INCIDENT 2026-08-28 02:45:45 trigger: php_rss=1623MB ================================================================== load: 1.02 0.83 1.16 4/598 613930 ncpu:10 mem_avail: 9239MB/13777MB (67.1%) swap_used:370MB swapout:0/s blocked(D):0 running:6 iowait:0.2% steal:0.0% php: 11 procs / 1623MB heaviest user: madalice (9 procs, 1533MB) apache: 56 procs tcp_estab: 40 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 9 1376 root 250 1227 nobody 55 990 mysql 1 540 mailman 20 417 netdata 7 217 wp-toolkit 3 133 mailnull 4 79 cpanellogin 1 72 evolution 5 69 dovenull 6 65 kurri 4 56 named 1 55 zabbix 1 28 dovecot 3 28 polkitd 1 24 aaa 1 15 lowrange 1 14 infinium 1 14 rpc 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 9 1381 evolution 1 55 root 1 33 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 8189 MB Active(file): 4348 MB Inactive(file): 4175 MB Dirty: 3 MB Writeback: 0 MB SReclaimable: 722 MB CommitLimit: 10984 MB Committed_AS: 8310 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 27:05 14820 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 553844 2.1 Ssl 26:34 /usr/sbin/mariadbd 613633 510022 madalice 205900 13.0 S 00:25 php-fpm: pool madalice_com_au 602500 510022 madalice 202120 18.2 R 00:42 php-fpm: pool madalice_com_au 529388 527476 root 184860 0.0 S 21:27 spamd child 613632 510022 madalice 179356 13.1 R 00:25 php-fpm: pool madalice_com_au 527476 1 root 175656 0.3 Ss 23:06 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 508924 1 netdata 168252 1.9 Ssl 26:03 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 529389 527476 root 168124 0.0 S 21:27 spamd child 580586 510022 madalice 161188 12.9 S 06:40 php-fpm: pool madalice_com_au 613570 510022 madalice 159728 17.4 S 00:29 php-fpm: pool madalice_com_au 613572 510022 madalice 159592 15.5 S 00:29 php-fpm: pool madalice_com_au 613894 510022 madalice 125412 57.0 S 00:02 php-fpm: pool madalice_com_au 613895 510022 madalice 125388 56.5 S 00:02 php-fpm: pool madalice_com_au 613868 510022 madalice 125376 57.0 S 00:02 php-fpm: pool madalice_com_au 483542 1 wp-toolkit 75888 0.0 Ss 27:25 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 508149 1353308 cpanellogin 73908 0.1 S 26:19 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 509236 509098 root 62400 0.0 Sl 26:00 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4180059 4180015 evolution 57076 0.0 Ss 02:45:45 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 508634 1 named 56976 0.0 Ssl 26:08 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 483546 1 wp-toolkit 49324 0.0 Ss 27:25 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 482788 1 root 43144 0.0 Ss 28:24 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 509098 1 root 42224 0.0 Ss 26:01 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion 1353308 1 root 42116 0.0 Ss 37-00:04:26 cpsrvd (SSL) - waiting for connections 1469 1 root 41504 0.1 Ss 59-16:35:55 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 526869 1 root 37900 0.0 Ss 23:29 lfd - sleeping 510022 1 root 34248 0.0 Ss 25:56 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 481558 1 root 32012 0.1 Ssl 28:27 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 483898 1 zabbix 28848 0.2 Ssl 27:17 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 508591 1 polkitd 25192 0.0 Ssl 26:08 /usr/lib/polkit-1/polkitd --no-debug 1463 1 root 24660 0.0 Ss 59-16:35:55 tailwatchd 598694 506832 nobody 24524 0.0 S 02:28 /usr/sbin/httpd -k start 596956 506832 nobody 23388 0.0 S 04:10 /usr/sbin/httpd -k start 596114 506832 nobody 22760 0.0 S 05:02 /usr/sbin/httpd -k start 508863 508814 mailman 22304 0.0 S 26:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 508851 508814 mailman 22288 0.0 S 26:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 508857 508814 mailman 22288 0.0 S 26:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 508856 508814 mailman 22212 0.0 S 26:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508855 508814 mailman 22180 0.0 S 26:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 508864 508814 mailman 22136 0.0 S 26:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 508867 508814 mailman 22120 0.0 S 26:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 508858 508814 mailman 22100 0.0 S 26:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s 508861 508814 mailman 22100 0.0 S 26:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 508860 508814 mailman 22028 0.0 S 26:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 508865 508814 mailman 22028 0.0 S 26:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 508850 508814 mailman 22016 0.0 S 26:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:0:2 -s 508854 508814 mailman 22004 0.0 S 26:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 508852 508814 mailman 22000 0.0 S 26:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s 508866 508814 mailman 21896 0.0 S 26:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 508853 508814 mailman 21868 0.0 S 26:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 508849 508814 mailman 21832 0.0 S 26:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=ArchRunner:0:1 -s 508859 508814 mailman 21828 0.0 S 26:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 508862 508814 mailman 21828 0.0 S 26:06 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 613566 506832 nobody 21488 0.1 S 00:29 /usr/sbin/httpd -k start 596974 506832 nobody 21268 0.0 S 04:08 /usr/sbin/httpd -k start 599637 506832 nobody 21016 0.0 S 00:49 /usr/sbin/httpd -k start 599265 506832 nobody 20808 0.0 S 01:30 /usr/sbin/httpd -k start 508720 1 mailnull 20584 0.0 Ss 26:07 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 613511 506832 nobody 20564 0.0 S 00:32 /usr/sbin/httpd -k start 613607 506832 nobody 20532 0.0 S 00:28 /usr/sbin/httpd -k start 613611 506832 nobody 20512 0.0 S 00:28 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 1995 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min customc/customcentral.com.au-ssl_log 84 madalice/madalice.com.au-ssl_log 80 lowrange/lowrange.com.au-ssl_log 28 evolution/portal.evolutionerp.com.au-ssl_log 26 candyfabcom/candyfab.com.au-ssl_log 18 aaa/aaadownunder.com.au-ssl_log 9 corpkicks/corporatekicks.com.au-ssl_log 6 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 81 20.48.250.41 35 20.48.251.3 28 4.204.200.136 26 203.54.180.238 25 147.224.255.6 18 82.102.18.190 10 108.130.197.167 5 118.127.40.55 3 136.108.62.72 2 47.128.32.36 2 34.196.51.17 2 198.98.59.181 2 162.241.216.122 2 114.119.140.234 2 106.54.62.156 --- top request paths across all vhosts (last 3 min) --- 26 GET /heartbeat.php 9 GET / 5 POST /wp-cron.php 3 GET /store/kids-af1-spaceship-alien/ 2 POST /wp-login.php 2 HEAD / 2 GET //xmlrpc.php 2 GET /wp-login.php 2 GET //wp-includes/wlwmanifest.xml 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /this_is_a_new_hello_world.php 2 GET /product-category/custom-orders/ 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 POST / 1 GET /yj09.php 1 GET /xxw.php 1 GET /xwx1.php 1 GET /xmy.php --- busiest 3 vhosts: top paths + last 10 requests --- == customc/customcentral.com.au-ssl_log == -- top paths -- 1 POST /wp-login.php 1 POST /wp-cron.php 1 GET /xxw.php 1 GET /xwx1.php 1 GET /xiugai.php 1 GET /xa.php 1 GET /wtiiy.php 1 GET /ws87.php 1 GET /ws85.php 1 GET /ws80.php 1 GET /ws78.php 1 GET /ws58.php -- last 10 requests -- 20.48.250.41 - - [28/Aug/2026:02:43:48 +1000] "GET /koiy.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [28/Aug/2026:02:43:48 +1000] "GET /kj.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [28/Aug/2026:02:43:49 +1000] "GET /xiugai.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [28/Aug/2026:02:43:49 +1000] "GET /ortasekerli1.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [28/Aug/2026:02:43:50 +1000] "GET /xxw.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [28/Aug/2026:02:43:50 +1000] "GET /ioxi-o.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [28/Aug/2026:02:43:51 +1000] "GET /155.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [28/Aug/2026:02:43:51 +1000] "GET /tinynologin.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [28/Aug/2026:02:43:52 +1000] "GET /UuAFIYGYKdefault.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [28/Aug/2026:02:43:52 +1000] "GET /grsiuk.php HTTP/1.1" 401 36 "-" "-" == madalice/madalice.com.au-ssl_log == -- top paths -- 3 GET /store/kids-af1-spaceship-alien/ 3 GET / 2 GET /product-category/custom-orders/ 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 POST / 1 GET /xmy.php 1 GET /wp-blog.php 1 GET /wp-admin/sc.php 1 GET /wander.php 1 GET /v4.php -- last 10 requests -- 108.130.197.167 - - [28/Aug/2026:02:45:20 +1000] "POST /api/graphql HTTP/1.1" 404 36638 "https://www.madalice.com.au" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Saf 47.128.32.36 - - [28/Aug/2026:02:45:21 +1000] "POST /?wc-ajax=get_refreshed_fragments HTTP/1.1" 200 601 "https://madalice.com.au/custom-shoes-durability/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like 108.130.197.167 - - [28/Aug/2026:02:45:23 +1000] "POST /v1/graphql HTTP/1.1" 404 36638 "https://www.madalice.com.au" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safa 114.119.140.234 - - [28/Aug/2026:02:45:38 +1000] "GET /store/hand-painted-nike-af1-pink-pastel-flower/?rating=1&verified=1&wcpr_page=2 HTTP/1.1" 301 1 "https://madalice.com.au/store/hand-painted-nike-af1-pink-pastel-flow 108.130.197.167 - - [28/Aug/2026:02:45:43 +1000] "GET /secure HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 108.130.197.167 - - [28/Aug/2026:02:45:43 +1000] "GET /backoffice HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 108.130.197.167 - - [28/Aug/2026:02:45:43 +1000] "GET /admin/login HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 108.130.197.167 - - [28/Aug/2026:02:45:43 +1000] "GET /console HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 108.130.197.167 - - [28/Aug/2026:02:45:43 +1000] "GET /app HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" 108.130.197.167 - - [28/Aug/2026:02:45:43 +1000] "GET /dashboard HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" == lowrange/lowrange.com.au-ssl_log == -- top paths -- 1 GET /yj09.php 1 GET /w.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-0.php 1 GET /verox.php 1 GET /this_is_a_new_hello_world.php 1 GET /sky.php 1 GET /sixxis.php 1 GET /robots.php 1 GET /red.php 1 GET /or.php 1 GET /nail.php -- last 10 requests -- 4.204.200.136 - - [28/Aug/2026:02:45:25 +1000] "GET /100.php HTTP/1.1" 404 5749 "-" "-" 4.204.200.136 - - [28/Aug/2026:02:45:25 +1000] "GET /ccc.php?p= HTTP/1.1" 404 5749 "-" "-" 4.204.200.136 - - [28/Aug/2026:02:45:25 +1000] "GET /images.php HTTP/1.1" 404 5749 "-" "-" 4.204.200.136 - - [28/Aug/2026:02:45:26 +1000] "GET /alls.php HTTP/1.1" 404 5749 "-" "-" 4.204.200.136 - - [28/Aug/2026:02:45:26 +1000] "GET /coffexium.php HTTP/1.1" 404 5749 "-" "-" 4.204.200.136 - - [28/Aug/2026:02:45:27 +1000] "GET /red.php HTTP/1.1" 404 5749 "-" "-" 4.204.200.136 - - [28/Aug/2026:02:45:27 +1000] "GET /admin.php HTTP/1.1" 404 5749 "-" "-" 4.204.200.136 - - [28/Aug/2026:02:45:28 +1000] "GET /file52.php HTTP/1.1" 404 5749 "-" "-" 4.204.200.136 - - [28/Aug/2026:02:45:28 +1000] "GET /geck.php HTTP/1.1" 404 5749 "-" "-" 4.204.200.136 - - [28/Aug/2026:02:45:28 +1000] "GET /biufile.php HTTP/1.1" 404 5749 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-28 02:43:23 L1=0.67 run=1 blk=0 avail=10417(75.6%) swpO=0 conn=2 myRSS=540 php=6 phpRSS=584 ap=21 tcp=34 topuser=madalice 2026-08-28 02:43:24 L1=0.67 run=2 blk=0 avail=10518(76.3%) swpO=0 conn=2 myRSS=540 php=4 phpRSS=421 ap=21 tcp=31 topuser=madalice 2026-08-28 02:43:33 L1=0.65 run=7 blk=0 avail=10473(76.0%) swpO=1 conn=2 myRSS=540 php=5 phpRSS=531 ap=18 tcp=30 topuser=madalice 2026-08-28 02:43:34 L1=0.65 run=2 blk=0 avail=10478(76.1%) swpO=1 conn=2 myRSS=540 php=5 phpRSS=516 ap=18 tcp=31 topuser=madalice 2026-08-28 02:43:43 L1=0.55 run=2 blk=0 avail=10495(76.2%) swpO=0 conn=2 myRSS=540 php=6 phpRSS=524 ap=18 tcp=30 topuser=madalice 2026-08-28 02:43:44 L1=0.55 run=1 blk=0 avail=10546(76.6%) swpO=0 conn=2 myRSS=540 php=4 phpRSS=420 ap=18 tcp=30 topuser=madalice 2026-08-28 02:43:53 L1=0.54 run=1 blk=0 avail=10537(76.5%) swpO=0 conn=2 myRSS=540 php=5 phpRSS=459 ap=18 tcp=28 topuser=madalice 2026-08-28 02:43:54 L1=0.54 run=1 blk=0 avail=10549(76.6%) swpO=0 conn=2 myRSS=540 php=4 phpRSS=420 ap=18 tcp=28 topuser=madalice 2026-08-28 02:44:03 L1=0.61 run=1 blk=0 avail=10541(76.5%) swpO=0 conn=2 myRSS=540 php=5 phpRSS=459 ap=18 tcp=30 topuser=madalice 2026-08-28 02:44:04 L1=0.61 run=2 blk=0 avail=10488(76.1%) swpO=0 conn=2 myRSS=540 php=4 phpRSS=488 ap=18 tcp=31 topuser=madalice 2026-08-28 02:44:13 L1=0.59 run=3 blk=0 avail=10478(76.1%) swpO=0 conn=2 myRSS=540 php=5 phpRSS=459 ap=17 tcp=31 topuser=madalice 2026-08-28 02:44:14 L1=0.59 run=4 blk=0 avail=10362(75.2%) swpO=0 conn=2 myRSS=540 php=6 phpRSS=680 ap=17 tcp=31 topuser=madalice 2026-08-28 02:44:23 L1=0.58 run=2 blk=0 avail=10538(76.5%) swpO=0 conn=2 myRSS=540 php=5 phpRSS=463 ap=18 tcp=33 topuser=madalice 2026-08-28 02:44:25 L1=0.58 run=2 blk=0 avail=10500(76.2%) swpO=0 conn=2 myRSS=540 php=5 phpRSS=498 ap=18 tcp=32 topuser=madalice 2026-08-28 02:44:33 L1=0.57 run=2 blk=0 avail=10495(76.2%) swpO=0 conn=2 myRSS=540 php=5 phpRSS=533 ap=15 tcp=25 topuser=madalice 2026-08-28 02:44:35 L1=0.57 run=1 blk=0 avail=10577(76.8%) swpO=0 conn=2 myRSS=540 php=4 phpRSS=420 ap=15 tcp=27 topuser=madalice 2026-08-28 02:44:43 L1=0.65 run=4 blk=0 avail=10447(75.8%) swpO=0 conn=2 myRSS=540 php=6 phpRSS=610 ap=15 tcp=32 topuser=madalice 2026-08-28 02:44:45 L1=0.65 run=2 blk=0 avail=10202(74.1%) swpO=0 conn=2 myRSS=540 php=6 phpRSS=857 ap=15 tcp=34 topuser=corpkicks 2026-08-28 02:44:53 L1=0.63 run=1 blk=0 avail=10565(76.7%) swpO=0 conn=2 myRSS=540 php=5 phpRSS=459 ap=15 tcp=28 topuser=madalice 2026-08-28 02:44:55 L1=0.63 run=1 blk=0 avail=10573(76.7%) swpO=0 conn=2 myRSS=540 php=4 phpRSS=419 ap=15 tcp=30 topuser=madalice 2026-08-28 02:45:03 L1=0.69 run=3 blk=0 avail=10139(73.6%) swpO=0 conn=2 myRSS=540 php=8 phpRSS=943 ap=16 tcp=37 topuser=corpkicks 2026-08-28 02:45:05 L1=0.69 run=6 blk=0 avail=10168(73.8%) swpO=0 conn=5 myRSS=540 php=7 phpRSS=872 ap=17 tcp=36 topuser=madalice 2026-08-28 02:45:13 L1=0.81 run=1 blk=0 avail=10345(75.1%) swpO=0 conn=2 myRSS=540 php=7 phpRSS=687 ap=19 tcp=65 topuser=madalice 2026-08-28 02:45:15 L1=0.81 run=2 blk=0 avail=10313(74.9%) swpO=0 conn=5 myRSS=540 php=6 phpRSS=647 ap=25 tcp=67 topuser=madalice 2026-08-28 02:45:23 L1=1.43 run=2 blk=0 avail=9484 (68.8%) swpO=744 conn=2 myRSS=540 php=11 phpRSS=1244 ap=77 tcp=81 topuser=madalice 2026-08-28 02:45:25 L1=1.43 run=1 blk=0 avail=9512 (69.0%) swpO=744 conn=5 myRSS=540 php=10 phpRSS=1198 ap=76 tcp=75 topuser=madalice 2026-08-28 02:45:33 L1=1.21 run=2 blk=0 avail=9611 (69.8%) swpO=0 conn=2 myRSS=540 php=9 phpRSS=1128 ap=68 tcp=31 topuser=madalice 2026-08-28 02:45:35 L1=1.21 run=1 blk=0 avail=9633 (69.9%) swpO=0 conn=5 myRSS=540 php=9 phpRSS=1128 ap=66 tcp=32 topuser=madalice 2026-08-28 02:45:44 L1=1.02 run=10 blk=0 avail=9761 (70.8%) swpO=0 conn=2 myRSS=540 php=9 phpRSS=1068 ap=57 tcp=37 topuser=madalice 2026-08-28 02:45:45 L1=1.02 run=6 blk=0 avail=9239 (67.1%) swpO=0 conn=4 myRSS=540 php=11 phpRSS=1623 ap=56 tcp=40 topuser=madalice