INCIDENT 2026-08-28 03:00:50 trigger: php_rss=2897MB mysql_conn=21 ================================================================== load: 2.14 1.25 1.14 27/610 664271 ncpu:10 mem_avail: 8492MB/13777MB (61.6%) swap_used:383MB swapout:272/s blocked(D):0 running:21 iowait:0.1% steal:0.0% php: 22 procs / 2897MB heaviest user: corpkicks (20 procs, 2811MB) apache: 31 procs tcp_estab: 107 --- RSS by user (all processes) --- USER PROCS RSS_MB corpkicks 21 3002 root 257 1217 mysql 1 568 nobody 30 480 mailman 20 413 netdata 7 224 wp-toolkit 3 131 mailnull 5 98 cpanellogin 1 76 evolution 5 67 dovenull 6 67 named 1 56 kurri 3 42 infinium 3 42 dovecot 3 28 zabbix 1 27 polkitd 1 24 aaa 1 15 vinesit 1 14 madalice 1 14 --- php workers by user --- USER PROCS RSS_MB corpkicks 20 2921 evolution 1 54 root 1 31 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7317 MB Active(file): 4004 MB Inactive(file): 3631 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 706 MB CommitLimit: 10984 MB Committed_AS: 9125 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 42:09 14760 /usr/bin/imunify-agent-proxy 650108 root 00:49 2976 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 582100 2.6 Ssl 41:39 /usr/sbin/mariadbd 664203 664178 corpkicks 276132 45.6 R 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 664204 664179 corpkicks 272524 49.0 R 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 664209 649791 corpkicks 258904 47.3 R 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 664210 649558 corpkicks 246668 42.6 R 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 664191 664176 corpkicks 235540 46.0 R 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 664211 647595 corpkicks 231068 65.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 529388 527476 root 184700 0.0 S 36:32 spamd child 664226 664214 corpkicks 183944 44.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 527476 1 root 175572 0.1 Ss 38:11 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 508924 1 netdata 173124 1.9 Ssl 41:08 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 529389 527476 root 167940 0.0 S 36:32 spamd child 664227 647589 corpkicks 152040 31.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 664221 649570 corpkicks 145732 30.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 664223 632099 corpkicks 133424 26.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 664229 649159 corpkicks 124704 25.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 664228 632957 corpkicks 119676 24.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 664225 664213 corpkicks 117136 22.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 664231 664156 corpkicks 114672 20.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 664222 632606 corpkicks 111632 26.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 664230 649431 corpkicks 108008 22.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 664224 664212 corpkicks 92100 19.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 664238 664167 corpkicks 79780 24.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 508149 1353308 cpanellogin 78360 0.1 S 41:24 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 483542 1 wp-toolkit 74872 0.0 Ss 42:30 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 509236 509098 root 65000 0.0 Sl 41:05 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 664252 664168 corpkicks 60376 14.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 508634 1 named 57380 0.0 Ssl 41:13 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 4180059 4180015 evolution 55536 0.0 Ss 03:00:50 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 483546 1 wp-toolkit 48356 0.0 Ss 42:30 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 509098 1 root 42216 0.0 Ss 41:06 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion 1353308 1 root 42080 0.0 Ss 37-00:19:31 cpsrvd (SSL) - waiting for connections 482788 1 root 41548 0.0 Ss 43:29 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 1469 1 root 41444 0.1 Ss 59-16:51:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 526869 1 root 37096 0.0 Ss 38:34 lfd - sleeping 510022 1 root 32128 0.0 Ss 41:01 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 481558 1 root 32012 0.1 Ssl 43:32 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 483898 1 zabbix 27920 0.2 Ssl 42:22 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 508591 1 polkitd 25192 0.0 Ssl 41:13 /usr/lib/polkit-1/polkitd --no-debug 664041 508720 mailnull 25064 0.0 S 00:23 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1463 1 root 24652 0.0 Ss 59-16:51:00 tailwatchd 632957 506832 nobody 22672 0.0 S 06:33 /usr/sbin/httpd -k start 647589 506832 nobody 22332 0.0 S 05:05 /usr/sbin/httpd -k start 508863 508814 mailman 22304 0.0 S 41:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 508851 508814 mailman 22288 0.0 S 41:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 508857 508814 mailman 22288 0.0 S 41:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 508856 508814 mailman 22212 0.0 S 41:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508855 508814 mailman 22180 0.0 S 41:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 508864 508814 mailman 22136 0.0 S 41:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 508867 508814 mailman 22120 0.0 S 41:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 508858 508814 mailman 22100 0.0 S 41:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s 508861 508814 mailman 22100 0.0 S 41:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 508860 508814 mailman 22028 0.0 S 41:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 508865 508814 mailman 22028 0.0 S 41:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 508850 508814 mailman 22016 0.0 S 41:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:0:2 -s 508854 508814 mailman 22004 0.0 S 41:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 508852 508814 mailman 22000 0.0 S 41:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s 648310 506832 nobody 22000 0.0 S 03:54 /usr/sbin/httpd -k start 508866 508814 mailman 21896 0.0 S 41:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 508853 508814 mailman 21868 0.0 S 41:11 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3192 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min alison/alisonarts.com.au-ssl_log 180 evolution/my.evolutionerp.com.au-ssl_log 122 kurri/kurrimotorinn.com.au-ssl_log 97 evolution/portal.evolutionerp.com.au-ssl_log 22 corpkicks/corporatekicks.com.au-ssl_log 6 evolution/evolutionerp.com.au-ssl_log 5 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 170 158.23.184.117 120 158.158.54.35 97 74.248.24.12 22 203.54.180.238 3 118.127.40.55 3 114.119.141.112 2 198.235.24.47 2 167.71.240.77 1 85.208.96.198 1 40.77.167.247 1 34.196.51.17 1 216.244.66.198 1 185.191.171.4 1 162.241.244.118 1 151.228.192.81 --- top request paths across all vhosts (last 3 min) --- 22 GET /heartbeat.php 5 GET / 3 POST /wp-cron.php 3 GET /wp-login.php 3 GET /wp-admin/css/colors/modern/ 2 GET /xda.php 2 GET /wp-includes/ID3/index.php 2 GET /wp-includes/ID3/ 2 GET /wp-includes/fonts/ 2 GET /wp-includes/css/ 2 GET /wp-includes/bk/ 2 GET /wp-includes/ 2 GET /wp-content/uploads/ 2 GET /wp-content.php 2 GET /wp-content/admin.php 2 GET /wp-content/about.php 2 GET /wp-content/ 2 GET /wp-admin/js/ 2 GET /wp-admin/css/colors/blue/index.php 2 GET /wp-admin/ --- busiest 3 vhosts: top paths + last 10 requests --- == alison/alisonarts.com.au-ssl_log == -- top paths -- 1 POST /wp-login.php 1 GET /wp/wp-admin/includes/ 1 GET /wp-login.php 1 GET /wp-includes/sodium_compat/src/Core32/Curve25519/Ge/ 1 GET /wp-includes/SimplePie/XML/ 1 GET /wp-includes/SimplePie/Decode/HTML/ 1 GET /wp-includes/Requests/ 1 GET /wp-includes/js/tinymce/themes/ 1 GET /wp-includes/js/tinymce/plugins/fullscreen/ 1 GET /wp-includes/images/smilies/index.php 1 GET /wp-includes/images/smilies/about.php 1 GET /wp-includes/images/media/ -- last 10 requests -- 158.23.184.117 - - [28/Aug/2026:02:59:53 +1000] "GET /pages.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:02:59:53 +1000] "GET /php.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:02:59:53 +1000] "GET /php8.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:02:59:53 +1000] "GET /pinfo.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:02:59:53 +1000] "GET /robots.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:02:59:54 +1000] "GET /rt.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:02:59:54 +1000] "GET /s.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:02:59:54 +1000] "GET /setup.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:02:59:54 +1000] "GET /simple.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [28/Aug/2026:02:59:54 +1000] "GET /sts.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /index.php 1 GET /zup.php73 1 GET /x.php 1 GET /xleet.php 1 GET /xda.php 1 GET /ww5.php 1 GET /wso.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php -- last 10 requests -- 158.158.54.35 - - [28/Aug/2026:02:58:49 +1000] "GET /randkeyword.PhP7 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:02:58:49 +1000] "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:02:58:49 +1000] "GET /wp-content/ HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:02:58:49 +1000] "GET /ww5.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:02:58:50 +1000] "GET /2.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:02:58:50 +1000] "GET /wp-admin/classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:02:58:50 +1000] "GET /atomlib.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:02:58:50 +1000] "GET /rip.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:02:58:51 +1000] "GET /p.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 40.77.167.247 - - [28/Aug/2026:02:59:18 +1000] "GET /index.php?page=activities&keyword=endere%C3%A7o+lumino+park+db1 HTTP/1.1" 200 5288 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +ht == kurri/kurrimotorinn.com.au-ssl_log == -- top paths -- 1 GET /zoom1.php 1 GET /xx.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /ws81.php 1 GET /ws77.php 1 GET /ws37.php 1 GET /wp-trackback.php 1 GET /wp-the.php 1 GET /wp-themes.php 1 GET /wp-signin.php -- last 10 requests -- 74.248.24.12 - - [28/Aug/2026:03:00:23 +1000] "GET /install.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [28/Aug/2026:03:00:23 +1000] "GET /radio.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [28/Aug/2026:03:00:23 +1000] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [28/Aug/2026:03:00:24 +1000] "GET /wp-signin.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [28/Aug/2026:03:00:24 +1000] "GET /Ov-Simple1.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [28/Aug/2026:03:00:24 +1000] "GET /fm.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [28/Aug/2026:03:00:25 +1000] "GET /ftde.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [28/Aug/2026:03:00:25 +1000] "GET /hplfuns.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [28/Aug/2026:03:00:25 +1000] "GET /log.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.24.12 - - [28/Aug/2026:03:00:25 +1000] "GET /test.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-28 02:58:27 L1=0.81 run=2 blk=0 avail=10338(75.0%) swpO=0 conn=1 myRSS=565 php=5 phpRSS=668 ap=18 tcp=34 topuser=corpkicks 2026-08-28 02:58:29 L1=0.83 run=5 blk=0 avail=10420(75.6%) swpO=0 conn=1 myRSS=565 php=6 phpRSS=620 ap=18 tcp=31 topuser=corpkicks 2026-08-28 02:58:37 L1=0.84 run=1 blk=0 avail=10628(77.1%) swpO=0 conn=1 myRSS=565 php=4 phpRSS=342 ap=18 tcp=31 topuser=madalice 2026-08-28 02:58:39 L1=0.77 run=1 blk=0 avail=10696(77.6%) swpO=0 conn=1 myRSS=565 php=3 phpRSS=245 ap=18 tcp=27 topuser=madalice 2026-08-28 02:58:47 L1=0.87 run=1 blk=0 avail=10695(77.6%) swpO=0 conn=1 myRSS=565 php=3 phpRSS=243 ap=18 tcp=31 topuser=madalice 2026-08-28 02:58:49 L1=0.88 run=1 blk=0 avail=10694(77.6%) swpO=0 conn=1 myRSS=565 php=3 phpRSS=243 ap=18 tcp=28 topuser=madalice 2026-08-28 02:58:57 L1=1.05 run=3 blk=0 avail=10581(76.8%) swpO=0 conn=2 myRSS=565 php=5 phpRSS=370 ap=17 tcp=32 topuser=madalice 2026-08-28 02:58:59 L1=1.13 run=1 blk=0 avail=10698(77.6%) swpO=0 conn=1 myRSS=565 php=3 phpRSS=243 ap=17 tcp=28 topuser=madalice 2026-08-28 02:59:07 L1=1.20 run=1 blk=0 avail=10687(77.6%) swpO=0 conn=2 myRSS=565 php=3 phpRSS=245 ap=18 tcp=32 topuser=madalice 2026-08-28 02:59:09 L1=1.10 run=1 blk=0 avail=10688(77.6%) swpO=0 conn=1 myRSS=565 php=3 phpRSS=245 ap=18 tcp=30 topuser=madalice 2026-08-28 02:59:17 L1=1.24 run=2 blk=0 avail=10633(77.2%) swpO=0 conn=2 myRSS=565 php=4 phpRSS=349 ap=16 tcp=28 topuser=madalice 2026-08-28 02:59:19 L1=1.24 run=2 blk=0 avail=10705(77.7%) swpO=0 conn=1 myRSS=565 php=3 phpRSS=245 ap=16 tcp=28 topuser=madalice 2026-08-28 02:59:27 L1=1.20 run=2 blk=0 avail=10682(77.5%) swpO=0 conn=2 myRSS=565 php=3 phpRSS=243 ap=19 tcp=27 topuser=madalice 2026-08-28 02:59:29 L1=1.20 run=1 blk=0 avail=10704(77.7%) swpO=0 conn=1 myRSS=565 php=3 phpRSS=243 ap=18 tcp=29 topuser=madalice 2026-08-28 02:59:38 L1=1.09 run=1 blk=0 avail=10704(77.7%) swpO=0 conn=2 myRSS=565 php=3 phpRSS=243 ap=17 tcp=30 topuser=madalice 2026-08-28 02:59:39 L1=1.09 run=1 blk=0 avail=10704(77.7%) swpO=0 conn=1 myRSS=565 php=3 phpRSS=243 ap=17 tcp=30 topuser=madalice 2026-08-28 02:59:48 L1=1.21 run=1 blk=0 avail=10836(78.6%) swpO=0 conn=2 myRSS=565 php=2 phpRSS=88 ap=17 tcp=29 topuser=evolution 2026-08-28 02:59:49 L1=1.21 run=2 blk=0 avail=10732(77.9%) swpO=0 conn=1 myRSS=565 php=3 phpRSS=219 ap=17 tcp=28 topuser=corpkicks 2026-08-28 02:59:58 L1=1.17 run=1 blk=0 avail=10833(78.6%) swpO=0 conn=1 myRSS=565 php=2 phpRSS=88 ap=17 tcp=30 topuser=evolution 2026-08-28 02:59:59 L1=1.17 run=3 blk=0 avail=10834(78.6%) swpO=0 conn=1 myRSS=565 php=2 phpRSS=88 ap=17 tcp=28 topuser=evolution 2026-08-28 03:00:08 L1=1.37 run=2 blk=0 avail=10785(78.3%) swpO=0 conn=1 myRSS=565 php=3 phpRSS=157 ap=17 tcp=30 topuser=evolution 2026-08-28 03:00:09 L1=1.37 run=2 blk=0 avail=10781(78.3%) swpO=0 conn=2 myRSS=565 php=3 phpRSS=158 ap=17 tcp=31 topuser=evolution 2026-08-28 03:00:18 L1=1.39 run=2 blk=0 avail=10717(77.8%) swpO=0 conn=1 myRSS=565 php=4 phpRSS=245 ap=17 tcp=31 topuser=evolution 2026-08-28 03:00:19 L1=1.39 run=1 blk=0 avail=10673(77.5%) swpO=0 conn=2 myRSS=565 php=4 phpRSS=290 ap=17 tcp=28 topuser=madalice 2026-08-28 03:00:28 L1=1.25 run=1 blk=0 avail=10709(77.7%) swpO=0 conn=1 myRSS=565 php=3 phpRSS=220 ap=17 tcp=33 topuser=madalice 2026-08-28 03:00:29 L1=1.25 run=1 blk=0 avail=10711(77.7%) swpO=0 conn=2 myRSS=565 php=3 phpRSS=220 ap=17 tcp=32 topuser=madalice 2026-08-28 03:00:38 L1=1.13 run=1 blk=0 avail=10724(77.8%) swpO=0 conn=1 myRSS=565 php=3 phpRSS=220 ap=16 tcp=32 topuser=madalice 2026-08-28 03:00:40 L1=1.13 run=1 blk=0 avail=10832(78.6%) swpO=0 conn=2 myRSS=565 php=2 phpRSS=88 ap=16 tcp=31 topuser=evolution 2026-08-28 03:00:48 L1=2.14 run=6 blk=0 avail=9557 (69.4%) swpO=272 conn=1 myRSS=566 php=9 phpRSS=1450 ap=23 tcp=92 topuser=corpkicks 2026-08-28 03:00:50 L1=2.14 run=21 blk=0 avail=8492 (61.6%) swpO=272 conn=21 myRSS=567 php=22 phpRSS=2897 ap=31 tcp=107 topuser=corpkicks