INCIDENT 2026-08-19 06:09:10 trigger: php_rss=1612MB ================================================================== load: 2.26 1.04 0.87 17/638 2250907 ncpu:10 mem_avail: 5123MB/11729MB (43.7%) swap_used:2328MB swapout:1431/s blocked(D):0 running:14 iowait:2.8% steal:0.0% php: 9 procs / 1612MB heaviest user: corpkicks (7 procs, 1539MB) apache: 34 procs tcp_estab: 44 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2408 corpkicks 6 1345 root 241 904 nobody 33 567 mailman 20 362 netdata 8 251 vinesit 3 96 kurri 5 57 named 1 54 cpanellogin 1 48 dovenull 6 24 lowrange 2 22 wp-toolkit 6 17 mailnull 1 16 zabbix 1 15 aaa 1 12 infinium 1 11 evolution 4 10 dovecot 3 6 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB corpkicks 6 1352 vinesit 2 66 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4189 MB Active(file): 3492 MB Inactive(file): 855 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 440 MB CommitLimit: 9960 MB Committed_AS: 7963 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2064673 root 04:57:54 5120 /usr/bin/imunify-agent-proxy 2245078 root 09:09 3148 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2466240 9.9 Ssl 3-22:18:33 /usr/sbin/mariadbd 2250818 2250483 corpkicks 273004 71.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2250812 2247981 corpkicks 272832 72.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2250819 2250457 corpkicks 261452 135 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2250836 2250482 corpkicks 238280 124 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2250852 2248737 corpkicks 224564 113 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1220 1 netdata 203176 2.5 Ssl 50-19:59:15 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2122938 2112450 root 182940 0.0 S 03:30:41 spamd child 2122939 2112450 root 173388 0.0 S 03:30:41 spamd child 2250860 2250759 corpkicks 166784 77.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2112450 1 root 116984 0.0 Ss 03:45:37 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2575382 1 root 101948 0.0 Ss 3-22:18:36 /usr/lib/systemd/systemd-journald 2107664 1 named 56204 0.0 Ssl 03:46:29 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 2243794 1353308 cpanellogin 49840 0.0 S 11:00 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 2223 1201 root 46504 0.0 Sl 50-19:59:14 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41948 0.0 Ss 28-03:27:45 cpsrvd (SSL) - waiting for connections 2250903 2250783 vinesit 40584 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1469 1 root 39616 0.1 Ss 50-19:59:14 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 33260 0.1 Sl 50-19:59:10 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2111676 1 root 28324 0.0 Ss 03:46:07 lfd - sleeping 1463 1 root 25892 0.0 Ss 50-19:59:14 tailwatchd 2247981 1276780 nobody 22352 0.0 S 05:12 /usr/sbin/httpd -k start 2250945 2250175 vinesit 22172 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2248887 1276780 nobody 21336 0.0 S 03:50 /usr/sbin/httpd -k start 2250759 1276780 nobody 21252 0.4 S 00:07 /usr/sbin/httpd -k start 2250205 1276780 nobody 21076 0.1 S 01:08 /usr/sbin/httpd -k start 2248737 1276780 nobody 20620 0.0 S 03:53 /usr/sbin/httpd -k start 2248707 1276780 nobody 20228 0.0 S 03:59 /usr/sbin/httpd -k start 2250208 1276780 nobody 19916 0.0 S 01:08 /usr/sbin/httpd -k start 2250483 1276780 nobody 19816 0.1 S 00:41 /usr/sbin/httpd -k start 2248884 1276780 nobody 19800 0.0 S 03:50 /usr/sbin/httpd -k start 2111816 2111790 mailman 19708 0.0 S 03:46:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s 2111818 2111790 mailman 19704 0.0 S 03:46:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 2111822 2111790 mailman 19704 0.0 S 03:46:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 2111819 2111790 mailman 19668 0.0 S 03:46:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 2111817 2111790 mailman 19584 0.0 S 03:46:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 2111821 2111790 mailman 19580 0.0 S 03:46:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 2111823 2111790 mailman 19564 0.0 S 03:46:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 2250457 1276780 nobody 19468 0.0 S 00:42 /usr/sbin/httpd -k start 2250681 1276780 nobody 19456 0.3 S 00:10 /usr/sbin/httpd -k start 2250482 1276780 nobody 19452 0.0 S 00:41 /usr/sbin/httpd -k start 2111808 2111790 mailman 19444 0.0 S 03:46:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:0:2 -s 2111812 2111790 mailman 19368 0.0 S 03:46:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 2250682 1276780 nobody 19344 0.2 S 00:10 /usr/sbin/httpd -k start 2111809 2111790 mailman 19316 0.0 S 03:46:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 2111813 2111790 mailman 19316 0.0 S 03:46:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 2111820 2111790 mailman 19308 0.0 S 03:46:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 2111811 2111790 mailman 19236 0.0 S 03:46:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 2111814 2111790 mailman 19232 0.0 S 03:46:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 2111825 2111790 mailman 19228 0.0 S 03:46:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 2111815 2111790 mailman 19184 0.0 S 03:46:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 2111810 2111790 mailman 19128 0.0 S 03:46:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s 2250175 1276780 nobody 19112 0.0 S 01:09 /usr/sbin/httpd -k start 2249495 1276780 nobody 19052 0.0 S 02:37 /usr/sbin/httpd -k start 2111824 2111790 mailman 19008 0.0 S 03:46:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 2111807 2111790 mailman 19000 0.0 S 03:46:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=ArchRunner:0:1 -s 2250762 1276780 nobody 18524 0.1 S 00:06 /usr/sbin/httpd -k start 2249902 1276780 nobody 18504 0.0 S 01:42 /usr/sbin/httpd -k start 2250678 1276780 nobody 18340 0.0 S 00:11 /usr/sbin/httpd -k start 2250756 1276780 nobody 18248 0.0 S 00:08 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10182656 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/portal.evolutionerp.com.au-ssl_log 115 evolution/my.evolutionerp.com.au-ssl_log 66 vinesit/westtankers.vinesit.com.au-ssl_log 43 corpkicks/corporatekicks.com.au-ssl_log 33 aaa/aaadownunder.com.au-ssl_log 2 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 124 203.54.180.238 43 35.247.137.29 35 182.239.240.254 29 34.126.189.152 7 40.77.167.79 5 103.104.165.99 4 62.60.130.199 3 118.127.40.55 3 103.104.164.114 2 65.55.210.97 1 40.77.167.7 1 34.196.51.17 1 223.109.252.176 1 107.189.14.87 --- top request paths across all vhosts (last 3 min) --- 42 GET /factory_session_checker.php 24 GET /heartbeat.php 21 GET /factory_session_processed_qty.php 21 GET /factory_session_joiner.php 20 POST /functions.php 17 GET /index.php 12 GET /app/ajax.php 5 GET / 4 POST /jobeditsave.php 3 POST /wp-cron.php 3 POST /portal/register 3 POST /mfreqsave.php 3 POST /app/ajax/selectFilterSingle.php 2 POST /v1/graphql 2 POST /graphql 2 POST /clienteditsave.php 2 POST /app/ajax.php 2 POST /api/graphql 2 GET /secrets.yml 2 GET /rclone.conf --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 42 GET /factory_session_checker.php 24 GET /heartbeat.php 21 GET /factory_session_processed_qty.php 21 GET /factory_session_joiner.php 3 POST /portal/register 3 GET /index.php 1 GET /factory_functions.php -- last 10 requests -- 203.54.180.238 - - [19/Aug/2026:06:08:52 +1000] "GET /heartbeat.php?sentAt=1787083732&bytes=106,132,187,212&_=1787056650979 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:06:08:53 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [19/Aug/2026:06:08:54 +1000] "GET /factory_session_joiner.php?id=34687 HTTP/1.1" 200 86 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [19/Aug/2026:06:08:55 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [19/Aug/2026:06:08:56 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [19/Aug/2026:06:08:55 +1000] "GET /heartbeat.php?sentAt=1787083736&bytes=106,132,187,216&_=1787032956912 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [19/Aug/2026:06:08:57 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [19/Aug/2026:06:08:57 +1000] "GET /factory_session_joiner.php?id=34691 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [19/Aug/2026:06:08:58 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [19/Aug/2026:06:09:01 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 20 POST /functions.php 14 GET /index.php 12 GET /app/ajax.php 4 POST /jobeditsave.php 3 POST /mfreqsave.php 3 POST /app/ajax/selectFilterSingle.php 2 POST /clienteditsave.php 2 POST /app/ajax.php 2 GET / 1 POST /plugins/csvexporter/plugin.php 1 POST /logsave.php 1 POST /index.php -- last 10 requests -- 182.239.240.254 - - [19/Aug/2026:06:08:03 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 13241 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=4139" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 182.239.240.254 - - [19/Aug/2026:06:08:03 +1000] "POST /app/ajax/selectFilter.php?call=filterstaffandcontractors&filter=&cursel=&curseltext=&fromMS=1&&nolimit=LIMIT%201000&excludelabour=1&include=18&contactid=252&returno 182.239.240.254 - - [19/Aug/2026:06:08:04 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=4139" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 103.104.165.99 - - [19/Aug/2026:06:08:08 +1000] "GET /index.php?page=activities HTTP/1.1" 200 30074 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge 103.104.165.99 - - [19/Aug/2026:06:08:08 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 103.104.165.99 - - [19/Aug/2026:06:08:08 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dactivities&call=getUserSetting&caller=ajaxSubmitLocal&seq=18920064487 HTTP/1.1" 200 164 "https://my.evolutionerp.com.au/index.ph 103.104.165.99 - - [19/Aug/2026:06:08:10 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 40.77.167.79 - - [19/Aug/2026:06:08:17 +1000] "GET /index.php?page=quotedit"eid=1586 HTTP/1.1" 200 5266 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.ht 40.77.167.79 - - [19/Aug/2026:06:08:17 +1000] "GET /index.php?page=quotedit"eid=77253 HTTP/1.1" 200 5267 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.h 103.104.164.114 - - [19/Aug/2026:06:08:25 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) C == vinesit/westtankers.vinesit.com.au-ssl_log == -- top paths -- 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /z9x8c7v6b5-debug-trigger-www.westtankers.vinesit.com.au 1 GET /terraform.tfstate 1 GET /.svn/entries 1 GET /.ssh/known_hosts 1 GET /.ssh/id_rsa 1 GET /.ssh/id_ed25519 1 GET /.ssh/id_dsa 1 GET /secrets.yml 1 GET /.s3cfg -- last 10 requests -- 35.247.137.29 - - [19/Aug/2026:06:09:09 +1000] "GET /docker-compose.yaml HTTP/1.1" 302 - "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Claude-User/1.0; +mailto:support@anthropic.com" 35.247.137.29 - - [19/Aug/2026:06:09:09 +1000] "GET /.git/HEAD HTTP/1.1" 302 - "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Claude-User/1.0; +mailto:support@anthropic.com" 35.247.137.29 - - [19/Aug/2026:06:09:10 +1000] "GET /.ssh/id_rsa HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Claude-User/1.0; +mailto:support@anthropic.com" 35.247.137.29 - - [19/Aug/2026:06:09:10 +1000] "GET /api/settings HTTP/1.1" 302 - "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Claude-User/1.0; +mailto:support@anthropic.com" 35.247.137.29 - - [19/Aug/2026:06:09:10 +1000] "GET /api/v1/settings HTTP/1.1" 302 - "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Claude-User/1.0; +mailto:support@anthropic.com" 35.247.137.29 - - [19/Aug/2026:06:09:10 +1000] "GET /.git-credentials HTTP/1.1" 302 - "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Claude-User/1.0; +mailto:support@anthropic.com" 35.247.137.29 - - [19/Aug/2026:06:09:10 +1000] "GET /.ssh/id_ed25519 HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Claude-User/1.0; +mailto:support@anthropic.com" 35.247.137.29 - - [19/Aug/2026:06:09:10 +1000] "GET /.gitconfig HTTP/1.1" 302 - "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Claude-User/1.0; +mailto:support@anthropic.com" 35.247.137.29 - - [19/Aug/2026:06:09:10 +1000] "GET /rclone.conf HTTP/1.1" 302 - "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Claude-User/1.0; +mailto:support@anthropic.com" 35.247.137.29 - - [19/Aug/2026:06:09:10 +1000] "GET /.ssh/known_hosts HTTP/1.1" 403 13 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Claude-User/1.0; +mailto:support@anthropic.com" --- last 30 samples (run-up to this incident) --- 2026-08-19 06:06:48 L1=0.58 run=1 blk=0 avail=6563 (56.0%) swpO=2 conn=2 myRSS=2433 php=0 phpRSS=0 ap=18 tcp=29 topuser=- 2026-08-19 06:06:49 L1=0.58 run=3 blk=0 avail=6538 (55.7%) swpO=0 conn=1 myRSS=2433 php=1 phpRSS=56 ap=18 tcp=30 topuser=madalice 2026-08-19 06:06:58 L1=0.72 run=1 blk=0 avail=6565 (56.0%) swpO=0 conn=1 myRSS=2433 php=0 phpRSS=0 ap=18 tcp=27 topuser=- 2026-08-19 06:06:59 L1=0.72 run=1 blk=0 avail=6566 (56.0%) swpO=0 conn=1 myRSS=2433 php=0 phpRSS=0 ap=18 tcp=26 topuser=- 2026-08-19 06:07:08 L1=0.69 run=1 blk=0 avail=6565 (56.0%) swpO=0 conn=1 myRSS=2433 php=0 phpRSS=0 ap=18 tcp=25 topuser=- 2026-08-19 06:07:09 L1=0.69 run=1 blk=0 avail=6565 (56.0%) swpO=0 conn=1 myRSS=2433 php=0 phpRSS=0 ap=18 tcp=23 topuser=- 2026-08-19 06:07:18 L1=0.58 run=1 blk=0 avail=6565 (56.0%) swpO=0 conn=1 myRSS=2433 php=0 phpRSS=0 ap=18 tcp=29 topuser=- 2026-08-19 06:07:19 L1=0.58 run=1 blk=0 avail=6564 (56.0%) swpO=0 conn=1 myRSS=2433 php=0 phpRSS=0 ap=18 tcp=24 topuser=- 2026-08-19 06:07:28 L1=0.65 run=2 blk=0 avail=6446 (55.0%) swpO=0 conn=1 myRSS=2434 php=1 phpRSS=127 ap=21 tcp=33 topuser=madalice 2026-08-19 06:07:29 L1=0.65 run=4 blk=0 avail=6422 (54.8%) swpO=0 conn=1 myRSS=2434 php=1 phpRSS=57 ap=25 tcp=34 topuser=olympic 2026-08-19 06:07:38 L1=0.70 run=1 blk=0 avail=6513 (55.5%) swpO=0 conn=1 myRSS=2434 php=0 phpRSS=0 ap=25 tcp=31 topuser=- 2026-08-19 06:07:39 L1=0.70 run=1 blk=0 avail=6514 (55.5%) swpO=0 conn=1 myRSS=2434 php=0 phpRSS=0 ap=25 tcp=30 topuser=- 2026-08-19 06:07:48 L1=0.59 run=5 blk=0 avail=6518 (55.6%) swpO=2 conn=1 myRSS=2434 php=1 phpRSS=65 ap=21 tcp=26 topuser=evolution 2026-08-19 06:07:49 L1=0.59 run=1 blk=0 avail=6550 (55.8%) swpO=2 conn=1 myRSS=2434 php=0 phpRSS=0 ap=21 tcp=26 topuser=- 2026-08-19 06:07:58 L1=0.58 run=2 blk=0 avail=6559 (55.9%) swpO=1 conn=1 myRSS=2434 php=0 phpRSS=0 ap=20 tcp=28 topuser=- 2026-08-19 06:07:59 L1=0.58 run=2 blk=0 avail=6528 (55.7%) swpO=1 conn=1 myRSS=2434 php=2 phpRSS=66 ap=20 tcp=30 topuser=madalice 2026-08-19 06:08:08 L1=0.80 run=2 blk=0 avail=6500 (55.4%) swpO=0 conn=1 myRSS=2436 php=0 phpRSS=0 ap=27 tcp=35 topuser=- 2026-08-19 06:08:09 L1=0.80 run=1 blk=0 avail=6501 (55.4%) swpO=0 conn=1 myRSS=2437 php=0 phpRSS=0 ap=27 tcp=32 topuser=- 2026-08-19 06:08:18 L1=0.76 run=1 blk=0 avail=6532 (55.7%) swpO=0 conn=1 myRSS=2437 php=0 phpRSS=0 ap=23 tcp=28 topuser=- 2026-08-19 06:08:19 L1=0.76 run=1 blk=0 avail=6546 (55.8%) swpO=0 conn=1 myRSS=2437 php=0 phpRSS=0 ap=21 tcp=26 topuser=- 2026-08-19 06:08:28 L1=0.64 run=1 blk=0 avail=6565 (56.0%) swpO=0 conn=1 myRSS=2437 php=0 phpRSS=0 ap=18 tcp=28 topuser=- 2026-08-19 06:08:29 L1=0.64 run=1 blk=0 avail=6555 (55.9%) swpO=0 conn=1 myRSS=2437 php=0 phpRSS=0 ap=20 tcp=29 topuser=- 2026-08-19 06:08:38 L1=0.62 run=1 blk=0 avail=6550 (55.8%) swpO=0 conn=1 myRSS=2437 php=0 phpRSS=0 ap=20 tcp=25 topuser=- 2026-08-19 06:08:39 L1=0.57 run=1 blk=0 avail=6562 (55.9%) swpO=0 conn=1 myRSS=2437 php=0 phpRSS=0 ap=20 tcp=23 topuser=- 2026-08-19 06:08:48 L1=0.52 run=1 blk=0 avail=6581 (56.1%) swpO=0 conn=1 myRSS=2437 php=0 phpRSS=0 ap=16 tcp=25 topuser=- 2026-08-19 06:08:49 L1=0.48 run=1 blk=0 avail=6581 (56.1%) swpO=0 conn=1 myRSS=2437 php=0 phpRSS=0 ap=16 tcp=25 topuser=- 2026-08-19 06:08:58 L1=0.44 run=2 blk=0 avail=6490 (55.3%) swpO=0 conn=2 myRSS=2437 php=1 phpRSS=121 ap=16 tcp=26 topuser=corpkicks 2026-08-19 06:09:00 L1=0.48 run=2 blk=0 avail=6260 (53.4%) swpO=0 conn=1 myRSS=2437 php=2 phpRSS=363 ap=19 tcp=27 topuser=corpkicks 2026-08-19 06:09:08 L1=1.33 run=12 blk=1 avail=5859 (50.0%) swpO=1431 conn=2 myRSS=2408 php=9 phpRSS=891 ap=33 tcp=46 topuser=corpkicks 2026-08-19 06:09:10 L1=2.26 run=14 blk=0 avail=5123 (43.7%) swpO=1431 conn=7 myRSS=2408 php=9 phpRSS=1612 ap=34 tcp=44 topuser=corpkicks