INCIDENT 2026-08-13 00:43:18 trigger: php_rss=1676MB ================================================================== load: 1.12 0.91 0.94 12/609 323677 ncpu:10 mem_avail: 6706MB/11729MB (57.2%) swap_used:1180MB swapout:0/s blocked(D):0 running:9 iowait:0.0% steal:0.0% php: 11 procs / 1676MB heaviest user: corpkicks (6 procs, 1288MB) apache: 23 procs tcp_estab: 35 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1554 corpkicks 5 1053 root 242 660 infinium 7 398 nobody 22 391 netdata 8 268 cpanellogin 1 64 evolution 12 46 lowrange 3 37 mailman 20 26 dovenull 6 24 wp-toolkit 6 22 zabbix 1 15 aaa 1 13 dovecot 3 9 named 1 6 nscd 1 3 dbus 1 3 cpanelconnecttrack 1 3 polkitd 1 2 --- php workers by user --- USER PROCS RSS_MB corpkicks 5 1064 infinium 4 367 evolution 1 39 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5824 MB Active(file): 3569 MB Inactive(file): 2428 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 347 MB CommitLimit: 9960 MB Committed_AS: 7963 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3432421 root 23:32:02 1828 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 184574 1 mysql 1592156 4.2 Ssl 04:09:46 /usr/sbin/mariadbd 323634 319896 corpkicks 265120 124 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 323638 323418 corpkicks 232696 105 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 323635 322772 corpkicks 228616 121 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1220 1 netdata 218800 2.5 Ssl 44-14:33:19 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 323637 323423 corpkicks 213908 108 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 323639 319395 corpkicks 210148 107 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 310241 3472245 root 164500 0.1 S 25:46 spamd child 159820 1 root 127808 0.0 Ss 23-14:56:27 /usr/lib/systemd/systemd-journald 323643 323422 infinium 117300 42.0 S 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 323636 323379 infinium 103336 38.0 S 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 323645 323628 infinium 101700 42.0 S 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 323648 314146 infinium 77004 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3979356 3472245 root 71420 0.0 S 11:32:15 spamd child 232673 1353308 cpanellogin 66036 0.0 S 02:44:30 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 3472245 1 root 49756 0.0 Ss 22:20:35 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1353308 1 root 42056 0.0 Ss 21-22:01:49 cpsrvd (SSL) - waiting for connections 2223 1201 root 41660 0.0 Sl 44-14:33:18 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 323641 316961 evolution 40920 5.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 36456 0.1 Sl 44-14:33:14 /usr/libexec/netdata/plugins.d/go.d.plugin 1 300286 1 root 32672 0.0 Ss 43:16 lfd - sleeping 316783 1276780 nobody 22716 0.0 S 12:21 /usr/sbin/httpd -k start 320995 1276780 nobody 22284 0.0 S 04:34 /usr/sbin/httpd -k start 322673 1276780 nobody 22248 0.0 S 01:23 /usr/sbin/httpd -k start 319896 1276780 nobody 22224 0.0 S 06:50 /usr/sbin/httpd -k start 320996 1276780 nobody 21656 0.0 S 04:34 /usr/sbin/httpd -k start 319395 1276780 nobody 21596 0.0 S 07:37 /usr/sbin/httpd -k start 316961 1276780 nobody 21464 0.0 S 12:05 /usr/sbin/httpd -k start 314146 1276780 nobody 21244 0.0 S 17:52 /usr/sbin/httpd -k start 321964 1276780 nobody 20600 0.0 S 03:05 /usr/sbin/httpd -k start 322669 1276780 nobody 20544 0.0 S 01:24 /usr/sbin/httpd -k start 322244 1276780 nobody 20520 0.0 S 02:26 /usr/sbin/httpd -k start 322758 1276780 nobody 19448 0.0 S 01:16 /usr/sbin/httpd -k start 323418 1276780 nobody 19348 0.1 S 00:20 /usr/sbin/httpd -k start 322772 1276780 nobody 19188 0.0 S 01:13 /usr/sbin/httpd -k start 323371 1276780 nobody 18624 0.2 S 00:24 /usr/sbin/httpd -k start 1469 1 root 17676 0.1 Ss 44-14:33:18 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 323422 1276780 nobody 17656 0.1 S 00:19 /usr/sbin/httpd -k start 323379 1276780 nobody 17580 0.0 S 00:23 /usr/sbin/httpd -k start 185104 2431 netdata 17372 1.9 Sl 04:09:37 /usr/libexec/netdata/plugins.d/apps.plugin 1 323423 1276780 nobody 16832 0.0 S 00:19 /usr/sbin/httpd -k start 323378 1276780 nobody 16312 0.0 S 00:23 /usr/sbin/httpd -k start 1204 1 zabbix 16196 0.2 Ssl 44-14:33:19 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 323628 1276780 nobody 15324 0.0 S 00:03 /usr/sbin/httpd -k start 1463 1 root 13752 0.0 Ss 44-14:33:18 tailwatchd 241600 3828812 aaa 13444 0.0 S 02:30:56 dovecot/imap 321767 3828812 lowrange 13116 0.0 S 03:18 dovecot/pop3 279308 3828812 lowrange 13020 0.0 S 01:24:52 dovecot/imap 273730 3828812 lowrange 12640 0.0 S 01:34:52 dovecot/imap 302346 3828812 infinium 12536 0.0 S 39:25 dovecot/imap 321554 3828812 infinium 12060 0.0 S 03:50 dovecot/imap 313315 3828812 infinium 11944 0.0 S 19:29 dovecot/imap 323033 3828812 root 11044 0.0 S 00:44 dovecot/auth -w 323593 3828812 root 10156 0.0 S 00:07 dovecot/quota-status -p postfix 837413 1471 root 9992 0.0 S 3-05:34:27 cPhulkd - dbprocessor 1805633 3828812 dovenull 8824 0.0 S 2-09:10:25 dovecot/imap-login 1466 1 root 7684 0.0 Ss 44-14:33:18 dnsadmin - dormant mode 3651102 1 root 7564 0.0 Ss 4-22:20:32 queueprocd - waiting up to 60s to process a task 1805629 3828812 dovenull 7492 0.0 S 2-09:10:25 dovecot/imap-login 1574 1 wp-toolkit 7456 0.0 Ss 44-14:33:18 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 100061 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min vinesit/vinesit.com.au-ssl_log 82 evolution/portal.evolutionerp.com.au-ssl_log 15 corpkicks/corporatekicks.com.au-ssl_log 9 madalice/madalice.com.au-ssl_log 5 otterfencing/otterfencing.com.au-ssl_log 4 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 82 20.218.66.54 15 203.54.180.238 5 34.138.228.63 4 118.127.40.55 2 114.119.143.104 2 100.22.112.234 1 57.141.16.120 1 34.196.51.17 1 2a03:2880:f802:14:: 1 114.119.140.234 1 114.119.137.101 --- top request paths across all vhosts (last 3 min) --- 15 GET /heartbeat.php 4 POST /wp-cron.php 4 GET /store/custom-manly-sea-eagles-kids/ 2 GET /fffm.php 1 HEAD / 1 GET /zaza.php 1 GET /z60.php 1 GET /xxw.php 1 GET /xwx1.php 1 GET /xr.php 1 GET /xml.php 1 GET /ww1.php 1 GET /ws.php 1 GET /ws77.php 1 GET /wp-the.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wpls.php 1 GET /wp-login.php 1 GET /wp-home.php --- busiest 3 vhosts: top paths + last 10 requests --- == vinesit/vinesit.com.au-ssl_log == -- top paths -- 2 GET /fffm.php 1 GET /zaza.php 1 GET /z60.php 1 GET /xxw.php 1 GET /xwx1.php 1 GET /xr.php 1 GET /xml.php 1 GET /ww1.php 1 GET /ws.php 1 GET /ws77.php 1 GET /wp-the.php 1 GET /wp.php -- last 10 requests -- 20.218.66.54 - - [13/Aug/2026:00:43:02 +1000] "GET /wp-admin/includes/about.php HTTP/1.1" 404 5749 "-" "-" 20.218.66.54 - - [13/Aug/2026:00:43:04 +1000] "GET /pn.php HTTP/1.1" 404 5749 "-" "-" 20.218.66.54 - - [13/Aug/2026:00:43:05 +1000] "GET /xwx1.php HTTP/1.1" 404 5749 "-" "-" 20.218.66.54 - - [13/Aug/2026:00:43:06 +1000] "GET /25.php HTTP/1.1" 404 5749 "-" "-" 20.218.66.54 - - [13/Aug/2026:00:43:06 +1000] "GET /wp-admin/options-privacy.php HTTP/1.1" 404 5749 "-" "-" 20.218.66.54 - - [13/Aug/2026:00:43:07 +1000] "GET /r.php HTTP/1.1" 404 5749 "-" "-" 20.218.66.54 - - [13/Aug/2026:00:43:07 +1000] "GET /elp.php HTTP/1.1" 404 5749 "-" "-" 20.218.66.54 - - [13/Aug/2026:00:43:08 +1000] "GET /admin-footer.php HTTP/1.1" 404 5749 "-" "-" 20.218.66.54 - - [13/Aug/2026:00:43:09 +1000] "GET /inso.php HTTP/1.1" 404 5749 "-" "-" 20.218.66.54 - - [13/Aug/2026:00:43:10 +1000] "GET /sc.php HTTP/1.1" 404 5749 "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 15 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [13/Aug/2026:00:41:27 +1000] "GET /heartbeat.php?sentAt=1786545687&bytes=106,124,134,23&_=1786510907024 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:00:41:32 +1000] "GET /heartbeat.php?sentAt=1786545692&bytes=106,124,134,28&_=1786532339620 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:00:41:37 +1000] "GET /heartbeat.php?sentAt=1786545697&bytes=106,124,134,33&_=1786510907025 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:00:41:42 +1000] "GET /heartbeat.php?sentAt=1786545702&bytes=106,124,134,38&_=1786532339621 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:00:41:47 +1000] "GET /heartbeat.php?sentAt=1786545707&bytes=106,124,134,43&_=1786510907026 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:00:41:52 +1000] "GET /heartbeat.php?sentAt=1786545712&bytes=106,124,134,48&_=1786532339622 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:00:41:57 +1000] "GET /heartbeat.php?sentAt=1786545717&bytes=106,124,134,53&_=1786510907027 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:00:42:02 +1000] "GET /heartbeat.php?sentAt=1786545722&bytes=106,124,134,58&_=1786532339623 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:00:42:07 +1000] "GET /heartbeat.php?sentAt=1786545727&bytes=106,124,134,63&_=1786510907028 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:00:42:12 +1000] "GET /heartbeat.php?sentAt=1786545732&bytes=106,124,134,68&_=1786532339624 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" == corpkicks/corporatekicks.com.au-ssl_log == -- top paths -- 2 POST /wp-cron.php 1 HEAD / 1 GET /.well-known/apple-app-site-association 1 GET /news_sitemap.xml 1 GET /llms.txt 1 GET /app-ads.txt 1 GET /ads.txt 1 GET / -- last 10 requests -- 57.141.16.120 - - [13/Aug/2026:00:41:37 +1000] "GET /news_sitemap.xml HTTP/1.1" 404 85708 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; 34.138.228.63 - - [13/Aug/2026:00:42:50 +1000] "GET / HTTP/1.1" 200 25643 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 PTST/260802.202201" 118.127.40.55 - - [13/Aug/2026:00:42:52 +1000] "POST /wp-cron.php?doing_wp_cron=1786545772.1236870288848876953125 HTTP/1.1" 200 1 "-" "WordPress/7.0.3; https://corporatekicks.com.au" 34.138.228.63 - - [13/Aug/2026:00:43:03 +1000] "GET /ads.txt HTTP/1.1" 404 16279 "https://corporatekicks.com.au/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 PTS 34.138.228.63 - - [13/Aug/2026:00:43:03 +1000] "GET /app-ads.txt HTTP/1.1" 404 16279 "https://corporatekicks.com.au/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 34.196.51.17 - - [13/Aug/2026:00:43:03 +1000] "HEAD / HTTP/1.1" 200 - "https://corporatekicks.com.au/" "WPMUDEV Uptime Monitor 5.0 (https://wpmudev.com)" 118.127.40.55 - - [13/Aug/2026:00:43:04 +1000] "POST /wp-cron.php?doing_wp_cron=1786545784.4632129669189453125000 HTTP/1.1" 200 1 "-" "WordPress/7.0.3; https://corporatekicks.com.au" 34.138.228.63 - - [13/Aug/2026:00:43:06 +1000] "GET /.well-known/apple-app-site-association HTTP/1.1" 404 16344 "https://corporatekicks.com.au/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chr 34.138.228.63 - - [13/Aug/2026:00:43:08 +1000] "GET /llms.txt HTTP/1.1" 404 16279 "https://corporatekicks.com.au/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 PT --- last 30 samples (run-up to this incident) --- 2026-08-13 00:40:49 L1=0.91 run=2 blk=0 avail=7878 (67.2%) swpO=0 conn=1 myRSS=1551 php=2 phpRSS=257 ap=14 tcp=29 topuser=evolution 2026-08-13 00:40:57 L1=0.85 run=7 blk=0 avail=7955 (67.8%) swpO=0 conn=2 myRSS=1551 php=4 phpRSS=277 ap=17 tcp=31 topuser=corpkicks 2026-08-13 00:40:59 L1=0.85 run=4 blk=0 avail=7577 (64.6%) swpO=0 conn=1 myRSS=1551 php=4 phpRSS=646 ap=18 tcp=34 topuser=corpkicks 2026-08-13 00:41:07 L1=0.80 run=1 blk=0 avail=8099 (69.0%) swpO=0 conn=2 myRSS=1551 php=1 phpRSS=41 ap=17 tcp=26 topuser=evolution 2026-08-13 00:41:09 L1=0.80 run=1 blk=0 avail=8112 (69.2%) swpO=0 conn=1 myRSS=1551 php=0 phpRSS=0 ap=16 tcp=25 topuser=- 2026-08-13 00:41:17 L1=0.67 run=1 blk=0 avail=8108 (69.1%) swpO=0 conn=2 myRSS=1551 php=1 phpRSS=41 ap=15 tcp=25 topuser=evolution 2026-08-13 00:41:19 L1=0.67 run=1 blk=0 avail=8119 (69.2%) swpO=0 conn=1 myRSS=1551 php=0 phpRSS=0 ap=15 tcp=24 topuser=- 2026-08-13 00:41:27 L1=0.57 run=6 blk=0 avail=8070 (68.8%) swpO=0 conn=4 myRSS=1551 php=3 phpRSS=141 ap=15 tcp=26 topuser=tubesupplies 2026-08-13 00:41:29 L1=0.57 run=2 blk=0 avail=7962 (67.9%) swpO=0 conn=1 myRSS=1551 php=2 phpRSS=219 ap=15 tcp=27 topuser=tubesupplies 2026-08-13 00:41:37 L1=0.78 run=4 blk=0 avail=7985 (68.1%) swpO=0 conn=4 myRSS=1551 php=2 phpRSS=193 ap=16 tcp=27 topuser=corpkicks 2026-08-13 00:41:39 L1=0.78 run=1 blk=0 avail=8117 (69.2%) swpO=0 conn=1 myRSS=1551 php=0 phpRSS=0 ap=16 tcp=24 topuser=- 2026-08-13 00:41:47 L1=0.66 run=1 blk=0 avail=8113 (69.2%) swpO=0 conn=4 myRSS=1551 php=1 phpRSS=40 ap=15 tcp=23 topuser=evolution 2026-08-13 00:41:49 L1=0.66 run=1 blk=0 avail=8129 (69.3%) swpO=0 conn=1 myRSS=1551 php=0 phpRSS=0 ap=15 tcp=20 topuser=- 2026-08-13 00:41:57 L1=0.71 run=4 blk=0 avail=7835 (66.8%) swpO=0 conn=4 myRSS=1551 php=4 phpRSS=393 ap=18 tcp=29 topuser=customc 2026-08-13 00:41:59 L1=0.71 run=2 blk=0 avail=7940 (67.7%) swpO=0 conn=1 myRSS=1551 php=2 phpRSS=227 ap=18 tcp=27 topuser=otterfencing 2026-08-13 00:42:07 L1=0.60 run=2 blk=0 avail=8035 (68.5%) swpO=0 conn=4 myRSS=1551 php=2 phpRSS=105 ap=20 tcp=35 topuser=madalice 2026-08-13 00:42:09 L1=0.60 run=2 blk=0 avail=7915 (67.5%) swpO=0 conn=2 myRSS=1551 php=1 phpRSS=196 ap=20 tcp=34 topuser=madalice 2026-08-13 00:42:17 L1=0.51 run=1 blk=0 avail=8085 (68.9%) swpO=0 conn=4 myRSS=1551 php=1 phpRSS=39 ap=19 tcp=28 topuser=evolution 2026-08-13 00:42:19 L1=0.51 run=1 blk=0 avail=8098 (69.0%) swpO=0 conn=2 myRSS=1551 php=0 phpRSS=0 ap=18 tcp=27 topuser=- 2026-08-13 00:42:28 L1=0.50 run=1 blk=0 avail=8084 (68.9%) swpO=0 conn=2 myRSS=1552 php=1 phpRSS=40 ap=18 tcp=28 topuser=evolution 2026-08-13 00:42:29 L1=0.50 run=1 blk=0 avail=8099 (69.0%) swpO=0 conn=2 myRSS=1552 php=0 phpRSS=0 ap=18 tcp=24 topuser=- 2026-08-13 00:42:38 L1=0.59 run=1 blk=0 avail=8079 (68.9%) swpO=0 conn=2 myRSS=1552 php=1 phpRSS=40 ap=18 tcp=29 topuser=evolution 2026-08-13 00:42:39 L1=0.59 run=1 blk=0 avail=8091 (69.0%) swpO=0 conn=2 myRSS=1552 php=0 phpRSS=0 ap=18 tcp=30 topuser=- 2026-08-13 00:42:48 L1=0.66 run=1 blk=0 avail=8066 (68.8%) swpO=0 conn=2 myRSS=1552 php=1 phpRSS=40 ap=18 tcp=29 topuser=evolution 2026-08-13 00:42:49 L1=0.66 run=3 blk=0 avail=7827 (66.7%) swpO=0 conn=2 myRSS=1552 php=2 phpRSS=311 ap=18 tcp=31 topuser=evolution 2026-08-13 00:42:58 L1=0.71 run=3 blk=0 avail=7947 (67.8%) swpO=0 conn=2 myRSS=1552 php=3 phpRSS=212 ap=21 tcp=34 topuser=infinium 2026-08-13 00:42:59 L1=0.71 run=2 blk=0 avail=8009 (68.3%) swpO=0 conn=2 myRSS=1552 php=1 phpRSS=75 ap=24 tcp=34 topuser=aaa 2026-08-13 00:43:08 L1=0.76 run=2 blk=0 avail=7998 (68.2%) swpO=0 conn=2 myRSS=1552 php=2 phpRSS=118 ap=24 tcp=31 topuser=madalice 2026-08-13 00:43:09 L1=0.76 run=3 blk=0 avail=7730 (65.9%) swpO=0 conn=3 myRSS=1552 php=2 phpRSS=390 ap=23 tcp=30 topuser=madalice 2026-08-13 00:43:18 L1=1.12 run=9 blk=0 avail=6706 (57.2%) swpO=0 conn=11 myRSS=1554 php=11 phpRSS=1676 ap=23 tcp=35 topuser=corpkicks