INCIDENT 2026-08-27 13:49:57 trigger: php_rss=1998MB mysql_conn=15 ================================================================== load: 2.41 2.25 2.47 18/750 2051563 ncpu:10 mem_avail: 4552MB/11729MB (38.8%) swap_used:2615MB swapout:918/s blocked(D):1 running:22 iowait:0.1% steal:0.0% php: 14 procs / 1998MB heaviest user: corpkicks (12 procs, 1866MB) apache: 105 procs tcp_estab: 53 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2566 corpkicks 13 2029 nobody 104 1797 root 238 717 netdata 8 257 evolution 7 177 cpanellogin 1 68 mailman 20 47 dovenull 6 43 infinium 2 28 wp-toolkit 6 19 dovecot 3 17 alison 1 14 zabbix 1 13 mailnull 3 11 kurri 1 6 nscd 1 5 named 1 4 cpanelconnecttrack 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB corpkicks 12 2041 evolution 3 174 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4182 MB Active(file): 3347 MB Inactive(file): 950 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 328 MB CommitLimit: 9960 MB Committed_AS: 10502 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3565593 root 12:38:41 2936 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2628124 16.7 Ssl 2-10:18:41 /usr/sbin/mariadbd 2051521 2050897 corpkicks 232368 62.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2051518 2049107 corpkicks 231568 65.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2051519 2048277 corpkicks 216108 56.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2051522 2050890 corpkicks 206736 52.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2051523 2050684 corpkicks 206296 52.5 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1220 1 netdata 205224 2.5 Ssl 59-03:40:07 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2051514 2050855 corpkicks 204388 54.5 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2051524 2050970 corpkicks 199660 51.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2051516 2049567 corpkicks 176520 43.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2051525 2050966 corpkicks 162124 38.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2051515 2048783 corpkicks 159736 37.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1910875 3797563 root 153496 0.1 S 36:05 spamd child 2575382 1 root 149996 0.0 Ss 12-05:59:28 /usr/lib/systemd/systemd-journald 2051526 2050894 corpkicks 142572 32.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2051517 2050896 corpkicks 137408 31.5 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3846467 3797563 root 86436 0.0 S 11:14:23 spamd child 3797563 1 root 82312 0.0 Ss 11:27:01 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1103418 1353308 cpanellogin 69868 0.0 S 04:13:34 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 2051512 2049590 evolution 68304 8.0 R 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2051529 2050979 evolution 67436 18.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 45152 0.0 Sl 59-03:40:06 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 2051591 2032357 evolution 42152 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 31928 0.1 Sl 59-03:40:02 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2014488 2938073 infinium 29420 0.0 S 10:05 php-fpm: pool user_infinium 1469 1 root 25760 0.1 Ss 59-03:40:06 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 25080 0.0 Ss 36-11:08:37 cpsrvd (SSL) - waiting for connections 2033222 1276780 nobody 21776 0.1 S 04:58 /usr/sbin/httpd -k start 2049385 1276780 nobody 20880 0.2 S 01:48 /usr/sbin/httpd -k start 2048733 1276780 nobody 20584 0.2 S 02:31 /usr/sbin/httpd -k start 2047895 1276780 nobody 20532 0.0 S 03:38 /usr/sbin/httpd -k start 2048056 1276780 nobody 20492 0.0 S 03:23 /usr/sbin/httpd -k start 2048277 1276780 nobody 20448 0.1 S 03:08 /usr/sbin/httpd -k start 2049592 1276780 nobody 20308 0.0 S 01:38 /usr/sbin/httpd -k start 2048242 1276780 nobody 20228 0.0 S 03:09 /usr/sbin/httpd -k start 2050850 1276780 nobody 19984 0.3 S 00:39 /usr/sbin/httpd -k start 2049387 1276780 nobody 19900 0.0 S 01:48 /usr/sbin/httpd -k start 2032357 1276780 nobody 19772 0.0 S 05:42 /usr/sbin/httpd -k start 2050929 1276780 nobody 19700 0.0 S 00:36 /usr/sbin/httpd -k start 2048278 1276780 nobody 19660 0.0 S 03:08 /usr/sbin/httpd -k start 185104 2431 netdata 19540 2.1 Sl 14-17:16:25 /usr/libexec/netdata/plugins.d/apps.plugin 1 2048720 1276780 nobody 19472 0.1 S 02:32 /usr/sbin/httpd -k start 2049590 1276780 nobody 19472 0.0 S 01:38 /usr/sbin/httpd -k start 2049384 1276780 nobody 19452 0.0 S 01:48 /usr/sbin/httpd -k start 2050920 1276780 nobody 19340 0.0 S 00:36 /usr/sbin/httpd -k start 2049107 1276780 nobody 19312 0.0 S 02:06 /usr/sbin/httpd -k start 2048783 1276780 nobody 19216 0.0 S 02:30 /usr/sbin/httpd -k start 2048292 1276780 nobody 19160 0.0 S 03:07 /usr/sbin/httpd -k start 2049594 1276780 nobody 19064 0.1 S 01:38 /usr/sbin/httpd -k start 2049570 1276780 nobody 19060 0.0 S 01:39 /usr/sbin/httpd -k start 2050856 1276780 nobody 19052 0.0 S 00:38 /usr/sbin/httpd -k start 2050854 1276780 nobody 18952 0.0 S 00:38 /usr/sbin/httpd -k start 2049978 1276780 nobody 18916 0.0 S 01:22 /usr/sbin/httpd -k start 2050855 1276780 nobody 18828 0.0 S 00:38 /usr/sbin/httpd -k start 2050961 1276780 nobody 18768 0.0 S 00:35 /usr/sbin/httpd -k start 2050858 1276780 nobody 18748 0.0 S 00:38 /usr/sbin/httpd -k start 2050922 1276780 nobody 18736 0.0 S 00:36 /usr/sbin/httpd -k start 2049567 1276780 nobody 18700 0.0 S 01:39 /usr/sbin/httpd -k start 2050890 1276780 nobody 18700 0.0 S 00:37 /usr/sbin/httpd -k start 2050924 1276780 nobody 18672 0.0 S 00:36 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 12854483 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 12854466 | root | 85-1559715131 | Execute | 0 | Sending data | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='11306' AND dispatchitems.j | +----------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 781 evolution/portal.evolutionerp.com.au-ssl_log 131 olympic/seb-mobile-auth.olympicfencing.com.au-ssl_log 129 otterfencing/otterfencing.com.au-ssl_log 129 candyfabcom/candyfab.com.au-ssl_log 123 olympic/seb-mobile-auth.olympicfencing.com.au 122 madalice/madalice.com.au-ssl_log 118 alison/alisonarts.com.au-ssl_log 101 customc/customcentral.com.au-ssl_log 52 corpkicks/corporatekicks.com.au-ssl_log 8 aaa/aaadownunder.com.au-ssl_log 6 alison/alisonarts.com.au 4 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 408 203.54.180.238 251 20.220.10.235 152 14.1.95.251 144 103.104.165.99 124 20.104.50.220 123 20.104.104.62 109 143.244.57.86 87 52.139.37.240 75 103.104.164.114 56 182.239.240.254 51 158.23.184.117 36 203.220.53.174 15 180.181.236.49 13 147.161.213.78 4 40.77.167.25 --- top request paths across all vhosts (last 3 min) --- 348 POST /functions.php 129 GET /app/ajax.php 71 GET /index.php 58 GET /heartbeat.php 52 POST /plugins/csvexporter/plugin.php 34 GET /factory_session_checker.php 26 POST /quoteditsave.php 21 POST /app/ajax/selectFilterSingle.php 21 POST /app/ajax/selectFilter.php 20 POST /inveditsave.php 19 POST /app/ajax.php 18 GET /factory_session_processed_qty.php 18 GET /factory_session_joiner.php 14 POST /itemModify.php 11 POST /clienteditsave.php 9 GET /custom-painted-motorcycles/custom-painted-bike-tribal-fire/ 8 POST /invaddsave.php 8 POST //functions.php 7 GET /plugins/fensa/fensa-ajax.php 7 GET / --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 348 POST /functions.php 129 GET /app/ajax.php 70 GET /index.php 52 POST /plugins/csvexporter/plugin.php 26 POST /quoteditsave.php 21 POST /app/ajax/selectFilterSingle.php 21 POST /app/ajax/selectFilter.php 20 POST /inveditsave.php 19 POST /app/ajax.php 14 POST /itemModify.php 11 POST /clienteditsave.php 8 POST /invaddsave.php -- last 10 requests -- 103.104.165.99 - - [27/Aug/2026:13:49:52 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvedit%26id%3D6313%26tab%3Dgeneraltab&call=getUserSetting&caller=ajaxSubmitLocal&seq=14483926298 HTTP/1.1" 200 110 "https://my. 103.104.165.99 - - [27/Aug/2026:13:49:53 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invedit&id=6314&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 203.54.180.238 - - [27/Aug/2026:13:49:54 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78848§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 203.54.180.238 - - [27/Aug/2026:13:49:54 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/2 203.54.180.238 - - [27/Aug/2026:13:49:54 +1000] "GET /index.php?page=quotereg HTTP/1.1" 200 84942 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=25858&tab=invoicingtab" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 203.54.180.238 - - [27/Aug/2026:13:49:55 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 203.54.180.238 - - [27/Aug/2026:13:49:55 +1000] "GET /plugins/fensa/fensa-ajax.php?function_name=load_fensa_modal HTTP/1.1" 200 357 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; 203.54.180.238 - - [27/Aug/2026:13:49:55 +1000] "POST /quoteditsave.php?call=getTheQuotes HTTP/1.1" 200 1435 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 203.54.180.238 - - [27/Aug/2026:13:49:56 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotereg&call=getUserSetting&caller=ajaxSubmitLocal&seq=11281018142 HTTP/1.1" 200 90 "https://my.evolutionerp.com.au/index.php?p 203.54.180.238 - - [27/Aug/2026:13:49:56 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 58 GET /heartbeat.php 34 GET /factory_session_checker.php 18 GET /factory_session_processed_qty.php 18 GET /factory_session_joiner.php 1 POST /portal/register 1 POST /factory_functions.php 1 GET /index.php -- last 10 requests -- 203.54.180.238 - - [27/Aug/2026:13:49:38 +1000] "GET /factory_session_joiner.php?id=34914 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [27/Aug/2026:13:49:39 +1000] "GET /heartbeat.php?sentAt=1787802579&bytes=106,143,179,211&_=1787802519320 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=1 203.54.180.238 - - [27/Aug/2026:13:49:40 +1000] "GET /heartbeat.php?sentAt=1787802581&bytes=106,143,179,213&_=1787749002439 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [27/Aug/2026:13:49:42 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [27/Aug/2026:13:49:43 +1000] "GET /heartbeat.php?sentAt=1787802583&bytes=106,143,179,215&_=1787801098813 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [27/Aug/2026:13:49:44 +1000] "GET /heartbeat.php?sentAt=1787802582&bytes=106,143,179,214&_=1787798194817 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [27/Aug/2026:13:49:47 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [27/Aug/2026:13:49:48 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 140 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [27/Aug/2026:13:49:48 +1000] "GET /factory_session_joiner.php?id=34914 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [27/Aug/2026:13:49:49 +1000] "GET /heartbeat.php?sentAt=1787802589&bytes=106,143,179,221&_=1787802519321 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=1 == olympic/seb-mobile-auth.olympicfencing.com.au-ssl_log == -- top paths -- 1 GET /Zoo.php 1 GET /zoo2.php 1 GET /z43agz.php 1 GET /yawa.php 1 GET /xwpg.php 1 GET /xty.php 1 GET /xmini4.php 1 GET /x1da.php 1 GET /wpxml.php 1 GET /wp-wlx.php 1 GET /wpupex.php 1 GET /wp-rrtx.php -- last 10 requests -- 20.220.10.235 - - [27/Aug/2026:13:49:49 +1000] "GET /karry.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [27/Aug/2026:13:49:49 +1000] "GET /reviall.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [27/Aug/2026:13:49:50 +1000] "GET /xwpg.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [27/Aug/2026:13:49:50 +1000] "GET /log.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [27/Aug/2026:13:49:50 +1000] "GET /wpupex.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [27/Aug/2026:13:49:51 +1000] "GET /000.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [27/Aug/2026:13:49:51 +1000] "GET /wp-content/options.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [27/Aug/2026:13:49:52 +1000] "GET /wp-rrtx.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [27/Aug/2026:13:49:52 +1000] "GET /wp-content/df.php HTTP/1.1" 404 - "-" "-" 20.220.10.235 - - [27/Aug/2026:13:49:53 +1000] "GET /wp-content/uploads/users.php HTTP/1.1" 403 12 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-27 13:47:29 L1=2.21 run=4 blk=0 avail=6744 (57.5%) swpO=0 conn=2 myRSS=2587 php=3 phpRSS=221 ap=39 tcp=45 topuser=madalice 2026-08-27 13:47:37 L1=2.03 run=5 blk=0 avail=6850 (58.4%) swpO=0 conn=4 myRSS=2587 php=4 phpRSS=172 ap=37 tcp=33 topuser=evolution 2026-08-27 13:47:39 L1=2.03 run=4 blk=0 avail=6820 (58.1%) swpO=0 conn=2 myRSS=2587 php=2 phpRSS=145 ap=35 tcp=37 topuser=madalice 2026-08-27 13:47:47 L1=1.87 run=3 blk=0 avail=6908 (58.9%) swpO=0 conn=4 myRSS=2587 php=0 phpRSS=0 ap=35 tcp=41 topuser=- 2026-08-27 13:47:49 L1=1.80 run=3 blk=0 avail=6832 (58.3%) swpO=0 conn=2 myRSS=2587 php=1 phpRSS=101 ap=36 tcp=37 topuser=madalice 2026-08-27 13:47:57 L1=1.65 run=2 blk=0 avail=6732 (57.4%) swpO=0 conn=4 myRSS=2587 php=2 phpRSS=197 ap=36 tcp=33 topuser=madalice 2026-08-27 13:47:59 L1=1.84 run=4 blk=0 avail=6617 (56.4%) swpO=0 conn=2 myRSS=2587 php=4 phpRSS=420 ap=34 tcp=41 topuser=madalice 2026-08-27 13:48:07 L1=1.85 run=3 blk=0 avail=6902 (58.8%) swpO=0 conn=4 myRSS=2587 php=2 phpRSS=106 ap=31 tcp=31 topuser=madalice 2026-08-27 13:48:09 L1=1.87 run=2 blk=0 avail=6860 (58.5%) swpO=0 conn=2 myRSS=2587 php=1 phpRSS=66 ap=37 tcp=40 topuser=evolution 2026-08-27 13:48:17 L1=2.04 run=2 blk=0 avail=6778 (57.8%) swpO=0 conn=4 myRSS=2587 php=1 phpRSS=135 ap=38 tcp=54 topuser=alison 2026-08-27 13:48:19 L1=2.35 run=5 blk=0 avail=6462 (55.1%) swpO=0 conn=2 myRSS=2587 php=4 phpRSS=443 ap=52 tcp=61 topuser=alison 2026-08-27 13:48:27 L1=2.25 run=2 blk=0 avail=6595 (56.2%) swpO=0 conn=4 myRSS=2587 php=1 phpRSS=209 ap=52 tcp=54 topuser=madalice 2026-08-27 13:48:29 L1=2.15 run=2 blk=0 avail=6561 (55.9%) swpO=0 conn=2 myRSS=2587 php=1 phpRSS=224 ap=55 tcp=51 topuser=madalice 2026-08-27 13:48:37 L1=2.29 run=2 blk=0 avail=6722 (57.3%) swpO=0 conn=4 myRSS=2587 php=1 phpRSS=73 ap=54 tcp=56 topuser=vinesit 2026-08-27 13:48:39 L1=2.35 run=3 blk=0 avail=6597 (56.2%) swpO=0 conn=2 myRSS=2587 php=2 phpRSS=231 ap=54 tcp=50 topuser=alison 2026-08-27 13:48:47 L1=2.40 run=4 blk=0 avail=6790 (57.9%) swpO=1 conn=4 myRSS=2587 php=1 phpRSS=53 ap=48 tcp=43 topuser=madalice 2026-08-27 13:48:50 L1=2.53 run=3 blk=0 avail=6635 (56.6%) swpO=1 conn=2 myRSS=2587 php=3 phpRSS=277 ap=46 tcp=44 topuser=corpkicks 2026-08-27 13:48:57 L1=2.49 run=3 blk=0 avail=6777 (57.8%) swpO=0 conn=2 myRSS=2587 php=2 phpRSS=131 ap=42 tcp=38 topuser=madalice 2026-08-27 13:49:00 L1=2.45 run=2 blk=0 avail=6826 (58.2%) swpO=0 conn=2 myRSS=2587 php=1 phpRSS=39 ap=41 tcp=43 topuser=evolution 2026-08-27 13:49:07 L1=2.33 run=8 blk=0 avail=6780 (57.8%) swpO=0 conn=2 myRSS=2587 php=3 phpRSS=165 ap=40 tcp=48 topuser=evolution 2026-08-27 13:49:10 L1=2.31 run=2 blk=0 avail=6805 (58.0%) swpO=0 conn=3 myRSS=2587 php=3 phpRSS=118 ap=41 tcp=49 topuser=evolution 2026-08-27 13:49:17 L1=2.28 run=6 blk=0 avail=6554 (55.9%) swpO=0 conn=2 myRSS=2587 php=4 phpRSS=407 ap=43 tcp=48 topuser=customc 2026-08-27 13:49:20 L1=2.26 run=3 blk=0 avail=6720 (57.3%) swpO=0 conn=3 myRSS=2587 php=2 phpRSS=65 ap=57 tcp=141 topuser=madalice 2026-08-27 13:49:27 L1=2.16 run=4 blk=0 avail=5986 (51.0%) swpO=0 conn=2 myRSS=2587 php=2 phpRSS=224 ap=135 tcp=64 topuser=madalice 2026-08-27 13:49:30 L1=2.22 run=4 blk=0 avail=6017 (51.3%) swpO=0 conn=3 myRSS=2587 php=6 phpRSS=330 ap=132 tcp=45 topuser=evolution 2026-08-27 13:49:37 L1=2.37 run=1 blk=0 avail=6220 (53.0%) swpO=0 conn=2 myRSS=2587 php=0 phpRSS=0 ap=125 tcp=45 topuser=- 2026-08-27 13:49:40 L1=2.42 run=3 blk=0 avail=6197 (52.8%) swpO=0 conn=3 myRSS=2587 php=3 phpRSS=110 ap=122 tcp=45 topuser=evolution 2026-08-27 13:49:47 L1=2.30 run=4 blk=0 avail=6242 (53.2%) swpO=0 conn=2 myRSS=2587 php=2 phpRSS=108 ap=115 tcp=32 topuser=evolution 2026-08-27 13:49:50 L1=2.36 run=5 blk=0 avail=6262 (53.4%) swpO=0 conn=3 myRSS=2587 php=2 phpRSS=97 ap=112 tcp=41 topuser=customc 2026-08-27 13:49:57 L1=2.41 run=22 blk=1 avail=4552 (38.8%) swpO=918 conn=15 myRSS=2566 php=14 phpRSS=1998 ap=105 tcp=53 topuser=corpkicks