INCIDENT 2026-08-20 21:11:21 trigger: php_rss=2149MB ================================================================== load: 1.00 0.84 0.90 19/674 128280 ncpu:10 mem_avail: 4703MB/11729MB (40.1%) swap_used:2871MB swapout:0/s blocked(D):0 running:14 iowait:0.1% steal:0.0% php: 12 procs / 2149MB heaviest user: madalice (12 procs, 2149MB) apache: 56 procs tcp_estab: 58 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2802 madalice 12 2083 nobody 55 1173 root 245 807 netdata 8 262 mailman 20 97 cpanellogin 1 69 evolution 8 31 dovenull 6 26 wp-toolkit 6 17 zabbix 1 15 named 1 12 kurri 1 10 dovecot 3 7 nscd 1 6 mailnull 1 5 cpanelconnecttrack 1 3 dbus 1 2 polkitd 1 1 rpc 1 0 --- php workers by user --- USER PROCS RSS_MB madalice 11 2081 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5208 MB Active(file): 2911 MB Inactive(file): 1251 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 483 MB CommitLimit: 9960 MB Committed_AS: 9299 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 120758 root 11:20 1304 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3248642 root 20:00:05 2652 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2870176 11.7 Ssl 5-13:20:45 /usr/sbin/mariadbd 128224 127670 madalice 268020 74.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 128240 127667 madalice 260952 79.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 128222 127648 madalice 230264 67.0 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 128242 128225 madalice 221420 65.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 128247 128227 madalice 219240 65.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 211052 2.5 Ssl 52-11:01:27 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 128249 128232 madalice 195684 60.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 128243 128237 madalice 185600 59.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 128250 128231 madalice 183884 56.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3298115 3290507 root 181136 0.0 S 18:35:46 spamd child 128248 128229 madalice 168968 49.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 128246 128226 madalice 157800 49.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 128244 128241 madalice 154208 43.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3864059 3290507 root 134784 0.0 S 08:11:46 spamd child 2575382 1 root 114272 0.0 Ss 5-13:20:48 /usr/lib/systemd/systemd-journald 4182872 1353308 cpanellogin 70888 0.0 S 03:08:40 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 3290507 1 root 48548 0.0 Ss 18:48:35 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2223 1201 root 42148 0.0 Sl 52-11:01:26 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 40852 0.1 Ss 52-11:01:26 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 38120 0.0 Ss 29-18:29:57 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 33476 0.1 Sl 52-11:01:22 /usr/libexec/netdata/plugins.d/go.d.plugin 1 127632 1276780 nobody 26580 0.0 S 01:08 /usr/sbin/httpd -k start 127649 1276780 nobody 26432 0.1 S 01:06 /usr/sbin/httpd -k start 122952 1276780 nobody 25600 0.0 S 07:11 /usr/sbin/httpd -k start 126553 1276780 nobody 25540 0.0 S 02:52 /usr/sbin/httpd -k start 126628 1276780 nobody 25484 0.0 S 02:49 /usr/sbin/httpd -k start 124938 1276780 nobody 25280 0.0 S 04:42 /usr/sbin/httpd -k start 127648 1276780 nobody 25172 0.0 S 01:06 /usr/sbin/httpd -k start 127671 1276780 nobody 24472 0.0 S 01:05 /usr/sbin/httpd -k start 127639 1276780 nobody 24408 0.0 S 01:07 /usr/sbin/httpd -k start 127670 1276780 nobody 24356 0.0 S 01:05 /usr/sbin/httpd -k start 127661 1276780 nobody 24104 0.0 S 01:06 /usr/sbin/httpd -k start 127659 1276780 nobody 24008 0.0 S 01:06 /usr/sbin/httpd -k start 127689 1276780 nobody 23764 0.1 S 01:05 /usr/sbin/httpd -k start 127697 1276780 nobody 23496 0.0 S 01:05 /usr/sbin/httpd -k start 127635 1276780 nobody 23316 0.0 S 01:07 /usr/sbin/httpd -k start 127695 1276780 nobody 23264 0.0 S 01:05 /usr/sbin/httpd -k start 128216 1276780 nobody 23128 0.0 S 00:04 /usr/sbin/httpd -k start 128236 1276780 nobody 23120 0.0 S 00:03 /usr/sbin/httpd -k start 127281 1276780 nobody 23024 0.0 S 01:31 /usr/sbin/httpd -k start 128212 1276780 nobody 22956 0.0 S 00:04 /usr/sbin/httpd -k start 127688 1276780 nobody 22880 0.0 S 01:05 /usr/sbin/httpd -k start 127682 1276780 nobody 22816 0.0 S 01:05 /usr/sbin/httpd -k start 127672 1276780 nobody 22436 0.0 S 01:05 /usr/sbin/httpd -k start 127667 1276780 nobody 21700 0.0 S 01:05 /usr/sbin/httpd -k start 128200 1276780 nobody 21484 0.0 S 00:07 /usr/sbin/httpd -k start 128239 1276780 nobody 21428 0.0 S 00:03 /usr/sbin/httpd -k start 128235 1276780 nobody 21420 0.0 S 00:03 /usr/sbin/httpd -k start 128203 1276780 nobody 21372 0.0 S 00:06 /usr/sbin/httpd -k start 128214 1276780 nobody 21364 0.0 S 00:04 /usr/sbin/httpd -k start 128238 1276780 nobody 21360 0.0 S 00:03 /usr/sbin/httpd -k start 128226 1276780 nobody 21348 0.0 S 00:03 /usr/sbin/httpd -k start 128213 1276780 nobody 21316 0.0 S 00:04 /usr/sbin/httpd -k start 128227 1276780 nobody 21308 0.0 S 00:03 /usr/sbin/httpd -k start 128237 1276780 nobody 21304 0.0 S 00:03 /usr/sbin/httpd -k start 128232 1276780 nobody 21288 0.0 S 00:03 /usr/sbin/httpd -k start 128225 1276780 nobody 21284 0.0 S 00:03 /usr/sbin/httpd -k start 128208 1276780 nobody 21276 0.0 S 00:05 /usr/sbin/httpd -k start 128229 1276780 nobody 21244 0.0 S 00:03 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 19388269 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min cosgrovecreative/cosgrovecreative.com.au-ssl_log 100 candyfabcom/candyfab.com.au-ssl_log 87 madalice/madalice.com.au-ssl_log 26 corpkicks/corporatekicks.com.au-ssl_log 10 evolution/portal.evolutionerp.com.au-ssl_log 10 evolution/my.evolutionerp.com.au-ssl_log 9 tubesupplies/tubesupplies.com.au-ssl_log 6 aaa/aaadownunder.com.au-ssl_log 4 tubesupplies/tubesupplies.com.au 3 olympic/olympicfencing.com.au-ssl_log 2 evolution/portal.evolutionerp.com.au 1 evolution/release.evolutionerp.com.au-ssl_log 1 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 101 20.80.111.3 87 4.204.200.143 10 95.85.238.60 10 203.54.180.238 7 115.70.50.7 5 85.204.70.88 5 121.200.5.170 5 118.211.77.91 4 2401:d006:d702:b201:9908:bce6:1fd6:846f 4 118.127.40.55 3 40.77.167.71 3 34.139.107.241 3 110.141.224.51 2 91.92.243.249 2 91.215.85.88 --- top request paths across all vhosts (last 3 min) --- 87 GET /autodiscover/autodiscover.xml 14 GET / 10 GET /heartbeat.php 5 GET /wp-content/plugins/wp_xthhhqh/wp_xthhhqh.php 5 GET /store/highlife-custom-af1-shoes-copy/ 5 GET /index.php 4 POST /wp-cron.php 3 POST /wp-login.php 3 POST /inveditsave.php 3 POST / 2 POST /xmlrpc.php 2 POST /functions.php 2 GET /wp-login.php 2 GET /include/ 2 GET /Assets/ 1 POST /wp-admin/admin-ajax.php 1 POST /product/cloudflare-custom-nike-sneakers-design-1/ 1 POST /cloudflare/ 1 HEAD / 1 GET /zup.php73 --- busiest 3 vhosts: top paths + last 10 requests --- == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 1 GET /zup.php73 1 GET /x.php 1 GET /xleet.php 1 GET /ww5.php 1 GET /wso.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-includes/Requests/library/index.php 1 GET /wp-includes/fonts/index.php -- last 10 requests -- 20.80.111.3 - - [20/Aug/2026:21:11:03 +1000] "GET /wp-blink.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.80.111.3 - - [20/Aug/2026:21:11:04 +1000] "GET /randkeyword.PhP7 HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.80.111.3 - - [20/Aug/2026:21:11:04 +1000] "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.80.111.3 - - [20/Aug/2026:21:11:04 +1000] "GET /wp-content/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.80.111.3 - - [20/Aug/2026:21:11:04 +1000] "GET /ww5.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.80.111.3 - - [20/Aug/2026:21:11:05 +1000] "GET /2.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.80.111.3 - - [20/Aug/2026:21:11:05 +1000] "GET /wp-admin/classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.80.111.3 - - [20/Aug/2026:21:11:05 +1000] "GET /atomlib.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.80.111.3 - - [20/Aug/2026:21:11:05 +1000] "GET /rip.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.80.111.3 - - [20/Aug/2026:21:11:05 +1000] "GET /p.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 87 GET /autodiscover/autodiscover.xml -- last 10 requests -- 4.204.200.143 - - [20/Aug/2026:21:10:10 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 4.204.200.143 - - [20/Aug/2026:21:10:17 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 4.204.200.143 - - [20/Aug/2026:21:10:17 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 4.204.200.143 - - [20/Aug/2026:21:10:18 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 4.204.200.143 - - [20/Aug/2026:21:10:19 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 4.204.200.143 - - [20/Aug/2026:21:10:20 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 4.204.200.143 - - [20/Aug/2026:21:10:21 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 4.204.200.143 - - [20/Aug/2026:21:10:22 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 4.204.200.143 - - [20/Aug/2026:21:10:23 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 4.204.200.143 - - [20/Aug/2026:21:10:24 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" == madalice/madalice.com.au-ssl_log == -- top paths -- 12 GET / 5 GET /wp-content/plugins/wp_xthhhqh/wp_xthhhqh.php 5 GET /store/highlife-custom-af1-shoes-copy/ 3 POST / 1 POST /wp-admin/admin-ajax.php 1 GET /wp-json 1 GET /plugins/editors/jce/jce.xml 1 GET /.aws/credentials 1 GET /.aws/config 1 GET /administrator/components/com_jce/ -- last 10 requests -- 114.119.130.40 - - [20/Aug/2026:21:11:05 +1000] "GET /store/highlife-custom-af1-shoes-copy/?amp%3Bwcpr_verified=1&wcpr_rating=4&verified=1&rating=4 HTTP/1.1" 200 47827 "https://madalice.com.au/store/highlife-custom-af1-s 118.211.77.91 - - [20/Aug/2026:21:11:09 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 578 "https://madalice.com.au/product-category/customised-shoes/mens/" "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_0 like M 2401:d006:d702:b201:9908:bce6:1fd6:846f - - [20/Aug/2026:21:11:11 +1000] "GET / HTTP/1.1" 200 36384 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Mobile 2401:d006:d702:b201:9908:bce6:1fd6:846f - - [20/Aug/2026:21:11:11 +1000] "GET / HTTP/1.1" 200 36387 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Mobile 118.211.77.91 - - [20/Aug/2026:21:11:13 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/store/cartoon-drippy-green-nike-court-copy/" "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6 34.139.107.241 - - [20/Aug/2026:21:11:19 +1000] "GET /.aws/config HTTP/1.1" 403 13 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 34.139.107.241 - - [20/Aug/2026:21:11:19 +1000] "GET /.aws/credentials HTTP/1.1" 403 13 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" 2401:d006:d702:b201:9908:bce6:1fd6:846f - - [20/Aug/2026:21:11:17 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) A 2401:d006:d702:b201:9908:bce6:1fd6:846f - - [20/Aug/2026:21:11:17 +1000] "GET /?commercekit-ajax=commercekit_get_nonce HTTP/1.1" 200 37 "https://madalice.com.au/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) A 34.139.107.241 - - [20/Aug/2026:21:11:19 +1000] "GET /wp-json HTTP/1.1" 200 50289 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)" --- last 30 samples (run-up to this incident) --- 2026-08-20 21:09:00 L1=0.59 run=3 blk=0 avail=6640 (56.6%) swpO=0 conn=2 myRSS=2802 php=0 phpRSS=0 ap=27 tcp=24 topuser=- 2026-08-20 21:09:00 L1=0.59 run=1 blk=0 avail=6663 (56.8%) swpO=0 conn=1 myRSS=2802 php=0 phpRSS=0 ap=26 tcp=20 topuser=- 2026-08-20 21:09:10 L1=0.80 run=3 blk=0 avail=6522 (55.6%) swpO=0 conn=2 myRSS=2802 php=1 phpRSS=186 ap=20 tcp=24 topuser=madalice 2026-08-20 21:09:10 L1=0.80 run=2 blk=0 avail=6493 (55.4%) swpO=0 conn=1 myRSS=2802 php=1 phpRSS=230 ap=20 tcp=24 topuser=madalice 2026-08-20 21:09:20 L1=0.68 run=2 blk=0 avail=6670 (56.9%) swpO=0 conn=2 myRSS=2802 php=1 phpRSS=66 ap=18 tcp=20 topuser=tubesupplies 2026-08-20 21:09:20 L1=0.68 run=2 blk=0 avail=6636 (56.6%) swpO=0 conn=1 myRSS=2802 php=1 phpRSS=98 ap=18 tcp=20 topuser=tubesupplies 2026-08-20 21:09:30 L1=0.57 run=1 blk=0 avail=6707 (57.2%) swpO=0 conn=1 myRSS=2802 php=0 phpRSS=0 ap=18 tcp=21 topuser=- 2026-08-20 21:09:30 L1=0.57 run=1 blk=0 avail=6707 (57.2%) swpO=0 conn=1 myRSS=2802 php=0 phpRSS=0 ap=18 tcp=19 topuser=- 2026-08-20 21:09:40 L1=0.64 run=1 blk=0 avail=6720 (57.3%) swpO=0 conn=1 myRSS=2802 php=0 phpRSS=0 ap=17 tcp=24 topuser=- 2026-08-20 21:09:40 L1=0.64 run=2 blk=0 avail=6716 (57.3%) swpO=0 conn=1 myRSS=2802 php=0 phpRSS=0 ap=17 tcp=25 topuser=- 2026-08-20 21:09:50 L1=0.54 run=2 blk=0 avail=6667 (56.8%) swpO=0 conn=1 myRSS=2802 php=0 phpRSS=0 ap=25 tcp=25 topuser=- 2026-08-20 21:09:50 L1=0.54 run=1 blk=0 avail=6663 (56.8%) swpO=0 conn=1 myRSS=2802 php=0 phpRSS=0 ap=25 tcp=24 topuser=- 2026-08-20 21:10:00 L1=0.46 run=5 blk=0 avail=6466 (55.1%) swpO=0 conn=1 myRSS=2802 php=2 phpRSS=291 ap=19 tcp=20 topuser=corpkicks 2026-08-20 21:10:01 L1=0.46 run=3 blk=0 avail=6596 (56.2%) swpO=0 conn=1 myRSS=2802 php=1 phpRSS=130 ap=19 tcp=20 topuser=corpkicks 2026-08-20 21:10:10 L1=0.63 run=2 blk=0 avail=6489 (55.3%) swpO=0 conn=1 myRSS=2802 php=1 phpRSS=242 ap=18 tcp=23 topuser=madalice 2026-08-20 21:10:11 L1=0.63 run=1 blk=0 avail=6697 (57.1%) swpO=0 conn=1 myRSS=2802 php=0 phpRSS=0 ap=18 tcp=58 topuser=- 2026-08-20 21:10:20 L1=0.69 run=2 blk=0 avail=6222 (53.1%) swpO=0 conn=1 myRSS=2802 php=1 phpRSS=104 ap=78 tcp=83 topuser=madalice 2026-08-20 21:10:21 L1=0.69 run=2 blk=0 avail=6186 (52.7%) swpO=0 conn=1 myRSS=2802 php=1 phpRSS=138 ap=78 tcp=69 topuser=madalice 2026-08-20 21:10:30 L1=0.59 run=1 blk=0 avail=6363 (54.2%) swpO=0 conn=1 myRSS=2802 php=0 phpRSS=0 ap=69 tcp=23 topuser=- 2026-08-20 21:10:31 L1=0.59 run=1 blk=0 avail=6364 (54.3%) swpO=0 conn=1 myRSS=2802 php=0 phpRSS=0 ap=69 tcp=23 topuser=- 2026-08-20 21:10:40 L1=0.74 run=2 blk=0 avail=6332 (54.0%) swpO=0 conn=1 myRSS=2802 php=1 phpRSS=132 ap=59 tcp=23 topuser=corpkicks 2026-08-20 21:10:41 L1=0.74 run=3 blk=0 avail=6268 (53.4%) swpO=0 conn=1 myRSS=2802 php=1 phpRSS=197 ap=59 tcp=24 topuser=corpkicks 2026-08-20 21:10:50 L1=1.06 run=1 blk=0 avail=6486 (55.3%) swpO=0 conn=1 myRSS=2802 php=0 phpRSS=0 ap=49 tcp=18 topuser=- 2026-08-20 21:10:51 L1=1.06 run=1 blk=0 avail=6486 (55.3%) swpO=0 conn=1 myRSS=2802 php=0 phpRSS=0 ap=49 tcp=18 topuser=- 2026-08-20 21:11:00 L1=0.90 run=1 blk=0 avail=6563 (56.0%) swpO=0 conn=1 myRSS=2802 php=0 phpRSS=0 ap=39 tcp=16 topuser=- 2026-08-20 21:11:01 L1=0.90 run=1 blk=0 avail=6565 (56.0%) swpO=0 conn=1 myRSS=2802 php=0 phpRSS=0 ap=39 tcp=16 topuser=- 2026-08-20 21:11:10 L1=1.00 run=2 blk=0 avail=6475 (55.2%) swpO=0 conn=1 myRSS=2802 php=1 phpRSS=190 ap=29 tcp=19 topuser=madalice 2026-08-20 21:11:11 L1=1.00 run=2 blk=0 avail=6428 (54.8%) swpO=0 conn=1 myRSS=2802 php=1 phpRSS=240 ap=29 tcp=19 topuser=madalice 2026-08-20 21:11:21 L1=1.00 run=14 blk=0 avail=4703 (40.1%) swpO=0 conn=13 myRSS=2802 php=12 phpRSS=2149 ap=56 tcp=58 topuser=madalice 2026-08-20 21:11:21 L1=1.00 run=21 blk=0 avail=4593 (39.2%) swpO=0 conn=10 myRSS=2802 php=11 phpRSS=2213 ap=56 tcp=58 topuser=madalice