INCIDENT 2026-08-18 13:05:23 trigger: php_rss=2034MB ================================================================== load: 4.27 2.44 2.23 23/704 1525892 ncpu:10 mem_avail: 4929MB/11729MB (42.0%) swap_used:2260MB swapout:686/s blocked(D):0 running:21 iowait:0.3% steal:0.0% php: 14 procs / 2034MB heaviest user: corpkicks (9 procs, 1576MB) apache: 66 procs tcp_estab: 62 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2606 corpkicks 9 1720 nobody 64 1049 root 238 684 netdata 8 251 evolution 7 172 madalice 1 146 olympic 1 86 kurri 7 81 cpanellogin 1 61 dovenull 6 28 candyfabcom 2 24 wp-toolkit 6 18 mailnull 2 17 zabbix 1 13 mailman 20 13 alison 1 13 lowrange 1 11 dovecot 3 8 nscd 1 7 --- php workers by user --- USER PROCS RSS_MB corpkicks 9 1733 evolution 3 168 madalice 1 147 olympic 1 87 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4666 MB Active(file): 3406 MB Inactive(file): 1126 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 368 MB CommitLimit: 9960 MB Committed_AS: 9795 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 955450 root 11:54:07 2664 /usr/bin/imunify-agent-proxy 1521038 root 05:23 3160 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 1525374 root 00:23 1308 /bin/sh -c bash -c "sleep $((RANDOM % 60))" ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2667196 9.0 Ssl 3-05:14:46 /usr/sbin/mariadbd 1525827 1521417 corpkicks 240872 65.5 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1525831 1524016 corpkicks 239024 66.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1525822 1525053 corpkicks 238244 64.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1525826 1523319 corpkicks 234784 71.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1525825 1525097 corpkicks 231620 62.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1525828 1523144 corpkicks 218052 56.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1220 1 netdata 201292 2.5 Ssl 50-02:55:28 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1000360 998750 root 179296 0.1 S 10:40:34 spamd child 1525824 1525073 corpkicks 168200 42.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1525823 1523124 corpkicks 163928 39.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1525821 1523146 madalice 157984 73.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1525830 1525076 corpkicks 148920 36.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 998750 1 root 119448 0.0 Ss 10:42:39 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1525856 1525071 olympic 90896 32.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1000361 998750 root 68040 0.0 S 10:40:34 spamd child 1525878 1518014 evolution 67568 16.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1525829 1525638 evolution 67156 7.0 R 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1474499 1353308 cpanellogin 62652 0.0 S 54:32 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 2575382 1 root 48468 0.0 Ss 3-05:14:49 /usr/lib/systemd/systemd-journald 1353308 1 root 41144 0.0 Ss 27-10:23:58 cpsrvd (SSL) - waiting for connections 2223 1201 root 39568 0.0 Sl 50-02:55:27 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 39228 0.1 Ss 50-02:55:27 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 33048 0.1 Sl 50-02:55:23 /usr/libexec/netdata/plugins.d/go.d.plugin 1 998083 1 root 23436 0.0 Ss 10:43:12 lfd - sleeping 1518014 1276780 nobody 22024 0.0 S 08:22 /usr/sbin/httpd -k start 1519291 1276780 nobody 21784 0.0 S 07:05 /usr/sbin/httpd -k start 1523127 1276780 nobody 20756 0.0 S 03:08 /usr/sbin/httpd -k start 1521417 1276780 nobody 20608 0.0 S 05:06 /usr/sbin/httpd -k start 1524801 1276780 nobody 20564 0.1 S 01:02 /usr/sbin/httpd -k start 1525100 1276780 nobody 20096 0.1 S 00:42 /usr/sbin/httpd -k start 1524016 1276780 nobody 20044 0.0 R 02:04 /usr/sbin/httpd -k start 1463 1 root 19992 0.0 Ss 50-02:55:27 tailwatchd 1523468 1276780 nobody 19976 0.0 S 02:44 /usr/sbin/httpd -k start 1524512 1276780 nobody 19644 0.0 S 01:25 /usr/sbin/httpd -k start 1524523 1276780 nobody 19624 0.1 S 01:24 /usr/sbin/httpd -k start 1524777 1276780 nobody 19584 0.1 S 01:05 /usr/sbin/httpd -k start 1525664 1276780 nobody 19540 0.5 S 00:12 /usr/sbin/httpd -k start 1525090 1276780 nobody 19276 0.0 S 00:42 /usr/sbin/httpd -k start 1523144 1276780 nobody 19264 0.0 S 03:07 /usr/sbin/httpd -k start 1523319 1276780 nobody 19264 0.0 S 02:54 /usr/sbin/httpd -k start 1525097 1276780 nobody 19096 0.1 S 00:42 /usr/sbin/httpd -k start 1522440 1276780 nobody 19008 0.0 S 03:52 /usr/sbin/httpd -k start 1523146 1276780 nobody 18988 0.2 S 03:07 /usr/sbin/httpd -k start 1523141 1276780 nobody 18856 0.0 S 03:07 /usr/sbin/httpd -k start 1524429 1276780 nobody 18768 0.0 S 01:31 /usr/sbin/httpd -k start 1525076 1276780 nobody 18400 0.1 S 00:43 /usr/sbin/httpd -k start 1525022 1276780 nobody 18336 0.0 S 00:46 /usr/sbin/httpd -k start 1523124 1276780 nobody 18316 0.0 S 03:08 /usr/sbin/httpd -k start 1525072 1276780 nobody 18208 0.0 S 00:43 /usr/sbin/httpd -k start 1525096 1276780 nobody 17880 0.0 S 00:42 /usr/sbin/httpd -k start 1524802 1276780 nobody 17824 0.0 S 01:02 /usr/sbin/httpd -k start 1525627 1276780 nobody 17736 0.0 S 00:14 /usr/sbin/httpd -k start 1525056 1276780 nobody 17324 0.0 S 00:44 /usr/sbin/httpd -k start 1525071 1276780 nobody 17120 0.0 S 00:43 /usr/sbin/httpd -k start 1525091 1276780 nobody 16936 0.0 S 00:42 /usr/sbin/httpd -k start 1525750 1276780 nobody 16756 0.1 S 00:08 /usr/sbin/httpd -k start 1525070 1276780 nobody 16636 0.0 S 00:43 /usr/sbin/httpd -k start 1525095 1276780 nobody 16604 0.0 S 00:42 /usr/sbin/httpd -k start 1525053 1276780 nobody 16576 0.0 S 00:44 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 1525821 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1525856 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi --- mariadb processlist (non-sleeping) --- +---------+------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 8002071 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 8002069 | root | 108-1481181613 | Execute | 0 | Sending data | SELECT * FROM projectActivities WHERE activityid like '33143' | +---------+------+----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 736 evolution/portal.evolutionerp.com.au-ssl_log 200 kamcool/kamcool.com.au-ssl_log 60 madalice/madalice.com.au-ssl_log 52 nrg/nrgservices.net.au 41 nrg/nrgservices.net.au-ssl_log 35 speedlin/speedlinefencing.com.au-ssl_log 8 alison/alisonarts.com.au-ssl_log 2 olympic/olympicfencing.com.au-ssl_log 2 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 447 203.54.180.238 230 103.104.165.99 76 20.151.128.234 74 193.82.239.232 60 20.226.7.189 57 182.239.240.254 51 101.166.96.210 36 20.228.229.148 27 103.104.164.114 23 147.161.213.78 11 203.214.146.60 7 116.91.223.246 6 66.249.65.168 5 203.31.118.167 5 115.128.106.35 --- top request paths across all vhosts (last 3 min) --- 232 POST /functions.php 116 GET /app/ajax.php 69 GET /factory_session_checker.php 59 GET /index.php 53 GET /heartbeat.php 47 POST /app/ajax/selectFilter.php 45 POST /plugins/csvexporter/plugin.php 42 POST /quoteditsave.php 35 GET /factory_session_joiner.php 34 GET /factory_session_processed_qty.php 27 POST /app/ajax/selectFilterSingle.php 21 POST /clienteditsave.php 20 POST /itemModify.php 19 POST /app/ajax.php 16 GET //app/ajax.php 15 POST //functions.php 13 HEAD /index.php 12 POST /plugins/fencecosting/plugin.php 10 POST //jobeditsave.php 8 POST /logsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 232 POST /functions.php 116 GET /app/ajax.php 55 GET /index.php 47 POST /app/ajax/selectFilter.php 45 POST /plugins/csvexporter/plugin.php 42 POST /quoteditsave.php 27 POST /app/ajax/selectFilterSingle.php 21 POST /clienteditsave.php 20 POST /itemModify.php 19 POST /app/ajax.php 16 GET //app/ajax.php 15 POST //functions.php -- last 10 requests -- 203.54.180.238 - - [18/Aug/2026:13:05:20 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 233 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=77995" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 203.54.180.238 - - [18/Aug/2026:13:05:20 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=mfreqedit&id=20806" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 203.54.180.238 - - [18/Aug/2026:13:05:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 203.54.180.238 - - [18/Aug/2026:13:05:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 203.54.180.238 - - [18/Aug/2026:13:05:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 203.54.180.238 - - [18/Aug/2026:13:05:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=mfstatus" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 203.54.180.238 - - [18/Aug/2026:13:05:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=25858" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) 203.54.180.238 - - [18/Aug/2026:13:05:21 +1000] "POST /quoteditsave.php?call=addLineItem HTTP/1.1" 200 333 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78502§ionid=0" "Mozilla/5.0 (Windows NT 10.0; 203.214.146.60 - - [18/Aug/2026:13:05:22 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 203.54.180.238 - - [18/Aug/2026:13:05:23 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78502§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 69 GET /factory_session_checker.php 53 GET /heartbeat.php 35 GET /factory_session_joiner.php 34 GET /factory_session_processed_qty.php 4 POST /portal/register 4 GET /index.php 1 POST /factory_functions.php -- last 10 requests -- 203.54.180.238 - - [18/Aug/2026:13:05:15 +1000] "GET /factory_session_joiner.php?id=34681 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [18/Aug/2026:13:05:15 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 123 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [18/Aug/2026:13:05:15 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [18/Aug/2026:13:05:18 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [18/Aug/2026:13:05:18 +1000] "POST /factory_functions.php HTTP/1.1" 302 20 "https://portal.evolutionerp.com.au/index.php?page=inventory_picking_goods&pickid=37725&seq=432018484590" "Mozilla/5.0 (Linux; 203.54.180.238 - - [18/Aug/2026:13:05:18 +1000] "GET /index.php?page=inventory_picking_goods&pickid=37725 HTTP/1.1" 200 12637 "https://portal.evolutionerp.com.au/index.php?page=inventory_picking_goods&pickid=37725&seq=43 203.54.180.238 - - [18/Aug/2026:13:05:18 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php?page=inventory_picking_goods&pickid=37725" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [18/Aug/2026:13:05:17 +1000] "GET /heartbeat.php?sentAt=1787022315&bytes=106,131,203,235&_=1787002019063 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [18/Aug/2026:13:05:17 +1000] "GET /heartbeat.php?sentAt=1787022317&bytes=106,131,203,237&_=1786971218316 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [18/Aug/2026:13:05:21 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == kamcool/kamcool.com.au-ssl_log == -- top paths -- 1 GET /t.php 1 GET /sts.php 1 GET /ss.php 1 GET /sid3.php 1 GET /shell.php 1 GET /setup-config.php 1 GET /r.php 1 GET /root.php 1 GET /p.php 1 GET /php.php 1 GET /php8.php 1 GET /past.php -- last 10 requests -- 20.226.7.189 - - [18/Aug/2026:13:03:14 +1000] "GET /php.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.7.189 - - [18/Aug/2026:13:03:15 +1000] "GET /past.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.7.189 - - [18/Aug/2026:13:03:15 +1000] "GET /root.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.7.189 - - [18/Aug/2026:13:03:15 +1000] "GET /r.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.7.189 - - [18/Aug/2026:13:03:15 +1000] "GET /sid3.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.7.189 - - [18/Aug/2026:13:03:16 +1000] "GET /ss.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.7.189 - - [18/Aug/2026:13:03:16 +1000] "GET /sts.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.7.189 - - [18/Aug/2026:13:03:16 +1000] "GET /shell.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.7.189 - - [18/Aug/2026:13:03:17 +1000] "GET /setup-config.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.226.7.189 - - [18/Aug/2026:13:03:17 +1000] "GET /t.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-18 13:03:01 L1=1.16 run=2 blk=0 avail=6558 (55.9%) swpO=0 conn=1 myRSS=2628 php=1 phpRSS=40 ap=52 tcp=52 topuser=evolution 2026-08-18 13:03:02 L1=1.16 run=1 blk=0 avail=6583 (56.1%) swpO=0 conn=4 myRSS=2628 php=0 phpRSS=0 ap=51 tcp=49 topuser=- 2026-08-18 13:03:11 L1=1.30 run=4 blk=0 avail=6463 (55.1%) swpO=0 conn=1 myRSS=2628 php=4 phpRSS=287 ap=44 tcp=51 topuser=madalice 2026-08-18 13:03:12 L1=1.30 run=4 blk=0 avail=6421 (54.7%) swpO=0 conn=4 myRSS=2628 php=1 phpRSS=240 ap=44 tcp=53 topuser=madalice 2026-08-18 13:03:21 L1=1.25 run=3 blk=0 avail=6428 (54.8%) swpO=0 conn=1 myRSS=2628 php=8 phpRSS=353 ap=56 tcp=65 topuser=evolution 2026-08-18 13:03:22 L1=1.25 run=2 blk=0 avail=6499 (55.4%) swpO=0 conn=4 myRSS=2628 php=1 phpRSS=86 ap=56 tcp=60 topuser=madalice 2026-08-18 13:03:31 L1=1.21 run=5 blk=0 avail=6245 (53.2%) swpO=0 conn=1 myRSS=2628 php=8 phpRSS=592 ap=49 tcp=48 topuser=madalice 2026-08-18 13:03:32 L1=1.21 run=12 blk=0 avail=5970 (50.9%) swpO=0 conn=4 myRSS=2628 php=13 phpRSS=994 ap=48 tcp=55 topuser=evolution 2026-08-18 13:03:41 L1=1.47 run=2 blk=0 avail=6553 (55.9%) swpO=0 conn=3 myRSS=2628 php=2 phpRSS=121 ap=46 tcp=46 topuser=madalice 2026-08-18 13:03:42 L1=1.47 run=2 blk=0 avail=6489 (55.3%) swpO=0 conn=2 myRSS=2628 php=1 phpRSS=164 ap=45 tcp=43 topuser=madalice 2026-08-18 13:03:51 L1=1.48 run=7 blk=0 avail=6343 (54.1%) swpO=0 conn=3 myRSS=2628 php=5 phpRSS=453 ap=41 tcp=53 topuser=evolution 2026-08-18 13:03:52 L1=1.48 run=3 blk=0 avail=6507 (55.5%) swpO=0 conn=2 myRSS=2628 php=2 phpRSS=173 ap=45 tcp=47 topuser=evolution 2026-08-18 13:04:01 L1=1.95 run=5 blk=0 avail=6409 (54.6%) swpO=0 conn=3 myRSS=2628 php=6 phpRSS=321 ap=52 tcp=46 topuser=evolution 2026-08-18 13:04:02 L1=1.95 run=3 blk=0 avail=6402 (54.6%) swpO=0 conn=2 myRSS=2628 php=2 phpRSS=239 ap=51 tcp=48 topuser=madalice 2026-08-18 13:04:11 L1=1.81 run=2 blk=0 avail=6592 (56.2%) swpO=0 conn=3 myRSS=2628 php=2 phpRSS=115 ap=42 tcp=38 topuser=alison 2026-08-18 13:04:12 L1=1.81 run=2 blk=0 avail=6603 (56.3%) swpO=0 conn=2 myRSS=2628 php=1 phpRSS=82 ap=41 tcp=38 topuser=madalice 2026-08-18 13:04:21 L1=1.92 run=2 blk=0 avail=6552 (55.9%) swpO=0 conn=3 myRSS=2628 php=2 phpRSS=149 ap=42 tcp=43 topuser=madalice 2026-08-18 13:04:22 L1=1.92 run=3 blk=0 avail=6445 (54.9%) swpO=0 conn=2 myRSS=2628 php=2 phpRSS=259 ap=42 tcp=42 topuser=madalice 2026-08-18 13:04:31 L1=1.85 run=4 blk=0 avail=6372 (54.3%) swpO=0 conn=3 myRSS=2628 php=3 phpRSS=234 ap=40 tcp=37 topuser=madalice 2026-08-18 13:04:32 L1=1.85 run=4 blk=0 avail=6401 (54.6%) swpO=0 conn=2 myRSS=2628 php=4 phpRSS=371 ap=39 tcp=40 topuser=madalice 2026-08-18 13:04:41 L1=2.44 run=6 blk=0 avail=6057 (51.6%) swpO=0 conn=6 myRSS=2628 php=5 phpRSS=556 ap=67 tcp=73 topuser=corpkicks 2026-08-18 13:04:42 L1=2.44 run=4 blk=0 avail=6103 (52.0%) swpO=0 conn=5 myRSS=2628 php=4 phpRSS=495 ap=67 tcp=65 topuser=corpkicks 2026-08-18 13:04:52 L1=2.22 run=4 blk=0 avail=6326 (53.9%) swpO=0 conn=6 myRSS=2628 php=4 phpRSS=340 ap=58 tcp=47 topuser=madalice 2026-08-18 13:04:52 L1=2.22 run=3 blk=0 avail=6539 (55.8%) swpO=0 conn=5 myRSS=2628 php=0 phpRSS=0 ap=57 tcp=48 topuser=- 2026-08-18 13:05:02 L1=2.11 run=6 blk=0 avail=6224 (53.1%) swpO=0 conn=6 myRSS=2628 php=5 phpRSS=504 ap=49 tcp=46 topuser=madalice 2026-08-18 13:05:02 L1=2.11 run=9 blk=0 avail=6212 (53.0%) swpO=0 conn=5 myRSS=2628 php=5 phpRSS=537 ap=49 tcp=47 topuser=olympic 2026-08-18 13:05:12 L1=2.39 run=5 blk=0 avail=6021 (51.3%) swpO=0 conn=6 myRSS=2628 php=6 phpRSS=718 ap=53 tcp=60 topuser=madalice 2026-08-18 13:05:13 L1=2.39 run=4 blk=0 avail=6068 (51.7%) swpO=0 conn=5 myRSS=2628 php=5 phpRSS=638 ap=53 tcp=56 topuser=madalice 2026-08-18 13:05:22 L1=2.47 run=15 blk=0 avail=6020 (51.3%) swpO=0 conn=6 myRSS=2629 php=13 phpRSS=849 ap=66 tcp=64 topuser=corpkicks 2026-08-18 13:05:23 L1=2.47 run=21 blk=0 avail=4929 (42.0%) swpO=686 conn=13 myRSS=2612 php=14 phpRSS=2034 ap=66 tcp=62 topuser=corpkicks