INCIDENT 2026-08-12 23:17:43 trigger: php_rss=1978MB mysql_conn=16 ================================================================== load: 3.29 1.24 0.94 19/613 278755 ncpu:10 mem_avail: 7152MB/11729MB (61.0%) swap_used:1279MB swapout:0/s blocked(D):0 running:22 iowait:0.0% steal:0.0% php: 16 procs / 1978MB heaviest user: evolution (15 procs, 1928MB) apache: 26 procs tcp_estab: 39 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 26 2185 mysql 1 1079 root 239 543 nobody 25 391 netdata 8 268 cpanellogin 1 62 infinium 3 36 mailman 20 26 lowrange 2 25 dovenull 6 24 wp-toolkit 6 20 zabbix 1 14 aaa 1 13 dovecot 3 8 named 1 6 nscd 1 3 dbus 1 3 cpanelconnecttrack 1 3 polkitd 1 2 mailnull 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 15 2217 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5175 MB Active(file): 3648 MB Inactive(file): 1698 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 310 MB CommitLimit: 9960 MB Committed_AS: 8334 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3432421 root 22:06:27 1300 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 184574 1 mysql 1105632 4.4 Ssl 02:44:11 /usr/sbin/mariadbd 1220 1 netdata 221604 2.5 Ssl 44-13:07:44 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 278698 274612 evolution 183028 104 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 278693 278295 evolution 177996 104 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 278688 278310 evolution 177744 105 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 278692 277320 evolution 177608 104 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 278691 278671 evolution 174276 111 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 278695 275895 evolution 169216 90.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3478969 3472245 root 168760 0.0 S 20:42:50 spamd child 278686 278672 evolution 158916 80.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 278690 277119 evolution 157044 88.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 278685 278274 evolution 153644 80.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 278699 278302 evolution 147380 71.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 278696 278293 evolution 143680 75.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 278694 278524 evolution 131572 60.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 278697 278283 evolution 117416 51.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 159820 1 root 99088 0.0 Ss 23-13:30:52 /usr/lib/systemd/systemd-journald 232673 1353308 cpanellogin 64292 0.0 S 01:18:55 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 3472245 1 root 48048 0.0 Ss 20:55:00 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1353308 1 root 41468 0.0 Ss 21-20:36:14 cpsrvd (SSL) - waiting for connections 2223 1201 root 38416 0.0 Sl 44-13:07:43 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 36164 0.1 Sl 44-13:07:39 /usr/libexec/netdata/plugins.d/go.d.plugin 1 275895 1276780 nobody 23176 0.0 S 05:46 /usr/sbin/httpd -k start 275201 1276780 nobody 22312 0.0 S 06:46 /usr/sbin/httpd -k start 277119 1276780 nobody 20740 0.0 S 03:00 /usr/sbin/httpd -k start 274612 1276780 nobody 20608 0.0 S 07:38 /usr/sbin/httpd -k start 278283 1276780 nobody 18400 0.0 S 00:47 /usr/sbin/httpd -k start 278315 1276780 nobody 18304 0.0 S 00:45 /usr/sbin/httpd -k start 278284 1276780 nobody 18284 0.0 S 00:47 /usr/sbin/httpd -k start 277320 1276780 nobody 17912 0.0 S 02:41 /usr/sbin/httpd -k start 278533 1276780 nobody 17900 0.0 S 00:27 /usr/sbin/httpd -k start 1469 1 root 17644 0.1 Ss 44-13:07:43 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 278302 1276780 nobody 17576 0.0 S 00:45 /usr/sbin/httpd -k start 278273 1276780 nobody 16896 0.0 S 00:48 /usr/sbin/httpd -k start 278274 1276780 nobody 16784 0.0 S 00:48 /usr/sbin/httpd -k start 278293 1276780 nobody 16748 0.0 S 00:46 /usr/sbin/httpd -k start 278310 1276780 nobody 16428 0.0 S 00:45 /usr/sbin/httpd -k start 278524 1276780 nobody 16284 0.0 S 00:28 /usr/sbin/httpd -k start 278295 1276780 nobody 15992 0.0 S 00:46 /usr/sbin/httpd -k start 278296 1276780 nobody 15840 0.0 S 00:46 /usr/sbin/httpd -k start 278285 1276780 nobody 15728 0.0 S 00:47 /usr/sbin/httpd -k start 278674 1276780 nobody 15724 0.0 S 00:06 /usr/sbin/httpd -k start 278673 1276780 nobody 15308 0.0 S 00:07 /usr/sbin/httpd -k start 3979356 3472245 root 15188 0.0 S 10:06:40 spamd child 278671 1276780 nobody 14904 0.0 S 00:08 /usr/sbin/httpd -k start 278672 1276780 nobody 14852 0.0 S 00:07 /usr/sbin/httpd -k start 185104 2431 netdata 14808 1.8 Sl 02:44:02 /usr/libexec/netdata/plugins.d/apps.plugin 1 1204 1 zabbix 14672 0.2 Ssl 44-13:07:44 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1463 1 root 13732 0.0 Ss 44-13:07:43 tailwatchd 241600 3828812 aaa 13432 0.0 S 01:05:21 dovecot/imap 250467 3828812 lowrange 12948 0.0 S 51:59 dovecot/imap 273730 3828812 lowrange 12652 0.0 S 09:17 dovecot/imap 270900 3828812 infinium 12536 0.0 S 14:15 dovecot/imap 257437 3828812 infinium 12384 0.0 S 38:30 dovecot/imap 267999 3828812 infinium 12144 0.0 S 20:19 dovecot/imap 3471498 1 root 11328 0.0 Ss 20:55:31 lfd - sleeping 277673 3828812 root 11028 0.0 S 01:58 dovecot/auth -w 278684 1276780 nobody 10840 0.0 S 00:01 /usr/sbin/httpd -k start 837413 1471 root 9928 0.0 S 3-04:08:52 cPhulkd - dbprocessor 1805633 3828812 dovenull 8824 0.0 S 2-07:44:50 dovecot/imap-login --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 83582 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/evolutionerp.com.au-ssl_log 110 infinium/infinium.net.au-ssl_log 25 evolution/portal.evolutionerp.com.au-ssl_log 22 (total vhosts taking traffic: 3) --- top client IPs across all vhosts (last 3 min) --- 102 34.16.176.168 22 203.54.180.238 8 118.127.40.55 2 95.216.13.46 2 69.72.136.99 2 51.79.65.194 2 198.38.94.67 2 188.164.197.230 2 167.71.70.215 2 162.240.105.3 2 162.240.102.228 2 160.250.130.168 2 124.156.157.91 2 108.167.161.33 2 108.167.161.148 --- top request paths across all vhosts (last 3 min) --- 22 GET /heartbeat.php 12 GET /wp-login.php 10 POST /wp-login.php 9 GET / 4 POST /wp-cron.php 2 POST / 1 GET /wp-json/wp/v2/users/me 1 GET /wp-json/jetpack/v4/sync/spawn-sync 1 GET /web/.env 1 GET /src/.env 1 GET /server/.env 1 GET /root/.aws/credentials 1 GET /root/.aws/config 1 GET /public/.env 1 GET /laravel/.env 1 GET /.git-credentials 1 GET /@fs/var/www/html/wp-config.php 1 GET /@fs/var/www/html/.env 1 GET /@fs/var/www/html/.aws/credentials 1 GET /@fs/var/www/.env --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 9 GET / 2 POST /wp-cron.php 1 POST /wp-login.php 1 GET /wp-login.php 1 GET /wp-json/jetpack/v4/sync/spawn-sync 1 GET /web/.env 1 GET /src/.env 1 GET /server/.env 1 GET /root/.aws/credentials 1 GET /root/.aws/config 1 GET /public/.env 1 GET /laravel/.env -- last 10 requests -- 34.16.176.168 - - [12/Aug/2026:23:17:34 +1000] "GET /admin/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.16.176.168 - - [12/Aug/2026:23:17:34 +1000] "GET /api/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 34.16.176.168 - - [12/Aug/2026:23:17:34 +1000] "GET /web/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 34.16.176.168 - - [12/Aug/2026:23:17:34 +1000] "GET /frontend/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 34.16.176.168 - - [12/Aug/2026:23:17:34 +1000] "GET /.aws/credentials HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 34.16.176.168 - - [12/Aug/2026:23:17:34 +1000] "GET /.aws/config HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.16.176.168 - - [12/Aug/2026:23:17:34 +1000] "GET /root/.aws/credentials HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 34.16.176.168 - - [12/Aug/2026:23:17:34 +1000] "GET /root/.aws/config HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 34.16.176.168 - - [12/Aug/2026:23:17:34 +1000] "GET /aws.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 34.16.176.168 - - [12/Aug/2026:23:17:34 +1000] "GET /.git-credentials HTTP/1.1" 404 201388 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" == infinium/infinium.net.au-ssl_log == -- top paths -- 11 GET /wp-login.php 9 POST /wp-login.php 2 POST /wp-cron.php 2 POST / 1 GET /wp-json/wp/v2/users/me -- last 10 requests -- 162.240.105.3 - - [12/Aug/2026:23:15:35 +1000] "POST /wp-login.php HTTP/1.1" 503 6747 "https://infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0. 118.127.40.55 - - [12/Aug/2026:23:15:44 +1000] "POST /?wordfence_syncAttackData=1786540544.6864 HTTP/1.1" 200 1 "-" "WordPress/7.0.3; https://infinium.net.au" 162.240.102.228 - - [12/Aug/2026:23:15:44 +1000] "GET /wp-login.php HTTP/1.1" 200 1706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 162.240.102.228 - - [12/Aug/2026:23:15:46 +1000] "POST /wp-login.php HTTP/1.1" 503 6747 "https://mail.infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome 188.164.197.230 - - [12/Aug/2026:23:16:13 +1000] "GET /wp-login.php HTTP/1.1" 200 1706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 188.164.197.230 - - [12/Aug/2026:23:16:14 +1000] "POST /wp-login.php HTTP/1.1" 503 6747 "https://mail.infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome 108.167.161.33 - - [12/Aug/2026:23:16:21 +1000] "GET /wp-login.php HTTP/1.1" 200 1706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 108.167.161.33 - - [12/Aug/2026:23:16:25 +1000] "POST /wp-login.php HTTP/1.1" 503 6747 "https://mail.infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ 69.72.136.99 - - [12/Aug/2026:23:16:48 +1000] "GET /wp-login.php HTTP/1.1" 503 6562 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 69.72.136.99 - - [12/Aug/2026:23:16:49 +1000] "POST /wp-login.php HTTP/1.1" 503 6562 "https://infinium.net.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/14 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 22 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [12/Aug/2026:23:16:02 +1000] "GET /heartbeat.php?sentAt=1786540562&bytes=106,124,114,18&_=1786532339107 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [12/Aug/2026:23:16:07 +1000] "GET /heartbeat.php?sentAt=1786540567&bytes=106,124,114,23&_=1786510906512 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [12/Aug/2026:23:16:12 +1000] "GET /heartbeat.php?sentAt=1786540572&bytes=106,124,114,28&_=1786532339108 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [12/Aug/2026:23:16:17 +1000] "GET /heartbeat.php?sentAt=1786540577&bytes=106,124,114,33&_=1786510906513 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [12/Aug/2026:23:16:22 +1000] "GET /heartbeat.php?sentAt=1786540582&bytes=106,124,114,38&_=1786532339109 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [12/Aug/2026:23:16:27 +1000] "GET /heartbeat.php?sentAt=1786540587&bytes=106,124,114,43&_=1786510906514 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [12/Aug/2026:23:16:32 +1000] "GET /heartbeat.php?sentAt=1786540592&bytes=106,124,114,48&_=1786532339110 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [12/Aug/2026:23:16:37 +1000] "GET /heartbeat.php?sentAt=1786540597&bytes=106,124,114,53&_=1786510906515 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [12/Aug/2026:23:16:42 +1000] "GET /heartbeat.php?sentAt=1786540602&bytes=106,124,114,58&_=1786532339111 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [12/Aug/2026:23:16:47 +1000] "GET /heartbeat.php?sentAt=1786540607&bytes=106,124,114,63&_=1786510906516 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-08-12 23:15:22 L1=0.79 run=1 blk=0 avail=8597 (73.3%) swpO=0 conn=5 myRSS=989 php=2 phpRSS=110 ap=20 tcp=34 topuser=evolution 2026-08-12 23:15:22 L1=0.79 run=1 blk=0 avail=8596 (73.3%) swpO=0 conn=3 myRSS=989 php=2 phpRSS=110 ap=20 tcp=35 topuser=evolution 2026-08-12 23:15:32 L1=0.66 run=1 blk=0 avail=8653 (73.8%) swpO=0 conn=5 myRSS=989 php=1 phpRSS=41 ap=19 tcp=33 topuser=evolution 2026-08-12 23:15:32 L1=0.66 run=3 blk=0 avail=8621 (73.5%) swpO=0 conn=3 myRSS=989 php=2 phpRSS=101 ap=19 tcp=34 topuser=infinium 2026-08-12 23:15:42 L1=0.64 run=1 blk=0 avail=8649 (73.7%) swpO=0 conn=5 myRSS=989 php=1 phpRSS=41 ap=19 tcp=31 topuser=evolution 2026-08-12 23:15:42 L1=0.64 run=1 blk=0 avail=8647 (73.7%) swpO=0 conn=2 myRSS=989 php=1 phpRSS=41 ap=19 tcp=32 topuser=evolution 2026-08-12 23:15:52 L1=0.61 run=3 blk=0 avail=8594 (73.3%) swpO=0 conn=5 myRSS=989 php=2 phpRSS=108 ap=19 tcp=32 topuser=alison 2026-08-12 23:15:52 L1=0.61 run=2 blk=0 avail=8571 (73.1%) swpO=0 conn=2 myRSS=989 php=2 phpRSS=147 ap=19 tcp=32 topuser=alison 2026-08-12 23:16:02 L1=0.52 run=1 blk=0 avail=8659 (73.8%) swpO=0 conn=2 myRSS=989 php=1 phpRSS=41 ap=18 tcp=27 topuser=evolution 2026-08-12 23:16:02 L1=0.52 run=1 blk=0 avail=8659 (73.8%) swpO=0 conn=2 myRSS=989 php=1 phpRSS=41 ap=18 tcp=28 topuser=evolution 2026-08-12 23:16:12 L1=0.52 run=1 blk=0 avail=8654 (73.8%) swpO=0 conn=2 myRSS=989 php=1 phpRSS=41 ap=18 tcp=30 topuser=evolution 2026-08-12 23:16:13 L1=0.52 run=1 blk=0 avail=8652 (73.8%) swpO=0 conn=2 myRSS=989 php=1 phpRSS=41 ap=18 tcp=30 topuser=evolution 2026-08-12 23:16:22 L1=0.44 run=2 blk=0 avail=8663 (73.9%) swpO=0 conn=2 myRSS=989 php=1 phpRSS=40 ap=17 tcp=28 topuser=evolution 2026-08-12 23:16:23 L1=0.44 run=1 blk=0 avail=8660 (73.8%) swpO=0 conn=2 myRSS=989 php=1 phpRSS=40 ap=17 tcp=28 topuser=evolution 2026-08-12 23:16:32 L1=0.37 run=2 blk=0 avail=8641 (73.7%) swpO=0 conn=2 myRSS=989 php=2 phpRSS=94 ap=15 tcp=30 topuser=madalice 2026-08-12 23:16:33 L1=0.37 run=2 blk=0 avail=8604 (73.4%) swpO=0 conn=2 myRSS=989 php=2 phpRSS=137 ap=15 tcp=29 topuser=madalice 2026-08-12 23:16:42 L1=0.31 run=1 blk=0 avail=8674 (74.0%) swpO=0 conn=2 myRSS=989 php=1 phpRSS=40 ap=15 tcp=28 topuser=evolution 2026-08-12 23:16:43 L1=0.31 run=1 blk=0 avail=8687 (74.1%) swpO=0 conn=1 myRSS=989 php=0 phpRSS=0 ap=15 tcp=28 topuser=- 2026-08-12 23:16:52 L1=0.34 run=1 blk=0 avail=8541 (72.8%) swpO=0 conn=2 myRSS=989 php=2 phpRSS=197 ap=16 tcp=29 topuser=evolution 2026-08-12 23:16:53 L1=0.34 run=2 blk=0 avail=8528 (72.7%) swpO=0 conn=1 myRSS=989 php=2 phpRSS=209 ap=16 tcp=29 topuser=evolution 2026-08-12 23:17:02 L1=0.43 run=4 blk=0 avail=7988 (68.1%) swpO=0 conn=6 myRSS=989 php=5 phpRSS=657 ap=44 tcp=36 topuser=corpkicks 2026-08-12 23:17:03 L1=0.43 run=2 blk=0 avail=7904 (67.4%) swpO=0 conn=1 myRSS=989 php=4 phpRSS=708 ap=44 tcp=37 topuser=corpkicks 2026-08-12 23:17:12 L1=0.37 run=2 blk=0 avail=8530 (72.7%) swpO=0 conn=6 myRSS=989 php=2 phpRSS=136 ap=34 tcp=27 topuser=evolution 2026-08-12 23:17:13 L1=0.37 run=2 blk=0 avail=8607 (73.4%) swpO=0 conn=1 myRSS=989 php=0 phpRSS=0 ap=34 tcp=27 topuser=- 2026-08-12 23:17:22 L1=2.60 run=3 blk=0 avail=8384 (71.5%) swpO=41 conn=6 myRSS=1079 php=3 phpRSS=238 ap=35 tcp=29 topuser=madalice 2026-08-12 23:17:23 L1=2.60 run=3 blk=0 avail=8318 (70.9%) swpO=41 conn=1 myRSS=1079 php=2 phpRSS=274 ap=35 tcp=30 topuser=madalice 2026-08-12 23:17:32 L1=2.49 run=1 blk=0 avail=8593 (73.3%) swpO=0 conn=6 myRSS=1079 php=1 phpRSS=41 ap=25 tcp=24 topuser=evolution 2026-08-12 23:17:33 L1=2.49 run=1 blk=0 avail=8612 (73.4%) swpO=0 conn=1 myRSS=1079 php=0 phpRSS=0 ap=24 tcp=24 topuser=- 2026-08-12 23:17:42 L1=3.29 run=19 blk=0 avail=7696 (65.6%) swpO=0 conn=6 myRSS=1079 php=16 phpRSS=1417 ap=26 tcp=40 topuser=evolution 2026-08-12 23:17:43 L1=3.29 run=22 blk=0 avail=7152 (61.0%) swpO=0 conn=16 myRSS=1079 php=16 phpRSS=1978 ap=26 tcp=39 topuser=evolution