INCIDENT 2026-08-29 02:56:31 trigger: php_rss=1864MB ================================================================== load: 2.31 2.74 2.55 4/682 1573040 ncpu:10 mem_avail: 6809MB/13777MB (49.4%) swap_used:1181MB swapout:0/s blocked(D):0 running:4 iowait:0.1% steal:0.0% php: 14 procs / 1864MB heaviest user: madalice (10 procs, 1589MB) apache: 44 procs tcp_estab: 42 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2789 madalice 10 1590 root 255 1338 nobody 42 837 mailman 20 235 netdata 7 203 customc 1 167 cpanellogin 1 85 dovenull 6 59 wp-toolkit 3 55 kurri 3 37 evolution 7 30 lowrange 2 29 infinium 2 28 zabbix 1 23 dovecot 3 23 named 1 16 aaa 1 15 mailnull 1 9 polkitd 1 8 --- php workers by user --- USER PROCS RSS_MB madalice 10 1562 customc 1 172 root 2 103 evolution 1 15 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4590 MB Active(file): 4546 MB Inactive(file): 858 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 1030 MB CommitLimit: 10984 MB Committed_AS: 8812 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-00:37:51 7296 /usr/bin/imunify-agent-proxy 1538110 root 09:30 1368 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))'; /usr/libexec/report-command-error /opt/imunify360/venv/share/imunify360/scripts/imunify-check-pkg-integr --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2856812 12.3 Ssl 1-00:37:20 /usr/sbin/mariadbd 1573008 1558093 customc 188304 82.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1202218 1202214 root 182208 0.3 S 01:45:30 /usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/scripts/gather_update_log_stats --logfile /var/cpanel/updatelogs/last --upload 1502903 1451906 root 179812 0.0 S 20:09 spamd child 508924 1 netdata 177560 2.0 Ssl 1-00:36:49 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1451906 1 root 175608 0.2 Ss 33:24 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1502904 1451906 root 167800 0.0 S 20:09 spamd child 1572922 510022 madalice 163072 36.0 S 00:10 php-fpm: pool madalice_com_au 1572923 510022 madalice 160804 35.6 S 00:10 php-fpm: pool madalice_com_au 1572926 510022 madalice 160188 43.6 S 00:09 php-fpm: pool madalice_com_au 1572924 510022 madalice 160164 34.6 S 00:10 php-fpm: pool madalice_com_au 1572920 510022 madalice 160124 23.4 S 00:10 php-fpm: pool madalice_com_au 1572933 510022 madalice 159984 27.2 S 00:09 php-fpm: pool madalice_com_au 1572921 510022 madalice 159980 26.5 S 00:10 php-fpm: pool madalice_com_au 1572999 510022 madalice 137520 29.6 S 00:05 php-fpm: pool madalice_com_au 1573000 510022 madalice 137516 31.4 S 00:05 php-fpm: pool madalice_com_au 1573001 510022 madalice 137512 28.2 S 00:05 php-fpm: pool madalice_com_au 1416362 1353308 cpanellogin 87840 0.1 S 42:23 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 509266 1 root 75684 0.0 Ss 1-00:36:46 /usr/lib/systemd/systemd-journald 1415522 1202218 root 73160 98.8 R 43:39 /usr/local/cpanel/3rdparty/bin/php /opt/cpanel/ea-wappspector/wappspector.phar --max=1 --json --depth=9 /home/nrg 509236 509098 root 49928 0.0 Sl 1-00:36:46 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42180 0.1 Ss 38-00:15:12 cpsrvd (SSL) - waiting for connections 1451116 1 root 37596 0.0 Ss 34:17 lfd - sleeping 938582 1 wp-toolkit 32992 0.0 Ss 22:44:23 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 510022 1 root 32568 0.0 Ss 1-00:36:42 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 509640 508992 root 29632 0.0 Sl 1-00:36:44 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1557971 506832 nobody 25636 0.0 S 02:11 /usr/sbin/httpd -k start 1555091 506832 nobody 25204 0.0 S 06:02 /usr/sbin/httpd -k start 1556190 506832 nobody 25120 0.0 S 04:37 /usr/sbin/httpd -k start 1540053 506832 nobody 25080 0.1 S 07:32 /usr/sbin/httpd -k start 1557084 506832 nobody 25036 0.0 S 03:41 /usr/sbin/httpd -k start 1538612 506832 nobody 24908 0.0 S 08:53 /usr/sbin/httpd -k start 1557632 506832 nobody 24804 0.0 S 02:55 /usr/sbin/httpd -k start 1469 1 root 24068 0.1 Ss 60-16:46:41 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 483898 1 zabbix 23752 0.2 Ssl 1-00:38:03 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1556820 506832 nobody 23092 0.0 S 04:03 /usr/sbin/httpd -k start 1558139 506832 nobody 23032 0.0 S 02:00 /usr/sbin/httpd -k start 1558093 506832 nobody 23028 0.1 S 02:02 /usr/sbin/httpd -k start 1572985 506832 nobody 23024 0.2 S 00:05 /usr/sbin/httpd -k start 1572978 506832 nobody 22988 0.1 S 00:06 /usr/sbin/httpd -k start 1572983 506832 nobody 22988 0.2 S 00:05 /usr/sbin/httpd -k start 1572986 506832 nobody 22988 0.4 S 00:05 /usr/sbin/httpd -k start 1572987 506832 nobody 22988 0.2 S 00:05 /usr/sbin/httpd -k start 1572976 506832 nobody 22960 0.1 S 00:06 /usr/sbin/httpd -k start 1572977 506832 nobody 22928 0.3 S 00:06 /usr/sbin/httpd -k start 1572979 506832 nobody 22924 0.1 S 00:06 /usr/sbin/httpd -k start 1572980 506832 nobody 22896 0.1 S 00:06 /usr/sbin/httpd -k start 1558140 506832 nobody 22448 0.0 S 02:00 /usr/sbin/httpd -k start 1572981 506832 nobody 21700 0.0 S 00:06 /usr/sbin/httpd -k start 1572984 506832 nobody 21636 0.0 S 00:05 /usr/sbin/httpd -k start 1463 1 root 21200 0.0 Ss 60-16:46:41 tailwatchd 938585 1 wp-toolkit 21176 0.0 Ss 22:44:23 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1572988 506832 nobody 21036 0.0 S 00:05 /usr/sbin/httpd -k start 1572941 506832 nobody 20800 0.0 S 00:07 /usr/sbin/httpd -k start 1572992 506832 nobody 20796 0.0 S 00:05 /usr/sbin/httpd -k start 1572991 506832 nobody 20788 0.2 S 00:05 /usr/sbin/httpd -k start 1572927 506832 nobody 20764 0.0 S 00:09 /usr/sbin/httpd -k start 1572939 506832 nobody 20752 0.0 S 00:07 /usr/sbin/httpd -k start 1572940 506832 nobody 20748 0.0 S 00:07 /usr/sbin/httpd -k start 1572975 506832 nobody 20664 0.0 S 00:06 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3784642 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min customc/customcentral.com.au 140 customc/customcentral.com.au-ssl_log 140 candyfabcom/candyfab.com.au-ssl_log 60 otter2/otterfencing.net.au-ssl_log 46 lowrange/lowrange.com.au 45 madalice/madalice.com.au-ssl_log 41 tubesupplies/tubesupplies.com.au-ssl_log 32 evolution/portal.evolutionerp.com.au-ssl_log 18 speedlin/speedlinefencing.com.au-ssl_log 18 tubesupplies/tubesupplies.com.au 18 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 161 20.104.50.220 160 158.23.147.79 60 158.23.184.117 46 20.48.250.41 45 20.48.179.39 19 35.185.113.246 18 203.54.180.238 18 146.70.194.238 15 118.127.40.55 2 65.111.31.8 2 114.119.159.70 2 114.119.143.104 1 52.200.251.20 1 44.223.115.10 1 2a02:ce0:2002:dfc0:a1b0:64ab:8a1d:ad1d --- top request paths across all vhosts (last 3 min) --- 18 GET /heartbeat.php 11 POST / 5 GET /wp-cron.php 5 GET /store/hand-painted-af1-drippy-kids/ 5 GET / 4 POST /wp-cron.php 4 GET /wp-login.php 4 GET /wp-includes/wp-class.php 4 GET /wp-includes/Text/about.php 4 GET /wp-includes/plugins.php 4 GET /wp-includes/js/tinymce/skins/lightgray/img/index.php 4 GET /wp-includes/certificates/wp-login.php 4 GET /wp-includes/blocks/about.php 4 GET /wp-content/upgrade/wp-login.php 4 GET /wp-content/themes/wp-pridmag/init.php 4 GET /wp-content/themes/index.php 4 GET /wp-admin/js/ 4 GET /wp-admin/install.php 4 GET /wp-admin/images/chosen.php 4 GET /wp-admin/css/network.php --- busiest 3 vhosts: top paths + last 10 requests --- == customc/customcentral.com.au == -- top paths -- 1 GET /ws.php 1 GET /wso.php 1 GET /wp-trackback.php 1 GET /wp-mail.php 1 GET /wp-includes/wp-includes_function.php 1 GET /wp-includes/wp-class.php 1 GET /wp-includes/widgets/include.php 1 GET /wp-includes/Text/about.php 1 GET /wp-includes/sodium_compat/src/Core32/Curve25519/Ge/index.php 1 GET /wp-includes/SimplePie/gzdecodes.php 1 GET /wp-includes/rest-api/about.php 1 GET /wp-includes/plugins.php -- last 10 requests -- 20.104.50.220 - - [29/Aug/2026:02:56:05 +1000] "GET /wp-admin/class.php HTTP/1.1" 301 295 "-" "-" 20.104.50.220 - - [29/Aug/2026:02:56:06 +1000] "GET /js/lock360.php HTTP/1.1" 301 291 "-" "-" 20.104.50.220 - - [29/Aug/2026:02:56:08 +1000] "GET /admin/moon.php HTTP/1.1" 301 291 "-" "-" 20.104.50.220 - - [29/Aug/2026:02:56:10 +1000] "GET /wp-admin/css/wp.php HTTP/1.1" 301 296 "-" "-" 20.104.50.220 - - [29/Aug/2026:02:56:12 +1000] "GET /admin/maint.php HTTP/1.1" 301 292 "-" "-" 20.104.50.220 - - [29/Aug/2026:02:56:13 +1000] "GET /admin/network.php HTTP/1.1" 301 294 "-" "-" 20.104.50.220 - - [29/Aug/2026:02:56:15 +1000] "GET /wp-includes/as.php HTTP/1.1" 301 295 "-" "-" 20.104.50.220 - - [29/Aug/2026:02:56:17 +1000] "GET /wp-includes/js/ HTTP/1.1" 301 292 "-" "-" 20.104.50.220 - - [29/Aug/2026:02:56:18 +1000] "GET /wp-admin/cc.php HTTP/1.1" 301 292 "-" "-" 20.104.50.220 - - [29/Aug/2026:02:56:20 +1000] "GET /index/chosen.php HTTP/1.1" 301 293 "-" "-" == customc/customcentral.com.au-ssl_log == -- top paths -- 3 GET /wp-login.php 2 POST /wp-cron.php 2 POST / 1 GET /ws.php 1 GET /wso.php 1 GET /wp-trackback.php 1 GET /wp-mail.php 1 GET /wp-includes/wp-includes_function.php 1 GET /wp-includes/wp-class.php 1 GET /wp-includes/widgets/include.php 1 GET /wp-includes/Text/about.php 1 GET /wp-includes/sodium_compat/src/Core32/Curve25519/Ge/index.php -- last 10 requests -- 20.104.50.220 - - [29/Aug/2026:02:55:44 +1000] "GET /update/02.php HTTP/1.1" 404 73284 "-" "-" 20.104.50.220 - - [29/Aug/2026:02:55:46 +1000] "GET /update/go.php HTTP/1.1" 404 73284 "-" "-" 20.104.50.220 - - [29/Aug/2026:02:55:48 +1000] "GET /mpvloi.php HTTP/1.1" 404 73280 "-" "-" 20.104.50.220 - - [29/Aug/2026:02:55:49 +1000] "GET /images/mar.php HTTP/1.1" 404 73285 "-" "-" 20.104.50.220 - - [29/Aug/2026:02:55:51 +1000] "GET /files/moon.php HTTP/1.1" 404 73285 "-" "-" 20.104.50.220 - - [29/Aug/2026:02:55:53 +1000] "GET /img/ty.php HTTP/1.1" 404 73281 "-" "-" 20.104.50.220 - - [29/Aug/2026:02:55:54 +1000] "GET /js/wp-login.php HTTP/1.1" 404 73286 "-" "-" 20.104.50.220 - - [29/Aug/2026:02:55:56 +1000] "GET /index/link.php HTTP/1.1" 404 73285 "-" "-" 20.104.50.220 - - [29/Aug/2026:02:55:57 +1000] "GET /index/cong.php HTTP/1.1" 404 73285 "-" "-" 20.104.50.220 - - [29/Aug/2026:02:55:59 +1000] "GET /update/simple.php HTTP/1.1" 404 73288 "-" "-" == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 1 GET /zwso.php 1 GET /WZGHHra0r3.php 1 GET /wpsml-sys.php 1 GET /wp-signin.php 1 GET /wp-setup.php 1 GET /wp-file.php 1 GET /wp-conf.php 1 GET /user.php 1 GET /updates.php 1 GET /task.php 1 GET /size.php 1 GET /simi.php -- last 10 requests -- 158.23.184.117 - - [29/Aug/2026:02:54:43 +1000] "GET /my.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:02:54:43 +1000] "GET /nc4.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:02:54:43 +1000] "GET /root.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:02:54:43 +1000] "GET /fix.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:02:54:44 +1000] "GET /size.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:02:54:44 +1000] "GET /amfsqvgv.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:02:54:44 +1000] "GET /bugz.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:02:54:44 +1000] "GET /fox.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:02:54:44 +1000] "GET /profile.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [29/Aug/2026:02:54:45 +1000] "GET /task.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-29 02:54:05 L1=2.63 run=3 blk=0 avail=8204 (59.6%) swpO=2 conn=4 myRSS=2789 php=5 phpRSS=314 ap=19 tcp=34 topuser=madalice 2026-08-29 02:54:11 L1=2.74 run=5 blk=1 avail=7981 (57.9%) swpO=2 conn=1 myRSS=2789 php=7 phpRSS=599 ap=19 tcp=34 topuser=customc 2026-08-29 02:54:15 L1=2.68 run=4 blk=0 avail=8039 (58.4%) swpO=0 conn=4 myRSS=2789 php=7 phpRSS=535 ap=19 tcp=36 topuser=customc 2026-08-29 02:54:21 L1=2.79 run=5 blk=0 avail=7914 (57.4%) swpO=0 conn=1 myRSS=2789 php=7 phpRSS=649 ap=20 tcp=35 topuser=customc 2026-08-29 02:54:25 L1=3.13 run=4 blk=0 avail=7992 (58.0%) swpO=0 conn=3 myRSS=2789 php=7 phpRSS=555 ap=23 tcp=39 topuser=customc 2026-08-29 02:54:31 L1=3.12 run=4 blk=0 avail=8087 (58.7%) swpO=0 conn=1 myRSS=2789 php=6 phpRSS=392 ap=28 tcp=46 topuser=madalice 2026-08-29 02:54:35 L1=3.11 run=7 blk=0 avail=7978 (57.9%) swpO=0 conn=3 myRSS=2789 php=5 phpRSS=440 ap=32 tcp=48 topuser=customc 2026-08-29 02:54:41 L1=3.02 run=5 blk=0 avail=7948 (57.7%) swpO=0 conn=4 myRSS=2789 php=7 phpRSS=553 ap=32 tcp=37 topuser=madalice 2026-08-29 02:54:45 L1=3.18 run=4 blk=0 avail=8032 (58.3%) swpO=0 conn=3 myRSS=2789 php=6 phpRSS=456 ap=28 tcp=38 topuser=madalice 2026-08-29 02:54:51 L1=3.24 run=6 blk=0 avail=7891 (57.3%) swpO=0 conn=4 myRSS=2789 php=7 phpRSS=627 ap=27 tcp=37 topuser=customc 2026-08-29 02:54:55 L1=3.22 run=2 blk=0 avail=8157 (59.2%) swpO=0 conn=3 myRSS=2789 php=4 phpRSS=274 ap=25 tcp=38 topuser=madalice 2026-08-29 02:55:01 L1=3.05 run=8 blk=0 avail=7813 (56.7%) swpO=0 conn=4 myRSS=2789 php=7 phpRSS=686 ap=25 tcp=36 topuser=corpkicks 2026-08-29 02:55:05 L1=2.96 run=4 blk=0 avail=8125 (59.0%) swpO=0 conn=3 myRSS=2789 php=5 phpRSS=348 ap=24 tcp=34 topuser=madalice 2026-08-29 02:55:11 L1=2.96 run=2 blk=0 avail=8191 (59.5%) swpO=2 conn=4 myRSS=2789 php=4 phpRSS=274 ap=22 tcp=32 topuser=madalice 2026-08-29 02:55:15 L1=3.13 run=2 blk=0 avail=8202 (59.5%) swpO=2 conn=3 myRSS=2789 php=4 phpRSS=274 ap=21 tcp=36 topuser=madalice 2026-08-29 02:55:21 L1=3.12 run=3 blk=0 avail=8122 (59.0%) swpO=1 conn=4 myRSS=2789 php=5 phpRSS=389 ap=21 tcp=28 topuser=madalice 2026-08-29 02:55:25 L1=3.03 run=5 blk=0 avail=8171 (59.3%) swpO=1 conn=3 myRSS=2789 php=5 phpRSS=349 ap=19 tcp=33 topuser=madalice 2026-08-29 02:55:31 L1=2.95 run=3 blk=0 avail=8168 (59.3%) swpO=0 conn=4 myRSS=2789 php=5 phpRSS=351 ap=19 tcp=30 topuser=madalice 2026-08-29 02:55:35 L1=2.87 run=2 blk=0 avail=8200 (59.5%) swpO=0 conn=3 myRSS=2789 php=4 phpRSS=276 ap=19 tcp=33 topuser=madalice 2026-08-29 02:55:41 L1=2.72 run=3 blk=0 avail=8220 (59.7%) swpO=0 conn=1 myRSS=2789 php=5 phpRSS=311 ap=19 tcp=25 topuser=madalice 2026-08-29 02:55:45 L1=2.66 run=3 blk=0 avail=8094 (58.7%) swpO=0 conn=3 myRSS=2789 php=5 phpRSS=445 ap=17 tcp=26 topuser=customc 2026-08-29 02:55:51 L1=2.61 run=3 blk=0 avail=8163 (59.3%) swpO=0 conn=1 myRSS=2789 php=5 phpRSS=372 ap=17 tcp=26 topuser=madalice 2026-08-29 02:55:55 L1=2.64 run=3 blk=0 avail=8188 (59.4%) swpO=0 conn=3 myRSS=2789 php=4 phpRSS=317 ap=17 tcp=30 topuser=madalice 2026-08-29 02:56:01 L1=2.59 run=4 blk=0 avail=7911 (57.4%) swpO=0 conn=1 myRSS=2789 php=7 phpRSS=679 ap=17 tcp=30 topuser=corpkicks 2026-08-29 02:56:05 L1=2.54 run=4 blk=0 avail=7874 (57.2%) swpO=0 conn=3 myRSS=2789 php=8 phpRSS=694 ap=17 tcp=30 topuser=olympic 2026-08-29 02:56:11 L1=2.42 run=2 blk=0 avail=8224 (59.7%) swpO=0 conn=1 myRSS=2789 php=4 phpRSS=275 ap=17 tcp=27 topuser=madalice 2026-08-29 02:56:15 L1=2.30 run=3 blk=0 avail=8231 (59.7%) swpO=0 conn=3 myRSS=2789 php=5 phpRSS=308 ap=16 tcp=29 topuser=madalice 2026-08-29 02:56:21 L1=2.28 run=2 blk=0 avail=8369 (60.7%) swpO=0 conn=1 myRSS=2789 php=3 phpRSS=118 ap=16 tcp=24 topuser=root 2026-08-29 02:56:25 L1=2.34 run=6 blk=0 avail=7635 (55.4%) swpO=0 conn=4 myRSS=2789 php=10 phpRSS=1093 ap=23 tcp=53 topuser=madalice 2026-08-29 02:56:31 L1=2.31 run=4 blk=0 avail=6809 (49.4%) swpO=0 conn=3 myRSS=2789 php=14 phpRSS=1864 ap=44 tcp=42 topuser=madalice