INCIDENT 2026-08-13 01:49:08 trigger: php_rss=1853MB ================================================================== load: 1.68 1.26 1.12 16/609 363747 ncpu:10 mem_avail: 6392MB/11729MB (54.5%) swap_used:1175MB swapout:41/s blocked(D):0 running:15 iowait:0.0% steal:0.0% php: 10 procs / 1853MB heaviest user: corpkicks (9 procs, 1813MB) apache: 23 procs tcp_estab: 36 --- RSS by user (all processes) --- USER PROCS RSS_MB corpkicks 9 1897 mysql 1 1645 root 241 702 nobody 22 361 netdata 8 275 cpanellogin 1 55 evolution 12 47 mailman 20 26 lowrange 2 25 dovenull 6 25 wp-toolkit 6 22 zabbix 1 15 aaa 1 13 vinesit 1 12 infinium 1 11 mailnull 2 10 dovecot 3 9 named 1 7 nscd 1 3 dbus 1 3 --- php workers by user --- USER PROCS RSS_MB corpkicks 9 1918 evolution 1 39 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5382 MB Active(file): 3668 MB Inactive(file): 2086 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 614 MB CommitLimit: 9960 MB Committed_AS: 8202 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 342014 root 37:51 13360 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 184574 1 mysql 1683404 3.8 Ssl 05:15:36 /usr/sbin/mariadbd 363678 361709 corpkicks 272672 74.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 363688 363528 corpkicks 238676 115 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 363685 363537 corpkicks 230008 125 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 363683 363529 corpkicks 229536 119 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 363681 362705 corpkicks 228172 120 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1220 1 netdata 223164 2.5 Ssl 44-15:39:09 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 363682 363542 corpkicks 206644 125 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 363713 363687 corpkicks 194404 86.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 363684 358149 corpkicks 188132 109 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 310241 3472245 root 167564 0.0 S 01:31:36 spamd child 159820 1 root 149936 0.0 Ss 23-16:02:17 /usr/lib/systemd/systemd-journald 3979356 3472245 root 70596 0.0 S 12:38:05 spamd child 356923 1353308 cpanellogin 56628 0.1 S 12:16 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 3472245 1 root 48240 0.0 Ss 23:26:25 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1353308 1 root 42012 0.0 Ss 21-23:07:39 cpsrvd (SSL) - waiting for connections 2223 1201 root 41736 0.0 Sl 44-15:39:08 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 363715 361557 evolution 40920 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 39288 0.1 Sl 44-15:39:04 /usr/libexec/netdata/plugins.d/go.d.plugin 1 300286 1 root 30876 0.0 Ss 01:49:06 lfd - sleeping 358149 1276780 nobody 23680 0.0 S 09:50 /usr/sbin/httpd -k start 361709 1276780 nobody 21948 0.0 S 03:45 /usr/sbin/httpd -k start 361557 1276780 nobody 21332 0.0 S 04:04 /usr/sbin/httpd -k start 361033 1276780 nobody 21244 0.1 S 05:00 /usr/sbin/httpd -k start 362694 1276780 nobody 20528 0.0 S 01:40 /usr/sbin/httpd -k start 362706 1276780 nobody 20384 0.0 S 01:39 /usr/sbin/httpd -k start 361711 1276780 nobody 20244 0.0 S 03:44 /usr/sbin/httpd -k start 362705 1276780 nobody 20024 0.1 S 01:39 /usr/sbin/httpd -k start 363528 1276780 nobody 19484 0.1 S 00:16 /usr/sbin/httpd -k start 363537 1276780 nobody 19468 0.2 S 00:15 /usr/sbin/httpd -k start 362592 1276780 nobody 19416 0.0 S 01:42 /usr/sbin/httpd -k start 363529 1276780 nobody 18832 0.1 S 00:16 /usr/sbin/httpd -k start 363525 1276780 nobody 18552 0.2 S 00:17 /usr/sbin/httpd -k start 363536 1276780 nobody 18500 0.2 S 00:15 /usr/sbin/httpd -k start 363538 1276780 nobody 18224 0.1 S 00:15 /usr/sbin/httpd -k start 363542 1276780 nobody 18216 0.0 S 00:13 /usr/sbin/httpd -k start 363535 1276780 nobody 17644 0.1 S 00:15 /usr/sbin/httpd -k start 185104 2431 netdata 17600 1.9 Sl 05:15:27 /usr/libexec/netdata/plugins.d/apps.plugin 1 1469 1 root 17516 0.1 Ss 44-15:39:08 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1204 1 zabbix 15932 0.2 Ssl 44-15:39:09 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 363687 1276780 nobody 14876 0.0 S 00:01 /usr/sbin/httpd -k start 363716 1276780 nobody 13732 0.0 S 00:00 /usr/sbin/httpd -k start 1463 1 root 13688 0.0 Ss 44-15:39:08 tailwatchd 359361 3828812 aaa 13632 0.0 S 08:06 dovecot/imap 342014 1 root 13360 0.0 Ssl 37:51 /usr/bin/imunify-agent-proxy 279308 3828812 lowrange 13020 0.0 S 02:30:42 dovecot/imap 363342 1471 root 12984 0.0 S 00:35 cPhulkd - processor - http socket 273730 3828812 lowrange 12772 0.0 S 02:40:42 dovecot/imap 363461 3828812 vinesit 12420 0.0 S 00:23 dovecot/imap 347756 3828812 infinium 12148 0.0 S 29:18 dovecot/imap 363610 3828812 root 11108 0.1 S 00:08 dovecot/auth -w 363717 1276780 nobody 10844 0.0 S 00:00 /usr/sbin/httpd -k start 837413 1471 root 10052 0.0 S 3-06:40:17 cPhulkd - dbprocessor 1805633 3828812 dovenull 8820 0.0 S 2-10:16:15 dovecot/imap-login 363656 281734 mailnull 8220 0.0 S 00:05 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2536732 1 named 7860 0.0 Ssl 40-23:26:56 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 3651102 1 root 7564 0.0 Ss 4-23:26:22 queueprocd - waiting up to 60s to process a task 1466 1 root 7536 0.0 Ss 44-15:39:08 dnsadmin - dormant mode 1 0 root 7504 0.2 Ss 44-15:39:17 /usr/lib/systemd/systemd --switched-root --system --deserialize 17 1805629 3828812 dovenull 7468 0.0 S 2-10:16:15 dovecot/imap-login --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 105549 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 105536 | corpkicks_wp_iwddf | corpkicks_wp_baolr | Query | 0 | Opening tables | SELECT option_value FROM MPHOrV_options WHERE option_name = 'woocommerce_review_rating_required' LIMIT 1 | +--------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min cosgrovecreative/cosgrovecreative.com.au-ssl_log 118 infinium/infinium.net.au-ssl_log 31 evolution/portal.evolutionerp.com.au-ssl_log 23 tubesupplies/tubesupplies.com.au-ssl_log 15 corpkicks/corporatekicks.com.au-ssl_log 12 madalice/madalice.com.au-ssl_log 5 alison/alisonarts.com.au-ssl_log 3 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 118 136.70.81.125 23 203.54.180.238 12 207.241.235.150 10 118.127.40.55 5 193.202.44.12 5 129.121.76.191 3 68.67.112.164 3 50.6.231.19 3 202.170.197.204 3 154.66.197.114 2 91.92.243.243 2 8.36.41.118 2 74.220.219.216 2 50.6.207.27 2 167.71.240.77 --- top request paths across all vhosts (last 3 min) --- 23 GET /heartbeat.php 12 GET /wp-login.php 10 POST /wp-login.php 7 POST /wp-cron.php 7 GET / 6 GET /wp-json/wp/v2/users/me 3 POST / 3 GET /store/black-nike-air-forces-drippy-custom-shoes/ 3 GET /robots.txt 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 HEAD / 1 GET /z9x8c7v6b5-debug-trigger-cpanel.cosgrovecreative.com.au 1 GET /wp-json 1 GET /web.config 1 GET /values.yaml 1 GET /v1/graphql 1 GET /trace.axd 1 GET /test.php --- busiest 3 vhosts: top paths + last 10 requests --- == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 4 GET / 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /z9x8c7v6b5-debug-trigger-cpanel.cosgrovecreative.com.au 1 GET /wp-json 1 GET /web.config 1 GET /values.yaml 1 GET /v1/graphql 1 GET /trace.axd 1 GET /test.php 1 GET /terraform.tfstate -- last 10 requests -- 136.70.81.125 - - [13/Aug/2026:01:47:37 +1000] "GET /.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 136.70.81.125 - - [13/Aug/2026:01:47:37 +1000] "GET /.boto HTTP/1.1" 401 12606 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 136.70.81.125 - - [13/Aug/2026:01:47:37 +1000] "GET /.npmrc HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 136.70.81.125 - - [13/Aug/2026:01:47:37 +1000] "GET /.github/workflows/deploy.yml HTTP/1.1" 401 12601 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 136.70.81.125 - - [13/Aug/2026:01:47:37 +1000] "GET /.env.example HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 136.70.81.125 - - [13/Aug/2026:01:47:37 +1000] "GET /.svn/entries HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 136.70.81.125 - - [13/Aug/2026:01:47:37 +1000] "GET /.env.production HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 136.70.81.125 - - [13/Aug/2026:01:47:37 +1000] "GET /terraform.tfstate HTTP/1.1" 404 3493 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 136.70.81.125 - - [13/Aug/2026:01:47:37 +1000] "GET /docker-compose.yaml HTTP/1.1" 404 3493 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 136.70.81.125 - - [13/Aug/2026:01:47:37 +1000] "GET /.env.old HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" == infinium/infinium.net.au-ssl_log == -- top paths -- 11 GET /wp-login.php 8 POST /wp-login.php 5 GET /wp-json/wp/v2/users/me 4 POST /wp-cron.php 3 POST / -- last 10 requests -- 193.202.44.12 - - [13/Aug/2026:01:48:24 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 503 6562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 193.202.44.12 - - [13/Aug/2026:01:48:26 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 503 6562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 118.127.40.55 - - [13/Aug/2026:01:48:41 +1000] "POST /wp-cron.php?doing_wp_cron=1786549721.0329248905181884765625 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://infinium.net.au" 118.127.40.55 - - [13/Aug/2026:01:48:40 +1000] "POST /?wordfence_syncAttackData=1786549720.6014 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://infinium.net.au" 118.127.40.55 - - [13/Aug/2026:01:48:41 +1000] "POST /wp-cron.php?doing_wp_cron=1786549721.6930940151214599609375 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://infinium.net.au" 8.36.41.118 - - [13/Aug/2026:01:48:40 +1000] "GET /wp-login.php HTTP/1.1" 200 1706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 8.36.41.118 - - [13/Aug/2026:01:48:42 +1000] "POST /wp-login.php HTTP/1.1" 503 6747 "https://infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0. 154.66.197.114 - - [13/Aug/2026:01:48:52 +1000] "GET /wp-login.php HTTP/1.1" 503 6562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 50.6.231.19 - - [13/Aug/2026:01:48:54 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 503 6562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 162.240.228.207 - - [13/Aug/2026:01:48:57 +1000] "GET /wp-login.php HTTP/1.1" 503 6562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 23 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [13/Aug/2026:01:48:07 +1000] "GET /heartbeat.php?sentAt=1786549687&bytes=106,124,149,183&_=1786510907424 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:01:48:12 +1000] "GET /heartbeat.php?sentAt=1786549692&bytes=106,124,149,188&_=1786532340020 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:01:48:17 +1000] "GET /heartbeat.php?sentAt=1786549697&bytes=106,124,149,193&_=1786510907425 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:01:48:22 +1000] "GET /heartbeat.php?sentAt=1786549702&bytes=106,124,149,198&_=1786532340021 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:01:48:27 +1000] "GET /heartbeat.php?sentAt=1786549707&bytes=106,124,149,203&_=1786510907426 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:01:48:32 +1000] "GET /heartbeat.php?sentAt=1786549712&bytes=106,124,149,208&_=1786532340022 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:01:48:37 +1000] "GET /heartbeat.php?sentAt=1786549717&bytes=106,124,149,213&_=1786510907427 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:01:48:42 +1000] "GET /heartbeat.php?sentAt=1786549722&bytes=106,124,149,218&_=1786532340023 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:01:48:47 +1000] "GET /heartbeat.php?sentAt=1786549727&bytes=106,124,149,223&_=1786510907428 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:01:48:52 +1000] "GET /heartbeat.php?sentAt=1786549732&bytes=106,124,149,228&_=1786532340024 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 --- last 30 samples (run-up to this incident) --- 2026-08-13 01:46:46 L1=1.02 run=1 blk=0 avail=8011 (68.3%) swpO=0 conn=1 myRSS=1647 php=0 phpRSS=0 ap=17 tcp=19 topuser=- 2026-08-13 01:46:47 L1=0.94 run=1 blk=0 avail=8008 (68.3%) swpO=0 conn=1 myRSS=1647 php=1 phpRSS=39 ap=16 tcp=19 topuser=evolution 2026-08-13 01:46:56 L1=0.95 run=2 blk=0 avail=8002 (68.2%) swpO=0 conn=1 myRSS=1647 php=1 phpRSS=60 ap=14 tcp=20 topuser=customc 2026-08-13 01:46:57 L1=1.11 run=5 blk=0 avail=7728 (65.9%) swpO=0 conn=1 myRSS=1647 php=5 phpRSS=454 ap=14 tcp=24 topuser=customc 2026-08-13 01:47:06 L1=1.10 run=1 blk=0 avail=8011 (68.3%) swpO=0 conn=1 myRSS=1647 php=0 phpRSS=0 ap=15 tcp=19 topuser=- 2026-08-13 01:47:07 L1=1.09 run=2 blk=0 avail=7960 (67.9%) swpO=0 conn=1 myRSS=1647 php=2 phpRSS=110 ap=15 tcp=21 topuser=tubesupplies 2026-08-13 01:47:16 L1=1.09 run=2 blk=0 avail=7985 (68.1%) swpO=0 conn=1 myRSS=1647 php=1 phpRSS=61 ap=15 tcp=19 topuser=tubesupplies 2026-08-13 01:47:17 L1=1.16 run=4 blk=0 avail=7906 (67.4%) swpO=0 conn=1 myRSS=1647 php=2 phpRSS=168 ap=15 tcp=20 topuser=tubesupplies 2026-08-13 01:47:26 L1=1.23 run=1 blk=0 avail=8001 (68.2%) swpO=0 conn=1 myRSS=1647 php=0 phpRSS=0 ap=16 tcp=40 topuser=- 2026-08-13 01:47:27 L1=1.13 run=1 blk=0 avail=7985 (68.1%) swpO=0 conn=1 myRSS=1647 php=0 phpRSS=0 ap=18 tcp=44 topuser=- 2026-08-13 01:47:37 L1=1.12 run=1 blk=0 avail=7939 (67.7%) swpO=0 conn=1 myRSS=1647 php=0 phpRSS=0 ap=25 tcp=31 topuser=- 2026-08-13 01:47:37 L1=1.11 run=4 blk=0 avail=7846 (66.9%) swpO=0 conn=1 myRSS=1647 php=3 phpRSS=183 ap=25 tcp=28 topuser=alison 2026-08-13 01:47:47 L1=1.18 run=2 blk=0 avail=7972 (68.0%) swpO=0 conn=2 myRSS=1647 php=1 phpRSS=52 ap=19 tcp=24 topuser=tubesupplies 2026-08-13 01:47:47 L1=1.16 run=3 blk=0 avail=7893 (67.3%) swpO=0 conn=1 myRSS=1647 php=2 phpRSS=160 ap=18 tcp=24 topuser=tubesupplies 2026-08-13 01:47:57 L1=1.15 run=3 blk=0 avail=8013 (68.3%) swpO=0 conn=2 myRSS=1647 php=2 phpRSS=73 ap=15 tcp=20 topuser=tubesupplies 2026-08-13 01:47:57 L1=1.22 run=4 blk=0 avail=7841 (66.9%) swpO=0 conn=1 myRSS=1647 php=4 phpRSS=299 ap=15 tcp=22 topuser=tubesupplies 2026-08-13 01:48:07 L1=1.12 run=2 blk=0 avail=7843 (66.9%) swpO=0 conn=2 myRSS=1647 php=2 phpRSS=236 ap=15 tcp=21 topuser=tubesupplies 2026-08-13 01:48:08 L1=1.11 run=2 blk=0 avail=7957 (67.8%) swpO=0 conn=1 myRSS=1647 php=2 phpRSS=119 ap=15 tcp=23 topuser=madalice 2026-08-13 01:48:17 L1=1.10 run=2 blk=0 avail=7979 (68.0%) swpO=0 conn=2 myRSS=1647 php=1 phpRSS=63 ap=15 tcp=20 topuser=tubesupplies 2026-08-13 01:48:18 L1=1.09 run=2 blk=0 avail=7901 (67.4%) swpO=0 conn=1 myRSS=1647 php=2 phpRSS=174 ap=15 tcp=20 topuser=tubesupplies 2026-08-13 01:48:27 L1=1.09 run=1 blk=0 avail=8010 (68.3%) swpO=0 conn=2 myRSS=1647 php=0 phpRSS=0 ap=15 tcp=20 topuser=- 2026-08-13 01:48:28 L1=1.08 run=3 blk=0 avail=7922 (67.5%) swpO=0 conn=3 myRSS=1647 php=2 phpRSS=145 ap=15 tcp=19 topuser=madalice 2026-08-13 01:48:37 L1=0.99 run=1 blk=0 avail=8032 (68.5%) swpO=0 conn=2 myRSS=1647 php=0 phpRSS=0 ap=14 tcp=20 topuser=- 2026-08-13 01:48:38 L1=0.91 run=2 blk=0 avail=7978 (68.0%) swpO=0 conn=3 myRSS=1647 php=2 phpRSS=110 ap=14 tcp=21 topuser=tubesupplies 2026-08-13 01:48:47 L1=0.92 run=2 blk=0 avail=7933 (67.6%) swpO=0 conn=2 myRSS=1647 php=1 phpRSS=127 ap=14 tcp=23 topuser=tubesupplies 2026-08-13 01:48:48 L1=0.93 run=2 blk=0 avail=7922 (67.5%) swpO=0 conn=3 myRSS=1647 php=2 phpRSS=160 ap=14 tcp=23 topuser=corpkicks 2026-08-13 01:48:57 L1=0.93 run=3 blk=0 avail=7937 (67.7%) swpO=0 conn=2 myRSS=1647 php=1 phpRSS=54 ap=22 tcp=28 topuser=infinium 2026-08-13 01:48:58 L1=0.94 run=2 blk=0 avail=7858 (67.0%) swpO=0 conn=3 myRSS=1647 php=2 phpRSS=119 ap=22 tcp=22 topuser=infinium 2026-08-13 01:49:07 L1=1.68 run=13 blk=0 avail=7392 (63.0%) swpO=25 conn=2 myRSS=1646 php=9 phpRSS=830 ap=21 tcp=38 topuser=corpkicks 2026-08-13 01:49:08 L1=1.68 run=15 blk=0 avail=6392 (54.5%) swpO=41 conn=11 myRSS=1646 php=10 phpRSS=1853 ap=23 tcp=36 topuser=corpkicks