INCIDENT 2026-08-13 22:53:07 trigger: php_rss=1820MB ================================================================== load: 1.85 1.19 0.83 15/606 1328180 ncpu:10 mem_avail: 5704MB/11729MB (48.6%) swap_used:1304MB swapout:117/s blocked(D):0 running:12 iowait:0.0% steal:0.0% php: 9 procs / 1820MB heaviest user: corpkicks (8 procs, 1696MB) apache: 30 procs tcp_estab: 40 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2250 corpkicks 7 1571 root 235 844 nobody 29 471 netdata 8 254 madalice 1 136 kurri 5 70 dovenull 6 66 aaa 2 30 mailman 20 29 dovecot 3 28 mailnull 4 26 cpanellogin 1 22 wp-toolkit 6 19 evolution 4 18 zabbix 1 15 candyfabcom 1 14 named 1 6 nscd 1 3 dbus 1 3 --- php workers by user --- USER PROCS RSS_MB corpkicks 7 1540 madalice 1 142 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5332 MB Active(file): 2663 MB Inactive(file): 2591 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 413 MB CommitLimit: 9960 MB Committed_AS: 8097 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 342014 root 21:41:50 4584 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 184574 1 mysql 2305132 14.7 Ssl 1-02:19:35 /usr/sbin/mariadbd 1328150 1327960 corpkicks 240928 122 D 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1328149 1327723 corpkicks 233372 126 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1328146 1327888 corpkicks 232844 127 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1328147 1327956 corpkicks 230300 126 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1328151 1328010 corpkicks 230136 124 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1328148 1327955 corpkicks 220724 117 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1220 1 netdata 202272 2.5 Ssl 45-12:43:08 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 388652 382990 root 174412 0.0 S 20:19:08 spamd child 1328145 1327959 madalice 151016 143 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 159820 1 root 131120 0.0 Ss 24-13:06:16 /usr/lib/systemd/systemd-journald 382990 1 root 122576 0.0 Ss 20:30:20 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 955146 382990 root 79872 0.0 S 09:02:16 spamd child 2223 1201 root 42428 0.0 Sl 45-12:43:07 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41844 0.0 Ss 22-20:11:38 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 33156 0.1 Sl 45-12:43:03 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 31452 0.1 Ss 45-12:43:07 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 382254 1 root 26032 0.0 Ss 20:30:54 lfd - sleeping 1318469 1353308 cpanellogin 23228 0.0 S 19:40 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 1321240 1276780 nobody 21876 0.0 S 13:43 /usr/sbin/httpd -k start 1327034 1276780 nobody 21128 0.0 S 01:59 /usr/sbin/httpd -k start 1326960 1276780 nobody 20416 0.0 S 02:03 /usr/sbin/httpd -k start 1327012 1276780 nobody 20324 0.0 S 02:00 /usr/sbin/httpd -k start 1327865 1276780 nobody 19776 0.1 S 00:29 /usr/sbin/httpd -k start 1328118 1276780 nobody 19592 0.5 S 00:04 /usr/sbin/httpd -k start 1326859 1276780 nobody 19488 0.0 S 02:09 /usr/sbin/httpd -k start 1328136 1276780 nobody 18952 0.6 S 00:03 /usr/sbin/httpd -k start 1327958 1276780 nobody 18600 0.1 S 00:16 /usr/sbin/httpd -k start 185104 2431 netdata 18348 2.0 Sl 1-02:19:26 /usr/libexec/netdata/plugins.d/apps.plugin 1 1327023 1276780 nobody 18160 0.0 S 01:59 /usr/sbin/httpd -k start 1327723 1276780 nobody 17976 0.0 S 00:41 /usr/sbin/httpd -k start 1327888 1276780 nobody 17940 0.0 S 00:25 /usr/sbin/httpd -k start 1327722 1276780 nobody 17856 0.0 S 00:41 /usr/sbin/httpd -k start 1326873 1276780 nobody 17832 0.0 S 02:07 /usr/sbin/httpd -k start 1327960 1276780 nobody 17800 0.0 S 00:16 /usr/sbin/httpd -k start 1327720 1276780 nobody 17628 0.0 S 00:41 /usr/sbin/httpd -k start 1327705 1276780 nobody 17444 0.0 S 00:43 /usr/sbin/httpd -k start 1328010 1276780 nobody 16968 0.0 S 00:11 /usr/sbin/httpd -k start 1326592 1471 root 16880 0.0 S 02:48 cPhulkd - dbprocessor 1327858 1276780 nobody 16676 0.0 S 00:30 /usr/sbin/httpd -k start 1327959 1276780 nobody 16620 0.0 S 00:16 /usr/sbin/httpd -k start 1327955 1276780 nobody 16584 0.0 S 00:17 /usr/sbin/httpd -k start 1327956 1276780 nobody 16428 0.0 S 00:17 /usr/sbin/httpd -k start 1289073 3828812 aaa 15816 0.0 S 50:35 dovecot/imap 1194962 3828812 aaa 15780 0.0 S 03:10:59 dovecot/imap 1471 1 root 15692 0.0 Ss 45-12:43:07 cPhulkd - processor 1204 1 zabbix 15520 0.2 Ssl 45-12:43:08 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1328137 3828812 kurri 14864 0.0 S 00:02 dovecot/imap 1328135 1276780 nobody 14636 0.0 S 00:03 /usr/sbin/httpd -k start 1328140 1276780 nobody 14636 0.0 S 00:02 /usr/sbin/httpd -k start 1328141 1276780 nobody 14636 0.0 S 00:02 /usr/sbin/httpd -k start 1328142 1276780 nobody 14584 0.0 S 00:02 /usr/sbin/httpd -k start 1328143 1276780 nobody 14584 0.0 S 00:02 /usr/sbin/httpd -k start 1059106 3828812 root 14544 0.0 S 07:20:13 dovecot/config 1328103 3828812 candyfabcom 14392 0.0 S 00:04 dovecot/imap 1258646 3828812 kurri 14364 0.0 S 01:27:12 dovecot/imap 1323345 3828812 kurri 14348 0.0 S 09:42 dovecot/imap 1322335 3828812 kurri 14264 0.0 S 12:00 dovecot/imap 1463 1 root 14248 0.0 Ss 45-12:43:07 tailwatchd 1323346 3828812 kurri 14044 0.0 S 09:42 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 5379238 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min vinesit/vinesit.com.au-ssl_log 331 madalice/madalice.com.au-ssl_log 52 evolution/portal.evolutionerp.com.au-ssl_log 16 corpkicks/corporatekicks.com.au-ssl_log 7 evolution/my.evolutionerp.com.au-ssl_log 3 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 213 34.13.218.216 118 34.26.57.145 46 4.232.151.198 16 203.54.180.238 4 34.78.182.101 2 51.68.107.138 2 120.21.37.245 2 118.127.40.55 1 34.196.51.17 1 157.55.39.197 1 114.119.159.70 1 114.119.143.14 1 114.119.137.101 1 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 16 GET /heartbeat.php 15 GET /fetch 4 GET / 3 GET /proxy 3 GET /.aws/credentials 3 GET /.aws/config 2 POST /wp-cron.php 2 GET /web/.env 2 GET /store/xl-magnetic-drop-down-side-door-sneaker-display-case-black/ 2 GET /store/toys-kids-custom-shoes/ 2 GET /.ssh/id_rsa 2 GET /.ssh/id_ed25519 2 GET /src/.env 2 GET /server/.env 2 GET /root/.aws/credentials 2 GET /root/.aws/config 2 GET /redirect 2 GET /public/.env 2 GET /pms 2 GET /laravel/.env --- busiest 3 vhosts: top paths + last 10 requests --- == vinesit/vinesit.com.au-ssl_log == -- top paths -- 15 GET /fetch 3 GET /proxy 2 GET /web/.env 2 GET /.ssh/id_rsa 2 GET /.ssh/id_ed25519 2 GET /src/.env 2 GET /server/.env 2 GET /root/.aws/credentials 2 GET /root/.aws/config 2 GET /redirect 2 GET /public/.env 2 GET /pms -- last 10 requests -- 34.26.57.145 - - [13/Aug/2026:22:52:56 +1000] "GET /api/config HTTP/1.1" 401 53 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.26.57.145 - - [13/Aug/2026:22:52:56 +1000] "GET /api/settings HTTP/1.1" 401 53 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 34.26.57.145 - - [13/Aug/2026:22:52:56 +1000] "GET /api/v1/config HTTP/1.1" 401 53 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 34.26.57.145 - - [13/Aug/2026:22:52:56 +1000] "GET /api/env HTTP/1.1" 401 53 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 34.26.57.145 - - [13/Aug/2026:22:52:56 +1000] "GET /api/v1/env HTTP/1.1" 401 53 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 34.26.57.145 - - [13/Aug/2026:22:53:03 +1000] "GET /api/v1/settings HTTP/1.1" 401 53 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 34.26.57.145 - - [13/Aug/2026:22:53:03 +1000] "GET /.ssh/id_rsa HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 34.26.57.145 - - [13/Aug/2026:22:53:03 +1000] "GET /.ssh/id_ed25519 HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 34.26.57.145 - - [13/Aug/2026:22:53:03 +1000] "GET /.ssh/id_ecdsa HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 34.26.57.145 - - [13/Aug/2026:22:53:03 +1000] "GET /.ssh/config HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" == madalice/madalice.com.au-ssl_log == -- top paths -- 2 GET /store/xl-magnetic-drop-down-side-door-sneaker-display-case-black/ 2 GET /store/toys-kids-custom-shoes/ 1 GET /.well-known/wp-login.php 1 GET /.well-known/wp-links-opml.php 1 GET /.well-known/radio.php 1 GET /.well-known/pki-validation/xmrlpc.php 1 GET /.well-known/pki-validation/worksec.php 1 GET /.well-known/pki-validation/mariju.php 1 GET /.well-known/pki-validation/ckyocyyp.php 1 GET /.well-known/pki-validation/about.php 1 GET /.well-known/logs233/index.php 1 GET /.well-known/gecko-litespeed.php -- last 10 requests -- 4.232.151.198 - - [13/Aug/2026:22:52:06 +1000] "GET /404.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.151.198 - - [13/Aug/2026:22:52:09 +1000] "GET /406.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.151.198 - - [13/Aug/2026:22:52:11 +1000] "GET /666.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.151.198 - - [13/Aug/2026:22:52:13 +1000] "GET /7.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.151.198 - - [13/Aug/2026:22:52:16 +1000] "GET /8.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.151.198 - - [13/Aug/2026:22:52:18 +1000] "GET /82.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.151.198 - - [13/Aug/2026:22:52:21 +1000] "GET /a.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 114.119.137.101 - - [13/Aug/2026:22:52:21 +1000] "GET /store/toys-kids-custom-shoes/?image=1&rating=1&wcpr_rating=1 HTTP/1.1" 200 49045 "https://madalice.com.au/store/toys-kids-custom-shoes/?image=1&rating=1&wcpr_rating= 4.232.151.198 - - [13/Aug/2026:22:52:26 +1000] "GET /a7.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 4.232.151.198 - - [13/Aug/2026:22:52:28 +1000] "GET /aa.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 16 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [13/Aug/2026:22:51:30 +1000] "GET /heartbeat.php?sentAt=1786625490&bytes=106,125,189,210&_=1786602369657 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:22:51:33 +1000] "GET /heartbeat.php?sentAt=1786625493&bytes=106,125,189,213&_=1786596791907 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:22:51:40 +1000] "GET /heartbeat.php?sentAt=1786625500&bytes=106,125,189,220&_=1786602369658 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:22:51:43 +1000] "GET /heartbeat.php?sentAt=1786625503&bytes=106,125,189,223&_=1786596791908 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:22:51:50 +1000] "GET /heartbeat.php?sentAt=1786625510&bytes=106,125,189,230&_=1786602369659 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:22:51:53 +1000] "GET /heartbeat.php?sentAt=1786625513&bytes=106,125,189,233&_=1786596791909 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:22:52:00 +1000] "GET /heartbeat.php?sentAt=1786625520&bytes=106,125,189,240&_=1786602369660 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:22:52:03 +1000] "GET /heartbeat.php?sentAt=1786625523&bytes=106,125,189,243&_=1786596791910 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:22:52:10 +1000] "GET /heartbeat.php?sentAt=1786625530&bytes=106,125,189,250&_=1786602369661 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [13/Aug/2026:22:52:13 +1000] "GET /heartbeat.php?sentAt=1786625533&bytes=106,125,189,253&_=1786596791911 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 --- last 30 samples (run-up to this incident) --- 2026-08-13 22:50:42 L1=0.53 run=1 blk=0 avail=7302 (62.3%) swpO=0 conn=1 myRSS=2257 php=0 phpRSS=0 ap=14 tcp=22 topuser=- 2026-08-13 22:50:46 L1=0.57 run=2 blk=0 avail=7291 (62.2%) swpO=0 conn=1 myRSS=2257 php=0 phpRSS=0 ap=14 tcp=24 topuser=- 2026-08-13 22:50:52 L1=0.52 run=2 blk=0 avail=7224 (61.6%) swpO=0 conn=1 myRSS=2257 php=1 phpRSS=96 ap=14 tcp=24 topuser=madalice 2026-08-13 22:50:56 L1=0.56 run=2 blk=0 avail=7268 (62.0%) swpO=0 conn=1 myRSS=2257 php=1 phpRSS=54 ap=14 tcp=26 topuser=madalice 2026-08-13 22:51:02 L1=0.84 run=3 blk=0 avail=7028 (59.9%) swpO=0 conn=1 myRSS=2257 php=2 phpRSS=237 ap=29 tcp=42 topuser=madalice 2026-08-13 22:51:06 L1=1.09 run=2 blk=0 avail=6974 (59.5%) swpO=0 conn=1 myRSS=2257 php=1 phpRSS=202 ap=36 tcp=59 topuser=madalice 2026-08-13 22:51:12 L1=1.16 run=1 blk=0 avail=7009 (59.8%) swpO=0 conn=1 myRSS=2257 php=0 phpRSS=0 ap=58 tcp=55 topuser=- 2026-08-13 22:51:16 L1=1.15 run=3 blk=0 avail=6902 (58.8%) swpO=0 conn=1 myRSS=2257 php=3 phpRSS=230 ap=53 tcp=59 topuser=aaa 2026-08-13 22:51:22 L1=1.30 run=2 blk=0 avail=6918 (59.0%) swpO=0 conn=1 myRSS=2257 php=1 phpRSS=133 ap=48 tcp=39 topuser=madalice 2026-08-13 22:51:26 L1=1.43 run=4 blk=1 avail=6931 (59.1%) swpO=0 conn=1 myRSS=2257 php=2 phpRSS=221 ap=43 tcp=39 topuser=olympic 2026-08-13 22:51:32 L1=1.64 run=2 blk=0 avail=7074 (60.3%) swpO=0 conn=1 myRSS=2257 php=1 phpRSS=76 ap=38 tcp=27 topuser=madalice 2026-08-13 22:51:36 L1=1.67 run=2 blk=0 avail=7156 (61.0%) swpO=0 conn=1 myRSS=2257 php=0 phpRSS=0 ap=33 tcp=21 topuser=- 2026-08-13 22:51:42 L1=1.78 run=2 blk=0 avail=7137 (60.9%) swpO=0 conn=2 myRSS=2257 php=1 phpRSS=89 ap=28 tcp=23 topuser=madalice 2026-08-13 22:51:46 L1=1.79 run=1 blk=0 avail=7222 (61.6%) swpO=0 conn=1 myRSS=2257 php=0 phpRSS=0 ap=23 tcp=21 topuser=- 2026-08-13 22:51:52 L1=1.73 run=2 blk=0 avail=7181 (61.2%) swpO=0 conn=2 myRSS=2257 php=1 phpRSS=102 ap=19 tcp=23 topuser=madalice 2026-08-13 22:51:56 L1=1.83 run=3 blk=0 avail=7051 (60.1%) swpO=0 conn=2 myRSS=2257 php=1 phpRSS=240 ap=18 tcp=23 topuser=madalice 2026-08-13 22:52:02 L1=1.86 run=3 blk=0 avail=7151 (61.0%) swpO=0 conn=2 myRSS=2257 php=2 phpRSS=164 ap=18 tcp=22 topuser=madalice 2026-08-13 22:52:06 L1=1.86 run=3 blk=0 avail=7243 (61.8%) swpO=0 conn=2 myRSS=2257 php=1 phpRSS=43 ap=18 tcp=22 topuser=madalice 2026-08-13 22:52:12 L1=1.81 run=3 blk=0 avail=7114 (60.7%) swpO=0 conn=2 myRSS=2257 php=2 phpRSS=202 ap=18 tcp=25 topuser=madalice 2026-08-13 22:52:16 L1=1.81 run=2 blk=0 avail=7199 (61.4%) swpO=0 conn=2 myRSS=2257 php=1 phpRSS=96 ap=18 tcp=25 topuser=madalice 2026-08-13 22:52:22 L1=1.77 run=4 blk=0 avail=7019 (59.8%) swpO=0 conn=2 myRSS=2257 php=2 phpRSS=301 ap=18 tcp=24 topuser=madalice 2026-08-13 22:52:26 L1=1.77 run=3 blk=0 avail=6974 (59.5%) swpO=0 conn=2 myRSS=2257 php=2 phpRSS=249 ap=33 tcp=29 topuser=customc 2026-08-13 22:52:32 L1=1.80 run=4 blk=0 avail=6933 (59.1%) swpO=0 conn=2 myRSS=2257 php=2 phpRSS=295 ap=30 tcp=30 topuser=madalice 2026-08-13 22:52:36 L1=1.80 run=2 blk=0 avail=7113 (60.6%) swpO=0 conn=2 myRSS=2257 php=1 phpRSS=113 ap=26 tcp=62 topuser=madalice 2026-08-13 22:52:42 L1=1.68 run=3 blk=0 avail=7036 (60.0%) swpO=0 conn=2 myRSS=2257 php=1 phpRSS=124 ap=28 tcp=48 topuser=madalice 2026-08-13 22:52:47 L1=1.68 run=3 blk=0 avail=7059 (60.2%) swpO=0 conn=2 myRSS=2257 php=2 phpRSS=190 ap=28 tcp=28 topuser=madalice 2026-08-13 22:52:52 L1=1.81 run=4 blk=0 avail=6956 (59.3%) swpO=0 conn=2 myRSS=2257 php=4 phpRSS=325 ap=32 tcp=35 topuser=tubesupplies 2026-08-13 22:52:57 L1=1.81 run=2 blk=0 avail=7139 (60.9%) swpO=0 conn=2 myRSS=2257 php=1 phpRSS=64 ap=29 tcp=43 topuser=madalice 2026-08-13 22:53:02 L1=1.85 run=3 blk=0 avail=7027 (59.9%) swpO=0 conn=2 myRSS=2257 php=2 phpRSS=249 ap=24 tcp=27 topuser=madalice 2026-08-13 22:53:07 L1=1.85 run=12 blk=0 avail=5704 (48.6%) swpO=117 conn=9 myRSS=2254 php=9 phpRSS=1820 ap=30 tcp=40 topuser=corpkicks