INCIDENT 2026-08-17 05:18:08 trigger: php_rss=2047MB mysql_conn=21 ================================================================== load: 1.36 0.96 0.89 29/730 55656 ncpu:10 mem_avail: 5030MB/11729MB (42.9%) swap_used:1790MB swapout:1568/s blocked(D):0 running:28 iowait:0.1% steal:0.0% php: 23 procs / 2047MB heaviest user: corpkicks (3 procs, 432MB) apache: 93 procs tcp_estab: 97 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2309 nobody 92 1269 root 237 991 corpkicks 4 470 customc 3 424 infinium 5 394 evolution 8 276 olympic 3 259 netdata 8 249 vinesit 2 180 speedlin 2 180 cpanellogin 1 59 mailnull 2 32 dovenull 6 27 lowrange 2 24 kurri 2 22 wp-toolkit 6 20 mailman 20 15 zabbix 1 14 candyfabcom 1 12 --- php workers by user --- USER PROCS RSS_MB corpkicks 3 461 customc 3 433 infinium 4 384 evolution 4 276 olympic 3 269 speedlin 2 185 vinesit 2 180 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4650 MB Active(file): 3392 MB Inactive(file): 1090 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 474 MB CommitLimit: 9960 MB Committed_AS: 10354 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 4090795 root 04:06:53 7544 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2354756 2.7 Ssl 1-21:27:31 /usr/sbin/mariadbd 55565 55469 corpkicks 213692 41.3 R 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1220 1 netdata 197668 2.5 Ssl 48-19:08:13 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 55558 55524 customc 186684 31.3 R 00:03 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 55567 55521 customc 186080 30.0 R 00:03 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4146603 4140634 root 184160 0.0 S 02:45:02 spamd child 4140634 1 root 175412 0.0 Ss 02:55:23 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 55595 55471 corpkicks 164652 38.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 4146604 4140634 root 160996 0.0 S 02:45:02 spamd child 2575382 1 root 157852 0.0 Ss 1-21:27:34 /usr/lib/systemd/systemd-journald 55583 55530 speedlin 132124 57.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 55596 55589 olympic 131168 60.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 55602 55487 corpkicks 128004 27.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 55575 55538 infinium 121144 28.0 R 00:02 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 55592 55344 olympic 120392 50.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 55614 55611 customc 117220 45.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 55617 54482 infinium 101348 39.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 55587 52484 vinesit 94016 34.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 55590 55338 vinesit 93980 35.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 55615 55612 infinium 93916 37.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 55609 55529 evolution 87628 31.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 55619 55113 evolution 82544 29.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 55603 55494 speedlin 80104 49.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 55620 54474 evolution 76580 21.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 55623 55413 evolution 74156 21.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2223 1201 root 61444 0.0 Sl 48-19:08:12 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 54023 1353308 cpanellogin 61100 0.4 S 01:58 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 1353308 1 root 41720 0.0 Ss 26-02:36:43 cpsrvd (SSL) - waiting for connections 55629 50393 evolution 40432 4.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4922 2431 netdata 35008 0.1 Sl 48-19:08:08 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 32724 0.1 Ss 48-19:08:12 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4139988 1 root 32628 0.0 Ss 02:55:56 lfd - sleeping 52817 1276780 nobody 19388 0.0 S 04:16 /usr/sbin/httpd -k start 54474 1276780 nobody 19004 0.0 S 01:26 /usr/sbin/httpd -k start 52813 1276780 nobody 18996 0.1 S 04:17 /usr/sbin/httpd -k start 52816 1276780 nobody 18768 0.0 S 04:16 /usr/sbin/httpd -k start 50393 1276780 nobody 18272 0.0 S 08:42 /usr/sbin/httpd -k start 281734 1 mailnull 18188 0.0 Ss 8-02:56:01 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 54512 1276780 nobody 17584 0.0 S 01:22 /usr/sbin/httpd -k start 55113 1276780 nobody 17252 0.0 S 00:36 /usr/sbin/httpd -k start 53952 1276780 nobody 16996 0.0 S 02:02 /usr/sbin/httpd -k start 52538 1276780 nobody 16988 0.0 S 05:00 /usr/sbin/httpd -k start 53947 1276780 nobody 16932 0.1 S 02:03 /usr/sbin/httpd -k start 55489 1276780 nobody 16812 0.2 S 00:05 /usr/sbin/httpd -k start 54482 1276780 nobody 16788 0.0 S 01:25 /usr/sbin/httpd -k start 38372 1471 root 16776 0.0 S 28:47 cPhulkd - dbprocessor 54269 1276780 nobody 16604 0.0 S 01:41 /usr/sbin/httpd -k start 52484 1276780 nobody 16328 0.0 S 05:04 /usr/sbin/httpd -k start 55533 1276780 nobody 15992 0.2 S 00:04 /usr/sbin/httpd -k start 53951 1276780 nobody 15792 0.0 S 02:02 /usr/sbin/httpd -k start 55529 1276780 nobody 15784 0.2 S 00:04 /usr/sbin/httpd -k start 185104 2431 netdata 15740 2.0 Rl 4-08:44:31 /usr/libexec/netdata/plugins.d/apps.plugin 1 55472 1276780 nobody 15676 0.0 S 00:06 /usr/sbin/httpd -k start 55519 1276780 nobody 15632 0.0 S 00:04 /usr/sbin/httpd -k start 55470 1276780 nobody 15592 0.1 S 00:06 /usr/sbin/httpd -k start 55322 1276780 nobody 15564 0.0 S 00:17 /usr/sbin/httpd -k start 1471 1 root 15504 0.0 Ss 48-19:08:12 cPhulkd - processor 55454 1276780 nobody 15480 0.0 S 00:07 /usr/sbin/httpd -k start 52157 1471 root 15352 0.0 S 05:34 cPhulkd - processor - http socket 55413 1276780 nobody 15352 0.0 S 00:09 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 460488 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 460487 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Writing to net | SELECT option_name, option_value FROM QpCIPREUS_options WHERE autoload IN ( 'yes', 'on', 'auto-on', 'auto' ) | +--------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min tubesupplies/tubesupplies.com.au-ssl_log 272 candyfabcom/candyfab.com.au-ssl_log 117 evolution/portal.evolutionerp.com.au-ssl_log 24 madalice/madalice.com.au-ssl_log 5 aaa/aaadownunder.com.au-ssl_log 1 otter2/otterfencing.net.au-ssl_log 1 otterfencing/otterfencing.com.au-ssl_log 1 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 142 20.100.185.105 130 20.79.222.117 117 20.197.195.76 24 203.54.180.238 2 66.249.65.170 2 114.119.159.70 1 88.99.104.138 1 20.119.58.187 1 198.235.24.33 1 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 24 GET /heartbeat.php 7 GET /admin.php 4 GET /store/diamond-bling-laces/ 4 GET /k.php 4 GET /inputs.php 4 GET /adminfuns.php 4 GET /about.php 3 GET /x.php 3 GET /simple.php 3 GET /ms-edit.php 3 GET /ioxi-o.php 3 GET /file.php 3 GET /f35.php 3 GET /edit.php 3 GET /chosen.php 3 GET /aa.php 3 GET /222.php 3 GET /1.php 2 GET /xxx.php 2 GET /wp.php --- busiest 3 vhosts: top paths + last 10 requests --- == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 4 GET /admin.php 3 GET /k.php 2 GET /xxx.php 2 GET /x.php 2 GET /wp-includes/ID3/about.php 2 GET /wp-admin/js/index.php 2 GET /wp-admin/css/colors/blue/ 2 GET /v.php 2 GET /simple.php 2 GET /ms-edit.php 2 GET /mar.php 2 GET /inputs.php -- last 10 requests -- 20.100.185.105 - - [17/Aug/2026:05:18:03 +1000] "GET /wp-content/x/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.185.105 - - [17/Aug/2026:05:18:04 +1000] "GET /admin.php7 HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.185.105 - - [17/Aug/2026:05:18:04 +1000] "GET /.well-known/wp-login.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.185.105 - - [17/Aug/2026:05:18:04 +1000] "GET /wp-content/plugins/linkpreview/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Saf 20.100.185.105 - - [17/Aug/2026:05:18:05 +1000] "GET /wp-content/cache/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.185.105 - - [17/Aug/2026:05:18:05 +1000] "GET /wp-admin/file.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.185.105 - - [17/Aug/2026:05:18:05 +1000] "GET /bak.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.185.105 - - [17/Aug/2026:05:18:06 +1000] "GET /config.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.185.105 - - [17/Aug/2026:05:18:06 +1000] "GET /wp-content/uploads/2025/03/themes.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/5 20.100.185.105 - - [17/Aug/2026:05:18:06 +1000] "GET /wp-activate.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 3 GET /ioxi-o.php 3 GET /admin.php 3 GET /adminfuns.php 2 GET /wp-content/themes/admin.php 2 GET /wk/index.php 2 GET /lite.php 2 GET /inputs.php 2 GET /edit.php 2 GET /as.php 2 GET /about.php 2 GET /aa.php 2 GET /222.php -- last 10 requests -- 20.197.195.76 - - [17/Aug/2026:05:17:29 +1000] "GET /wp-includes/ HTTP/1.1" 401 36 "-" "-" 20.197.195.76 - - [17/Aug/2026:05:17:29 +1000] "GET /wp-includes/js/crop/ HTTP/1.1" 401 36 "-" "-" 20.197.195.76 - - [17/Aug/2026:05:17:30 +1000] "GET /ioxi-o.php HTTP/1.1" 401 36 "-" "-" 20.197.195.76 - - [17/Aug/2026:05:17:31 +1000] "GET /0x.php HTTP/1.1" 401 36 "-" "-" 20.197.195.76 - - [17/Aug/2026:05:17:32 +1000] "GET /222.php HTTP/1.1" 401 36 "-" "-" 20.197.195.76 - - [17/Aug/2026:05:17:32 +1000] "GET /aa.php HTTP/1.1" 401 36 "-" "-" 20.197.195.76 - - [17/Aug/2026:05:17:33 +1000] "GET /abcd.php HTTP/1.1" 401 36 "-" "-" 20.197.195.76 - - [17/Aug/2026:05:17:34 +1000] "GET /admin.php HTTP/1.1" 401 36 "-" "-" 20.197.195.76 - - [17/Aug/2026:05:17:35 +1000] "GET /admin/controller/extension/extension/ HTTP/1.1" 401 36 "-" "-" 20.197.195.76 - - [17/Aug/2026:05:17:35 +1000] "GET /adminfuns.php HTTP/1.1" 401 36 "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 24 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [17/Aug/2026:05:17:12 +1000] "GET /heartbeat.php?sentAt=1786907832&bytes=106,130,12,184&_=1786683811833 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [17/Aug/2026:05:17:15 +1000] "GET /heartbeat.php?sentAt=1786907835&bytes=106,130,12,187&_=1786712401801 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [17/Aug/2026:05:17:22 +1000] "GET /heartbeat.php?sentAt=1786907842&bytes=106,130,12,194&_=1786683811834 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [17/Aug/2026:05:17:25 +1000] "GET /heartbeat.php?sentAt=1786907845&bytes=106,130,12,197&_=1786712401802 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [17/Aug/2026:05:17:32 +1000] "GET /heartbeat.php?sentAt=1786907852&bytes=106,130,12,204&_=1786683811835 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [17/Aug/2026:05:17:35 +1000] "GET /heartbeat.php?sentAt=1786907855&bytes=106,130,12,207&_=1786712401803 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [17/Aug/2026:05:17:42 +1000] "GET /heartbeat.php?sentAt=1786907862&bytes=106,130,12,214&_=1786683811836 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [17/Aug/2026:05:17:45 +1000] "GET /heartbeat.php?sentAt=1786907865&bytes=106,130,12,217&_=1786712401804 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [17/Aug/2026:05:17:52 +1000] "GET /heartbeat.php?sentAt=1786907872&bytes=106,130,12,224&_=1786683811837 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [17/Aug/2026:05:17:55 +1000] "GET /heartbeat.php?sentAt=1786907875&bytes=106,130,12,227&_=1786712401805 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-08-17 05:15:48 L1=0.84 run=1 blk=0 avail=6903 (58.9%) swpO=0 conn=2 myRSS=2348 php=0 phpRSS=0 ap=15 tcp=18 topuser=- 2026-08-17 05:15:48 L1=0.84 run=1 blk=0 avail=6904 (58.9%) swpO=0 conn=3 myRSS=2348 php=0 phpRSS=0 ap=15 tcp=17 topuser=- 2026-08-17 05:15:58 L1=0.71 run=1 blk=0 avail=6982 (59.5%) swpO=0 conn=2 myRSS=2348 php=0 phpRSS=0 ap=15 tcp=24 topuser=- 2026-08-17 05:15:58 L1=0.71 run=1 blk=0 avail=6982 (59.5%) swpO=0 conn=3 myRSS=2348 php=0 phpRSS=0 ap=15 tcp=22 topuser=- 2026-08-17 05:16:08 L1=0.60 run=1 blk=0 avail=6957 (59.3%) swpO=0 conn=2 myRSS=2348 php=0 phpRSS=0 ap=18 tcp=25 topuser=- 2026-08-17 05:16:08 L1=0.60 run=1 blk=0 avail=6957 (59.3%) swpO=0 conn=3 myRSS=2348 php=0 phpRSS=0 ap=18 tcp=24 topuser=- 2026-08-17 05:16:18 L1=0.89 run=1 blk=0 avail=6920 (59.0%) swpO=0 conn=1 myRSS=2348 php=0 phpRSS=0 ap=18 tcp=25 topuser=- 2026-08-17 05:16:19 L1=0.89 run=2 blk=0 avail=6859 (58.5%) swpO=0 conn=2 myRSS=2348 php=1 phpRSS=93 ap=18 tcp=25 topuser=madalice 2026-08-17 05:16:28 L1=0.99 run=2 blk=0 avail=6925 (59.0%) swpO=0 conn=1 myRSS=2348 php=0 phpRSS=0 ap=19 tcp=27 topuser=- 2026-08-17 05:16:29 L1=0.99 run=1 blk=0 avail=6919 (59.0%) swpO=0 conn=2 myRSS=2348 php=0 phpRSS=0 ap=19 tcp=26 topuser=- 2026-08-17 05:16:38 L1=0.84 run=1 blk=0 avail=6926 (59.1%) swpO=2 conn=1 myRSS=2348 php=0 phpRSS=0 ap=19 tcp=25 topuser=- 2026-08-17 05:16:39 L1=0.84 run=4 blk=0 avail=6918 (59.0%) swpO=2 conn=2 myRSS=2348 php=0 phpRSS=0 ap=19 tcp=23 topuser=- 2026-08-17 05:16:48 L1=0.78 run=2 blk=0 avail=6736 (57.4%) swpO=0 conn=1 myRSS=2348 php=1 phpRSS=185 ap=23 tcp=30 topuser=madalice 2026-08-17 05:16:49 L1=0.78 run=1 blk=0 avail=6896 (58.8%) swpO=0 conn=2 myRSS=2348 php=0 phpRSS=0 ap=23 tcp=30 topuser=- 2026-08-17 05:16:58 L1=0.66 run=1 blk=0 avail=6879 (58.7%) swpO=0 conn=1 myRSS=2348 php=0 phpRSS=0 ap=23 tcp=31 topuser=- 2026-08-17 05:16:59 L1=0.66 run=1 blk=0 avail=6880 (58.7%) swpO=0 conn=2 myRSS=2348 php=0 phpRSS=0 ap=23 tcp=31 topuser=- 2026-08-17 05:17:08 L1=0.78 run=2 blk=0 avail=6852 (58.4%) swpO=0 conn=1 myRSS=2348 php=1 phpRSS=61 ap=23 tcp=27 topuser=madalice 2026-08-17 05:17:09 L1=0.78 run=2 blk=0 avail=6790 (57.9%) swpO=0 conn=2 myRSS=2348 php=1 phpRSS=126 ap=23 tcp=25 topuser=madalice 2026-08-17 05:17:18 L1=0.66 run=1 blk=0 avail=6891 (58.7%) swpO=0 conn=1 myRSS=2348 php=0 phpRSS=0 ap=22 tcp=26 topuser=- 2026-08-17 05:17:19 L1=0.66 run=1 blk=0 avail=6896 (58.8%) swpO=0 conn=1 myRSS=2348 php=0 phpRSS=0 ap=22 tcp=29 topuser=- 2026-08-17 05:17:28 L1=0.56 run=1 blk=0 avail=6856 (58.5%) swpO=0 conn=1 myRSS=2348 php=0 phpRSS=0 ap=21 tcp=27 topuser=- 2026-08-17 05:17:29 L1=0.56 run=2 blk=0 avail=6859 (58.5%) swpO=0 conn=1 myRSS=2348 php=0 phpRSS=0 ap=21 tcp=26 topuser=- 2026-08-17 05:17:38 L1=0.55 run=3 blk=0 avail=6841 (58.3%) swpO=0 conn=1 myRSS=2348 php=0 phpRSS=0 ap=23 tcp=26 topuser=- 2026-08-17 05:17:39 L1=0.55 run=2 blk=0 avail=6858 (58.5%) swpO=0 conn=1 myRSS=2348 php=0 phpRSS=0 ap=23 tcp=26 topuser=- 2026-08-17 05:17:48 L1=0.47 run=1 blk=0 avail=6862 (58.5%) swpO=0 conn=1 myRSS=2348 php=0 phpRSS=0 ap=21 tcp=27 topuser=- 2026-08-17 05:17:49 L1=0.47 run=2 blk=0 avail=6861 (58.5%) swpO=0 conn=1 myRSS=2348 php=0 phpRSS=0 ap=21 tcp=29 topuser=- 2026-08-17 05:17:58 L1=0.47 run=2 blk=0 avail=6828 (58.2%) swpO=1 conn=1 myRSS=2348 php=0 phpRSS=0 ap=25 tcp=31 topuser=- 2026-08-17 05:17:59 L1=0.47 run=1 blk=0 avail=6827 (58.2%) swpO=1 conn=1 myRSS=2348 php=0 phpRSS=0 ap=25 tcp=30 topuser=- 2026-08-17 05:18:08 L1=1.36 run=28 blk=0 avail=5030 (42.9%) swpO=1568 conn=21 myRSS=2317 php=23 phpRSS=2047 ap=93 tcp=97 topuser=corpkicks 2026-08-17 05:18:09 L1=1.36 run=24 blk=2 avail=4794 (40.9%) swpO=2462 conn=18 myRSS=2295 php=18 phpRSS=2115 ap=97 tcp=90 topuser=corpkicks