INCIDENT 2026-08-12 18:14:08 trigger: swapout=3106/s ================================================================== load: 3.53 1.48 1.15 2/632 104745 ncpu:10 mem_avail: 6755MB/11729MB (57.6%) swap_used:1792MB swapout:3106/s blocked(D):0 running:2 iowait:1.1% steal:0.0% php: 2 procs / 205MB heaviest user: corpkicks (1 procs, 165MB) apache: 41 procs tcp_estab: 31 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2401 root 243 770 nobody 40 558 netdata 8 266 corpkicks 1 173 evolution 12 64 cpanellogin 1 54 dovenull 6 34 mailnull 4 32 mailman 20 30 wp-toolkit 6 19 dovecot 3 13 zabbix 1 12 kamcool 1 11 kurri 1 10 cpanelphpmyadmin 1 8 named 1 6 nscd 1 4 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB corpkicks 1 174 evolution 1 39 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 2890 MB Active(file): 1819 MB Inactive(file): 1050 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 347 MB CommitLimit: 9960 MB Committed_AS: 7145 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 96507 root 14:08 1144 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3432421 root 17:02:52 3608 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2125801 1 mysql 2459340 15.7 Ssl 1-21:41:02 /usr/sbin/mariadbd 1220 1 netdata 212184 2.5 Ssl 44-08:04:09 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 104716 103123 corpkicks 188060 79.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3478969 3472245 root 187940 0.0 S 15:39:15 spamd child 3979356 3472245 root 164336 0.0 S 05:03:05 spamd child 3472245 1 root 123080 0.0 Ss 15:51:25 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 42204 1353308 cpanellogin 55948 0.0 S 01:31:04 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 2223 1201 root 44800 0.0 Sl 44-08:04:08 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 104715 101167 evolution 40700 4.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 39364 0.0 Ss 21-15:32:39 cpsrvd (SSL) - waiting for connections 159820 1 root 33648 0.0 Ss 23-08:27:17 /usr/lib/systemd/systemd-journald 4922 2431 netdata 32156 0.1 Sl 44-08:04:04 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 31328 0.1 Ss 44-08:04:08 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3471498 1 root 24512 0.0 Ss 15:51:56 lfd - sleeping 1463 1 root 23248 0.0 Ss 44-08:04:08 tailwatchd 1481367 2431 netdata 21572 2.2 Sl 21-09:28:53 /usr/libexec/netdata/plugins.d/apps.plugin 1 104358 1276780 nobody 18656 0.0 S 00:22 /usr/sbin/httpd -k start 104422 1276780 nobody 17784 0.1 S 00:19 /usr/sbin/httpd -k start 104425 1276780 nobody 17384 0.0 S 00:19 /usr/sbin/httpd -k start 104702 1276780 nobody 17276 0.0 S 00:03 /usr/sbin/httpd -k start 103433 1276780 nobody 17228 0.0 S 02:09 /usr/sbin/httpd -k start 104424 1276780 nobody 16664 0.0 S 00:19 /usr/sbin/httpd -k start 104700 1276780 nobody 16204 0.0 S 00:03 /usr/sbin/httpd -k start 104361 1276780 nobody 16084 0.0 S 00:21 /usr/sbin/httpd -k start 104388 1276780 nobody 16004 0.0 S 00:20 /usr/sbin/httpd -k start 104390 1276780 nobody 15924 0.1 S 00:20 /usr/sbin/httpd -k start 104419 1276780 nobody 15864 0.0 S 00:19 /usr/sbin/httpd -k start 104420 1276780 nobody 15836 0.0 S 00:19 /usr/sbin/httpd -k start 104421 1276780 nobody 15796 0.0 S 00:19 /usr/sbin/httpd -k start 104576 1276780 nobody 15756 0.0 S 00:13 /usr/sbin/httpd -k start 104575 1276780 nobody 15748 0.0 S 00:14 /usr/sbin/httpd -k start 104389 1276780 nobody 15716 0.1 S 00:20 /usr/sbin/httpd -k start 104574 1276780 nobody 15680 0.0 S 00:15 /usr/sbin/httpd -k start 104681 1276780 nobody 15508 0.2 S 00:05 /usr/sbin/httpd -k start 104677 1276780 nobody 15504 0.0 S 00:06 /usr/sbin/httpd -k start 104697 1276780 nobody 15452 0.0 S 00:03 /usr/sbin/httpd -k start 104686 1276780 nobody 15444 0.2 S 00:04 /usr/sbin/httpd -k start 104687 1276780 nobody 15444 0.2 S 00:04 /usr/sbin/httpd -k start 104682 1276780 nobody 15436 0.2 S 00:05 /usr/sbin/httpd -k start 104689 1276780 nobody 15436 0.0 S 00:04 /usr/sbin/httpd -k start 104688 1276780 nobody 15384 0.0 S 00:04 /usr/sbin/httpd -k start 103967 281734 mailnull 15340 0.0 S 01:18 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 103123 1276780 nobody 15268 0.0 S 02:38 /usr/sbin/httpd -k start 104695 1276780 nobody 15184 0.0 S 00:03 /usr/sbin/httpd -k start 104696 1276780 nobody 14064 0.0 S 00:03 /usr/sbin/httpd -k start 104699 1276780 nobody 14064 0.0 S 00:03 /usr/sbin/httpd -k start 104701 1276780 nobody 14064 0.0 S 00:03 /usr/sbin/httpd -k start 101202 1276780 nobody 13896 0.0 S 06:13 /usr/sbin/httpd -k start 103356 1276780 nobody 13288 0.0 S 02:14 /usr/sbin/httpd -k start 101167 1276780 nobody 13152 0.0 S 06:15 /usr/sbin/httpd -k start 101216 1276780 nobody 13092 0.0 S 06:13 /usr/sbin/httpd -k start 101188 1276780 nobody 12968 0.0 S 06:14 /usr/sbin/httpd -k start 101223 1276780 nobody 12956 0.0 S 06:13 /usr/sbin/httpd -k start 103355 1276780 nobody 12796 0.0 S 02:14 /usr/sbin/httpd -k start 1204 1 zabbix 12720 0.2 Ssl 44-08:04:09 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 104261 3828812 kamcool 11496 0.0 S 00:37 dovecot/quota-status -p postfix 837413 1471 root 11192 0.0 S 2-23:05:17 cPhulkd - dbprocessor 2893045 3828812 kurri 10736 0.0 S 1-05:46:55 dovecot/imap 104694 1471 root 10348 0.2 S 00:04 cPhulkd - processor - http socket 1805633 3828812 dovenull 9600 0.0 S 2-02:41:15 dovecot/imap-login --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9180831 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min corpkicks/corporatekicks.com.au-ssl_log 67 lowrange/lowrange.com.au-ssl_log 36 evolution/portal.evolutionerp.com.au-ssl_log 21 evolution/my.evolutionerp.com.au-ssl_log 17 otter2/otterfencing.net.au-ssl_log 10 madalice/madalice.com.au-ssl_log 5 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 65 34.75.236.152 36 4.225.166.176 21 203.54.180.238 10 20.91.239.158 5 52.167.144.142 4 103.104.164.114 3 180.181.236.49 2 66.249.65.170 2 207.46.13.83 2 114.119.159.70 1 66.249.65.171 1 59.102.27.131 1 34.196.51.17 1 121.45.95.181 1 118.127.40.55 --- top request paths across all vhosts (last 3 min) --- 21 GET /heartbeat.php 10 POST /functions.php 3 GET /index.php 3 GET / 2 GET /shopify/overview.php 1 POST /wp-cron.php 1 POST / 1 HEAD / 1 GET /zi-936.php 1 GET /wp-login.php 1 GET /wp-includes/rest-api/ 1 GET /wp-includes/pomo/ 1 GET /wp-includes/js/tinymce/plugins/compat3x/css/ 1 GET /wp-includes/images/smilies/ 1 GET /wp-includes/ID3/ 1 GET /wp-includes/blocks/shortcode/index.php 1 GET /wp-good.php 1 GET /wp-content/x/index.php 1 GET /wp-content/upgrade/index.php 1 GET /wp-content/themes/twentytwenty/404.php --- busiest 3 vhosts: top paths + last 10 requests --- == corpkicks/corporatekicks.com.au-ssl_log == -- top paths -- 3 GET / 1 POST /wp-cron.php 1 HEAD / 1 GET /@fs/var/www/html/wp-config.php 1 GET /@fs/var/www/html/.env 1 GET /@fs/var/www/html/.aws/credentials 1 GET /@fs/var/www/.env 1 GET /@fs/var/www/.aws/credentials 1 GET /@fs/var/run/secrets/kubernetes.io/serviceaccount/token 1 GET /@fs/usr/src/app/.env 1 GET /@fs/usr/src/app/.aws/credentials 1 GET /@fs/src/.env -- last 10 requests -- 34.75.236.152 - - [12/Aug/2026:18:14:05 +1000] "GET /@fs/var/www/html/wp-config.php?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.75.236.152 - - [12/Aug/2026:18:14:01 +1000] "GET /@fs/root/.config/gcloud/credentials.db?raw?? HTTP/1.1" 404 85782 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.75.236.152 - - [12/Aug/2026:18:14:01 +1000] "GET /@fs/var/run/secrets/kubernetes.io/serviceaccount/token?raw?? HTTP/1.1" 404 86517 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +cl 34.75.236.152 - - [12/Aug/2026:18:14:01 +1000] "GET /@fs/etc/apache2/apache2.conf?raw?? HTTP/1.1" 404 85782 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 34.75.236.152 - - [12/Aug/2026:18:14:01 +1000] "GET /@fs/..%2f..%2f..%2f..%2f..%2fapp/.env?raw?? HTTP/1.1" 404 85782 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 34.75.236.152 - - [12/Aug/2026:18:14:01 +1000] "GET /@fs/root/.config/hcloud/cli.toml?raw?? HTTP/1.1" 404 85782 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 34.75.236.152 - - [12/Aug/2026:18:14:01 +1000] "GET /@fs/proc/self/cmdline?raw?? HTTP/1.1" 404 86517 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 34.75.236.152 - - [12/Aug/2026:18:14:01 +1000] "GET /@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ?raw?? HTTP/1.1" 404 86517 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 34.75.236.152 - - [12/Aug/2026:18:14:01 +1000] "GET /@fs/home/ubuntu/.azure/credentials?raw?? HTTP/1.1" 404 86517 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.75.236.152 - - [12/Aug/2026:18:14:02 +1000] "GET /@fs/root/.ovh.conf?raw?? HTTP/1.1" 404 85782 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" == lowrange/lowrange.com.au-ssl_log == -- top paths -- 1 GET /wp-login.php 1 GET /wp-includes/rest-api/ 1 GET /wp-includes/pomo/ 1 GET /wp-includes/js/tinymce/plugins/compat3x/css/ 1 GET /wp-includes/images/smilies/ 1 GET /wp-includes/ID3/ 1 GET /wp-includes/blocks/shortcode/index.php 1 GET /wp-good.php 1 GET /wp-content/x/index.php 1 GET /wp-content/upgrade/index.php 1 GET /wp-content/themes/twentytwenty/404.php 1 GET /wp-content/themes/admin.php -- last 10 requests -- 4.225.166.176 - - [12/Aug/2026:18:12:21 +1000] "GET /index/function.php HTTP/1.1" 404 5750 "-" "-" 4.225.166.176 - - [12/Aug/2026:18:12:21 +1000] "GET /edit.php HTTP/1.1" 404 5750 "-" "-" 4.225.166.176 - - [12/Aug/2026:18:12:22 +1000] "GET /wp-includes/rest-api/ HTTP/1.1" 404 5750 "-" "-" 4.225.166.176 - - [12/Aug/2026:18:12:23 +1000] "GET /wp-content/themes/twentytwenty/404.php HTTP/1.1" 404 5750 "-" "-" 4.225.166.176 - - [12/Aug/2026:18:12:24 +1000] "GET /wp-good.php HTTP/1.1" 404 5750 "-" "-" 4.225.166.176 - - [12/Aug/2026:18:12:24 +1000] "GET /wp-admin/js/widgets/ HTTP/1.1" 404 5750 "-" "-" 4.225.166.176 - - [12/Aug/2026:18:12:25 +1000] "GET /wp-admin/css/colors/midnight/ HTTP/1.1" 404 5750 "-" "-" 4.225.166.176 - - [12/Aug/2026:18:12:26 +1000] "GET /tes.php HTTP/1.1" 404 5750 "-" "-" 4.225.166.176 - - [12/Aug/2026:18:12:26 +1000] "GET /files/index.php HTTP/1.1" 404 5750 "-" "-" 4.225.166.176 - - [12/Aug/2026:18:12:27 +1000] "GET /images/images/about.php HTTP/1.1" 404 5750 "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 21 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [12/Aug/2026:18:12:57 +1000] "GET /heartbeat.php?sentAt=1786522377&bytes=106,124,43,9&_=1786510904693 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" " 203.54.180.238 - - [12/Aug/2026:18:13:03 +1000] "GET /heartbeat.php?sentAt=1786522383&bytes=106,124,43,15&_=1786517960251 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [12/Aug/2026:18:13:07 +1000] "GET /heartbeat.php?sentAt=1786522387&bytes=106,124,43,19&_=1786510904694 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [12/Aug/2026:18:13:13 +1000] "GET /heartbeat.php?sentAt=1786522393&bytes=106,124,43,25&_=1786517960252 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [12/Aug/2026:18:13:17 +1000] "GET /heartbeat.php?sentAt=1786522397&bytes=106,124,43,29&_=1786510904695 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [12/Aug/2026:18:13:23 +1000] "GET /heartbeat.php?sentAt=1786522403&bytes=106,124,43,35&_=1786517960253 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [12/Aug/2026:18:13:27 +1000] "GET /heartbeat.php?sentAt=1786522407&bytes=106,124,43,39&_=1786510904696 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [12/Aug/2026:18:13:33 +1000] "GET /heartbeat.php?sentAt=1786522413&bytes=106,124,43,45&_=1786517960254 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [12/Aug/2026:18:13:37 +1000] "GET /heartbeat.php?sentAt=1786522417&bytes=106,124,43,49&_=1786510904697 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [12/Aug/2026:18:13:43 +1000] "GET /heartbeat.php?sentAt=1786522423&bytes=106,124,43,55&_=1786517960255 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-08-12 18:11:39 L1=0.96 run=3 blk=0 avail=6744 (57.5%) swpO=0 conn=2 myRSS=2470 php=1 phpRSS=161 ap=20 tcp=20 topuser=madalice 2026-08-12 18:11:47 L1=0.81 run=1 blk=0 avail=6864 (58.5%) swpO=0 conn=2 myRSS=2470 php=1 phpRSS=39 ap=18 tcp=22 topuser=evolution 2026-08-12 18:11:49 L1=0.81 run=1 blk=0 avail=6873 (58.6%) swpO=0 conn=2 myRSS=2470 php=0 phpRSS=0 ap=18 tcp=24 topuser=- 2026-08-12 18:11:57 L1=0.84 run=2 blk=0 avail=6842 (58.3%) swpO=0 conn=2 myRSS=2470 php=1 phpRSS=39 ap=21 tcp=29 topuser=evolution 2026-08-12 18:11:59 L1=0.84 run=1 blk=0 avail=6850 (58.4%) swpO=0 conn=2 myRSS=2470 php=0 phpRSS=0 ap=21 tcp=29 topuser=- 2026-08-12 18:12:07 L1=0.94 run=3 blk=0 avail=6850 (58.4%) swpO=0 conn=2 myRSS=2470 php=1 phpRSS=39 ap=21 tcp=25 topuser=evolution 2026-08-12 18:12:09 L1=0.94 run=1 blk=0 avail=6863 (58.5%) swpO=0 conn=2 myRSS=2470 php=0 phpRSS=0 ap=20 tcp=24 topuser=- 2026-08-12 18:12:18 L1=1.02 run=3 blk=0 avail=6820 (58.1%) swpO=0 conn=3 myRSS=2470 php=2 phpRSS=101 ap=19 tcp=26 topuser=infinium 2026-08-12 18:12:19 L1=1.02 run=2 blk=0 avail=6803 (58.0%) swpO=0 conn=2 myRSS=2470 php=1 phpRSS=87 ap=19 tcp=25 topuser=infinium 2026-08-12 18:12:28 L1=0.87 run=2 blk=0 avail=6787 (57.9%) swpO=2 conn=3 myRSS=2470 php=2 phpRSS=143 ap=19 tcp=26 topuser=madalice 2026-08-12 18:12:29 L1=0.87 run=2 blk=0 avail=6699 (57.1%) swpO=2 conn=2 myRSS=2470 php=1 phpRSS=202 ap=19 tcp=25 topuser=madalice 2026-08-12 18:12:38 L1=0.73 run=2 blk=0 avail=6689 (57.0%) swpO=0 conn=3 myRSS=2470 php=3 phpRSS=269 ap=19 tcp=27 topuser=evolution 2026-08-12 18:12:39 L1=0.73 run=1 blk=0 avail=6869 (58.6%) swpO=0 conn=1 myRSS=2470 php=0 phpRSS=0 ap=19 tcp=24 topuser=- 2026-08-12 18:12:48 L1=0.62 run=1 blk=0 avail=6855 (58.4%) swpO=0 conn=3 myRSS=2470 php=1 phpRSS=39 ap=19 tcp=25 topuser=evolution 2026-08-12 18:12:49 L1=0.62 run=2 blk=0 avail=6798 (58.0%) swpO=0 conn=1 myRSS=2470 php=1 phpRSS=96 ap=19 tcp=26 topuser=madalice 2026-08-12 18:12:58 L1=0.52 run=1 blk=0 avail=6850 (58.4%) swpO=0 conn=3 myRSS=2470 php=1 phpRSS=39 ap=19 tcp=26 topuser=evolution 2026-08-12 18:12:59 L1=0.52 run=1 blk=0 avail=6862 (58.5%) swpO=0 conn=1 myRSS=2470 php=0 phpRSS=0 ap=19 tcp=25 topuser=- 2026-08-12 18:13:08 L1=0.44 run=2 blk=0 avail=6701 (57.1%) swpO=0 conn=3 myRSS=2470 php=2 phpRSS=237 ap=17 tcp=25 topuser=corpkicks 2026-08-12 18:13:09 L1=0.44 run=3 blk=0 avail=6441 (54.9%) swpO=0 conn=1 myRSS=2470 php=3 phpRSS=534 ap=17 tcp=27 topuser=corpkicks 2026-08-12 18:13:18 L1=0.45 run=1 blk=0 avail=6881 (58.7%) swpO=0 conn=2 myRSS=2470 php=1 phpRSS=39 ap=16 tcp=21 topuser=evolution 2026-08-12 18:13:19 L1=0.45 run=1 blk=0 avail=6888 (58.7%) swpO=0 conn=1 myRSS=2470 php=0 phpRSS=0 ap=16 tcp=23 topuser=- 2026-08-12 18:13:28 L1=0.38 run=1 blk=0 avail=6895 (58.8%) swpO=0 conn=2 myRSS=2470 php=1 phpRSS=39 ap=15 tcp=21 topuser=evolution 2026-08-12 18:13:29 L1=0.38 run=3 blk=0 avail=6907 (58.9%) swpO=0 conn=1 myRSS=2470 php=0 phpRSS=0 ap=15 tcp=19 topuser=- 2026-08-12 18:13:38 L1=0.33 run=2 blk=0 avail=6887 (58.7%) swpO=0 conn=2 myRSS=2470 php=1 phpRSS=39 ap=15 tcp=19 topuser=evolution 2026-08-12 18:13:39 L1=0.33 run=1 blk=0 avail=6898 (58.8%) swpO=0 conn=1 myRSS=2470 php=0 phpRSS=0 ap=15 tcp=21 topuser=- 2026-08-12 18:13:48 L1=1.15 run=3 blk=0 avail=6648 (56.7%) swpO=61 conn=2 myRSS=2469 php=1 phpRSS=127 ap=18 tcp=64 topuser=corpkicks 2026-08-12 18:13:49 L1=1.15 run=1 blk=0 avail=6835 (58.3%) swpO=61 conn=1 myRSS=2469 php=0 phpRSS=0 ap=22 tcp=54 topuser=- 2026-08-12 18:13:58 L1=1.41 run=1 blk=0 avail=6848 (58.4%) swpO=527 conn=2 myRSS=2452 php=1 phpRSS=39 ap=29 tcp=23 topuser=evolution 2026-08-12 18:13:59 L1=1.41 run=1 blk=1 avail=6866 (58.5%) swpO=527 conn=1 myRSS=2452 php=0 phpRSS=0 ap=28 tcp=26 topuser=- 2026-08-12 18:14:08 L1=3.53 run=2 blk=0 avail=6755 (57.6%) swpO=3106 conn=3 myRSS=2401 php=2 phpRSS=205 ap=41 tcp=31 topuser=corpkicks