INCIDENT 2026-08-25 05:37:52 trigger: php_rss=2266MB mysql_conn=18 ================================================================== load: 3.47 1.82 1.55 23/634 2779149 ncpu:10 mem_avail: 6668MB/11729MB (56.8%) swap_used:1151MB swapout:0/s blocked(D):0 running:23 iowait:0.0% steal:0.0% php: 17 procs / 2266MB heaviest user: madalice (15 procs, 2044MB) apache: 56 procs tcp_estab: 89 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 15 2268 mysql 1 943 nobody 55 823 root 242 761 netdata 8 281 alison 1 154 olympic 1 75 cpanellogin 1 69 dovenull 6 44 mailman 20 24 wp-toolkit 6 21 kurri 2 21 dovecot 3 18 zabbix 1 16 vinesit 1 14 lowrange 1 9 infinium 1 8 nscd 1 4 named 1 4 polkitd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 15 2297 alison 1 156 olympic 1 76 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6632 MB Active(file): 3636 MB Inactive(file): 1908 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 452 MB CommitLimit: 9960 MB Committed_AS: 10206 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1913717 root 04:26:35 776 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 966488 3.3 Ssl 02:06:36 /usr/sbin/mariadbd 2779050 2779042 madalice 270960 61.0 S 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2779035 2778685 madalice 247692 44.2 S 00:05 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 221316 2.5 Ssl 56-19:28:02 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2779069 2779039 madalice 206916 62.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2779079 2779054 madalice 202952 64.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2779071 2779040 madalice 199884 59.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2779070 2779041 madalice 169868 47.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2779072 2779059 madalice 168196 47.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2160755 2145741 root 162860 0.0 S 03:12:29 spamd child 2779075 2779055 madalice 159796 50.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2779077 2779057 madalice 153940 42.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2779073 2779060 madalice 153628 44.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2779078 2779058 madalice 147044 39.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 128824 0.0 Ss 9-21:47:23 /usr/lib/systemd/systemd-journald 2779076 2779056 madalice 126548 37.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2779074 2779061 madalice 125316 33.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2779110 2779026 madalice 107336 41.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2145741 1 root 94580 0.0 Ss 03:14:51 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2779111 2779025 olympic 88884 24.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2779114 2779001 madalice 84160 23.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2362139 1353308 cpanellogin 71192 0.0 S 02:06:46 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 2160756 2145741 root 49764 0.0 S 03:12:29 spamd child 4922 2431 netdata 45980 0.1 Sl 56-19:27:57 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2779166 2742729 corpkicks 41152 4.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1353308 1 root 40644 0.0 Ss 34-02:56:32 cpsrvd (SSL) - waiting for connections 2223 1201 root 37948 0.0 Sl 56-19:28:01 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 2779135 1469 root 28372 1.0 R 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2743292 1276780 nobody 25888 0.0 S 11:06 /usr/sbin/httpd -k start 2761251 1276780 nobody 25740 0.0 S 04:43 /usr/sbin/httpd -k start 2779159 1469 root 25348 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2727094 1276780 nobody 24416 0.0 S 15:35 /usr/sbin/httpd -k start 2742729 1276780 nobody 24108 0.0 S 11:51 /usr/sbin/httpd -k start 2744686 1276780 nobody 23272 0.0 S 09:31 /usr/sbin/httpd -k start 2761322 1276780 nobody 22612 0.1 S 04:38 /usr/sbin/httpd -k start 2761246 1276780 nobody 22512 0.0 S 04:44 /usr/sbin/httpd -k start 2761279 1276780 nobody 21928 0.0 S 04:41 /usr/sbin/httpd -k start 2778494 1276780 nobody 21824 0.0 S 00:46 /usr/sbin/httpd -k start 2760665 1276780 nobody 21752 0.0 S 05:51 /usr/sbin/httpd -k start 2777607 1276780 nobody 21220 0.0 S 01:44 /usr/sbin/httpd -k start 2761970 1276780 nobody 20820 0.0 S 03:50 /usr/sbin/httpd -k start 2777588 1276780 nobody 20692 0.0 S 01:45 /usr/sbin/httpd -k start 2777604 1276780 nobody 20532 0.0 S 01:44 /usr/sbin/httpd -k start 2778685 1276780 nobody 20316 0.1 S 00:30 /usr/sbin/httpd -k start 2779187 1469 root 20308 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2779026 1276780 nobody 19284 0.3 S 00:06 /usr/sbin/httpd -k start 2777605 1276780 nobody 19276 0.0 S 01:44 /usr/sbin/httpd -k start 2779001 1276780 nobody 18896 0.2 S 00:07 /usr/sbin/httpd -k start 185104 2431 netdata 18832 2.1 Sl 12-09:04:20 /usr/libexec/netdata/plugins.d/apps.plugin 1 2778503 1276780 nobody 18828 0.0 S 00:45 /usr/sbin/httpd -k start 2762326 1276780 nobody 18776 0.0 S 03:31 /usr/sbin/httpd -k start 2778504 1276780 nobody 18008 0.0 S 00:45 /usr/sbin/httpd -k start 2761283 1276780 nobody 17944 0.0 S 04:40 /usr/sbin/httpd -k start 2777606 1276780 nobody 17552 0.0 S 01:44 /usr/sbin/httpd -k start 1204 1 zabbix 17052 0.2 Ssl 56-19:28:02 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2778753 1276780 nobody 16956 0.0 S 00:23 /usr/sbin/httpd -k start 2676242 1471 root 16832 0.0 S 32:35 cPhulkd - dbprocessor 2779058 1276780 nobody 16392 0.0 S 00:04 /usr/sbin/httpd -k start 2779059 1276780 nobody 16392 0.2 S 00:04 /usr/sbin/httpd -k start 2779039 1276780 nobody 16332 0.0 S 00:05 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 31294 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min otter2/otterfencing.net.au-ssl_log 208 nrg/nrgservices.net.au-ssl_log 99 olympic/olympicfencing.com.au-ssl_log 93 customc/customcentral.com.au-ssl_log 86 corpkicks/corporatekicks.com.au-ssl_log 44 alison/alisonarts.com.au-ssl_log 32 speedlin/speedlinefencing.com.au-ssl_log 27 whiz/whizengineering.com.au-ssl_log 24 madalice/madalice.com.au-ssl_log 20 vinesit/vinesit.com.au-ssl_log 20 bigdeals/bigdeals.com.au-ssl_log 17 evolution/portal.evolutionerp.com.au-ssl_log 8 evolution/my.evolutionerp.com.au-ssl_log 3 (total vhosts taking traffic: 13) --- top client IPs across all vhosts (last 3 min) --- 208 68.155.159.216 185 52.139.37.240 86 20.104.50.220 38 20.48.147.90 27 4.204.200.136 27 20.48.160.90 24 20.104.86.241 20 117.132.188.205 13 20.220.10.235 8 203.54.180.238 7 143.198.212.166 6 118.127.40.55 4 172.212.194.58 4 114.119.131.88 2 35.243.228.85 --- top request paths across all vhosts (last 3 min) --- 8 GET /heartbeat.php 5 GET /wp-content/plugins/hellopress/wp_filemanager.php 5 GET /this_is_a_new_hello_world.php 5 GET / 4 GET /x.php 4 GET /k.php 4 GET /index.php 4 GET /goods.php 4 GET /gecko-new.php 4 GET /admin.php 4 GET /adminfuns.php 4 GET /about.php 4 GET /aa.php 4 GET /222.php 4 GET /1.php 3 POST /wp-cron.php 3 POST / 3 GET /xmlrpc.php 3 GET /xleet.php 3 GET /wp.php --- busiest 3 vhosts: top paths + last 10 requests --- == otter2/otterfencing.net.au-ssl_log == -- top paths -- 1 GET /xxx.php 1 GET /xx.php 1 GET /xpw.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /wp-signup.php 1 GET /wp-seo.php 1 GET /wp-load.php 1 GET /wp-links.php 1 GET /wp-includes/Text/autoload_classmap.php 1 GET /wp-includes/SimplePie/index.php 1 GET /wp-includes/SimplePie/admin.php -- last 10 requests -- 68.155.159.216 - - [25/Aug/2026:05:37:19 +1000] "GET /filebrowser.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [25/Aug/2026:05:37:20 +1000] "GET /wp-content/plugins/index.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [25/Aug/2026:05:37:20 +1000] "GET /makeasmtp.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [25/Aug/2026:05:37:22 +1000] "GET /admin/function.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [25/Aug/2026:05:37:23 +1000] "GET /wp-includes/Requests/chosen.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [25/Aug/2026:05:37:23 +1000] "GET /wp-content/themes/about.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [25/Aug/2026:05:37:24 +1000] "GET /wp-includes/pomo/about.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [25/Aug/2026:05:37:25 +1000] "GET /.well-known/cong.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [25/Aug/2026:05:37:25 +1000] "GET /wp-includes/SimplePie/index.php HTTP/1.1" 401 36 "-" "-" 68.155.159.216 - - [25/Aug/2026:05:37:26 +1000] "GET /wp-content/languages/about.php HTTP/1.1" 401 36 "-" "-" == nrg/nrgservices.net.au-ssl_log == -- top paths -- 1 GET /zup.php73 1 GET /x.php 1 GET /xleet.php 1 GET /ww5.php 1 GET /wso.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-includes/Requests/library/index.php 1 GET /wp-includes/fonts/index.php -- last 10 requests -- 52.139.37.240 - - [25/Aug/2026:05:36:14 +1000] "GET /wp-blink.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:05:36:14 +1000] "GET /randkeyword.PhP7 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:05:36:14 +1000] "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:05:36:15 +1000] "GET /wp-content/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:05:36:15 +1000] "GET /ww5.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:05:36:15 +1000] "GET /2.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:05:36:15 +1000] "GET /wp-admin/classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:05:36:16 +1000] "GET /atomlib.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:05:36:16 +1000] "GET /rip.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:05:36:16 +1000] "GET /p.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == olympic/olympicfencing.com.au-ssl_log == -- top paths -- 2 POST /wp-cron.php 2 GET /robots.txt 2 GET / 1 GET /x.php 1 GET /xleet.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-includes/Requests/library/index.php 1 GET /wp-includes/fonts/index.php -- last 10 requests -- 52.139.37.240 - - [25/Aug/2026:05:36:40 +1000] "GET /atex1.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:05:36:40 +1000] "GET /class-t.api.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:05:36:40 +1000] "GET /w.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:05:36:40 +1000] "GET /archive.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:05:36:41 +1000] "GET /bless.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:05:36:41 +1000] "GET /sagax1.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:05:36:41 +1000] "GET /wpc.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:05:36:41 +1000] "GET /fone1.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:05:36:41 +1000] "GET /ncx.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [25/Aug/2026:05:36:42 +1000] "GET /wp-admin/js/index.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-25 05:35:25 L1=1.18 run=1 blk=0 avail=8597 (73.3%) swpO=0 conn=1 myRSS=922 php=0 phpRSS=0 ap=19 tcp=25 topuser=- 2026-08-25 05:35:32 L1=1.09 run=3 blk=0 avail=8605 (73.4%) swpO=0 conn=1 myRSS=922 php=0 phpRSS=0 ap=17 tcp=27 topuser=- 2026-08-25 05:35:36 L1=1.08 run=2 blk=0 avail=8545 (72.9%) swpO=0 conn=1 myRSS=922 php=1 phpRSS=92 ap=17 tcp=25 topuser=vinesit 2026-08-25 05:35:42 L1=0.99 run=3 blk=0 avail=8364 (71.3%) swpO=0 conn=1 myRSS=922 php=1 phpRSS=72 ap=17 tcp=26 topuser=corpkicks 2026-08-25 05:35:46 L1=1.00 run=2 blk=0 avail=8560 (73.0%) swpO=0 conn=1 myRSS=922 php=1 phpRSS=71 ap=17 tcp=26 topuser=vinesit 2026-08-25 05:35:52 L1=1.00 run=1 blk=0 avail=8599 (73.3%) swpO=0 conn=1 myRSS=922 php=0 phpRSS=0 ap=17 tcp=30 topuser=- 2026-08-25 05:35:56 L1=0.92 run=1 blk=0 avail=8595 (73.3%) swpO=0 conn=1 myRSS=922 php=0 phpRSS=0 ap=17 tcp=32 topuser=- 2026-08-25 05:36:02 L1=1.00 run=3 blk=0 avail=8595 (73.3%) swpO=0 conn=1 myRSS=922 php=0 phpRSS=0 ap=17 tcp=30 topuser=- 2026-08-25 05:36:06 L1=1.08 run=1 blk=0 avail=8586 (73.2%) swpO=0 conn=1 myRSS=922 php=0 phpRSS=0 ap=17 tcp=35 topuser=- 2026-08-25 05:36:12 L1=1.16 run=5 blk=0 avail=8184 (69.8%) swpO=0 conn=1 myRSS=939 php=3 phpRSS=378 ap=24 tcp=38 topuser=evolution 2026-08-25 05:36:16 L1=1.30 run=3 blk=0 avail=8408 (71.7%) swpO=0 conn=2 myRSS=939 php=2 phpRSS=190 ap=24 tcp=28 topuser=madalice 2026-08-25 05:36:22 L1=1.28 run=1 blk=0 avail=8545 (72.9%) swpO=0 conn=1 myRSS=939 php=0 phpRSS=0 ap=23 tcp=29 topuser=- 2026-08-25 05:36:26 L1=1.18 run=3 blk=0 avail=8367 (71.3%) swpO=0 conn=2 myRSS=939 php=3 phpRSS=250 ap=23 tcp=31 topuser=olympic 2026-08-25 05:36:32 L1=1.40 run=1 blk=0 avail=8525 (72.7%) swpO=0 conn=1 myRSS=939 php=0 phpRSS=0 ap=23 tcp=29 topuser=- 2026-08-25 05:36:36 L1=1.37 run=2 blk=0 avail=8407 (71.7%) swpO=0 conn=2 myRSS=939 php=2 phpRSS=202 ap=22 tcp=28 topuser=alison 2026-08-25 05:36:42 L1=1.50 run=3 blk=0 avail=8424 (71.8%) swpO=0 conn=1 myRSS=939 php=2 phpRSS=194 ap=21 tcp=32 topuser=madalice 2026-08-25 05:36:46 L1=1.46 run=1 blk=0 avail=8574 (73.1%) swpO=0 conn=2 myRSS=939 php=0 phpRSS=0 ap=21 tcp=30 topuser=- 2026-08-25 05:36:52 L1=1.34 run=1 blk=0 avail=8597 (73.3%) swpO=0 conn=1 myRSS=939 php=0 phpRSS=0 ap=21 tcp=23 topuser=- 2026-08-25 05:36:56 L1=1.32 run=1 blk=0 avail=8598 (73.3%) swpO=0 conn=2 myRSS=939 php=0 phpRSS=0 ap=20 tcp=22 topuser=- 2026-08-25 05:37:02 L1=1.45 run=3 blk=0 avail=8384 (71.5%) swpO=0 conn=1 myRSS=940 php=2 phpRSS=268 ap=20 tcp=26 topuser=corpkicks 2026-08-25 05:37:06 L1=1.50 run=3 blk=0 avail=8256 (70.4%) swpO=0 conn=2 myRSS=940 php=2 phpRSS=400 ap=20 tcp=27 topuser=corpkicks 2026-08-25 05:37:12 L1=1.62 run=2 blk=0 avail=8531 (72.7%) swpO=0 conn=1 myRSS=940 php=1 phpRSS=70 ap=23 tcp=32 topuser=corpkicks 2026-08-25 05:37:16 L1=1.49 run=4 blk=0 avail=8261 (70.4%) swpO=0 conn=3 myRSS=940 php=2 phpRSS=226 ap=23 tcp=29 topuser=madalice 2026-08-25 05:37:22 L1=1.53 run=3 blk=0 avail=8399 (71.6%) swpO=0 conn=2 myRSS=940 php=1 phpRSS=193 ap=23 tcp=31 topuser=corpkicks 2026-08-25 05:37:26 L1=1.57 run=3 blk=0 avail=8359 (71.3%) swpO=0 conn=3 myRSS=940 php=2 phpRSS=122 ap=24 tcp=31 topuser=corpkicks 2026-08-25 05:37:32 L1=1.68 run=5 blk=0 avail=8070 (68.8%) swpO=0 conn=2 myRSS=940 php=3 phpRSS=574 ap=25 tcp=33 topuser=madalice 2026-08-25 05:37:36 L1=1.63 run=6 blk=0 avail=8278 (70.6%) swpO=0 conn=3 myRSS=940 php=4 phpRSS=400 ap=25 tcp=32 topuser=madalice 2026-08-25 05:37:42 L1=1.74 run=4 blk=0 avail=8340 (71.1%) swpO=0 conn=2 myRSS=940 php=2 phpRSS=252 ap=25 tcp=34 topuser=madalice 2026-08-25 05:37:46 L1=1.68 run=3 blk=0 avail=8451 (72.1%) swpO=0 conn=3 myRSS=940 php=2 phpRSS=139 ap=25 tcp=30 topuser=alison 2026-08-25 05:37:52 L1=3.47 run=23 blk=0 avail=6668 (56.8%) swpO=0 conn=18 myRSS=943 php=17 phpRSS=2266 ap=56 tcp=89 topuser=madalice