INCIDENT 2026-08-17 21:38:47 trigger: php_rss=1511MB ================================================================== load: 2.08 1.14 0.98 9/639 822853 ncpu:10 mem_avail: 5509MB/11729MB (47.0%) swap_used:2136MB swapout:0/s blocked(D):0 running:9 iowait:0.4% steal:0.0% php: 7 procs / 1511MB heaviest user: corpkicks (7 procs, 1511MB) apache: 21 procs tcp_estab: 27 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2475 corpkicks 8 1566 root 232 944 nobody 20 336 netdata 8 248 cpanellogin 1 61 alison 2 47 dovenull 6 27 wp-toolkit 6 18 mailman 20 14 zabbix 1 13 aaa 1 13 vinesit 1 12 lowrange 1 12 mailnull 1 10 kurri 1 10 dovecot 3 8 nscd 1 7 named 1 5 evolution 4 3 --- php workers by user --- USER PROCS RSS_MB corpkicks 7 1563 alison 1 38 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3506 MB Active(file): 3156 MB Inactive(file): 583 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 412 MB CommitLimit: 9960 MB Committed_AS: 8058 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 4090795 root 20:27:32 6996 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2535148 7.3 Ssl 2-13:48:10 /usr/sbin/mariadbd 822813 822129 corpkicks 281544 71.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 822437 816206 corpkicks 281004 5.8 S 00:30 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 822780 816207 corpkicks 267336 22.3 S 00:06 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 822815 820788 corpkicks 233352 60.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 502627 4140634 root 215620 0.1 S 07:44:58 spamd child 2575382 1 root 210964 0.0 Ss 2-13:48:13 /usr/lib/systemd/systemd-journald 1220 1 netdata 198556 2.5 Ssl 49-11:28:52 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 822820 820774 corpkicks 152460 59.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 822819 820054 corpkicks 146468 59.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 4146604 4140634 root 145996 0.0 S 19:05:41 spamd child 4140634 1 root 118120 0.0 Ss 19:16:02 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 817130 1353308 cpanellogin 63280 0.1 S 08:12 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 822848 821506 alison 57324 8.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2223 1201 root 43612 0.0 Sl 49-11:28:51 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41868 0.0 Ss 26-18:57:22 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 33368 0.1 Sl 49-11:28:47 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 29840 0.1 Ss 49-11:28:51 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4139988 1 root 26828 0.0 Ss 19:16:35 lfd - sleeping 820065 1276780 nobody 22148 0.2 S 03:35 /usr/sbin/httpd -k start 820976 1276780 nobody 21724 0.3 S 02:04 /usr/sbin/httpd -k start 820974 1276780 nobody 21700 0.2 S 02:05 /usr/sbin/httpd -k start 820788 1276780 nobody 21496 0.2 S 02:23 /usr/sbin/httpd -k start 820054 1276780 nobody 20996 0.1 S 03:36 /usr/sbin/httpd -k start 820775 1276780 nobody 20488 0.2 S 02:26 /usr/sbin/httpd -k start 821559 1276780 nobody 20428 0.2 S 01:10 /usr/sbin/httpd -k start 822129 1276780 nobody 19820 0.1 S 00:49 /usr/sbin/httpd -k start 816206 1276780 nobody 19472 0.1 S 09:36 /usr/sbin/httpd -k start 820774 1276780 nobody 18872 0.3 S 02:26 /usr/sbin/httpd -k start 821558 1276780 nobody 17384 0.0 R 01:10 /usr/sbin/httpd -k start 821506 1276780 nobody 17324 0.0 S 01:12 /usr/sbin/httpd -k start 816207 1276780 nobody 17096 0.0 S 09:36 /usr/sbin/httpd -k start 821629 1276780 nobody 16968 0.0 S 01:09 /usr/sbin/httpd -k start 821632 1276780 nobody 16628 0.0 S 01:09 /usr/sbin/httpd -k start 821557 1276780 nobody 16340 0.1 S 01:10 /usr/sbin/httpd -k start 821633 1276780 nobody 16324 0.0 S 01:09 /usr/sbin/httpd -k start 821538 1276780 nobody 16136 0.0 S 01:11 /usr/sbin/httpd -k start 185104 2431 netdata 16000 2.0 Sl 5-01:05:10 /usr/libexec/netdata/plugins.d/apps.plugin 1 38372 1471 root 15428 0.0 S 16:49:26 cPhulkd - dbprocessor 1204 1 zabbix 14216 0.2 Ssl 49-11:28:52 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1463 1 root 13948 0.0 Ss 49-11:28:51 tailwatchd 789830 3828812 alison 13488 0.0 S 52:18 dovecot/imap 822230 3828812 aaa 13388 0.0 S 00:47 dovecot/imap 822648 3828812 lowrange 13072 0.6 S 00:17 dovecot/pop3 822694 3828812 corpkicks 12432 0.0 S 00:11 dovecot/imap 822556 3828812 vinesit 12380 0.0 S 00:25 dovecot/imap 822558 1471 root 11740 0.0 S 00:25 cPhulkd - processor - http socket 822627 3828812 root 10992 0.0 S 00:19 dovecot/auth -w 1471 1 root 10988 0.0 Ss 49-11:28:51 cPhulkd - processor 3816866 3828812 kurri 10972 0.0 S 1-03:47:48 dovecot/imap 281734 1 mailnull 10756 0.0 Ss 8-19:16:40 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1059098 3828812 dovenull 8268 0.0 S 4-06:05:57 dovecot/imap-login 3651378 1 nscd 7868 0.0 Ssl 9-19:15:54 /usr/sbin/nscd 1059102 3828812 dovenull 7760 0.0 S 4-06:05:57 dovecot/imap-login 3651102 1 root 7204 0.0 Ss 9-19:16:05 queueprocd - waiting up to 60s to process a task 4090795 1 root 6996 0.0 Ssl 20:27:32 /usr/bin/imunify-agent-proxy 1466 1 root 6944 0.0 Ss 49-11:28:51 dnsadmin - dormant mode 1 0 root 6612 0.2 Ss 49-11:29:00 /usr/lib/systemd/systemd --switched-root --system --deserialize 17 1059104 3828812 dovenull 6056 0.0 S 4-06:05:57 dovecot/pop3-login 1059100 3828812 dovenull 5816 0.0 S 4-06:05:57 dovecot/pop3-login --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4947621 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min coscom/coscom.com.au-ssl_log 164 corpkicks/corporatekicks.com.au-ssl_log 116 alison/alisonarts.com.au-ssl_log 27 evolution/portal.evolutionerp.com.au-ssl_log 26 speedlin/speedlinefencing.com.au-ssl_log 5 madalice/madalice.com.au-ssl_log 4 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 164 20.65.105.233 95 202.153.211.134 26 203.54.180.238 22 118.127.40.55 21 158.23.18.197 5 20.250.27.191 2 216.73.216.108 2 114.119.150.154 2 114.119.134.10 1 40.77.167.235 1 34.196.51.17 1 114.119.137.101 --- top request paths across all vhosts (last 3 min) --- 26 GET /heartbeat.php 16 POST /wp-admin/admin-post.php 15 POST /wp-json/wp/v2/media 14 GET /wp-json/wp/v2/media 13 POST /wp-admin/admin-ajax.php 6 GET /wp-admin/load-scripts.php 4 POST /wp-json/wpforms/v1/themes/custom/ 4 GET /wp-admin/load-styles.php 3 POST /wp-cron.php 3 GET /wp-json/wp/v2/categories 3 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 GET /this_is_a_new_hello_world.php 3 GET /koiy.php 3 GET /fff.php 2 GET /zwq13.php 2 GET /ze.php 2 GET /ws61.php 2 GET /wp-json/elementor/v1/global-classes 2 GET /wp-admin/post.php 2 GET /wp-admin/ --- busiest 3 vhosts: top paths + last 10 requests --- == coscom/coscom.com.au-ssl_log == -- top paths -- 2 GET /thui.php 2 GET /ms.php 2 GET /koiy.php 2 GET /fff.php 1 GET /zz.php 1 GET /zxin.php 1 GET /zwq13.php 1 GET /z.php 1 GET /ze.php 1 GET /zc-318.php 1 GET /xxx.php 1 GET /xqq.php -- last 10 requests -- 20.65.105.233 - - [17/Aug/2026:21:38:27 +1000] "GET /fs.php HTTP/1.1" 404 5749 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:38:27 +1000] "GET /wp-tem.php HTTP/1.1" 404 5749 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:38:27 +1000] "GET /sadd.php HTTP/1.1" 404 5749 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:38:28 +1000] "GET /ex.php HTTP/1.1" 404 5749 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:38:28 +1000] "GET /tax.php HTTP/1.1" 404 5749 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:38:29 +1000] "GET /X7x.php HTTP/1.1" 404 5749 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:38:29 +1000] "GET /ocxla.php HTTP/1.1" 404 5749 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:38:29 +1000] "GET /post.php HTTP/1.1" 404 5749 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:38:30 +1000] "GET /nhr.php HTTP/1.1" 404 5749 "-" "-" 20.65.105.233 - - [17/Aug/2026:21:38:30 +1000] "GET /ms-edit.php HTTP/1.1" 404 5749 "-" "-" == corpkicks/corporatekicks.com.au-ssl_log == -- top paths -- 16 POST /wp-admin/admin-post.php 15 POST /wp-json/wp/v2/media 14 GET /wp-json/wp/v2/media 11 POST /wp-admin/admin-ajax.php 6 GET /wp-admin/load-scripts.php 4 POST /wp-json/wpforms/v1/themes/custom/ 4 GET /wp-admin/load-styles.php 3 POST /wp-cron.php 3 GET /wp-json/wp/v2/categories 2 GET /wp-json/elementor/v1/global-classes 2 GET /wp-admin/post.php 2 GET /wp-admin/ -- last 10 requests -- 202.153.211.134 - - [17/Aug/2026:21:38:43 +1000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 69 "https://corporatekicks.com.au/wp-admin/post.php?post=10385&action=elementor" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Ap 202.153.211.134 - - [17/Aug/2026:21:38:43 +1000] "GET /wp-json/elementor/v1/site-navigation/recent-posts?posts_per_page=6&_locale=user HTTP/1.1" 200 344 "https://corporatekicks.com.au/wp-admin/post.php?post=10385&action= 202.153.211.134 - - [17/Aug/2026:21:38:43 +1000] "GET /wp-json/elementor/v1/checklist/user-progress HTTP/1.1" 200 176 "https://corporatekicks.com.au/wp-admin/post.php?post=10385&action=elementor" "Mozilla/5.0 (Windows NT 202.153.211.134 - - [17/Aug/2026:21:38:43 +1000] "GET /?p=10385&elementor-preview=10385&ver=1786966722 HTTP/1.1" 200 26105 "https://corporatekicks.com.au/wp-admin/post.php?post=10385&action=elementor" "Mozilla/5.0 (Windo 202.153.211.134 - - [17/Aug/2026:21:38:43 +1000] "GET /wp-json/elementor/v1/global-classes/usage HTTP/1.1" 200 25 "https://corporatekicks.com.au/wp-admin/post.php?post=10385&action=elementor" "Mozilla/5.0 (Windows NT 10. 202.153.211.134 - - [17/Aug/2026:21:38:44 +1000] "GET /wp-json/elementor/v1/global-classes?context=preview HTTP/1.1" 200 25 "https://corporatekicks.com.au/wp-admin/post.php?post=10385&action=elementor" "Mozilla/5.0 (Wind 202.153.211.134 - - [17/Aug/2026:21:38:45 +1000] "GET /wp-json/elementor/v1/global-classes?context=frontend HTTP/1.1" 200 25 "https://corporatekicks.com.au/wp-admin/post.php?post=10385&action=elementor" "Mozilla/5.0 (Win 202.153.211.134 - - [17/Aug/2026:21:38:45 +1000] "GET /wp-json/elementor/v1/components HTTP/1.1" 200 25 "https://corporatekicks.com.au/wp-admin/post.php?post=10385&action=elementor" "Mozilla/5.0 (Windows NT 10.0; Win64; 202.153.211.134 - - [17/Aug/2026:21:38:45 +1000] "GET /wp-json/elementor/v1/kit-elements-defaults HTTP/1.1" 200 6 "https://corporatekicks.com.au/wp-admin/post.php?post=10385&action=elementor" "Mozilla/5.0 (Windows NT 10. 202.153.211.134 - - [17/Aug/2026:21:38:45 +1000] "GET /wp-json/elementor/v1/user-data/current-user?context=edit HTTP/1.1" 200 926 "https://corporatekicks.com.au/wp-admin/post.php?post=10385&action=elementor" "Mozilla/5.0 == alison/alisonarts.com.au-ssl_log == -- top paths -- 1 GET /zwq13.php 1 GET /ze.php 1 GET /ws61.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-act.php 1 GET /this_is_a_new_hello_world.php 1 GET /rum.php 1 GET /robots.txt 1 GET /pouhg.php 1 GET /opts.php 1 GET /Okxob.php 1 GET /new4.php -- last 10 requests -- 158.23.18.197 - - [17/Aug/2026:21:38:42 +1000] "GET /fff.php HTTP/1.1" 404 5750 "-" "-" 158.23.18.197 - - [17/Aug/2026:21:38:43 +1000] "GET /pouhg.php HTTP/1.1" 404 5750 "-" "-" 158.23.18.197 - - [17/Aug/2026:21:38:43 +1000] "GET /moon3.php HTTP/1.1" 404 5750 "-" "-" 158.23.18.197 - - [17/Aug/2026:21:38:43 +1000] "GET /opts.php HTTP/1.1" 404 5750 "-" "-" 158.23.18.197 - - [17/Aug/2026:21:38:44 +1000] "GET /zwq13.php HTTP/1.1" 404 5750 "-" "-" 158.23.18.197 - - [17/Aug/2026:21:38:44 +1000] "GET /Okxob.php HTTP/1.1" 404 5750 "-" "-" 158.23.18.197 - - [17/Aug/2026:21:38:45 +1000] "GET /file59.php HTTP/1.1" 404 5750 "-" "-" 158.23.18.197 - - [17/Aug/2026:21:38:45 +1000] "GET /eauu.php HTTP/1.1" 404 5750 "-" "-" 158.23.18.197 - - [17/Aug/2026:21:38:46 +1000] "GET /dsd.php HTTP/1.1" 404 5750 "-" "-" 158.23.18.197 - - [17/Aug/2026:21:38:46 +1000] "GET /c4.php HTTP/1.1" 404 5750 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-17 21:36:20 L1=0.34 run=3 blk=0 avail=6571 (56.0%) swpO=0 conn=1 myRSS=2501 php=3 phpRSS=389 ap=15 tcp=18 topuser=corpkicks 2026-08-17 21:36:27 L1=0.31 run=2 blk=0 avail=6582 (56.1%) swpO=1 conn=3 myRSS=2501 php=1 phpRSS=265 ap=21 tcp=20 topuser=corpkicks 2026-08-17 21:36:30 L1=0.29 run=6 blk=0 avail=6014 (51.3%) swpO=1 conn=1 myRSS=2501 php=4 phpRSS=754 ap=21 tcp=23 topuser=corpkicks 2026-08-17 21:36:37 L1=0.42 run=1 blk=0 avail=6799 (58.0%) swpO=0 conn=3 myRSS=2501 php=0 phpRSS=0 ap=21 tcp=15 topuser=- 2026-08-17 21:36:40 L1=0.39 run=2 blk=0 avail=6749 (57.5%) swpO=0 conn=1 myRSS=2501 php=2 phpRSS=128 ap=20 tcp=17 topuser=olympic 2026-08-17 21:36:47 L1=0.52 run=3 blk=0 avail=6790 (57.9%) swpO=0 conn=3 myRSS=2501 php=1 phpRSS=41 ap=22 tcp=22 topuser=corpkicks 2026-08-17 21:36:50 L1=0.56 run=8 blk=0 avail=6785 (57.9%) swpO=0 conn=1 myRSS=2501 php=2 phpRSS=76 ap=22 tcp=22 topuser=evolution 2026-08-17 21:36:57 L1=0.99 run=3 blk=0 avail=6481 (55.3%) swpO=0 conn=3 myRSS=2501 php=2 phpRSS=373 ap=21 tcp=20 topuser=madalice 2026-08-17 21:37:00 L1=0.99 run=4 blk=0 avail=6762 (57.7%) swpO=0 conn=1 myRSS=2501 php=2 phpRSS=81 ap=21 tcp=21 topuser=evolution 2026-08-17 21:37:07 L1=0.91 run=1 blk=0 avail=6809 (58.1%) swpO=0 conn=1 myRSS=2501 php=0 phpRSS=0 ap=18 tcp=20 topuser=- 2026-08-17 21:37:10 L1=0.84 run=3 blk=0 avail=6783 (57.8%) swpO=0 conn=3 myRSS=2501 php=2 phpRSS=81 ap=18 tcp=18 topuser=evolution 2026-08-17 21:37:17 L1=0.77 run=1 blk=0 avail=6828 (58.2%) swpO=0 conn=1 myRSS=2501 php=0 phpRSS=0 ap=16 tcp=13 topuser=- 2026-08-17 21:37:20 L1=0.71 run=1 blk=0 avail=6820 (58.1%) swpO=0 conn=3 myRSS=2501 php=2 phpRSS=81 ap=15 tcp=17 topuser=evolution 2026-08-17 21:37:27 L1=0.73 run=2 blk=0 avail=6749 (57.5%) swpO=0 conn=1 myRSS=2501 php=1 phpRSS=129 ap=14 tcp=17 topuser=alison 2026-08-17 21:37:30 L1=0.68 run=1 blk=0 avail=6821 (58.2%) swpO=0 conn=3 myRSS=2501 php=2 phpRSS=81 ap=14 tcp=18 topuser=evolution 2026-08-17 21:37:37 L1=0.62 run=12 blk=0 avail=5683 (48.5%) swpO=0 conn=1 myRSS=2501 php=8 phpRSS=1453 ap=15 tcp=22 topuser=corpkicks 2026-08-17 21:37:40 L1=1.37 run=2 blk=0 avail=5063 (43.2%) swpO=683 conn=10 myRSS=2479 php=9 phpRSS=1921 ap=29 tcp=86 topuser=corpkicks 2026-08-17 21:37:47 L1=1.26 run=1 blk=0 avail=5259 (44.8%) swpO=683 conn=7 myRSS=2479 php=6 phpRSS=1657 ap=26 tcp=43 topuser=corpkicks 2026-08-17 21:37:51 L1=1.16 run=1 blk=0 avail=5222 (44.5%) swpO=0 conn=9 myRSS=2479 php=8 phpRSS=1754 ap=24 tcp=98 topuser=corpkicks 2026-08-17 21:37:57 L1=1.07 run=10 blk=0 avail=5978 (51.0%) swpO=0 conn=7 myRSS=2479 php=8 phpRSS=1014 ap=24 tcp=25 topuser=corpkicks 2026-08-17 21:38:01 L1=1.62 run=3 blk=0 avail=5091 (43.4%) swpO=340 conn=10 myRSS=2475 php=9 phpRSS=1909 ap=24 tcp=84 topuser=corpkicks 2026-08-17 21:38:07 L1=1.57 run=2 blk=0 avail=4959 (42.3%) swpO=340 conn=9 myRSS=2475 php=8 phpRSS=2075 ap=24 tcp=34 topuser=corpkicks 2026-08-17 21:38:11 L1=1.61 run=1 blk=0 avail=5277 (45.0%) swpO=0 conn=8 myRSS=2475 php=7 phpRSS=1717 ap=23 tcp=98 topuser=corpkicks 2026-08-17 21:38:17 L1=1.48 run=3 blk=0 avail=5511 (47.0%) swpO=0 conn=9 myRSS=2475 php=6 phpRSS=1475 ap=23 tcp=30 topuser=corpkicks 2026-08-17 21:38:21 L1=1.52 run=6 blk=0 avail=5182 (44.2%) swpO=0 conn=10 myRSS=2475 php=9 phpRSS=1904 ap=22 tcp=61 topuser=corpkicks 2026-08-17 21:38:27 L1=1.56 run=2 blk=0 avail=5621 (47.9%) swpO=0 conn=9 myRSS=2475 php=6 phpRSS=1363 ap=22 tcp=29 topuser=corpkicks 2026-08-17 21:38:31 L1=1.59 run=5 blk=0 avail=5321 (45.4%) swpO=0 conn=7 myRSS=2475 php=8 phpRSS=1608 ap=22 tcp=64 topuser=corpkicks 2026-08-17 21:38:37 L1=1.79 run=4 blk=0 avail=5731 (48.9%) swpO=0 conn=9 myRSS=2475 php=5 phpRSS=1215 ap=22 tcp=28 topuser=corpkicks 2026-08-17 21:38:41 L1=1.72 run=1 blk=0 avail=6329 (54.0%) swpO=0 conn=7 myRSS=2475 php=2 phpRSS=536 ap=21 tcp=29 topuser=corpkicks 2026-08-17 21:38:47 L1=2.08 run=9 blk=0 avail=5509 (47.0%) swpO=0 conn=8 myRSS=2475 php=7 phpRSS=1511 ap=21 tcp=27 topuser=corpkicks