INCIDENT 2026-08-13 05:58:18 trigger: php_rss=1952MB ================================================================== load: 0.82 1.19 1.08 14/587 501379 ncpu:10 mem_avail: 5955MB/11729MB (50.8%) swap_used:1009MB swapout:0/s blocked(D):0 running:16 iowait:0.0% steal:0.0% php: 10 procs / 1952MB heaviest user: corpkicks (9 procs, 1713MB) apache: 18 procs tcp_estab: 29 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1878 corpkicks 9 1814 root 234 925 nobody 17 281 madalice 1 253 netdata 8 250 cpanellogin 1 64 mailman 20 30 dovenull 6 28 lowrange 2 25 wp-toolkit 6 22 zabbix 1 15 kurri 1 11 mailnull 2 10 dovecot 3 9 named 1 7 evolution 4 5 nscd 1 3 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB corpkicks 9 1829 madalice 1 254 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4866 MB Active(file): 4479 MB Inactive(file): 589 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 491 MB CommitLimit: 9960 MB Committed_AS: 8316 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 342014 root 04:47:01 7328 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 184574 1 mysql 1923992 3.9 Ssl 09:24:46 /usr/sbin/mariadbd 501343 500577 corpkicks 269120 127 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 501333 499964 madalice 266000 123 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 501344 498522 corpkicks 248544 128 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 501342 501078 corpkicks 243576 130 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 501347 498966 corpkicks 242508 116 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 501341 501275 corpkicks 242440 128 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 501346 501007 corpkicks 227296 107 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 501339 498527 corpkicks 210048 129 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1220 1 netdata 199112 2.5 Ssl 44-19:48:19 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 388651 382990 root 182052 0.0 S 03:24:19 spamd child 159820 1 root 172208 0.0 Ss 23-20:11:27 /usr/lib/systemd/systemd-journald 382990 1 root 169000 0.0 Ss 03:35:31 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 501340 499034 corpkicks 160568 76.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 388652 382990 root 154056 0.0 S 03:24:19 spamd child 501348 501345 corpkicks 134216 58.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 454769 1353308 cpanellogin 66088 0.0 S 01:24:00 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 2223 1201 root 42116 0.0 Sl 44-19:48:18 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41788 0.0 Ss 22-03:16:49 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 37320 0.1 Sl 44-19:48:14 /usr/libexec/netdata/plugins.d/go.d.plugin 1 382254 1 root 32168 0.0 Ss 03:36:05 lfd - sleeping 498518 1276780 nobody 22252 0.0 S 05:17 /usr/sbin/httpd -k start 498525 1276780 nobody 22060 0.0 S 05:16 /usr/sbin/httpd -k start 498527 1276780 nobody 21248 0.0 S 05:16 /usr/sbin/httpd -k start 498966 1276780 nobody 21208 0.0 S 04:18 /usr/sbin/httpd -k start 498522 1276780 nobody 21132 0.1 S 05:16 /usr/sbin/httpd -k start 1469 1 root 20940 0.1 Ss 44-19:48:18 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 499034 1276780 nobody 19940 0.0 S 04:16 /usr/sbin/httpd -k start 500577 1276780 nobody 19924 0.0 S 01:46 /usr/sbin/httpd -k start 499964 1276780 nobody 19648 0.0 S 02:48 /usr/sbin/httpd -k start 501072 1276780 nobody 18104 0.0 S 00:39 /usr/sbin/httpd -k start 185104 2431 netdata 17860 1.9 Sl 09:24:37 /usr/libexec/netdata/plugins.d/apps.plugin 1 501007 1276780 nobody 17612 0.0 S 00:50 /usr/sbin/httpd -k start 501350 1276780 nobody 16924 0.0 R 00:00 /usr/sbin/httpd -k start 501349 1276780 nobody 16920 0.0 D 00:00 /usr/sbin/httpd -k start 501078 1276780 nobody 16872 0.0 S 00:38 /usr/sbin/httpd -k start 501275 1276780 nobody 16176 0.0 S 00:10 /usr/sbin/httpd -k start 1204 1 zabbix 16008 0.2 Ssl 44-19:48:19 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 501345 1276780 nobody 14904 0.0 S 00:01 /usr/sbin/httpd -k start 1463 1 root 14404 0.0 Ss 44-19:48:18 tailwatchd 367498 3828812 lowrange 12988 0.0 S 04:02:50 dovecot/imap 273730 3828812 lowrange 12748 0.0 S 06:49:52 dovecot/imap 383627 3828812 kurri 11784 0.0 S 03:34:50 dovecot/imap 500896 3828812 root 10956 0.0 S 01:07 dovecot/auth -w 837413 1471 root 10200 0.0 S 3-10:49:27 cPhulkd - dbprocessor 1805633 3828812 dovenull 8840 0.0 S 2-14:25:25 dovecot/imap-login 3651102 1 root 7968 0.0 Ss 5-03:35:32 queueprocd - waiting up to 60s to process a task 1805629 3828812 dovenull 7840 0.0 S 2-14:25:25 dovecot/imap-login 2536732 1 named 7820 0.0 Ssl 41-03:36:06 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1 0 root 7580 0.2 Ss 44-19:48:27 /usr/lib/systemd/systemd --switched-root --system --deserialize 17 501338 281734 mailnull 7472 0.0 S 00:01 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1574 1 wp-toolkit 7456 0.0 Ss 44-19:48:18 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1466 1 root 7448 0.0 Ss 44-19:48:18 dnsadmin - dormant mode 427293 1 root 7364 0.0 SN 02:13:17 ConfigServer Version Check 342014 1 root 7328 0.0 Ssl 04:47:01 /usr/bin/imunify-agent-proxy 1578 1 wp-toolkit 6984 0.0 Ss 44-19:48:18 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1805635 3828812 dovenull 6136 0.0 S 2-14:25:25 dovecot/pop3-login 1471 1 root 6052 0.0 Ss 44-19:48:18 cPhulkd - processor 1805631 3828812 dovenull 5876 0.0 S 2-14:25:25 dovecot/pop3-login 1805638 3828812 dovecot 5396 0.0 S 2-14:25:25 dovecot/auth --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 205299 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 58 infinium/infinium.net.au-ssl_log 25 evolution/portal.evolutionerp.com.au-ssl_log 21 evolution/my.evolutionerp.com.au-ssl_log 14 corpkicks/corporatekicks.com.au-ssl_log 6 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 52 23.99.130.35 26 203.54.180.238 8 118.127.40.55 4 143.95.144.95 4 103.104.165.99 3 34.169.116.234 3 182.239.240.254 3 129.121.123.168 3 114.119.143.14 2 43.225.53.201 2 216.172.172.205 2 192.185.83.225 2 115.146.125.52 2 114.119.143.104 2 108.167.132.74 --- top request paths across all vhosts (last 3 min) --- 21 GET /heartbeat.php 12 POST /functions.php 10 GET /wp-login.php 8 POST /wp-login.php 6 GET /store/black-nike-air-forces-drippy-custom-shoes/ 4 POST /wp-cron.php 4 POST / 2 GET /wp-json/wp/v2/users/me 2 GET /index.php 1 HEAD / 1 GET /xmlrpc.php 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-includes/Requests/src/Response/about.php 1 GET /wp-includes/PHPMailer/ 1 GET /wp-includes/images/ 1 GET /wp-includes/html-api/ 1 GET /wp-includes/ 1 GET /wp-good.php 1 GET /wp-content/uploads/index.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 6 GET /store/black-nike-air-forces-drippy-custom-shoes/ 1 GET /xmlrpc.php 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-login.php 1 GET /wp-includes/Requests/src/Response/about.php 1 GET /wp-includes/PHPMailer/ 1 GET /wp-includes/images/ 1 GET /wp-includes/html-api/ 1 GET /wp-includes/ 1 GET /wp-good.php 1 GET /wp-content/uploads/index.php -- last 10 requests -- 23.99.130.35 - - [13/Aug/2026:05:57:03 +1000] "GET /wp-content/uploads/ HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 23.99.130.35 - - [13/Aug/2026:05:57:03 +1000] "GET /wp-content/themes/admin.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 23.99.130.35 - - [13/Aug/2026:05:57:04 +1000] "GET /wp-content/themes/index.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 23.99.130.35 - - [13/Aug/2026:05:57:05 +1000] "GET /wp-content/plugins/index.php HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 23.99.130.35 - - [13/Aug/2026:05:57:05 +1000] "GET /wp-includes/PHPMailer/ HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 23.99.130.35 - - [13/Aug/2026:05:57:06 +1000] "GET /wp-includes/images/ HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 23.99.130.35 - - [13/Aug/2026:05:57:06 +1000] "GET /wp-content/plugins/WordPressCore/ HTTP/1.1" 400 44 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 114.119.143.104 - - [13/Aug/2026:05:57:10 +1000] "GET /store/black-nike-air-forces-drippy-custom-shoes/?amp%3Brating=1&wcpr_rating=4&wcpr_page=2&rating=4 HTTP/1.1" 200 49111 "https://madalice.com.au/store/black-nike-air- 114.119.131.88 - - [13/Aug/2026:05:57:33 +1000] "GET /store/black-nike-air-forces-drippy-custom-shoes/?amp%3Brating=1&wcpr_page=2&wcpr_rating=5&rating=2 HTTP/1.1" 200 49104 "https://madalice.com.au/store/black-nike-air-f 114.119.143.14 - - [13/Aug/2026:05:57:54 +1000] "GET /store/black-nike-air-forces-drippy-custom-shoes/?amp%3Bimage=1&wcpr_rating=5&verified=1&wcpr_verified=1 HTTP/1.1" 200 49139 "https://madalice.com.au/store/black-nike- == infinium/infinium.net.au-ssl_log == -- top paths -- 9 GET /wp-login.php 8 POST /wp-login.php 4 POST / 2 POST /wp-cron.php 2 GET /wp-json/wp/v2/users/me -- last 10 requests -- 129.121.123.168 - - [13/Aug/2026:05:57:19 +1000] "GET /wp-json/wp/v2/users/me HTTP/1.1" 401 82 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 192.185.83.225 - - [13/Aug/2026:05:57:20 +1000] "GET /wp-login.php HTTP/1.1" 200 1706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 216.172.172.205 - - [13/Aug/2026:05:57:20 +1000] "GET /wp-login.php HTTP/1.1" 200 1706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 192.185.83.225 - - [13/Aug/2026:05:57:21 +1000] "POST /wp-login.php HTTP/1.1" 503 6744 "https://mail.infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ 115.146.125.52 - - [13/Aug/2026:05:57:22 +1000] "GET /wp-login.php HTTP/1.1" 503 6561 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 118.127.40.55 - - [13/Aug/2026:05:57:23 +1000] "POST /?wordfence_syncAttackData=1786564643.3777 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://infinium.net.au" 216.172.172.205 - - [13/Aug/2026:05:57:23 +1000] "POST /wp-login.php HTTP/1.1" 503 6744 "https://mail.infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome 129.121.123.168 - - [13/Aug/2026:05:57:24 +1000] "GET /wp-login.php HTTP/1.1" 200 1706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 115.146.125.52 - - [13/Aug/2026:05:57:24 +1000] "POST /wp-login.php HTTP/1.1" 200 1804 "https://mail.infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ 129.121.123.168 - - [13/Aug/2026:05:57:25 +1000] "POST /wp-login.php HTTP/1.1" 503 6744 "https://infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133. == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 21 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [13/Aug/2026:05:56:57 +1000] "GET /heartbeat.php?sentAt=1786564617&bytes=106,124,208,9&_=1786510908917 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:05:57:01 +1000] "GET /heartbeat.php?sentAt=1786564622&bytes=106,124,208,14&_=1786532341513 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:05:57:07 +1000] "GET /heartbeat.php?sentAt=1786564627&bytes=106,124,208,19&_=1786510908918 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:05:57:11 +1000] "GET /heartbeat.php?sentAt=1786564632&bytes=106,124,208,24&_=1786532341514 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:05:57:17 +1000] "GET /heartbeat.php?sentAt=1786564637&bytes=106,124,208,29&_=1786510908919 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:05:57:21 +1000] "GET /heartbeat.php?sentAt=1786564642&bytes=106,124,208,34&_=1786532341515 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:05:57:27 +1000] "GET /heartbeat.php?sentAt=1786564647&bytes=106,124,208,39&_=1786510908920 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:05:57:31 +1000] "GET /heartbeat.php?sentAt=1786564652&bytes=106,124,208,44&_=1786532341516 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:05:57:37 +1000] "GET /heartbeat.php?sentAt=1786564657&bytes=106,124,208,49&_=1786510908921 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [13/Aug/2026:05:57:41 +1000] "GET /heartbeat.php?sentAt=1786564662&bytes=106,124,208,54&_=1786532341517 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-08-13 05:55:50 L1=2.33 run=2 blk=0 avail=7529 (64.2%) swpO=0 conn=5 myRSS=1879 php=0 phpRSS=0 ap=20 tcp=18 topuser=- 2026-08-13 05:55:57 L1=2.22 run=1 blk=0 avail=7551 (64.4%) swpO=0 conn=3 myRSS=1879 php=1 phpRSS=40 ap=16 tcp=17 topuser=evolution 2026-08-13 05:56:01 L1=2.13 run=1 blk=0 avail=7562 (64.5%) swpO=0 conn=1 myRSS=1879 php=0 phpRSS=0 ap=16 tcp=17 topuser=- 2026-08-13 05:56:07 L1=2.04 run=2 blk=0 avail=7462 (63.6%) swpO=0 conn=3 myRSS=1879 php=2 phpRSS=143 ap=17 tcp=20 topuser=madalice 2026-08-13 05:56:11 L1=1.87 run=1 blk=0 avail=7563 (64.5%) swpO=0 conn=1 myRSS=1879 php=0 phpRSS=0 ap=16 tcp=18 topuser=- 2026-08-13 05:56:17 L1=1.72 run=1 blk=0 avail=7558 (64.4%) swpO=0 conn=3 myRSS=1879 php=1 phpRSS=40 ap=15 tcp=16 topuser=evolution 2026-08-13 05:56:21 L1=1.58 run=1 blk=0 avail=7570 (64.5%) swpO=0 conn=1 myRSS=1879 php=0 phpRSS=0 ap=15 tcp=16 topuser=- 2026-08-13 05:56:27 L1=1.46 run=1 blk=0 avail=7572 (64.6%) swpO=0 conn=3 myRSS=1879 php=1 phpRSS=40 ap=14 tcp=16 topuser=evolution 2026-08-13 05:56:31 L1=1.42 run=1 blk=0 avail=7588 (64.7%) swpO=2 conn=1 myRSS=1878 php=0 phpRSS=0 ap=14 tcp=16 topuser=- 2026-08-13 05:56:37 L1=1.31 run=1 blk=0 avail=7568 (64.5%) swpO=2 conn=3 myRSS=1878 php=1 phpRSS=40 ap=15 tcp=16 topuser=evolution 2026-08-13 05:56:41 L1=1.28 run=3 blk=0 avail=7478 (63.8%) swpO=0 conn=1 myRSS=1878 php=1 phpRSS=121 ap=15 tcp=14 topuser=infinium 2026-08-13 05:56:47 L1=1.26 run=1 blk=0 avail=7559 (64.4%) swpO=0 conn=2 myRSS=1878 php=1 phpRSS=40 ap=15 tcp=18 topuser=evolution 2026-08-13 05:56:51 L1=1.24 run=2 blk=0 avail=7432 (63.4%) swpO=0 conn=1 myRSS=1878 php=1 phpRSS=168 ap=15 tcp=20 topuser=madalice 2026-08-13 05:56:57 L1=1.14 run=1 blk=0 avail=7559 (64.4%) swpO=0 conn=2 myRSS=1878 php=1 phpRSS=40 ap=15 tcp=20 topuser=evolution 2026-08-13 05:57:01 L1=1.05 run=1 blk=0 avail=7571 (64.6%) swpO=0 conn=1 myRSS=1878 php=0 phpRSS=0 ap=15 tcp=17 topuser=- 2026-08-13 05:57:07 L1=1.04 run=3 blk=0 avail=7561 (64.5%) swpO=0 conn=2 myRSS=1878 php=1 phpRSS=39 ap=15 tcp=15 topuser=evolution 2026-08-13 05:57:11 L1=0.96 run=3 blk=0 avail=7419 (63.2%) swpO=0 conn=1 myRSS=1878 php=2 phpRSS=212 ap=15 tcp=17 topuser=alison 2026-08-13 05:57:17 L1=0.96 run=2 blk=0 avail=7556 (64.4%) swpO=0 conn=2 myRSS=1879 php=1 phpRSS=40 ap=15 tcp=19 topuser=evolution 2026-08-13 05:57:21 L1=0.89 run=1 blk=0 avail=7567 (64.5%) swpO=0 conn=1 myRSS=1879 php=0 phpRSS=0 ap=15 tcp=18 topuser=- 2026-08-13 05:57:28 L1=0.81 run=2 blk=0 avail=7452 (63.5%) swpO=0 conn=2 myRSS=1879 php=2 phpRSS=176 ap=15 tcp=20 topuser=alison 2026-08-13 05:57:31 L1=0.75 run=2 blk=0 avail=7512 (64.1%) swpO=0 conn=1 myRSS=1879 php=1 phpRSS=77 ap=16 tcp=18 topuser=alison 2026-08-13 05:57:38 L1=0.85 run=1 blk=0 avail=7545 (64.3%) swpO=1 conn=2 myRSS=1878 php=1 phpRSS=40 ap=16 tcp=22 topuser=evolution 2026-08-13 05:57:41 L1=1.10 run=2 blk=0 avail=7442 (63.4%) swpO=1 conn=1 myRSS=1878 php=1 phpRSS=121 ap=19 tcp=19 topuser=infinium 2026-08-13 05:57:48 L1=1.01 run=1 blk=0 avail=7541 (64.3%) swpO=0 conn=2 myRSS=1878 php=1 phpRSS=40 ap=17 tcp=18 topuser=evolution 2026-08-13 05:57:51 L1=0.93 run=1 blk=0 avail=7581 (64.6%) swpO=0 conn=1 myRSS=1878 php=0 phpRSS=0 ap=15 tcp=15 topuser=- 2026-08-13 05:57:58 L1=0.94 run=1 blk=0 avail=7571 (64.5%) swpO=1 conn=2 myRSS=1878 php=1 phpRSS=40 ap=14 tcp=19 topuser=evolution 2026-08-13 05:58:01 L1=0.86 run=2 blk=0 avail=7580 (64.6%) swpO=1 conn=1 myRSS=1878 php=0 phpRSS=0 ap=14 tcp=17 topuser=- 2026-08-13 05:58:08 L1=0.87 run=2 blk=0 avail=7374 (62.9%) swpO=0 conn=2 myRSS=1878 php=2 phpRSS=264 ap=15 tcp=18 topuser=madalice 2026-08-13 05:58:11 L1=0.80 run=1 blk=0 avail=7577 (64.6%) swpO=0 conn=1 myRSS=1878 php=0 phpRSS=0 ap=15 tcp=14 topuser=- 2026-08-13 05:58:18 L1=0.82 run=16 blk=0 avail=5955 (50.8%) swpO=0 conn=11 myRSS=1878 php=10 phpRSS=1952 ap=18 tcp=29 topuser=corpkicks