INCIDENT 2026-08-27 00:29:58 trigger: php_rss=1777MB ================================================================== load: 0.73 1.05 1.34 16/660 3414004 ncpu:10 mem_avail: 6116MB/11729MB (52.1%) swap_used:2592MB swapout:0/s blocked(D):0 running:12 iowait:0.1% steal:0.0% php: 8 procs / 1777MB heaviest user: corpkicks (8 procs, 1777MB) apache: 22 procs tcp_estab: 34 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1974 corpkicks 8 1835 root 231 632 nobody 21 362 netdata 8 254 infinium 4 56 mailman 20 55 cpanellogin 1 54 dovenull 6 42 lowrange 2 29 kurri 2 21 wp-toolkit 6 17 dovecot 3 16 zabbix 1 15 aaa 1 15 vinesit 1 14 mailnull 2 9 evolution 6 7 nscd 1 6 named 1 5 --- php workers by user --- USER PROCS RSS_MB corpkicks 8 1849 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5026 MB Active(file): 2412 MB Inactive(file): 2729 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 317 MB CommitLimit: 9960 MB Committed_AS: 8322 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2703186 root 23:18:41 640 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2021852 14.8 Ssl 1-20:58:41 /usr/sbin/mariadbd 3413933 3413457 corpkicks 281804 73.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3413935 3413889 corpkicks 248128 121 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3413940 3413890 corpkicks 241932 118 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3413937 3413888 corpkicks 238496 118 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3413941 3413451 corpkicks 237784 117 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3413938 3411471 corpkicks 235012 113 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3413939 3412827 corpkicks 234912 117 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3413936 3413814 corpkicks 234412 116 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1220 1 netdata 206252 2.5 Ssl 58-14:20:07 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2575382 1 root 157424 0.0 Ss 11-16:39:28 /usr/lib/systemd/systemd-journald 2956399 2938778 root 104744 0.0 S 21:59:59 spamd child 3380112 2938778 root 73476 0.0 S 11:04 spamd child 2938778 1 root 71020 0.0 Ss 22:06:29 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2244622 1353308 cpanellogin 55376 0.0 S 05:47:21 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 3414016 3412836 corpkicks 47592 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2223 1201 root 39328 0.0 Sl 58-14:20:06 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 33116 0.1 Sl 58-14:20:02 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3313810 1 root 32560 0.0 Ss 29:57 lfd - sleeping 3397437 1276780 nobody 23424 0.3 S 04:57 /usr/sbin/httpd -k start 3395600 1276780 nobody 23240 0.0 S 07:56 /usr/sbin/httpd -k start 3412832 1276780 nobody 21996 0.0 S 01:38 /usr/sbin/httpd -k start 3412836 1276780 nobody 21608 0.0 S 01:38 /usr/sbin/httpd -k start 3413457 1276780 nobody 21196 0.0 S 00:49 /usr/sbin/httpd -k start 3411471 1276780 nobody 20992 0.0 S 04:01 /usr/sbin/httpd -k start 3413456 1276780 nobody 20800 0.1 S 00:49 /usr/sbin/httpd -k start 3413878 1276780 nobody 20432 0.4 S 00:09 /usr/sbin/httpd -k start 185104 2431 netdata 20064 2.1 Sl 14-03:56:25 /usr/libexec/netdata/plugins.d/apps.plugin 1 3413466 1276780 nobody 20012 0.0 S 00:47 /usr/sbin/httpd -k start 1469 1 root 19640 0.1 Ss 58-14:20:06 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3413877 1276780 nobody 19332 0.4 S 00:09 /usr/sbin/httpd -k start 3412829 1276780 nobody 19296 0.0 S 01:39 /usr/sbin/httpd -k start 3413451 1276780 nobody 18372 0.0 S 00:50 /usr/sbin/httpd -k start 3412827 1276780 nobody 17904 0.1 S 01:39 /usr/sbin/httpd -k start 3413814 1276780 nobody 17836 0.1 S 00:10 /usr/sbin/httpd -k start 3412828 1276780 nobody 17604 0.1 S 01:39 /usr/sbin/httpd -k start 3362599 1471 root 16832 0.0 S 18:22 cPhulkd - dbprocessor 3348025 3828812 aaa 16128 0.0 S 20:01 dovecot/imap 1204 1 zabbix 15824 0.2 Ssl 58-14:20:07 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3413888 1276780 nobody 15800 0.0 S 00:08 /usr/sbin/httpd -k start 3413889 1276780 nobody 15764 0.0 S 00:08 /usr/sbin/httpd -k start 1471 1 root 15744 0.0 Ss 58-14:20:06 cPhulkd - processor 3413890 1276780 nobody 15664 0.0 S 00:08 /usr/sbin/httpd -k start 3411679 1471 root 15300 0.0 S 03:35 cPhulkd - processor - http socket 1353308 1 root 15264 0.0 Ss 35-21:48:37 cpsrvd (SSL) - waiting for connections 3295375 3828812 lowrange 15140 0.0 S 38:31 dovecot/imap 3355510 3828812 lowrange 14912 0.0 S 19:51 dovecot/imap 3413887 1276780 nobody 14728 0.0 S 00:08 /usr/sbin/httpd -k start 3413898 3828812 vinesit 14664 0.0 S 00:07 dovecot/imap 3396672 3828812 infinium 14616 0.0 S 06:12 dovecot/imap 3112091 3828812 infinium 14512 0.0 S 01:32:28 dovecot/imap 3413915 3828812 kurri 14416 0.0 S 00:05 dovecot/imap 3379087 3828812 infinium 14384 0.0 S 12:48 dovecot/imap 1463 1 root 14352 0.0 Ss 58-14:20:06 tailwatchd 3329828 3828812 infinium 14284 0.0 S 25:26 dovecot/imap 2937469 1 root 11168 0.0 Ss 22:07:24 queueprocd - waiting up to 60s to process a task 1780156 3828812 dovenull 10248 0.0 S 1-23:57:07 dovecot/imap-login 1780152 3828812 dovenull 9892 0.0 S 1-23:57:07 dovecot/imap-login 1780154 3828812 dovenull 8560 0.0 S 1-23:57:07 dovecot/pop3-login 1780162 3828812 dovecot 8540 0.0 S 1-23:57:07 dovecot/auth --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9024648 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min alison/alisonarts.com.au-ssl_log 301 whiz/whizengineering.com.au-ssl_log 99 evolution/evolutionerp.com.au-ssl_log 32 evolution/portal.evolutionerp.com.au-ssl_log 31 evolution/my.evolutionerp.com.au-ssl_log 29 customc/customcentral.com.au-ssl_log 20 customc/customcentral.com.au 19 evolution/release.evolutionerp.com.au 19 corpkicks/corporatekicks.com.au-ssl_log 14 cosgrovecreative/cosgrovecreative.com.au-ssl_log 14 madalice/madalice.com.au-ssl_log 9 tubesupplies/tubesupplies.com.au-ssl_log 9 infinium/infinium.net.au-ssl_log 6 aaa/aaadownunder.com.au-ssl_log 3 alison/alisonarts.com.au 2 (total vhosts taking traffic: 19) --- top client IPs across all vhosts (last 3 min) --- 290 52.139.37.240 68 20.151.129.194 38 20.48.147.90 38 20.104.18.15 32 20.100.175.163 31 52.139.44.162 31 203.54.180.238 14 4.204.200.136 9 3.16.55.45 8 118.127.40.55 5 52.167.144.142 3 43.160.240.216 3 43.130.32.245 2 91.92.243.249 2 91.92.243.248 --- top request paths across all vhosts (last 3 min) --- 31 GET /heartbeat.php 12 POST /wp-login.php 9 GET / 8 POST /wp-cron.php 8 GET /index.php 7 GET /store/custom-af1-drippy-swoosh/ 5 GET /simple.php 5 GET /k.php 5 GET /1.php 4 GET /term.php 4 GET /mac.php 4 GET /ccc.php 3 GET /zoo2.php 3 GET /xa.php 3 GET /wp-includes/ID3/about.php 3 GET /wp-cron.php 3 GET /wp-content/admin.php 3 GET /wp-admin/includes/about.php 3 GET /samll.php 3 GET /sallu.php --- busiest 3 vhosts: top paths + last 10 requests --- == alison/alisonarts.com.au-ssl_log == -- top paths -- 3 GET /gallery/custom-painted-harness-helmet/ 2 GET /wp-cron.php 2 GET /mar.php 2 GET /k.php 2 GET /function.php 2 GET /airbrushed-arai-helmet/ 1 GET /zwso.php 1 GET /xxx.php 1 GET /xx.php 1 GET /xpw.php 1 GET /x.php 1 GET /xmlrpc.php -- last 10 requests -- 52.139.37.240 - - [27/Aug/2026:00:29:51 +1000] "GET /wp-admin/images/chosen.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:29:51 +1000] "GET /wp-admin/install.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:29:52 +1000] "GET /wp-includes/js/tinymce/skins/lightgray/img/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/12 52.139.37.240 - - [27/Aug/2026:00:29:52 +1000] "GET /cgi-bin/about.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:29:52 +1000] "GET /wp-admin/css/colors/about.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:29:52 +1000] "GET /.well-known/classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 52.139.37.240 - - [27/Aug/2026:00:29:53 +1000] "GET /wp-admin/js/about.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:29:53 +1000] "GET /comfunctions.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:29:53 +1000] "GET /images/class-config.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:29:53 +1000] "GET /wp-includes/widgets/include.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 == whiz/whizengineering.com.au-ssl_log == -- top paths -- 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /this_is_a_new_hello_world.php 2 GET /simple.php 2 GET /ops.php 2 GET /media.php 2 GET /mac.php 2 GET /images.php 2 GET /ccc.php 2 GET /admin.php 2 GET /about.php 2 GET /abcd.php 2 GET /aaa.php -- last 10 requests -- 52.139.44.162 - - [27/Aug/2026:00:28:49 +1000] "GET /ano.php HTTP/1.1" 404 5749 "-" "-" 52.139.44.162 - - [27/Aug/2026:00:28:49 +1000] "GET /mac.php HTTP/1.1" 404 5749 "-" "-" 52.139.44.162 - - [27/Aug/2026:00:28:50 +1000] "GET /simple.php HTTP/1.1" 404 5749 "-" "-" 52.139.44.162 - - [27/Aug/2026:00:28:50 +1000] "GET /sallu.php HTTP/1.1" 404 5749 "-" "-" 52.139.44.162 - - [27/Aug/2026:00:28:51 +1000] "GET /biufile.php HTTP/1.1" 404 5749 "-" "-" 52.139.44.162 - - [27/Aug/2026:00:28:51 +1000] "GET /abcd.php HTTP/1.1" 404 5749 "-" "-" 52.139.44.162 - - [27/Aug/2026:00:28:52 +1000] "GET /33.php HTTP/1.1" 404 5749 "-" "-" 52.139.44.162 - - [27/Aug/2026:00:28:52 +1000] "GET /xa.php HTTP/1.1" 404 5749 "-" "-" 52.139.44.162 - - [27/Aug/2026:00:28:53 +1000] "GET /ccc.php?p= HTTP/1.1" 404 5749 "-" "-" 52.139.44.162 - - [27/Aug/2026:00:28:53 +1000] "GET /133.php HTTP/1.1" 404 5749 "-" "-" == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 1 GET /xx.php 1 GET /ws81.php 1 GET /ws77.php 1 GET /wp-the.php 1 GET /wp-signin.php 1 GET /wp-includes/PHPMailer/ 1 GET /wp-includes/IXR/ 1 GET /wp-includes/css/ 1 GET /wp-includes/assets/index.php 1 GET /wp-content/packed.php 1 GET /wp-content/about.php 1 GET /wp-config-sample.php -- last 10 requests -- 20.100.175.163 - - [27/Aug/2026:00:27:25 +1000] "GET /hplfuns.php HTTP/1.1" 404 30376 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [27/Aug/2026:00:27:26 +1000] "GET /log.php HTTP/1.1" 404 30373 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [27/Aug/2026:00:27:28 +1000] "GET /test.php HTTP/1.1" 404 30373 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [27/Aug/2026:00:27:30 +1000] "GET /txets.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [27/Aug/2026:00:27:30 +1000] "GET /wp-admin.php HTTP/1.1" 404 30373 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [27/Aug/2026:00:27:31 +1000] "GET /wp-admin/images/ HTTP/1.1" 200 1503 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [27/Aug/2026:00:27:32 +1000] "GET /wp-admin/network/ HTTP/1.1" 302 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [27/Aug/2026:00:27:33 +1000] "GET /wp-config-sample.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [27/Aug/2026:00:27:34 +1000] "GET /wp-content/packed.php HTTP/1.1" 404 30377 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [27/Aug/2026:00:27:35 +1000] "GET /wp-includes/IXR/ HTTP/1.1" 200 474 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-27 00:27:37 L1=1.10 run=6 blk=0 avail=7622 (65.0%) swpO=0 conn=2 myRSS=1974 php=1 phpRSS=61 ap=19 tcp=27 topuser=madalice 2026-08-27 00:27:37 L1=1.10 run=4 blk=0 avail=7632 (65.1%) swpO=0 conn=3 myRSS=1974 php=1 phpRSS=64 ap=19 tcp=27 topuser=madalice 2026-08-27 00:27:47 L1=0.93 run=2 blk=0 avail=7673 (65.4%) swpO=0 conn=1 myRSS=1974 php=0 phpRSS=0 ap=17 tcp=27 topuser=- 2026-08-27 00:27:47 L1=0.93 run=2 blk=0 avail=7673 (65.4%) swpO=0 conn=3 myRSS=1974 php=0 phpRSS=0 ap=17 tcp=27 topuser=- 2026-08-27 00:27:57 L1=0.86 run=2 blk=0 avail=7681 (65.5%) swpO=0 conn=1 myRSS=1974 php=0 phpRSS=0 ap=16 tcp=26 topuser=- 2026-08-27 00:27:57 L1=0.86 run=2 blk=0 avail=7681 (65.5%) swpO=0 conn=3 myRSS=1974 php=0 phpRSS=0 ap=16 tcp=26 topuser=- 2026-08-27 00:28:07 L1=0.80 run=2 blk=0 avail=7665 (65.4%) swpO=0 conn=1 myRSS=1974 php=0 phpRSS=0 ap=16 tcp=25 topuser=- 2026-08-27 00:28:07 L1=0.80 run=2 blk=0 avail=7665 (65.3%) swpO=0 conn=1 myRSS=1974 php=0 phpRSS=0 ap=16 tcp=25 topuser=- 2026-08-27 00:28:17 L1=0.76 run=1 blk=0 avail=7661 (65.3%) swpO=0 conn=1 myRSS=1974 php=0 phpRSS=0 ap=17 tcp=40 topuser=- 2026-08-27 00:28:17 L1=0.76 run=2 blk=0 avail=7660 (65.3%) swpO=0 conn=1 myRSS=1974 php=0 phpRSS=0 ap=17 tcp=40 topuser=- 2026-08-27 00:28:27 L1=0.72 run=1 blk=0 avail=7595 (64.8%) swpO=0 conn=1 myRSS=1974 php=0 phpRSS=0 ap=27 tcp=24 topuser=- 2026-08-27 00:28:27 L1=0.72 run=2 blk=0 avail=7595 (64.8%) swpO=0 conn=1 myRSS=1974 php=0 phpRSS=0 ap=27 tcp=24 topuser=- 2026-08-27 00:28:37 L1=0.77 run=1 blk=0 avail=7681 (65.5%) swpO=0 conn=1 myRSS=1974 php=0 phpRSS=0 ap=17 tcp=23 topuser=- 2026-08-27 00:28:37 L1=0.77 run=2 blk=0 avail=7681 (65.5%) swpO=0 conn=1 myRSS=1974 php=0 phpRSS=0 ap=17 tcp=23 topuser=- 2026-08-27 00:28:47 L1=0.73 run=2 blk=0 avail=7682 (65.5%) swpO=0 conn=1 myRSS=1974 php=0 phpRSS=0 ap=16 tcp=27 topuser=- 2026-08-27 00:28:47 L1=0.73 run=1 blk=0 avail=7682 (65.5%) swpO=0 conn=1 myRSS=1974 php=0 phpRSS=0 ap=16 tcp=27 topuser=- 2026-08-27 00:28:57 L1=0.62 run=3 blk=0 avail=7588 (64.7%) swpO=0 conn=1 myRSS=1974 php=1 phpRSS=122 ap=16 tcp=25 topuser=infinium 2026-08-27 00:28:57 L1=0.62 run=3 blk=0 avail=7588 (64.7%) swpO=0 conn=1 myRSS=1974 php=1 phpRSS=122 ap=16 tcp=25 topuser=infinium 2026-08-27 00:29:07 L1=0.75 run=5 blk=0 avail=7446 (63.5%) swpO=0 conn=1 myRSS=1974 php=3 phpRSS=336 ap=15 tcp=31 topuser=madalice 2026-08-27 00:29:07 L1=0.75 run=5 blk=0 avail=7445 (63.5%) swpO=0 conn=4 myRSS=1974 php=3 phpRSS=337 ap=15 tcp=31 topuser=madalice 2026-08-27 00:29:17 L1=0.63 run=1 blk=0 avail=7708 (65.7%) swpO=0 conn=1 myRSS=1974 php=0 phpRSS=0 ap=16 tcp=23 topuser=- 2026-08-27 00:29:17 L1=0.63 run=2 blk=0 avail=7708 (65.7%) swpO=0 conn=4 myRSS=1974 php=0 phpRSS=0 ap=16 tcp=23 topuser=- 2026-08-27 00:29:27 L1=0.54 run=1 blk=0 avail=7712 (65.8%) swpO=0 conn=1 myRSS=1974 php=0 phpRSS=0 ap=15 tcp=24 topuser=- 2026-08-27 00:29:27 L1=0.54 run=2 blk=0 avail=7712 (65.8%) swpO=0 conn=4 myRSS=1974 php=0 phpRSS=0 ap=15 tcp=24 topuser=- 2026-08-27 00:29:37 L1=0.53 run=2 blk=0 avail=7596 (64.8%) swpO=0 conn=1 myRSS=1974 php=1 phpRSS=144 ap=15 tcp=26 topuser=alison 2026-08-27 00:29:37 L1=0.53 run=3 blk=0 avail=7594 (64.7%) swpO=0 conn=4 myRSS=1974 php=1 phpRSS=147 ap=15 tcp=26 topuser=alison 2026-08-27 00:29:47 L1=0.52 run=2 blk=0 avail=7526 (64.2%) swpO=0 conn=2 myRSS=1974 php=1 phpRSS=211 ap=16 tcp=33 topuser=corpkicks 2026-08-27 00:29:48 L1=0.52 run=3 blk=0 avail=7519 (64.1%) swpO=0 conn=4 myRSS=1974 php=1 phpRSS=216 ap=16 tcp=33 topuser=corpkicks 2026-08-27 00:29:58 L1=0.73 run=12 blk=0 avail=6116 (52.1%) swpO=0 conn=10 myRSS=1974 php=8 phpRSS=1777 ap=22 tcp=34 topuser=corpkicks 2026-08-27 00:29:58 L1=0.73 run=10 blk=0 avail=6126 (52.2%) swpO=0 conn=9 myRSS=1974 php=8 phpRSS=1770 ap=22 tcp=34 topuser=corpkicks