INCIDENT 2026-08-27 00:33:29 trigger: php_rss=1591MB ================================================================== load: 3.72 1.69 1.50 17/691 3430242 ncpu:10 mem_avail: 5872MB/11729MB (50.1%) swap_used:2537MB swapout:0/s blocked(D):0 running:16 iowait:0.0% steal:0.0% php: 11 procs / 1591MB heaviest user: madalice (11 procs, 1591MB) apache: 46 procs tcp_estab: 66 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2070 madalice 9 1188 nobody 46 792 root 238 702 netdata 8 253 infinium 4 56 mailman 20 55 cpanellogin 1 54 lowrange 3 44 dovenull 6 42 wp-toolkit 6 17 mailnull 2 17 dovecot 3 16 zabbix 1 15 aaa 1 15 candyfabcom 1 14 kurri 1 7 evolution 6 7 nscd 1 6 named 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 9 1202 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5695 MB Active(file): 2467 MB Inactive(file): 2750 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 337 MB CommitLimit: 9960 MB Committed_AS: 8703 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2703186 root 23:22:12 636 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2120152 14.8 Ssl 1-21:02:12 /usr/sbin/mariadbd 3430183 3430047 madalice 246312 109 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 204596 2.5 Ssl 58-14:23:38 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3430189 3430081 madalice 199996 92.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3430185 3430032 madalice 199000 87.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3430188 3429837 madalice 161708 68.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 158268 0.0 Ss 11-16:42:59 /usr/lib/systemd/systemd-journald 2956399 2938778 root 144424 0.0 S 22:03:30 spamd child 3430195 3430046 madalice 141980 121 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3430200 3430078 madalice 94588 56.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3430202 3430082 madalice 87372 49.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3430207 3430084 madalice 77572 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3380112 2938778 root 73476 0.0 S 14:35 spamd child 2938778 1 root 71020 0.0 Ss 22:10:00 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3430209 3430086 madalice 66364 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2244622 1353308 cpanellogin 55380 0.0 S 05:50:52 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 2223 1201 root 39328 0.0 Sl 58-14:23:37 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 33116 0.1 Sl 58-14:23:33 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3313810 1 root 32560 0.0 Ss 33:28 lfd - sleeping 1466 1 root 25588 0.0 Ss 58-14:23:37 dnsadmin - server mode 3413878 1276780 nobody 23804 0.0 S 03:40 /usr/sbin/httpd -k start 3395600 1276780 nobody 23476 0.0 S 11:27 /usr/sbin/httpd -k start 3412832 1276780 nobody 22568 0.0 S 05:09 /usr/sbin/httpd -k start 3413877 1276780 nobody 22568 0.1 S 03:40 /usr/sbin/httpd -k start 3413457 1276780 nobody 22344 0.0 S 04:20 /usr/sbin/httpd -k start 3413890 1276780 nobody 21604 0.0 S 03:39 /usr/sbin/httpd -k start 3411471 1276780 nobody 21520 0.0 R 07:32 /usr/sbin/httpd -k start 3412827 1276780 nobody 20704 0.0 S 05:10 /usr/sbin/httpd -k start 185104 2431 netdata 20064 2.1 Sl 14-03:59:56 /usr/libexec/netdata/plugins.d/apps.plugin 1 3428632 1276780 nobody 19920 0.0 S 02:31 /usr/sbin/httpd -k start 1469 1 root 19652 0.1 Ss 58-14:23:37 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3428608 1276780 nobody 19608 0.0 S 02:33 /usr/sbin/httpd -k start 3429837 1276780 nobody 19532 0.1 S 00:35 /usr/sbin/httpd -k start 3428296 1276780 nobody 19396 0.0 S 03:13 /usr/sbin/httpd -k start 3430029 1276780 nobody 19080 0.1 S 00:14 /usr/sbin/httpd -k start 3430077 1276780 nobody 18956 0.3 S 00:10 /usr/sbin/httpd -k start 3430040 1276780 nobody 18548 0.0 S 00:11 /usr/sbin/httpd -k start 3430088 1276780 nobody 18352 0.2 S 00:10 /usr/sbin/httpd -k start 3430037 1276780 nobody 18320 0.0 S 00:12 /usr/sbin/httpd -k start 3430080 1276780 nobody 18320 0.0 S 00:10 /usr/sbin/httpd -k start 3430041 1276780 nobody 18236 0.0 S 00:11 /usr/sbin/httpd -k start 3430042 1276780 nobody 18172 0.1 S 00:11 /usr/sbin/httpd -k start 3430078 1276780 nobody 18160 0.2 S 00:10 /usr/sbin/httpd -k start 3430032 1276780 nobody 18104 0.1 S 00:13 /usr/sbin/httpd -k start 3430044 1276780 nobody 18104 0.1 S 00:11 /usr/sbin/httpd -k start 3430046 1276780 nobody 18068 0.1 S 00:11 /usr/sbin/httpd -k start 3429415 1276780 nobody 17728 0.0 S 01:21 /usr/sbin/httpd -k start 3430090 1276780 nobody 17576 0.1 S 00:10 /usr/sbin/httpd -k start 3430036 1276780 nobody 17028 0.0 S 00:12 /usr/sbin/httpd -k start 3430087 1276780 nobody 16976 0.1 S 00:10 /usr/sbin/httpd -k start 3430035 1276780 nobody 16944 0.0 S 00:12 /usr/sbin/httpd -k start 3430045 1276780 nobody 16896 0.0 S 00:11 /usr/sbin/httpd -k start 3362599 1471 root 16832 0.0 S 21:53 cPhulkd - dbprocessor 3430084 1276780 nobody 16760 0.1 S 00:10 /usr/sbin/httpd -k start 3430033 1276780 nobody 16684 0.0 S 00:13 /usr/sbin/httpd -k start 3430081 1276780 nobody 16636 0.1 S 00:10 /usr/sbin/httpd -k start 3430086 1276780 nobody 16632 0.1 S 00:10 /usr/sbin/httpd -k start 3430082 1276780 nobody 16576 0.1 S 00:10 /usr/sbin/httpd -k start 3430079 1276780 nobody 16552 0.1 S 00:10 /usr/sbin/httpd -k start 3430089 1276780 nobody 16504 0.1 S 00:10 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9025139 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min nrg/nrgservices.net.au-ssl_log 80 otter2/otterfencing.net.au-ssl_log 80 madalice/madalice.com.au-ssl_log 75 corpkicks/corporatekicks.com.au 64 corpkicks/corporatekicks.com.au-ssl_log 49 alison/alisonarts.com.au-ssl_log 32 speedlin/speedlinefencing.com.au-ssl_log 20 evolution/portal.evolutionerp.com.au-ssl_log 19 cosgrovecreative/cosgrovecreative.com.au-ssl_log 14 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 180 52.139.37.240 110 168.62.48.100 36 20.196.209.81 30 35.231.96.126 20 103.215.74.26 19 203.54.180.238 14 158.23.184.117 3 192.168.0.2 2 114.119.159.70 2 114.119.140.234 2 114.119.130.40 2 114.116.181.153 1 97.74.87.194 1 92.222.108.119 1 66.249.73.172 --- top request paths across all vhosts (last 3 min) --- 19 GET /heartbeat.php 15 GET /autodiscover/autodiscover.xml 6 GET /term.php 6 GET /edit.php 6 GET / 5 GET /as.php 5 GET /about.php 5 GET /666.php 4 GET /wp-good.php 4 GET /store/custom-af1-drippy-swoosh/ 4 GET /ms-edit.php 4 GET /ioxi-o.php 4 GET /bthil.php 4 GET /404.php 4 GET /222.php 3 POST / 3 GET /xleet.php 3 GET /ws54.php 3 GET /wp-login.php 3 GET /wp-includes/fonts/index.php --- busiest 3 vhosts: top paths + last 10 requests --- == nrg/nrgservices.net.au-ssl_log == -- top paths -- 1 GET /x.php 1 GET /xleet.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-includes/Requests/library/index.php 1 GET /wp-includes/fonts/index.php 1 GET /w.php 1 GET /wp-good.php 1 GET /wpc.php -- last 10 requests -- 52.139.37.240 - - [27/Aug/2026:00:32:11 +1000] "GET /ws83.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:32:11 +1000] "GET /atex1.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:32:11 +1000] "GET /class-t.api.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:32:12 +1000] "GET /w.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:32:12 +1000] "GET /archive.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:32:12 +1000] "GET /bless.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:32:12 +1000] "GET /sagax1.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:32:13 +1000] "GET /wpc.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:32:13 +1000] "GET /fone1.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:32:13 +1000] "GET /ncx.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == otter2/otterfencing.net.au-ssl_log == -- top paths -- 1 GET /x.php 1 GET /xleet.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-includes/Requests/library/index.php 1 GET /wp-includes/fonts/index.php 1 GET /w.php 1 GET /wp-good.php 1 GET /wpc.php -- last 10 requests -- 52.139.37.240 - - [27/Aug/2026:00:31:37 +1000] "GET /ws83.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:31:37 +1000] "GET /atex1.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:31:38 +1000] "GET /class-t.api.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:31:38 +1000] "GET /w.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:31:38 +1000] "GET /archive.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:31:38 +1000] "GET /bless.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:31:39 +1000] "GET /sagax1.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:31:39 +1000] "GET /wpc.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:31:39 +1000] "GET /fone1.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:00:31:39 +1000] "GET /ncx.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 4 GET /store/custom-af1-drippy-swoosh/ 2 GET /users/login 2 GET /user/login 2 GET /store/cross-hatch-sketchy-af1/ 2 GET /signup 2 GET /signin 2 GET /sign-in 2 GET /reset-password 2 GET /register 2 GET /login 2 GET /auth/login 2 GET /auth -- last 10 requests -- 35.231.96.126 - - [27/Aug/2026:00:33:24 +1000] "GET /user/login HTTP/1.1" 404 36644 "https://www.madalice.com.au/user/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mob 92.222.108.119 - - [27/Aug/2026:00:33:27 +1000] "GET /robots.txt HTTP/1.1" 304 - "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" 35.231.96.126 - - [27/Aug/2026:00:33:25 +1000] "GET /admin HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 66.249.73.172 - - [27/Aug/2026:00:33:25 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 601 "https://madalice.com.au/terms-and-conditions/" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWeb 35.231.96.126 - - [27/Aug/2026:00:33:25 +1000] "GET /signup HTTP/1.1" 404 36642 "https://www.madalice.com.au/signup" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safa 35.231.96.126 - - [27/Aug/2026:00:33:25 +1000] "GET /wp-login.php HTTP/1.1" 200 4025 "https://madalice.com.au/login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safa 35.231.96.126 - - [27/Aug/2026:00:33:26 +1000] "GET /register HTTP/1.1" 404 36637 "https://www.madalice.com.au/register" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile 35.231.96.126 - - [27/Aug/2026:00:33:25 +1000] "GET /reset-password HTTP/1.1" 404 36643 "https://www.madalice.com.au/reset-password" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0 35.231.96.126 - - [27/Aug/2026:00:33:26 +1000] "GET /backoffice HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 35.231.96.126 - - [27/Aug/2026:00:33:26 +1000] "GET /admin/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-27 00:30:59 L1=1.20 run=2 blk=0 avail=7457 (63.6%) swpO=0 conn=3 myRSS=2069 php=1 phpRSS=135 ap=18 tcp=29 topuser=corpkicks 2026-08-27 00:31:08 L1=1.16 run=2 blk=0 avail=7555 (64.4%) swpO=0 conn=1 myRSS=2069 php=0 phpRSS=0 ap=18 tcp=28 topuser=- 2026-08-27 00:31:09 L1=1.16 run=2 blk=0 avail=7434 (63.4%) swpO=0 conn=2 myRSS=2069 php=1 phpRSS=152 ap=18 tcp=28 topuser=corpkicks 2026-08-27 00:31:18 L1=1.14 run=3 blk=0 avail=7519 (64.1%) swpO=0 conn=1 myRSS=2069 php=0 phpRSS=0 ap=17 tcp=24 topuser=- 2026-08-27 00:31:19 L1=1.14 run=3 blk=0 avail=7524 (64.2%) swpO=0 conn=2 myRSS=2069 php=1 phpRSS=83 ap=17 tcp=24 topuser=corpkicks 2026-08-27 00:31:28 L1=1.19 run=3 blk=0 avail=7517 (64.1%) swpO=0 conn=1 myRSS=2069 php=1 phpRSS=74 ap=16 tcp=25 topuser=corpkicks 2026-08-27 00:31:29 L1=1.19 run=1 blk=0 avail=7565 (64.5%) swpO=0 conn=2 myRSS=2069 php=0 phpRSS=0 ap=16 tcp=26 topuser=- 2026-08-27 00:31:38 L1=1.31 run=3 blk=0 avail=7519 (64.1%) swpO=0 conn=1 myRSS=2069 php=1 phpRSS=74 ap=16 tcp=27 topuser=corpkicks 2026-08-27 00:31:39 L1=1.31 run=1 blk=0 avail=7566 (64.5%) swpO=0 conn=2 myRSS=2069 php=0 phpRSS=0 ap=16 tcp=28 topuser=- 2026-08-27 00:31:48 L1=1.34 run=2 blk=0 avail=7464 (63.6%) swpO=0 conn=2 myRSS=2069 php=1 phpRSS=139 ap=16 tcp=27 topuser=corpkicks 2026-08-27 00:31:49 L1=1.34 run=3 blk=0 avail=7553 (64.4%) swpO=0 conn=2 myRSS=2069 php=1 phpRSS=51 ap=16 tcp=26 topuser=corpkicks 2026-08-27 00:31:58 L1=1.21 run=1 blk=0 avail=7552 (64.4%) swpO=0 conn=2 myRSS=2069 php=0 phpRSS=0 ap=16 tcp=29 topuser=- 2026-08-27 00:31:59 L1=1.21 run=3 blk=0 avail=7449 (63.5%) swpO=0 conn=2 myRSS=2069 php=1 phpRSS=142 ap=16 tcp=30 topuser=corpkicks 2026-08-27 00:32:08 L1=1.33 run=1 blk=0 avail=7486 (63.8%) swpO=0 conn=2 myRSS=2069 php=0 phpRSS=0 ap=17 tcp=34 topuser=- 2026-08-27 00:32:09 L1=1.33 run=3 blk=0 avail=7318 (62.4%) swpO=0 conn=3 myRSS=2069 php=2 phpRSS=230 ap=17 tcp=34 topuser=corpkicks 2026-08-27 00:32:18 L1=1.20 run=2 blk=0 avail=7504 (64.0%) swpO=0 conn=2 myRSS=2069 php=0 phpRSS=0 ap=17 tcp=29 topuser=- 2026-08-27 00:32:19 L1=1.20 run=1 blk=0 avail=7503 (64.0%) swpO=0 conn=3 myRSS=2069 php=0 phpRSS=0 ap=17 tcp=27 topuser=- 2026-08-27 00:32:28 L1=1.08 run=2 blk=0 avail=7345 (62.6%) swpO=0 conn=2 myRSS=2069 php=1 phpRSS=200 ap=15 tcp=27 topuser=madalice 2026-08-27 00:32:29 L1=1.08 run=1 blk=0 avail=7513 (64.1%) swpO=0 conn=3 myRSS=2069 php=0 phpRSS=0 ap=15 tcp=27 topuser=- 2026-08-27 00:32:38 L1=0.92 run=1 blk=0 avail=7579 (64.6%) swpO=0 conn=2 myRSS=2069 php=0 phpRSS=0 ap=15 tcp=25 topuser=- 2026-08-27 00:32:39 L1=0.92 run=1 blk=0 avail=7581 (64.6%) swpO=0 conn=3 myRSS=2069 php=0 phpRSS=0 ap=15 tcp=24 topuser=- 2026-08-27 00:32:48 L1=0.78 run=2 blk=0 avail=7159 (61.0%) swpO=0 conn=3 myRSS=2069 php=2 phpRSS=479 ap=15 tcp=30 topuser=corpkicks 2026-08-27 00:32:49 L1=0.78 run=2 blk=0 avail=7515 (64.1%) swpO=0 conn=3 myRSS=2069 php=1 phpRSS=92 ap=15 tcp=30 topuser=madalice 2026-08-27 00:32:58 L1=0.73 run=2 blk=0 avail=7569 (64.5%) swpO=0 conn=3 myRSS=2069 php=0 phpRSS=0 ap=16 tcp=26 topuser=- 2026-08-27 00:32:59 L1=0.73 run=1 blk=0 avail=7568 (64.5%) swpO=0 conn=3 myRSS=2069 php=0 phpRSS=0 ap=16 tcp=25 topuser=- 2026-08-27 00:33:09 L1=0.78 run=1 blk=0 avail=7493 (63.9%) swpO=0 conn=3 myRSS=2069 php=0 phpRSS=0 ap=16 tcp=27 topuser=- 2026-08-27 00:33:09 L1=0.78 run=1 blk=0 avail=7492 (63.9%) swpO=0 conn=1 myRSS=2069 php=0 phpRSS=0 ap=16 tcp=27 topuser=- 2026-08-27 00:33:19 L1=1.14 run=6 blk=0 avail=7038 (60.0%) swpO=0 conn=3 myRSS=2070 php=5 phpRSS=542 ap=31 tcp=53 topuser=madalice 2026-08-27 00:33:19 L1=1.14 run=18 blk=0 avail=6392 (54.5%) swpO=0 conn=1 myRSS=2070 php=13 phpRSS=1364 ap=47 tcp=60 topuser=madalice 2026-08-27 00:33:29 L1=3.72 run=16 blk=0 avail=5872 (50.1%) swpO=0 conn=9 myRSS=2070 php=11 phpRSS=1591 ap=46 tcp=66 topuser=madalice