INCIDENT 2026-08-19 21:47:26 trigger: php_rss=1875MB ================================================================== load: 1.63 0.90 0.75 11/655 3031181 ncpu:10 mem_avail: 4753MB/11729MB (40.5%) swap_used:2272MB swapout:6/s blocked(D):0 running:12 iowait:0.3% steal:0.0% php: 13 procs / 1875MB heaviest user: evolution (11 procs, 1604MB) apache: 49 procs tcp_estab: 43 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2840 evolution 16 1619 nobody 48 774 root 239 739 otterfencing 2 279 netdata 8 260 mailman 20 177 cpanellogin 1 63 kurri 3 34 dovenull 6 26 wp-toolkit 6 17 named 1 15 zabbix 1 13 alison 1 12 lowrange 1 11 mailnull 1 8 dovecot 3 6 nscd 1 5 cpanelconnecttrack 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 10 1604 otterfencing 2 280 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4491 MB Active(file): 3433 MB Inactive(file): 999 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 398 MB CommitLimit: 9960 MB Committed_AS: 8881 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2064673 root 20:36:10 1940 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2909044 11.1 Ssl 4-13:56:49 /usr/sbin/mariadbd 1220 1 netdata 209264 2.5 Ssl 51-11:37:31 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2122939 2112450 root 180344 0.0 S 19:08:57 spamd child 3031138 3028956 evolution 177896 94.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3031140 3030836 evolution 177828 87.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3031128 3030815 evolution 177820 93.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3031141 3030840 evolution 177808 92.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3031139 3030219 evolution 177772 89.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3031135 3030035 evolution 177660 89.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3031134 3030827 evolution 177536 96.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3031137 3030771 evolution 177336 89.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3031136 3030826 evolution 168556 73.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2661802 2112450 root 145004 0.0 S 08:33:10 spamd child 3031133 3030042 otterfencing 127600 106 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2999724 1353308 cpanellogin 65180 0.0 S 53:08 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 2112450 1 root 61692 0.0 Ss 19:23:53 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2223 1201 root 56636 0.0 Sl 51-11:37:30 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42088 0.0 Rs 28-19:06:01 cpsrvd (SSL) - waiting for connections 3031217 3030777 evolution 36796 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1469 1 root 36044 0.1 Ss 51-11:37:30 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 34548 0.1 Sl 51-11:37:26 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2575382 1 root 33748 0.0 Ss 4-13:56:52 /usr/lib/systemd/systemd-journald 3030035 1276780 nobody 20012 0.0 S 02:16 /usr/sbin/httpd -k start 3030219 1276780 nobody 19676 0.0 S 01:54 /usr/sbin/httpd -k start 3030042 1276780 nobody 19580 0.0 S 02:15 /usr/sbin/httpd -k start 3030828 1276780 nobody 19176 0.0 S 00:40 /usr/sbin/httpd -k start 3030823 1276780 nobody 19164 0.0 S 00:40 /usr/sbin/httpd -k start 3030855 1276780 nobody 19052 0.0 S 00:39 /usr/sbin/httpd -k start 3030787 1276780 nobody 19008 0.0 S 00:41 /usr/sbin/httpd -k start 3030784 1276780 nobody 18968 0.0 S 00:41 /usr/sbin/httpd -k start 3030237 1276780 nobody 18912 0.0 S 01:53 /usr/sbin/httpd -k start 3030860 1276780 nobody 18848 0.0 S 00:39 /usr/sbin/httpd -k start 3028956 1276780 nobody 18844 0.0 S 03:51 /usr/sbin/httpd -k start 3030815 1276780 nobody 18632 0.0 S 00:40 /usr/sbin/httpd -k start 3030208 1276780 nobody 18604 0.0 S 01:54 /usr/sbin/httpd -k start 1463 1 root 18504 0.0 Ss 51-11:37:30 tailwatchd 3030818 1276780 nobody 18412 0.1 S 00:40 /usr/sbin/httpd -k start 3030223 1276780 nobody 18304 0.0 S 01:54 /usr/sbin/httpd -k start 3030777 1276780 nobody 18176 0.0 S 00:42 /usr/sbin/httpd -k start 3030226 1276780 nobody 18044 0.0 S 01:53 /usr/sbin/httpd -k start 3030846 1276780 nobody 17832 0.0 S 00:39 /usr/sbin/httpd -k start 3030817 1276780 nobody 17660 0.0 S 00:40 /usr/sbin/httpd -k start 3030866 1276780 nobody 17632 0.0 S 00:39 /usr/sbin/httpd -k start 3030830 1276780 nobody 17596 0.0 S 00:40 /usr/sbin/httpd -k start 3030820 1276780 nobody 17508 0.0 S 00:40 /usr/sbin/httpd -k start 3030776 1276780 nobody 17396 0.0 S 00:42 /usr/sbin/httpd -k start 3030824 1276780 nobody 17292 0.0 S 00:40 /usr/sbin/httpd -k start 3030848 1276780 nobody 17172 0.0 S 00:39 /usr/sbin/httpd -k start 3030859 1276780 nobody 17024 0.0 S 00:39 /usr/sbin/httpd -k start 3030778 1276780 nobody 17020 0.0 S 00:42 /usr/sbin/httpd -k start 3030229 1276780 nobody 16820 0.0 S 01:53 /usr/sbin/httpd -k start 3030856 1276780 nobody 16600 0.0 S 00:39 /usr/sbin/httpd -k start 3030825 1276780 nobody 16592 0.0 S 00:40 /usr/sbin/httpd -k start 3030840 1276780 nobody 16544 0.0 S 00:39 /usr/sbin/httpd -k start 3030821 1276780 nobody 16528 0.0 S 00:40 /usr/sbin/httpd -k start 3030783 1276780 nobody 16512 0.0 S 00:41 /usr/sbin/httpd -k start 185104 2431 netdata 16432 2.1 Sl 7-01:13:49 /usr/libexec/netdata/plugins.d/apps.plugin 1 3030861 1276780 nobody 16428 0.0 S 00:39 /usr/sbin/httpd -k start 2111676 1 root 16384 0.0 Ss 19:24:23 lfd - sleeping 3030844 1276780 nobody 16332 0.0 S 00:39 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 14483726 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 14483725 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Writing to net | SELECT option_name, option_value FROM QpCIPREUS_options WHERE autoload IN ( 'yes', 'on', 'auto-on', 'auto' ) | +----------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min kamcool/kamcool.com.au-ssl_log 97 alison/wp.alisonarts.com.au 87 alison/wp.alisonarts.com.au-ssl_log 86 evolution/my.evolutionerp.com.au-ssl_log 72 evolution/portal.evolutionerp.com.au-ssl_log 23 madalice/madalice.com.au-ssl_log 17 evolution/evolutionerp.com.au-ssl_log 11 aaa/aaadownunder.com.au-ssl_log 3 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 173 135.225.75.187 97 172.161.79.158 43 180.181.236.49 25 1.158.60.60 23 203.54.180.238 5 202.153.211.134 5 118.127.40.55 4 35.229.51.64 4 2001:8003:3636:8601:b032:3b3:d608:af25 3 216.73.216.252 2 91.92.243.249 2 115.128.106.35 1 66.249.73.167 1 66.249.73.165 1 45.132.227.78 --- top request paths across all vhosts (last 3 min) --- 28 POST /app/ajax.php 23 GET /heartbeat.php 12 POST /functions.php 8 POST /app/ajax/selectFilter.php 7 GET /app/ajax.php 7 GET / 6 POST /wp-login.php 5 POST /quoteditsave.php 4 POST /wp-admin/admin-ajax.php 4 GET /wp.php 4 GET /index.php 3 POST /wp-cron.php 3 POST / 3 GET /xxx.php 3 GET /wp-the.php 3 GET /wp-includes/wp-class.php 3 GET /wp-content/themes/admin.php 3 GET /ops.php 3 GET /new.php 3 GET /gg.php --- busiest 3 vhosts: top paths + last 10 requests --- == kamcool/kamcool.com.au-ssl_log == -- top paths -- 1 GET /wp-the.php 1 GET /wp.php 1 GET /wp-includes/wp-class.php 1 GET /wp-includes/Text/about.php 1 GET /wp-includes/sitemaps/providers/ 1 GET /wp-includes/SimplePie/about.php 1 GET /wp-includes/rest-api/fields/ 1 GET /wp-includes/rest-api/ 1 GET /wp-includes/Requests/library/ 1 GET /wp-includes/pomo/ 1 GET /wp-includes/PHPMailer/ 1 GET /wp-includes/js/index.php -- last 10 requests -- 172.161.79.158 - - [19/Aug/2026:21:45:59 +1000] "GET /adminer.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [19/Aug/2026:21:45:59 +1000] "GET /wp-content/uploads/2024/ HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [19/Aug/2026:21:45:59 +1000] "GET /alfa.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [19/Aug/2026:21:46:00 +1000] "GET /wp-content/uploads/ HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [19/Aug/2026:21:46:00 +1000] "GET /wp-content/themes/alera/alpha.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 172.161.79.158 - - [19/Aug/2026:21:46:00 +1000] "GET /wp-includes/SimplePie/about.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [19/Aug/2026:21:46:01 +1000] "GET /wp-content/plugins/linkpreview/index.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari 172.161.79.158 - - [19/Aug/2026:21:46:01 +1000] "GET /edit.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [19/Aug/2026:21:46:01 +1000] "GET /wp-includes/block-supports/ HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [19/Aug/2026:21:46:01 +1000] "GET /wp-content/ HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == alison/wp.alisonarts.com.au == -- top paths -- 1 GET /yanz.php 1 GET /xxx.php 1 GET //xxx.php 1 GET /x.php 1 GET /xper1.php 1 GET /xex.php 1 GET /xda.php 1 GET /wp-xx.php 1 GET /wp-the.php 1 GET /wp-slss.php 1 GET /wp-sing.php 1 GET /wp.php -- last 10 requests -- 135.225.75.187 - - [19/Aug/2026:21:46:44 +1000] "GET /shell20211028.php HTTP/1.1" 301 294 "-" "-" 135.225.75.187 - - [19/Aug/2026:21:46:45 +1000] "GET /wp-links.php HTTP/1.1" 301 289 "-" "-" 135.225.75.187 - - [19/Aug/2026:21:46:45 +1000] "GET /admin/function.php HTTP/1.1" 301 295 "-" "-" 135.225.75.187 - - [19/Aug/2026:21:46:46 +1000] "GET /wp-admin/images/wp-login.php HTTP/1.1" 301 305 "-" "-" 135.225.75.187 - - [19/Aug/2026:21:46:47 +1000] "GET /wp-content/themes/twenty/twenty.php HTTP/1.1" 301 312 "-" "-" 135.225.75.187 - - [19/Aug/2026:21:46:48 +1000] "GET /wp-content/plugins/seoplugins/mar.php HTTP/1.1" 301 314 "-" "-" 135.225.75.187 - - [19/Aug/2026:21:46:48 +1000] "GET /wp-content/uploads/2024/index.php HTTP/1.1" 301 310 "-" "-" 135.225.75.187 - - [19/Aug/2026:21:46:49 +1000] "GET /wp-content/config.php HTTP/1.1" 301 298 "-" "-" 135.225.75.187 - - [19/Aug/2026:21:46:49 +1000] "GET /wp-admin/js/wp-conflg.php HTTP/1.1" 301 302 "-" "-" 135.225.75.187 - - [19/Aug/2026:21:46:50 +1000] "GET /wp-content/themes/aahana/json.php HTTP/1.1" 301 310 "-" "-" == alison/wp.alisonarts.com.au-ssl_log == -- top paths -- 2 GET /xxx.php 2 GET /wp.php 2 GET /ops.php 1 GET /yanz.php 1 GET /x.php 1 GET /xper1.php 1 GET /xex.php 1 GET /xda.php 1 GET /wp-xx.php 1 GET /wp-the.php 1 GET /wp-slss.php 1 GET /wp-sing.php -- last 10 requests -- 135.225.75.187 - - [19/Aug/2026:21:46:44 +1000] "GET /config.php HTTP/1.1" 404 - "-" "-" 135.225.75.187 - - [19/Aug/2026:21:46:45 +1000] "GET /shell20211028.php HTTP/1.1" 404 - "-" "-" 135.225.75.187 - - [19/Aug/2026:21:46:45 +1000] "GET /wp-links.php HTTP/1.1" 404 - "-" "-" 135.225.75.187 - - [19/Aug/2026:21:46:46 +1000] "GET /admin/function.php HTTP/1.1" 404 - "-" "-" 135.225.75.187 - - [19/Aug/2026:21:46:46 +1000] "GET /wp-admin/images/wp-login.php HTTP/1.1" 404 - "-" "-" 135.225.75.187 - - [19/Aug/2026:21:46:47 +1000] "GET /wp-content/themes/twenty/twenty.php HTTP/1.1" 404 - "-" "-" 135.225.75.187 - - [19/Aug/2026:21:46:48 +1000] "GET /wp-content/plugins/seoplugins/mar.php HTTP/1.1" 404 - "-" "-" 135.225.75.187 - - [19/Aug/2026:21:46:49 +1000] "GET /wp-content/uploads/2024/index.php HTTP/1.1" 403 12 "-" "-" 135.225.75.187 - - [19/Aug/2026:21:46:49 +1000] "GET /wp-content/config.php HTTP/1.1" 404 - "-" "-" 135.225.75.187 - - [19/Aug/2026:21:46:50 +1000] "GET /wp-admin/js/wp-conflg.php HTTP/1.1" 403 13 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-19 21:44:57 L1=0.70 run=1 blk=0 avail=6409 (54.6%) swpO=0 conn=1 myRSS=2839 php=0 phpRSS=0 ap=18 tcp=22 topuser=- 2026-08-19 21:45:05 L1=0.73 run=1 blk=0 avail=6360 (54.2%) swpO=0 conn=1 myRSS=2839 php=1 phpRSS=68 ap=18 tcp=19 topuser=evolution 2026-08-19 21:45:07 L1=0.67 run=1 blk=0 avail=6360 (54.2%) swpO=0 conn=1 myRSS=2839 php=1 phpRSS=68 ap=18 tcp=20 topuser=evolution 2026-08-19 21:45:15 L1=0.70 run=2 blk=0 avail=6317 (53.9%) swpO=0 conn=1 myRSS=2839 php=1 phpRSS=69 ap=25 tcp=24 topuser=evolution 2026-08-19 21:45:17 L1=0.72 run=1 blk=0 avail=6329 (54.0%) swpO=0 conn=1 myRSS=2839 php=1 phpRSS=69 ap=23 tcp=23 topuser=evolution 2026-08-19 21:45:25 L1=0.74 run=2 blk=0 avail=6390 (54.5%) swpO=0 conn=1 myRSS=2839 php=0 phpRSS=0 ap=22 tcp=16 topuser=- 2026-08-19 21:45:27 L1=0.84 run=1 blk=0 avail=6412 (54.7%) swpO=2 conn=1 myRSS=2839 php=0 phpRSS=0 ap=21 tcp=16 topuser=- 2026-08-19 21:45:35 L1=0.78 run=1 blk=0 avail=5575 (47.5%) swpO=2 conn=3 myRSS=2839 php=2 phpRSS=484 ap=82 tcp=74 topuser=madalice 2026-08-19 21:45:37 L1=0.71 run=1 blk=0 avail=6002 (51.2%) swpO=0 conn=1 myRSS=2839 php=0 phpRSS=0 ap=80 tcp=44 topuser=- 2026-08-19 21:45:45 L1=0.66 run=2 blk=0 avail=6014 (51.3%) swpO=0 conn=3 myRSS=2839 php=1 phpRSS=66 ap=72 tcp=23 topuser=evolution 2026-08-19 21:45:47 L1=0.68 run=1 blk=0 avail=6062 (51.7%) swpO=0 conn=1 myRSS=2839 php=0 phpRSS=0 ap=70 tcp=36 topuser=- 2026-08-19 21:45:55 L1=0.79 run=1 blk=0 avail=6092 (51.9%) swpO=0 conn=3 myRSS=2839 php=0 phpRSS=0 ap=65 tcp=24 topuser=- 2026-08-19 21:45:57 L1=0.73 run=1 blk=0 avail=6103 (52.0%) swpO=0 conn=1 myRSS=2839 php=0 phpRSS=0 ap=63 tcp=22 topuser=- 2026-08-19 21:46:05 L1=0.67 run=1 blk=0 avail=6161 (52.5%) swpO=0 conn=3 myRSS=2839 php=0 phpRSS=0 ap=55 tcp=19 topuser=- 2026-08-19 21:46:07 L1=0.61 run=1 blk=0 avail=6173 (52.6%) swpO=0 conn=1 myRSS=2839 php=0 phpRSS=0 ap=53 tcp=18 topuser=- 2026-08-19 21:46:15 L1=0.73 run=1 blk=0 avail=6226 (53.1%) swpO=0 conn=3 myRSS=2839 php=0 phpRSS=0 ap=45 tcp=23 topuser=- 2026-08-19 21:46:17 L1=0.67 run=2 blk=0 avail=6234 (53.1%) swpO=0 conn=1 myRSS=2839 php=1 phpRSS=42 ap=43 tcp=24 topuser=evolution 2026-08-19 21:46:26 L1=0.61 run=1 blk=0 avail=6290 (53.6%) swpO=0 conn=3 myRSS=2839 php=0 phpRSS=0 ap=35 tcp=24 topuser=- 2026-08-19 21:46:27 L1=0.56 run=1 blk=0 avail=6303 (53.7%) swpO=0 conn=1 myRSS=2839 php=0 phpRSS=0 ap=33 tcp=25 topuser=- 2026-08-19 21:46:36 L1=0.60 run=3 blk=0 avail=6102 (52.0%) swpO=0 conn=3 myRSS=2839 php=2 phpRSS=302 ap=28 tcp=26 topuser=madalice 2026-08-19 21:46:37 L1=0.71 run=2 blk=0 avail=6132 (52.3%) swpO=0 conn=1 myRSS=2839 php=2 phpRSS=291 ap=26 tcp=30 topuser=corpkicks 2026-08-19 21:46:46 L1=0.82 run=1 blk=0 avail=6039 (51.5%) swpO=2 conn=3 myRSS=2839 php=1 phpRSS=258 ap=39 tcp=55 topuser=madalice 2026-08-19 21:46:47 L1=0.75 run=2 blk=0 avail=5815 (49.6%) swpO=2 conn=1 myRSS=2839 php=1 phpRSS=178 ap=87 tcp=66 topuser=corpkicks 2026-08-19 21:46:56 L1=0.69 run=3 blk=0 avail=5762 (49.1%) swpO=0 conn=3 myRSS=2839 php=2 phpRSS=299 ap=80 tcp=46 topuser=madalice 2026-08-19 21:46:57 L1=0.79 run=3 blk=0 avail=5976 (51.0%) swpO=0 conn=2 myRSS=2839 php=1 phpRSS=65 ap=78 tcp=57 topuser=corpkicks 2026-08-19 21:47:06 L1=1.05 run=4 blk=0 avail=5929 (50.6%) swpO=0 conn=3 myRSS=2839 php=2 phpRSS=192 ap=70 tcp=29 topuser=madalice 2026-08-19 21:47:07 L1=1.05 run=2 blk=0 avail=6027 (51.4%) swpO=0 conn=2 myRSS=2839 php=1 phpRSS=77 ap=68 tcp=24 topuser=corpkicks 2026-08-19 21:47:16 L1=0.89 run=1 blk=0 avail=6125 (52.2%) swpO=0 conn=3 myRSS=2839 php=0 phpRSS=0 ap=60 tcp=18 topuser=- 2026-08-19 21:47:17 L1=0.89 run=2 blk=0 avail=6094 (52.0%) swpO=0 conn=2 myRSS=2839 php=1 phpRSS=79 ap=58 tcp=23 topuser=corpkicks 2026-08-19 21:47:26 L1=1.63 run=12 blk=0 avail=4753 (40.5%) swpO=6 conn=12 myRSS=2842 php=13 phpRSS=1875 ap=49 tcp=43 topuser=evolution