INCIDENT 2026-08-28 05:20:29 trigger: php_rss=1806MB ================================================================== load: 1.78 0.86 0.75 6/583 1175713 ncpu:10 mem_avail: 8737MB/13777MB (63.4%) swap_used:421MB swapout:133/s blocked(D):0 running:13 iowait:0.0% steal:0.0% php: 13 procs / 1806MB heaviest user: evolution (11 procs, 1643MB) apache: 19 procs tcp_estab: 40 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 15 1693 root 254 1229 mysql 1 1060 mailman 20 412 nobody 18 330 netdata 7 240 madalice 1 132 wp-toolkit 3 130 cpanellogin 1 77 dovenull 6 68 named 1 53 infinium 3 41 mailnull 2 33 dovecot 3 28 zabbix 1 27 kurri 2 27 polkitd 1 24 aaa 1 14 lowrange 1 13 rpc 1 5 --- php workers by user --- USER PROCS RSS_MB evolution 11 1507 madalice 1 132 root 1 30 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7368 MB Active(file): 4778 MB Inactive(file): 3082 MB Dirty: 98 MB Writeback: 0 MB SReclaimable: 797 MB CommitLimit: 10984 MB Committed_AS: 7548 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 03:01:49 14504 /usr/bin/imunify-agent-proxy 1094495 root 20:29 2976 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 1161658 root 00:28 3168 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 1086184 3.3 Ssl 03:01:18 /usr/sbin/mariadbd 529388 527476 root 187680 0.0 S 02:56:11 spamd child 508924 1 netdata 187280 1.9 Ssl 03:00:47 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1175666 1159873 evolution 185268 46.0 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1175672 1160855 evolution 181756 96.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1175675 1159347 evolution 179880 93.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 527476 1 root 174676 0.0 Ss 02:57:50 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 529389 527476 root 166904 0.0 S 02:56:11 spamd child 1175668 1161395 evolution 143624 51.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1175674 1159303 evolution 137396 69.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1175551 510022 madalice 135648 10.2 S 00:12 php-fpm: pool madalice_com_au 1175680 1175679 evolution 100068 36.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 973642 1353308 cpanellogin 79520 0.0 S 57:57 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 938582 1 wp-toolkit 75004 0.0 Ss 01:08:21 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 509236 509098 root 72224 0.0 Sl 03:00:44 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 508634 1 named 54516 0.0 Ssl 03:00:52 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 4180059 4180015 evolution 52216 0.0 Ss 05:20:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 938585 1 wp-toolkit 49008 0.0 Ss 01:08:21 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1353308 1 root 42264 0.0 Ss 37-02:39:10 cpsrvd (SSL) - waiting for connections 1469 1 root 41664 0.1 Ss 59-19:10:39 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 509098 1 root 40452 0.0 Ss 03:00:45 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion 938444 1 root 38848 0.0 Ss 01:08:24 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 526869 1 root 34496 0.0 Ss 02:58:13 lfd - sleeping 481558 1 root 31988 0.1 Ssl 03:03:11 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 510022 1 root 31316 0.0 Ss 03:00:40 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 28516 0.2 Ssl 03:02:01 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 508591 1 polkitd 25176 0.0 Ssl 03:00:52 /usr/lib/polkit-1/polkitd --no-debug 1463 1 root 24744 0.0 Ss 59-19:10:39 tailwatchd 509266 1 root 24116 0.0 Ss 03:00:44 /usr/lib/systemd/systemd-journald 1159305 506832 nobody 23108 0.0 S 04:02 /usr/sbin/httpd -k start 1143126 506832 nobody 23056 0.0 S 08:28 /usr/sbin/httpd -k start 1159303 506832 nobody 22716 0.0 S 04:03 /usr/sbin/httpd -k start 508863 508814 mailman 22240 0.0 S 03:00:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 508851 508814 mailman 22224 0.0 S 03:00:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 508857 508814 mailman 22224 0.0 S 03:00:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 508856 508814 mailman 22148 0.0 S 03:00:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508855 508814 mailman 22116 0.0 S 03:00:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 508864 508814 mailman 22072 0.0 S 03:00:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 508867 508814 mailman 22056 0.0 S 03:00:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 508858 508814 mailman 22036 0.0 S 03:00:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s 508861 508814 mailman 22036 0.0 S 03:00:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 508860 508814 mailman 21964 0.0 S 03:00:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 508865 508814 mailman 21964 0.0 S 03:00:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 508850 508814 mailman 21952 0.0 S 03:00:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:0:2 -s 508854 508814 mailman 21940 0.0 S 03:00:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 508852 508814 mailman 21936 0.0 S 03:00:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s 508866 508814 mailman 21832 0.0 S 03:00:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 508853 508814 mailman 21804 0.0 S 03:00:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 508849 508814 mailman 21768 0.0 S 03:00:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=ArchRunner:0:1 -s 508859 508814 mailman 21764 0.0 S 03:00:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 508862 508814 mailman 21764 0.0 S 03:00:50 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 1159347 506832 nobody 21260 0.0 S 04:00 /usr/sbin/httpd -k start 1159884 506832 nobody 21240 0.0 S 02:55 /usr/sbin/httpd -k start 1160855 506832 nobody 21152 0.0 S 01:29 /usr/sbin/httpd -k start 1159885 506832 nobody 20740 0.0 S 02:55 /usr/sbin/httpd -k start 1159873 506832 nobody 20552 0.0 S 02:56 /usr/sbin/httpd -k start 1159635 506832 nobody 20548 0.0 S 03:28 /usr/sbin/httpd -k start 1160555 506832 nobody 20152 0.1 S 01:57 /usr/sbin/httpd -k start 1126697 506832 nobody 19972 0.0 S 12:48 /usr/sbin/httpd -k start 1159297 506832 nobody 19712 0.0 S 04:04 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 32036 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min tubesupplies/tubesupplies.com.au-ssl_log 146 alison/alisonarts.com.au-ssl_log 125 olympic/olympicfencing.com.au-ssl_log 122 otter2/otterfencing.net.au-ssl_log 40 coscom/coscom.com.au-ssl_log 27 evolution/portal.evolutionerp.com.au-ssl_log 24 cosgrovecreative/cosgrovecreative.com.au-ssl_log 14 alison/alisonarts.com.au 8 evolution/my.evolutionerp.com.au-ssl_log 3 customc/customcentral.com.au-ssl_log 2 customc/customcentral.com.au 1 madalice/madalice.com.au-ssl_log 1 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 140 20.48.179.39 117 158.158.54.35 87 52.139.37.240 75 20.48.251.3 27 20.220.204.93 24 203.54.180.238 14 158.23.184.117 3 52.167.144.196 2 91.92.243.243 2 209.42.31.213 2 162.214.79.109 2 118.127.40.55 1 93.70.66.168 1 88.230.9.188 1 46.61.78.183 --- top request paths across all vhosts (last 3 min) --- 24 GET /heartbeat.php 12 GET /airbrushing/nggallery/helmets/thunderbird-helmet 6 GET /simple.php 6 GET /edit.php 6 GET /admin.php 5 GET /index.php 4 POST /wp-login.php 4 GET /wp.php 4 GET /wp-login.php 4 GET /ms-edit.php 4 GET /about.php 3 GET /wp-mail.php 3 GET /wp-cron.php 3 GET /wp-content/themes/index.php 3 GET /robots.txt 3 GET /makeasmtp.php 3 GET /log.php 3 GET /inputs.php 3 GET /av.php 3 GET /as.php --- busiest 3 vhosts: top paths + last 10 requests --- == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 3 POST /wp-login.php 3 GET /admin.php 2 GET /wp-content/themes/index.php 2 GET /av.php 1 POST /wp-cron.php 1 GET /zoo1.php 1 GET /yj09.php 1 GET /xnm-apc.php 1 GET /xiugai.php 1 GET /xamp.php 1 GET /wp-temp.php 1 GET /wp.php -- last 10 requests -- 20.48.179.39 - - [28/Aug/2026:05:19:29 +1000] "GET /cgi-bin/admin.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [28/Aug/2026:05:19:29 +1000] "GET /wp-content/ HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [28/Aug/2026:05:19:30 +1000] "GET /wp-admin/css/colors/blue/ HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [28/Aug/2026:05:19:30 +1000] "GET /wp-includes/block-bindings/ HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [28/Aug/2026:05:19:30 +1000] "GET /wp-includes/assets/ HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [28/Aug/2026:05:19:31 +1000] "GET /wp-admin/css/colors/sunrise/ HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [28/Aug/2026:05:19:31 +1000] "GET /wp-admin/network/plugins.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [28/Aug/2026:05:19:32 +1000] "GET /wp-admin/maint/index.php HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [28/Aug/2026:05:19:32 +1000] "GET /wp-includes/blocks/post-comments-form/ HTTP/1.1" 401 36 "-" "-" 20.48.179.39 - - [28/Aug/2026:05:19:33 +1000] "GET /qazwsx.php HTTP/1.1" 401 36 "-" "-" == alison/alisonarts.com.au-ssl_log == -- top paths -- 4 GET /airbrushing/nggallery/helmets/thunderbird-helmet 2 GET /wp-login.php 1 POST /wp-login.php 1 GET /zup.php73 1 GET /x.php 1 GET /xleet.php 1 GET /xda.php 1 GET /ww5.php 1 GET /wso.php 1 GET /ws83.php 1 GET /ws54.php 1 GET /wp.php -- last 10 requests -- 158.158.54.35 - - [28/Aug/2026:05:19:31 +1000] "GET /wso.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:05:19:31 +1000] "GET /zup.php73 HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:05:19:31 +1000] "GET /k.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:05:19:31 +1000] "GET /wp-blink.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:05:19:32 +1000] "GET /randkeyword.PhP7 HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:05:19:32 +1000] "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:05:19:32 +1000] "GET /wp-content/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:05:19:33 +1000] "GET /ww5.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:05:19:33 +1000] "GET /2.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:05:19:33 +1000] "GET /wp-admin/classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == olympic/olympicfencing.com.au-ssl_log == -- top paths -- 2 GET /simple.php 2 GET /log.php 2 GET /edit.php 1 GET /zz.php 1 GET /zaza.php 1 GET /xve22.php 1 GET /xmrlpc.php 1 GET /xda.php 1 GET /X57.php 1 GET /ws.php 1 GET /wso112233.php 1 GET /ws62.php -- last 10 requests -- 20.48.251.3 - - [28/Aug/2026:05:20:20 +1000] "GET /koiy.php HTTP/1.1" 404 5749 "-" "-" 20.48.251.3 - - [28/Aug/2026:05:20:21 +1000] "GET /gk.php HTTP/1.1" 404 5749 "-" "-" 20.48.251.3 - - [28/Aug/2026:05:20:21 +1000] "GET /services.php HTTP/1.1" 404 5749 "-" "-" 20.48.251.3 - - [28/Aug/2026:05:20:22 +1000] "GET /log.php HTTP/1.1" 404 5749 "-" "-" 20.48.251.3 - - [28/Aug/2026:05:20:22 +1000] "GET /btx25.php HTTP/1.1" 404 5749 "-" "-" 20.48.251.3 - - [28/Aug/2026:05:20:23 +1000] "GET /guk.php HTTP/1.1" 404 5749 "-" "-" 20.48.251.3 - - [28/Aug/2026:05:20:23 +1000] "GET /7.php HTTP/1.1" 404 5749 "-" "-" 20.48.251.3 - - [28/Aug/2026:05:20:24 +1000] "GET /wp-includes/js/codemirror/about.php HTTP/1.1" 404 5749 "-" "-" 20.48.251.3 - - [28/Aug/2026:05:20:24 +1000] "GET /app.default.php HTTP/1.1" 404 5749 "-" "-" 20.48.251.3 - - [28/Aug/2026:05:20:25 +1000] "GET /8.php HTTP/1.1" 404 5749 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-28 05:18:02 L1=0.48 run=1 blk=0 avail=10074(73.1%) swpO=0 conn=1 myRSS=1053 php=3 phpRSS=238 ap=17 tcp=33 topuser=madalice 2026-08-28 05:18:08 L1=0.44 run=1 blk=0 avail=10204(74.1%) swpO=0 conn=1 myRSS=1053 php=2 phpRSS=82 ap=17 tcp=28 topuser=evolution 2026-08-28 05:18:12 L1=0.40 run=1 blk=0 avail=10210(74.1%) swpO=0 conn=1 myRSS=1053 php=2 phpRSS=82 ap=16 tcp=29 topuser=evolution 2026-08-28 05:18:18 L1=0.37 run=1 blk=0 avail=10232(74.3%) swpO=0 conn=1 myRSS=1053 php=2 phpRSS=82 ap=16 tcp=28 topuser=evolution 2026-08-28 05:18:22 L1=0.34 run=2 blk=0 avail=10012(72.7%) swpO=0 conn=1 myRSS=1053 php=3 phpRSS=326 ap=16 tcp=28 topuser=madalice 2026-08-28 05:18:28 L1=0.31 run=2 blk=0 avail=10032(72.8%) swpO=0 conn=1 myRSS=1053 php=4 phpRSS=336 ap=15 tcp=29 topuser=madalice 2026-08-28 05:18:32 L1=0.29 run=3 blk=0 avail=10050(72.9%) swpO=0 conn=1 myRSS=1053 php=4 phpRSS=306 ap=15 tcp=31 topuser=madalice 2026-08-28 05:18:38 L1=0.27 run=2 blk=0 avail=10052(73.0%) swpO=0 conn=2 myRSS=1053 php=4 phpRSS=301 ap=16 tcp=31 topuser=madalice 2026-08-28 05:18:42 L1=0.32 run=2 blk=0 avail=10077(73.1%) swpO=0 conn=1 myRSS=1053 php=4 phpRSS=274 ap=16 tcp=30 topuser=madalice 2026-08-28 05:18:49 L1=0.30 run=1 blk=0 avail=10210(74.1%) swpO=0 conn=2 myRSS=1053 php=2 phpRSS=82 ap=17 tcp=29 topuser=evolution 2026-08-28 05:18:52 L1=0.27 run=2 blk=0 avail=10206(74.1%) swpO=0 conn=1 myRSS=1053 php=2 phpRSS=82 ap=17 tcp=27 topuser=evolution 2026-08-28 05:18:59 L1=0.33 run=1 blk=0 avail=10112(73.4%) swpO=0 conn=2 myRSS=1053 php=3 phpRSS=206 ap=17 tcp=31 topuser=infinium 2026-08-28 05:19:02 L1=0.39 run=3 blk=0 avail=10011(72.7%) swpO=0 conn=1 myRSS=1054 php=4 phpRSS=320 ap=18 tcp=33 topuser=madalice 2026-08-28 05:19:09 L1=0.44 run=3 blk=0 avail=10046(72.9%) swpO=0 conn=2 myRSS=1054 php=4 phpRSS=278 ap=19 tcp=31 topuser=madalice 2026-08-28 05:19:12 L1=0.40 run=2 blk=0 avail=9747 (70.8%) swpO=0 conn=1 myRSS=1054 php=5 phpRSS=605 ap=19 tcp=32 topuser=corpkicks 2026-08-28 05:19:19 L1=0.45 run=3 blk=0 avail=10086(73.2%) swpO=0 conn=2 myRSS=1054 php=3 phpRSS=214 ap=19 tcp=34 topuser=madalice 2026-08-28 05:19:22 L1=0.41 run=1 blk=0 avail=10063(73.0%) swpO=0 conn=1 myRSS=1054 php=3 phpRSS=236 ap=19 tcp=30 topuser=madalice 2026-08-28 05:19:29 L1=0.38 run=1 blk=0 avail=10057(73.0%) swpO=0 conn=2 myRSS=1054 php=3 phpRSS=237 ap=19 tcp=31 topuser=madalice 2026-08-28 05:19:32 L1=0.35 run=1 blk=0 avail=10062(73.0%) swpO=0 conn=1 myRSS=1054 php=3 phpRSS=237 ap=19 tcp=29 topuser=madalice 2026-08-28 05:19:39 L1=0.48 run=15 blk=0 avail=9478 (68.8%) swpO=0 conn=12 myRSS=1054 php=14 phpRSS=1170 ap=20 tcp=38 topuser=speedlin 2026-08-28 05:19:42 L1=1.72 run=1 blk=0 avail=10049(72.9%) swpO=248 conn=1 myRSS=1054 php=3 phpRSS=237 ap=22 tcp=33 topuser=madalice 2026-08-28 05:19:49 L1=1.59 run=1 blk=0 avail=10073(73.1%) swpO=248 conn=12 myRSS=1054 php=3 phpRSS=237 ap=20 tcp=29 topuser=madalice 2026-08-28 05:19:52 L1=1.46 run=2 blk=0 avail=10091(73.2%) swpO=0 conn=1 myRSS=1054 php=3 phpRSS=237 ap=18 tcp=28 topuser=madalice 2026-08-28 05:19:59 L1=1.42 run=1 blk=0 avail=10080(73.2%) swpO=0 conn=12 myRSS=1054 php=3 phpRSS=237 ap=18 tcp=27 topuser=madalice 2026-08-28 05:20:02 L1=1.31 run=2 blk=0 avail=10059(73.0%) swpO=0 conn=1 myRSS=1054 php=3 phpRSS=237 ap=18 tcp=28 topuser=madalice 2026-08-28 05:20:09 L1=1.28 run=4 blk=0 avail=10052(73.0%) swpO=0 conn=12 myRSS=1054 php=3 phpRSS=237 ap=18 tcp=30 topuser=madalice 2026-08-28 05:20:12 L1=1.26 run=4 blk=0 avail=10064(73.1%) swpO=0 conn=1 myRSS=1054 php=3 phpRSS=237 ap=18 tcp=30 topuser=madalice 2026-08-28 05:20:19 L1=1.07 run=1 blk=0 avail=10090(73.2%) swpO=0 conn=12 myRSS=1054 php=3 phpRSS=214 ap=18 tcp=29 topuser=madalice 2026-08-28 05:20:22 L1=1.07 run=1 blk=0 avail=10103(73.3%) swpO=0 conn=1 myRSS=1054 php=4 phpRSS=236 ap=18 tcp=29 topuser=madalice 2026-08-28 05:20:29 L1=1.78 run=13 blk=0 avail=8737 (63.4%) swpO=133 conn=11 myRSS=1060 php=13 phpRSS=1806 ap=19 tcp=40 topuser=evolution