INCIDENT 2026-08-28 00:21:09 trigger: php_rss=2876MB mysql_conn=15 ================================================================== load: 0.48 0.96 1.26 14/686 70698 ncpu:10 mem_avail: 6301MB/13777MB (45.7%) swap_used:2541MB swapout:91/s blocked(D):0 running:20 iowait:0.1% steal:0.0% php: 17 procs / 2876MB heaviest user: corpkicks (12 procs, 2519MB) apache: 23 procs tcp_estab: 53 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2746 corpkicks 12 2583 root 249 939 nobody 22 376 netdata 8 262 madalice 1 156 cpanellogin 1 111 evolution 5 71 kurri 5 64 olympic 1 63 mailman 20 47 dovenull 6 45 infinium 3 42 aaa 2 30 lowrange 2 28 mailnull 5 23 wp-toolkit 6 18 dovecot 3 18 zabbix 1 14 nscd 1 6 --- php workers by user --- USER PROCS RSS_MB corpkicks 12 2613 madalice 1 156 root 2 72 evolution 1 68 olympic 1 64 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5765 MB Active(file): 2610 MB Inactive(file): 3197 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 443 MB CommitLimit: 10984 MB Committed_AS: 9804 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3565593 root 23:09:53 3424 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2807296 15.7 Ssl 2-20:49:53 /usr/sbin/mariadbd 70634 38688 corpkicks 280988 72.5 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 70636 53644 corpkicks 279556 72.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 70645 70633 corpkicks 274164 69.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 70640 70044 corpkicks 273776 81.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 70638 56614 corpkicks 273000 84.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 70642 55817 corpkicks 260268 74.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 70639 70372 corpkicks 256876 75.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 70641 55728 corpkicks 247632 72.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 70637 55826 corpkicks 244444 80.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 70635 55814 corpkicks 241836 60.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1220 1 netdata 205680 2.5 Ssl 59-14:11:19 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1910875 3797563 root 172892 0.1 S 11:07:17 spamd child 70244 3787359 madalice 159856 8.3 S 00:30 php-fpm: pool madalice_com_au 3846467 3797563 root 141852 0.0 S 21:45:35 spamd child 70651 55785 corpkicks 123832 49.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2575382 1 root 122984 0.0 Ss 12-16:30:40 /usr/lib/systemd/systemd-journald 2805458 1353308 cpanellogin 113072 0.0 S 07:01:41 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 70660 70655 corpkicks 80384 28.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3797563 1 root 78176 0.0 Ss 21:58:13 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 70659 70656 olympic 72868 36.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4180059 4180015 evolution 70292 0.0 Ss 21:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 2223 1201 root 42164 0.0 Sl 59-14:11:18 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3066250 1 root 39892 0.0 Ss 05:49:44 php-fpm: master process (/opt/cpanel/ea-php82/root/etc/php-fpm.conf) 4922 2431 netdata 35660 0.1 Sl 59-14:11:14 /usr/libexec/netdata/plugins.d/go.d.plugin 1 4180253 1 root 34940 0.0 Ss 21:07 lfd - sleeping 3787359 1 root 34444 0.0 Ss 02:17:06 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1353308 1 root 27420 0.0 Ss 36-21:39:49 cpsrvd (SSL) - waiting for connections 70667 1469 root 24788 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 55728 3066150 nobody 22564 0.0 S 02:13 /usr/sbin/httpd -k start 53644 3066150 nobody 22200 0.0 S 05:01 /usr/sbin/httpd -k start 38688 3066150 nobody 21480 0.0 S 07:16 /usr/sbin/httpd -k start 55814 3066150 nobody 21280 0.0 S 02:08 /usr/sbin/httpd -k start 55817 3066150 nobody 20716 0.0 S 02:08 /usr/sbin/httpd -k start 54267 3066150 nobody 20108 0.1 S 04:07 /usr/sbin/httpd -k start 55826 3066150 nobody 20084 0.0 S 02:07 /usr/sbin/httpd -k start 185104 2431 netdata 19900 2.1 Sl 15-03:47:37 /usr/libexec/netdata/plugins.d/apps.plugin 1 55785 3066150 nobody 19852 0.0 S 02:09 /usr/sbin/httpd -k start 55828 3066150 nobody 19804 0.0 S 02:07 /usr/sbin/httpd -k start 1469 1 root 19752 0.1 Ss 59-14:11:18 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 70168 3066150 nobody 19364 0.0 S 00:33 /usr/sbin/httpd -k start 70167 3066150 nobody 19044 0.2 S 00:33 /usr/sbin/httpd -k start 55829 3066150 nobody 18440 0.0 S 02:07 /usr/sbin/httpd -k start 56614 3066150 nobody 18424 0.0 S 01:07 /usr/sbin/httpd -k start 70372 3066150 nobody 18400 0.0 S 00:19 /usr/sbin/httpd -k start 70044 3066150 nobody 17408 0.0 S 00:44 /usr/sbin/httpd -k start 70158 3066150 nobody 17064 0.0 S 00:34 /usr/sbin/httpd -k start 70655 3066150 nobody 16836 0.0 S 00:01 /usr/sbin/httpd -k start 70633 3066150 nobody 16776 0.0 S 00:02 /usr/sbin/httpd -k start 70656 3066150 nobody 16776 0.0 S 00:01 /usr/sbin/httpd -k start 3804135 3828812 aaa 15924 0.0 S 02:12:42 dovecot/imap 4092863 3828812 kurri 15164 0.0 S 49:59 dovecot/imap 3671 3828812 aaa 14804 0.0 S 17:54 dovecot/imap 53581 3828812 kurri 14624 0.0 S 05:06 dovecot/imap 4111287 3828812 lowrange 14560 0.0 S 44:01 dovecot/imap 4161063 3828812 infinium 14512 0.0 S 30:51 dovecot/imap 1204 1 zabbix 14496 0.2 Ssl 59-14:11:19 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 20579 3828812 lowrange 14472 0.0 S 13:58 dovecot/imap 39302 3828812 infinium 14408 0.0 S 06:20 dovecot/imap 19387 3828812 infinium 14392 0.0 S 15:28 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 14132302 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min olympic/olympicfencing.com.au-ssl_log 84 customc/customcentral.com.au-ssl_log 45 evolution/portal.evolutionerp.com.au-ssl_log 24 corpkicks/corporatekicks.com.au-ssl_log 16 madalice/madalice.com.au-ssl_log 6 olympic/olympicfencing.com.au 5 aaa/aaadownunder.com.au-ssl_log 3 corpkicks/corporatekicks.com.au 2 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 71 158.23.147.79 45 20.48.251.3 24 203.54.180.238 16 169.58.198.241 15 103.178.175.229 3 118.127.40.55 2 91.92.243.234 1 34.196.51.17 1 2a03:2880:f802:3c:: 1 2a03:2880:f802:3b:: 1 216.26.245.21 1 209.50.177.209 1 181.68.155.128 1 114.119.140.234 1 114.119.137.101 --- top request paths across all vhosts (last 3 min) --- 24 GET /heartbeat.php 13 POST / 4 GET / 3 POST /wp-cron.php 2 POST /wp-login.php 2 GET /wp-includes/fonts.php 2 GET /wp-includes/compat-utf8.php 2 GET /wp-includes/class-wp-url-pattern-prefixer.php 2 GET /wp-includes/class-wp-token-map.php 2 GET /wp-includes/class-wpdb.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /this_is_a_new_hello_world.php 2 GET /store/hand-painted-nike-af1-snake-rose-white/ 2 GET /ms-edit.php 2 GET /css.php 1 HEAD / 1 GET /zz.php 1 GET /xxx.php 1 GET /xx.php 1 GET /xpw.php --- busiest 3 vhosts: top paths + last 10 requests --- == olympic/olympicfencing.com.au-ssl_log == -- top paths -- 2 GET / 1 GET /xxx.php 1 GET /xx.php 1 GET /xpw.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /wp-links.php 1 GET /wp-includes/Text/autoload_classmap.php 1 GET /wp-includes/speculative-loading.php 1 GET /wp-includes/script-modules.php 1 GET /wp-includes/robots-template.php 1 GET /wp-includes/IXR/index.php -- last 10 requests -- 169.58.198.241 - - [28/Aug/2026:00:21:00 +1000] "GET /wp-includes/speculative-loading.php HTTP/1.1" 200 - "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.8 158.23.147.79 - - [28/Aug/2026:00:21:00 +1000] "GET /manager.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [28/Aug/2026:00:21:01 +1000] "GET /wp-links.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [28/Aug/2026:00:21:01 +1000] "GET /fi2.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [28/Aug/2026:00:21:02 +1000] "GET /a.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [28/Aug/2026:00:21:02 +1000] "GET /gecko-new.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [28/Aug/2026:00:21:02 +1000] "GET /about.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [28/Aug/2026:00:21:03 +1000] "GET /alfanew.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [28/Aug/2026:00:21:03 +1000] "GET /text.php HTTP/1.1" 401 36 "-" "-" 158.23.147.79 - - [28/Aug/2026:00:21:03 +1000] "GET /f.php HTTP/1.1" 401 36 "-" "-" == customc/customcentral.com.au-ssl_log == -- top paths -- 1 GET /zz.php 1 GET /xda.php 1 GET /ws62.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-content/db-status.php 1 GET /wp-class.php 1 GET /wp-access.php 1 GET /umgebung.php 1 GET /ty.php 1 GET /tinyfilemanager.php 1 GET /time.php 1 GET /thui.php -- last 10 requests -- 20.48.251.3 - - [28/Aug/2026:00:21:04 +1000] "GET /ws62.php HTTP/1.1" 404 5750 "-" "-" 20.48.251.3 - - [28/Aug/2026:00:21:04 +1000] "GET /wp-class.php HTTP/1.1" 404 5750 "-" "-" 20.48.251.3 - - [28/Aug/2026:00:21:04 +1000] "GET /hosty.php HTTP/1.1" 404 5750 "-" "-" 20.48.251.3 - - [28/Aug/2026:00:21:05 +1000] "GET /temp.php HTTP/1.1" 404 5750 "-" "-" 20.48.251.3 - - [28/Aug/2026:00:21:05 +1000] "GET /php-details.php HTTP/1.1" 404 5750 "-" "-" 20.48.251.3 - - [28/Aug/2026:00:21:06 +1000] "GET /ms-edit.php HTTP/1.1" 404 5750 "-" "-" 20.48.251.3 - - [28/Aug/2026:00:21:06 +1000] "GET /requirements.php HTTP/1.1" 404 5750 "-" "-" 20.48.251.3 - - [28/Aug/2026:00:21:07 +1000] "GET /hochladen.form.php HTTP/1.1" 404 5750 "-" "-" 20.48.251.3 - - [28/Aug/2026:00:21:07 +1000] "GET /asdf.php HTTP/1.1" 404 5750 "-" "-" 20.48.251.3 - - [28/Aug/2026:00:21:08 +1000] "GET /zz.php HTTP/1.1" 404 5750 "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 24 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [28/Aug/2026:00:20:10 +1000] "GET /heartbeat.php?sentAt=1787840410&bytes=106,144,71,154&_=1787810679338 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [28/Aug/2026:00:20:12 +1000] "GET /heartbeat.php?sentAt=1787840412&bytes=106,144,71,156&_=1787835389895 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [28/Aug/2026:00:20:20 +1000] "GET /heartbeat.php?sentAt=1787840420&bytes=106,144,71,164&_=1787810679339 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [28/Aug/2026:00:20:22 +1000] "GET /heartbeat.php?sentAt=1787840422&bytes=106,144,71,166&_=1787835389896 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [28/Aug/2026:00:20:30 +1000] "GET /heartbeat.php?sentAt=1787840430&bytes=106,144,71,174&_=1787810679340 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [28/Aug/2026:00:20:32 +1000] "GET /heartbeat.php?sentAt=1787840432&bytes=106,144,71,176&_=1787835389897 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [28/Aug/2026:00:20:40 +1000] "GET /heartbeat.php?sentAt=1787840440&bytes=106,144,71,184&_=1787810679341 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [28/Aug/2026:00:20:42 +1000] "GET /heartbeat.php?sentAt=1787840442&bytes=106,144,71,186&_=1787835389898 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [28/Aug/2026:00:20:50 +1000] "GET /heartbeat.php?sentAt=1787840450&bytes=106,144,71,194&_=1787810679342 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [28/Aug/2026:00:20:52 +1000] "GET /heartbeat.php?sentAt=1787840452&bytes=106,144,71,196&_=1787835389899 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-08-28 00:18:48 L1=1.09 run=1 blk=0 avail=8363 (60.7%) swpO=0 conn=4 myRSS=2752 php=5 phpRSS=432 ap=16 tcp=34 topuser=madalice 2026-08-28 00:18:49 L1=1.09 run=1 blk=0 avail=8379 (60.8%) swpO=0 conn=2 myRSS=2752 php=5 phpRSS=432 ap=15 tcp=32 topuser=madalice 2026-08-28 00:18:58 L1=0.92 run=1 blk=0 avail=8372 (60.8%) swpO=0 conn=4 myRSS=2752 php=5 phpRSS=432 ap=15 tcp=39 topuser=madalice 2026-08-28 00:18:59 L1=0.92 run=3 blk=0 avail=8355 (60.6%) swpO=0 conn=2 myRSS=2752 php=5 phpRSS=448 ap=16 tcp=41 topuser=madalice 2026-08-28 00:19:08 L1=1.16 run=2 blk=0 avail=8228 (59.7%) swpO=2 conn=4 myRSS=2752 php=6 phpRSS=524 ap=27 tcp=46 topuser=madalice 2026-08-28 00:19:09 L1=1.16 run=2 blk=0 avail=8068 (58.6%) swpO=2 conn=3 myRSS=2752 php=6 phpRSS=694 ap=26 tcp=40 topuser=madalice 2026-08-28 00:19:18 L1=1.05 run=1 blk=0 avail=8334 (60.5%) swpO=0 conn=2 myRSS=2752 php=5 phpRSS=454 ap=19 tcp=37 topuser=madalice 2026-08-28 00:19:19 L1=1.05 run=1 blk=0 avail=8342 (60.6%) swpO=0 conn=3 myRSS=2752 php=5 phpRSS=454 ap=18 tcp=35 topuser=madalice 2026-08-28 00:19:28 L1=0.96 run=3 blk=0 avail=8353 (60.6%) swpO=0 conn=2 myRSS=2752 php=5 phpRSS=459 ap=15 tcp=36 topuser=madalice 2026-08-28 00:19:29 L1=0.96 run=1 blk=0 avail=8356 (60.7%) swpO=0 conn=3 myRSS=2752 php=5 phpRSS=454 ap=15 tcp=35 topuser=madalice 2026-08-28 00:19:38 L1=0.81 run=1 blk=0 avail=8358 (60.7%) swpO=0 conn=2 myRSS=2752 php=5 phpRSS=455 ap=15 tcp=35 topuser=madalice 2026-08-28 00:19:39 L1=0.81 run=1 blk=0 avail=8357 (60.7%) swpO=0 conn=3 myRSS=2752 php=5 phpRSS=455 ap=15 tcp=35 topuser=madalice 2026-08-28 00:19:48 L1=0.77 run=1 blk=1 avail=8356 (60.7%) swpO=0 conn=2 myRSS=2752 php=5 phpRSS=455 ap=15 tcp=38 topuser=madalice 2026-08-28 00:19:49 L1=0.77 run=2 blk=0 avail=8351 (60.6%) swpO=0 conn=3 myRSS=2752 php=5 phpRSS=459 ap=15 tcp=37 topuser=madalice 2026-08-28 00:19:59 L1=0.73 run=1 blk=0 avail=8343 (60.6%) swpO=0 conn=2 myRSS=2752 php=5 phpRSS=454 ap=16 tcp=42 topuser=madalice 2026-08-28 00:20:00 L1=0.73 run=2 blk=0 avail=8298 (60.2%) swpO=0 conn=3 myRSS=2752 php=6 phpRSS=527 ap=16 tcp=43 topuser=madalice 2026-08-28 00:20:09 L1=0.85 run=4 blk=0 avail=8250 (59.9%) swpO=0 conn=2 myRSS=2752 php=6 phpRSS=563 ap=17 tcp=37 topuser=madalice 2026-08-28 00:20:10 L1=0.85 run=4 blk=0 avail=8199 (59.5%) swpO=0 conn=4 myRSS=2752 php=7 phpRSS=651 ap=17 tcp=40 topuser=madalice 2026-08-28 00:20:19 L1=0.72 run=1 blk=0 avail=8345 (60.6%) swpO=0 conn=2 myRSS=2752 php=5 phpRSS=454 ap=16 tcp=35 topuser=madalice 2026-08-28 00:20:20 L1=0.72 run=1 blk=0 avail=8346 (60.6%) swpO=0 conn=4 myRSS=2752 php=5 phpRSS=454 ap=15 tcp=33 topuser=madalice 2026-08-28 00:20:29 L1=0.61 run=1 blk=0 avail=8341 (60.5%) swpO=0 conn=2 myRSS=2752 php=5 phpRSS=454 ap=16 tcp=36 topuser=madalice 2026-08-28 00:20:30 L1=0.61 run=1 blk=0 avail=8347 (60.6%) swpO=0 conn=4 myRSS=2752 php=5 phpRSS=454 ap=16 tcp=36 topuser=madalice 2026-08-28 00:20:39 L1=0.59 run=2 blk=0 avail=8365 (60.7%) swpO=0 conn=2 myRSS=2752 php=5 phpRSS=420 ap=18 tcp=42 topuser=madalice 2026-08-28 00:20:40 L1=0.59 run=2 blk=0 avail=8413 (61.1%) swpO=0 conn=4 myRSS=2752 php=4 phpRSS=347 ap=18 tcp=42 topuser=madalice 2026-08-28 00:20:49 L1=0.58 run=2 blk=0 avail=8348 (60.6%) swpO=0 conn=2 myRSS=2752 php=5 phpRSS=431 ap=18 tcp=41 topuser=madalice 2026-08-28 00:20:50 L1=0.58 run=1 blk=0 avail=8342 (60.5%) swpO=0 conn=4 myRSS=2752 php=6 phpRSS=454 ap=18 tcp=41 topuser=madalice 2026-08-28 00:20:59 L1=0.57 run=1 blk=0 avail=8303 (60.3%) swpO=0 conn=2 myRSS=2752 php=5 phpRSS=454 ap=20 tcp=45 topuser=madalice 2026-08-28 00:21:00 L1=0.57 run=2 blk=0 avail=8289 (60.2%) swpO=0 conn=4 myRSS=2752 php=6 phpRSS=495 ap=20 tcp=45 topuser=madalice 2026-08-28 00:21:09 L1=0.48 run=20 blk=0 avail=6301 (45.7%) swpO=91 conn=15 myRSS=2749 php=17 phpRSS=2876 ap=23 tcp=53 topuser=corpkicks 2026-08-28 00:21:10 L1=0.48 run=21 blk=0 avail=5501 (39.9%) swpO=1348 conn=18 myRSS=2714 php=22 phpRSS=3790 ap=27 tcp=66 topuser=corpkicks