1660 php=5 phpRSS=239 ap=33 tcp=34 topuser=madalice 2026-09-08 15:46:47 L1=1.96 run=1 blk=1 avail=10050(72.9%) swpO=0 conn=5 myRSS=1660 php=5 phpRSS=196 ap=29 tcp=32 topuser=madalice 2026-09-08 15:46:50 L1=1.96 run=1 blk=1 avail=10086(73.2%) swpO=0 conn=3 myRSS=1660 php=4 phpRSS=157 ap=25 tcp=32 topuser=madalice 2026-09-08 15:46:57 L1=1.90 run=1 blk=1 avail=10071(73.1%) swpO=0 conn=5 myRSS=1660 php=5 phpRSS=196 ap=24 tcp=34 topuser=madalice 2026-09-08 15:47:00 L1=1.98 run=3 blk=1 avail=10029(72.8%) swpO=0 conn=2 myRSS=1660 php=6 phpRSS=269 ap=25 tcp=41 topuser=madalice 2026-09-08 15:47:07 L1=2.23 run=2 blk=1 avail=9919 (72.0%) swpO=405 conn=5 myRSS=1654 php=6 phpRSS=269 ap=42 tcp=46 topuser=madalice 2026-09-08 15:47:10 L1=2.21 run=4 blk=1 avail=9985 (72.5%) swpO=405 conn=2 myRSS=1654 php=4 phpRSS=176 ap=39 tcp=41 topuser=madalice 2026-09-08 15:47:17 L1=2.11 run=2 blk=1 avail=9723 (70.6%) swpO=0 conn=5 myRSS=1654 php=6 phpRSS=437 ap=35 tcp=45 topuser=madalice 2026-09-08 15:47:21 L1=2.10 run=3 blk=1 avail=9880 (71.7%) swpO=0 conn=2 myRSS=1654 php=7 phpRSS=386 ap=33 tcp=43 topuser=madalice 2026-09-08 15:47:27 L1=2.01 run=4 blk=2 avail=9818 (71.3%) swpO=0 conn=5 myRSS=1655 php=7 phpRSS=450 ap=33 tcp=35 topuser=madalice 2026-09-08 15:47:31 L1=2.09 run=2 blk=1 avail=9894 (71.8%) swpO=0 conn=2 myRSS=1655 php=7 phpRSS=383 ap=30 tcp=40 topuser=madalice 2026-09-08 15:47:37 L1=2.00 run=1 blk=1 avail=9939 (72.1%) swpO=0 conn=2 myRSS=1655 php=6 phpRSS=328 ap=29 tcp=33 topuser=madalice 2026-09-08 15:47:41 L1=2.08 run=2 blk=1 avail=9956 (72.3%) swpO=0 conn=2 myRSS=1655 php=5 phpRSS=298 ap=26 tcp=36 topuser=madalice 2026-09-08 15:47:47 L1=2.00 run=1 blk=1 avail=9901 (71.9%) swpO=0 conn=2 myRSS=1655 php=6 phpRSS=352 ap=30 tcp=38 topuser=madalice 2026-09-08 15:47:51 L1=2.08 run=2 blk=1 avail=9890 (71.8%) swpO=0 conn=2 myRSS=1655 php=6 phpRSS=342 ap=31 tcp=45 topuser=madalice 2026-09-08 15:47:57 L1=1.99 run=2 blk=2 avail=9833 (71.4%) swpO=0 conn=2 myRSS=1655 php=7 phpRSS=460 ap=28 tcp=36 topuser=madalice 2026-09-08 15:48:01 L1=2.31 run=4 blk=1 avail=9869 (71.6%) swpO=69 conn=4 myRSS=1652 php=7 phpRSS=437 ap=26 tcp=42 topuser=madalice 2026-09-08 15:48:07 L1=2.21 run=2 blk=1 avail=9710 (70.5%) swpO=102 conn=2 myRSS=1651 php=7 phpRSS=575 ap=29 tcp=40 topuser=madalice 2026-09-08 15:48:11 L1=2.51 run=6 blk=1 avail=9419 (68.4%) swpO=129 conn=4 myRSS=1648 php=8 phpRSS=856 ap=30 tcp=50 topuser=madalice 2026-09-08 15:48:17 L1=3.35 run=1 blk=1 avail=8334 (60.5%) swpO=312 conn=3 myRSS=1640 php=14 phpRSS=1684 ap=91 tcp=94 topuser=madalice