INCIDENT 2026-08-17 21:37:40 trigger: php_rss=1921MB ================================================================== load: 1.37 0.86 0.88 2/645 821678 ncpu:10 mem_avail: 5063MB/11729MB (43.2%) swap_used:2123MB swapout:683/s blocked(D):0 running:2 iowait:0.2% steal:0.0% php: 9 procs / 1921MB heaviest user: corpkicks (7 procs, 1841MB) apache: 29 procs tcp_estab: 86 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2479 corpkicks 7 1848 root 232 942 nobody 28 409 netdata 8 248 evolution 6 83 cpanellogin 1 61 dovenull 6 27 wp-toolkit 6 18 mailnull 2 17 zabbix 1 14 mailman 20 14 alison 1 13 kurri 1 10 dovecot 3 8 nscd 1 7 named 1 5 polkitd 1 2 dbus 1 2 cpanelconnecttrack 1 2 --- php workers by user --- USER PROCS RSS_MB corpkicks 7 1852 evolution 2 79 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3744 MB Active(file): 3299 MB Inactive(file): 685 MB Dirty: 3 MB Writeback: 0 MB SReclaimable: 436 MB CommitLimit: 9960 MB Committed_AS: 9143 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 4090795 root 20:26:24 7000 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2538776 7.3 Ssl 2-13:47:02 /usr/sbin/mariadbd 821497 820774 corpkicks 280076 32.0 S 00:05 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 821501 820788 corpkicks 279996 33.6 S 00:05 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 821502 820976 corpkicks 279976 36.0 S 00:05 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 821499 820775 corpkicks 279884 35.0 S 00:05 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 821498 820054 corpkicks 279824 32.6 S 00:05 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 821500 816206 corpkicks 279764 35.6 S 00:05 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 821624 821559 corpkicks 225520 109 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 502627 4140634 root 215620 0.1 S 07:43:50 spamd child 2575382 1 root 210340 0.0 Ss 2-13:47:05 /usr/lib/systemd/systemd-journald 1220 1 netdata 198556 2.5 Ssl 49-11:27:44 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 4146604 4140634 root 146568 0.0 S 19:04:33 spamd child 4140634 1 root 118120 0.0 Ss 19:14:54 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 817130 1353308 cpanellogin 63280 0.1 S 07:04 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 2223 1201 root 43632 0.0 Sl 49-11:27:43 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41868 0.0 Ss 26-18:56:14 cpsrvd (SSL) - waiting for connections 821640 821558 evolution 40716 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 821646 821539 evolution 40716 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 33368 0.1 Sl 49-11:27:39 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 29840 0.1 Ss 49-11:27:43 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4139988 1 root 26832 0.0 Ss 19:15:27 lfd - sleeping 816206 1276780 nobody 24528 0.1 S 08:28 /usr/sbin/httpd -k start 820065 1276780 nobody 21836 0.2 S 02:27 /usr/sbin/httpd -k start 820976 1276780 nobody 21672 0.5 S 00:56 /usr/sbin/httpd -k start 820974 1276780 nobody 21304 0.4 S 00:57 /usr/sbin/httpd -k start 816207 1276780 nobody 20732 0.0 S 08:28 /usr/sbin/httpd -k start 820775 1276780 nobody 20360 0.1 S 01:18 /usr/sbin/httpd -k start 820975 1276780 nobody 20348 0.3 S 00:56 /usr/sbin/httpd -k start 820788 1276780 nobody 19880 0.2 S 01:15 /usr/sbin/httpd -k start 820054 1276780 nobody 19392 0.0 S 02:28 /usr/sbin/httpd -k start 819492 1276780 nobody 18912 0.0 S 03:03 /usr/sbin/httpd -k start 820774 1276780 nobody 16380 0.0 S 01:18 /usr/sbin/httpd -k start 185104 2431 netdata 16000 2.0 Sl 5-01:04:02 /usr/libexec/netdata/plugins.d/apps.plugin 1 821539 1276780 nobody 15856 0.3 S 00:03 /usr/sbin/httpd -k start 38372 1471 root 15428 0.0 S 16:48:18 cPhulkd - dbprocessor 821538 1276780 nobody 15288 0.0 S 00:03 /usr/sbin/httpd -k start 821556 1276780 nobody 15288 0.0 S 00:02 /usr/sbin/httpd -k start 821557 1276780 nobody 15288 0.0 S 00:02 /usr/sbin/httpd -k start 821506 1276780 nobody 14816 0.0 S 00:04 /usr/sbin/httpd -k start 821558 1276780 nobody 14604 0.0 S 00:02 /usr/sbin/httpd -k start 1204 1 zabbix 14484 0.2 Ssl 49-11:27:44 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 821559 1276780 nobody 14468 0.0 S 00:02 /usr/sbin/httpd -k start 1463 1 root 13960 0.0 Ss 49-11:27:43 tailwatchd 789830 3828812 alison 13488 0.0 S 51:10 dovecot/imap 1471 1 root 10996 0.0 Ss 49-11:27:43 cPhulkd - processor 3816866 3828812 kurri 10972 0.0 S 1-03:46:40 dovecot/imap 821134 3828812 root 10920 0.0 S 00:36 dovecot/auth -w 281734 1 mailnull 10756 0.0 Ss 8-19:15:32 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 821627 1276780 nobody 10628 0.0 S 00:01 /usr/sbin/httpd -k start 821628 1276780 nobody 10628 0.0 S 00:01 /usr/sbin/httpd -k start 821629 1276780 nobody 10628 0.0 S 00:01 /usr/sbin/httpd -k start 821630 1276780 nobody 10628 0.0 S 00:01 /usr/sbin/httpd -k start 821631 1276780 nobody 10628 0.0 S 00:01 /usr/sbin/httpd -k start 821632 1276780 nobody 10628 0.0 S 00:01 /usr/sbin/httpd -k start 821633 1276780 nobody 10628 0.0 S 00:01 /usr/sbin/httpd -k start 821622 1471 root 9864 0.0 S 00:01 cPhulkd - processor - http socket 1059098 3828812 dovenull 8268 0.0 S 4-06:04:49 dovecot/imap-login 3651378 1 nscd 7868 0.0 Ssl 9-19:14:46 /usr/sbin/nscd 1059102 3828812 dovenull 7760 0.0 S 4-06:04:49 dovecot/imap-login 821489 281734 mailnull 7520 0.0 S 00:06 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4947498 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min tubesupplies/tubesupplies.com.au-ssl_log 141 corpkicks/corporatekicks.com.au-ssl_log 42 coscom/coscom.com.au-ssl_log 28 olympic/olympicfencing.com.au-ssl_log 28 evolution/portal.evolutionerp.com.au-ssl_log 26 madalice/madalice.com.au-ssl_log 7 speedlin/speedlinefencing.com.au-ssl_log 5 kurri/kurrimotorinn.com.au-ssl_log 3 alison/alisonarts.com.au-ssl_log 1 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 169 20.65.105.233 38 202.153.211.134 28 4.223.164.152 26 203.54.180.238 5 20.250.27.191 5 118.127.40.55 3 158.158.34.183 1 40.77.167.235 1 34.196.51.17 1 216.73.216.249 1 114.119.159.70 1 114.119.150.154 1 114.119.143.14 1 114.119.137.101 --- top request paths across all vhosts (last 3 min) --- 26 GET /heartbeat.php 7 POST /wp-admin/admin-ajax.php 4 GET /wp-admin/load-styles.php 4 GET /wp-admin/load-scripts.php 3 POST /wp-cron.php 3 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 GET /this_is_a_new_hello_world.php 3 GET /store/splatteraf1/ 3 GET /ms.php 2 GET /xx.php 2 GET /wp-json/wp/v2/categories 2 GET /wp-admin/ 2 GET /thui.php 2 GET /plugins.php 2 GET /mamzi.php 2 GET /koiy.php 2 GET /fff.php 2 GET /4PJcpMFsD8B.php 2 GET /3PJcpMFsD8B.php 2 GET /222.php --- busiest 3 vhosts: top paths + last 10 requests --- == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 2 GET /thui.php 2 GET /ms.php 1 GET /zz.php 1 GET /zxin.php 1 GET /z.php 1 GET /zc-318.php 1 GET /xxx.php 1 GET /xqq.php 1 GET /xmy.php 1 GET /xleet.php 1 GET /xda.php 1 GET /xa.php -- last 10 requests -- 20.65.105.233 - - [17/Aug/2026:21:35:53 +1000] "GET /wp-tem.php HTTP/1.1" 401 36 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:35:54 +1000] "GET /sadd.php HTTP/1.1" 401 36 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:35:54 +1000] "GET /ex.php HTTP/1.1" 401 36 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:35:54 +1000] "GET /tax.php HTTP/1.1" 401 36 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:35:55 +1000] "GET /X7x.php HTTP/1.1" 401 36 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:35:55 +1000] "GET /ocxla.php HTTP/1.1" 401 36 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:35:56 +1000] "GET /post.php HTTP/1.1" 401 36 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:35:56 +1000] "GET /nhr.php HTTP/1.1" 401 36 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:35:56 +1000] "GET /ms-edit.php HTTP/1.1" 401 36 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:35:57 +1000] "GET /ws79.php HTTP/1.1" 401 36 "-" "-" == corpkicks/corporatekicks.com.au-ssl_log == -- top paths -- 4 POST /wp-admin/admin-ajax.php 4 GET /wp-admin/load-styles.php 4 GET /wp-admin/load-scripts.php 3 POST /wp-cron.php 2 GET /wp-json/wp/v2/categories 2 GET /wp-admin/ 1 POST /wp-login.php 1 OPTIONS /wp-json/wp/v2/settings 1 OPTIONS /wp-json/wp/v2/posts/ 1 OPTIONS /wp-json/wp/v2/posts 1 HEAD / 1 GET /wp-login.php -- last 10 requests -- 202.153.211.134 - - [17/Aug/2026:21:36:52 +1000] "OPTIONS /wp-json/wp/v2/posts?_locale=user HTTP/1.1" 200 2903 "https://corporatekicks.com.au/wp-admin/post-new.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 202.153.211.134 - - [17/Aug/2026:21:36:52 +1000] "GET /wp-json/wp/v2/templates/lookup?slug=single-post&_locale=user HTTP/1.1" 200 6 "https://corporatekicks.com.au/wp-admin/post-new.php" "Mozilla/5.0 (Windows NT 10.0; Win 202.153.211.134 - - [17/Aug/2026:21:36:52 +1000] "GET /wp-json/wp/v2/pages/623?context=edit&_locale=user HTTP/1.1" 200 2459 "https://corporatekicks.com.au/wp-admin/post-new.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 202.153.211.134 - - [17/Aug/2026:21:36:51 +1000] "GET /wp-json/wp/v2/block-patterns/patterns?_locale=user HTTP/1.1" 200 34551 "https://corporatekicks.com.au/wp-admin/post-new.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 202.153.211.134 - - [17/Aug/2026:21:36:53 +1000] "GET /wp-json/wp/v2/categories?per_page=100&orderby=count&order=desc&_fields=id%2Cname&_locale=user HTTP/1.1" 200 90 "https://corporatekicks.com.au/wp-admin/post-new.php" 202.153.211.134 - - [17/Aug/2026:21:36:54 +1000] "GET /wp-json/wp/v2/categories?context=view&per_page=100&orderby=name&order=asc&_fields=id%2Cname%2Cparent&page=1&_locale=user HTTP/1.1" 200 104 "https://corporatekicks.co 202.153.211.134 - - [17/Aug/2026:21:36:54 +1000] "GET /wp-json/wp/v2/tags?context=view&per_page=10&orderby=count&order=desc&hide_empty=true&_fields=id%2Cname%2Ccount&_locale=user HTTP/1.1" 200 141 "https://corporatekicks 202.153.211.134 - - [17/Aug/2026:21:36:56 +1000] "OPTIONS /wp-json/wp/v2/posts/?context=edit&_locale=user HTTP/1.1" 200 2903 "https://corporatekicks.com.au/wp-admin/post-new.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 118.127.40.55 - - [17/Aug/2026:21:36:57 +1000] "POST /wp-cron.php?doing_wp_cron=1786966617.9601550102233886718750 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://corporatekicks.com.au" 202.153.211.134 - - [17/Aug/2026:21:37:00 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 77 "https://corporatekicks.com.au/wp-admin/post-new.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, == coscom/coscom.com.au-ssl_log == -- top paths -- 1 GET /zwq13.php 1 GET /ze.php 1 GET /ws61.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-act.php 1 GET /this_is_a_new_hello_world.php 1 GET /rum.php 1 GET /pouhg.php 1 GET /plugins.php 1 GET /opts.php 1 GET /Okxob.php 1 GET /new4.php -- last 10 requests -- 20.65.105.233 - - [17/Aug/2026:21:37:33 +1000] "GET /eauu.php HTTP/1.1" 404 5749 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:37:33 +1000] "GET /dsd.php HTTP/1.1" 404 5749 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:37:34 +1000] "GET /c4.php HTTP/1.1" 404 5749 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:37:34 +1000] "GET /an7.php HTTP/1.1" 404 5749 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:37:34 +1000] "GET /bsg-management/php.php HTTP/1.1" 404 5749 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:37:35 +1000] "GET /byp8.php HTTP/1.1" 404 5749 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:37:35 +1000] "GET /plugins.php HTTP/1.1" 404 5749 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:37:36 +1000] "GET /100.kb.php HTTP/1.1" 404 5749 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:37:36 +1000] "GET /mamzi.php HTTP/1.1" 404 5749 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:37:36 +1000] "GET /ms.php HTTP/1.1" 404 5749 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-17 21:35:16 L1=0.34 run=4 blk=0 avail=6734 (57.4%) swpO=0 conn=1 myRSS=2501 php=1 phpRSS=109 ap=22 tcp=20 topuser=madalice 2026-08-17 21:35:19 L1=0.39 run=1 blk=0 avail=6825 (58.2%) swpO=0 conn=1 myRSS=2501 php=0 phpRSS=0 ap=22 tcp=19 topuser=- 2026-08-17 21:35:26 L1=0.60 run=1 blk=0 avail=6829 (58.2%) swpO=0 conn=1 myRSS=2501 php=0 phpRSS=0 ap=20 tcp=19 topuser=- 2026-08-17 21:35:29 L1=0.55 run=3 blk=0 avail=6848 (58.4%) swpO=0 conn=1 myRSS=2501 php=0 phpRSS=0 ap=19 tcp=18 topuser=- 2026-08-17 21:35:36 L1=0.51 run=4 blk=0 avail=6823 (58.2%) swpO=0 conn=1 myRSS=2501 php=1 phpRSS=66 ap=17 tcp=16 topuser=corpkicks 2026-08-17 21:35:39 L1=0.55 run=2 blk=0 avail=6863 (58.5%) swpO=0 conn=1 myRSS=2501 php=0 phpRSS=0 ap=16 tcp=14 topuser=- 2026-08-17 21:35:46 L1=0.51 run=1 blk=0 avail=6861 (58.5%) swpO=0 conn=1 myRSS=2501 php=0 phpRSS=0 ap=16 tcp=13 topuser=- 2026-08-17 21:35:50 L1=0.46 run=2 blk=0 avail=6722 (57.3%) swpO=0 conn=1 myRSS=2501 php=1 phpRSS=175 ap=16 tcp=14 topuser=madalice 2026-08-17 21:35:57 L1=0.43 run=1 blk=0 avail=6860 (58.5%) swpO=0 conn=1 myRSS=2501 php=0 phpRSS=0 ap=16 tcp=13 topuser=- 2026-08-17 21:36:00 L1=0.47 run=2 blk=0 avail=6702 (57.1%) swpO=0 conn=1 myRSS=2501 php=1 phpRSS=199 ap=16 tcp=16 topuser=madalice 2026-08-17 21:36:07 L1=0.43 run=2 blk=0 avail=6473 (55.2%) swpO=0 conn=3 myRSS=2501 php=2 phpRSS=456 ap=16 tcp=13 topuser=madalice 2026-08-17 21:36:10 L1=0.40 run=1 blk=0 avail=6876 (58.6%) swpO=0 conn=1 myRSS=2501 php=0 phpRSS=0 ap=15 tcp=15 topuser=- 2026-08-17 21:36:17 L1=0.37 run=3 blk=0 avail=6756 (57.6%) swpO=0 conn=3 myRSS=2501 php=1 phpRSS=146 ap=15 tcp=19 topuser=corpkicks 2026-08-17 21:36:20 L1=0.34 run=3 blk=0 avail=6571 (56.0%) swpO=0 conn=1 myRSS=2501 php=3 phpRSS=389 ap=15 tcp=18 topuser=corpkicks 2026-08-17 21:36:27 L1=0.31 run=2 blk=0 avail=6582 (56.1%) swpO=1 conn=3 myRSS=2501 php=1 phpRSS=265 ap=21 tcp=20 topuser=corpkicks 2026-08-17 21:36:30 L1=0.29 run=6 blk=0 avail=6014 (51.3%) swpO=1 conn=1 myRSS=2501 php=4 phpRSS=754 ap=21 tcp=23 topuser=corpkicks 2026-08-17 21:36:37 L1=0.42 run=1 blk=0 avail=6799 (58.0%) swpO=0 conn=3 myRSS=2501 php=0 phpRSS=0 ap=21 tcp=15 topuser=- 2026-08-17 21:36:40 L1=0.39 run=2 blk=0 avail=6749 (57.5%) swpO=0 conn=1 myRSS=2501 php=2 phpRSS=128 ap=20 tcp=17 topuser=olympic 2026-08-17 21:36:47 L1=0.52 run=3 blk=0 avail=6790 (57.9%) swpO=0 conn=3 myRSS=2501 php=1 phpRSS=41 ap=22 tcp=22 topuser=corpkicks 2026-08-17 21:36:50 L1=0.56 run=8 blk=0 avail=6785 (57.9%) swpO=0 conn=1 myRSS=2501 php=2 phpRSS=76 ap=22 tcp=22 topuser=evolution 2026-08-17 21:36:57 L1=0.99 run=3 blk=0 avail=6481 (55.3%) swpO=0 conn=3 myRSS=2501 php=2 phpRSS=373 ap=21 tcp=20 topuser=madalice 2026-08-17 21:37:00 L1=0.99 run=4 blk=0 avail=6762 (57.7%) swpO=0 conn=1 myRSS=2501 php=2 phpRSS=81 ap=21 tcp=21 topuser=evolution 2026-08-17 21:37:07 L1=0.91 run=1 blk=0 avail=6809 (58.1%) swpO=0 conn=1 myRSS=2501 php=0 phpRSS=0 ap=18 tcp=20 topuser=- 2026-08-17 21:37:10 L1=0.84 run=3 blk=0 avail=6783 (57.8%) swpO=0 conn=3 myRSS=2501 php=2 phpRSS=81 ap=18 tcp=18 topuser=evolution 2026-08-17 21:37:17 L1=0.77 run=1 blk=0 avail=6828 (58.2%) swpO=0 conn=1 myRSS=2501 php=0 phpRSS=0 ap=16 tcp=13 topuser=- 2026-08-17 21:37:20 L1=0.71 run=1 blk=0 avail=6820 (58.1%) swpO=0 conn=3 myRSS=2501 php=2 phpRSS=81 ap=15 tcp=17 topuser=evolution 2026-08-17 21:37:27 L1=0.73 run=2 blk=0 avail=6749 (57.5%) swpO=0 conn=1 myRSS=2501 php=1 phpRSS=129 ap=14 tcp=17 topuser=alison 2026-08-17 21:37:30 L1=0.68 run=1 blk=0 avail=6821 (58.2%) swpO=0 conn=3 myRSS=2501 php=2 phpRSS=81 ap=14 tcp=18 topuser=evolution 2026-08-17 21:37:37 L1=0.62 run=12 blk=0 avail=5683 (48.5%) swpO=0 conn=1 myRSS=2501 php=8 phpRSS=1453 ap=15 tcp=22 topuser=corpkicks 2026-08-17 21:37:40 L1=1.37 run=2 blk=0 avail=5063 (43.2%) swpO=683 conn=10 myRSS=2479 php=9 phpRSS=1921 ap=29 tcp=86 topuser=corpkicks