INCIDENT 2026-08-29 03:29:05 trigger: php_rss=1812MB ================================================================== load: 1.74 1.12 1.49 10/681 1678450 ncpu:10 mem_avail: 6821MB/13777MB (49.5%) swap_used:1220MB swapout:22/s blocked(D):0 running:12 iowait:0.0% steal:0.0% php: 13 procs / 1812MB heaviest user: madalice (6 procs, 1159MB) apache: 25 procs tcp_estab: 48 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2770 madalice 6 1213 root 259 1142 nobody 24 442 corpkicks 2 376 mailman 20 231 infinium 5 214 netdata 7 209 cpanellogin 1 92 kurri 5 66 dovenull 6 59 wp-toolkit 3 53 lowrange 2 29 evolution 7 29 zabbix 1 23 dovecot 3 23 mailnull 2 21 named 1 16 aaa 1 15 sshd 2 8 --- php workers by user --- USER PROCS RSS_MB madalice 6 1219 corpkicks 2 380 infinium 2 172 root 1 31 evolution 1 14 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4169 MB Active(file): 4547 MB Inactive(file): 788 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 1613 MB CommitLimit: 10984 MB Committed_AS: 8403 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-01:10:25 7508 /usr/bin/imunify-agent-proxy 1644966 root 10:04 3192 /bin/bash /etc/cron.daily/imunify-antivirus.cron 1644967 root 10:04 1236 sed 1i\ /etc/cron.daily/imunify-antivirus.cron:\ 1644968 root 10:04 9100 /usr/libexec/report-command-error /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py 1644980 root 10:04 14616 /opt/imunify360/venv/bin/python3 /opt/imunify360/venv/share/imunify360/scripts/delay_on_cron_call.py --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2836848 12.1 Ssl 1-01:09:54 /usr/sbin/mariadbd 1678405 510022 madalice 248548 139 S 00:01 php-fpm: pool madalice_com_au 1678399 1678332 corpkicks 247256 61.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1678406 510022 madalice 242396 133 R 00:01 php-fpm: pool madalice_com_au 1678407 510022 madalice 226976 132 S 00:01 php-fpm: pool madalice_com_au 1502903 1451906 root 185412 0.0 S 52:43 spamd child 508924 1 netdata 184396 2.0 Ssl 1-01:09:23 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1451906 1 root 175604 0.1 Ss 01:05:58 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1502904 1451906 root 167848 0.0 S 52:43 spamd child 1677823 510022 madalice 163536 22.9 S 00:48 php-fpm: pool madalice_com_au 1678414 510022 madalice 161444 84.0 R 00:01 php-fpm: pool madalice_com_au 1678325 510022 madalice 160088 44.6 S 00:08 php-fpm: pool madalice_com_au 1678413 1644843 corpkicks 153264 77.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1678411 1677938 infinium 127556 61.0 S 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1416362 1353308 cpanellogin 95188 0.0 S 01:14:57 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 509266 1 root 76516 0.0 Ss 1-01:09:20 /usr/lib/systemd/systemd-journald 1678424 1677486 infinium 56656 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 509236 509098 root 48072 0.0 Sl 1-01:09:20 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41892 0.1 Ss 38-00:47:46 cpsrvd (SSL) - waiting for connections 1451116 1 root 36728 0.0 Ss 01:06:51 lfd - sleeping 510022 1 root 32388 0.0 Ss 1-01:09:16 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 31672 0.0 Ss 23:16:57 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 509640 508992 root 29884 0.0 Sl 1-01:09:18 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1469 1 root 24344 0.1 Ss 60-17:19:15 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1644843 506832 nobody 23700 0.0 S 10:16 /usr/sbin/httpd -k start 483898 1 zabbix 23672 0.2 Ssl 1-01:10:37 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1661796 506832 nobody 23536 0.0 S 04:09 /usr/sbin/httpd -k start 1661182 506832 nobody 23412 0.0 S 05:26 /usr/sbin/httpd -k start 1676497 506832 nobody 23252 0.0 S 02:56 /usr/sbin/httpd -k start 1661151 506832 nobody 23168 0.0 S 05:27 /usr/sbin/httpd -k start 1661128 506832 nobody 23140 0.0 S 05:28 /usr/sbin/httpd -k start 1661124 506832 nobody 22460 0.0 S 05:28 /usr/sbin/httpd -k start 1661798 506832 nobody 22260 0.0 S 04:09 /usr/sbin/httpd -k start 1463 1 root 21752 0.0 Ss 60-17:19:15 tailwatchd 1677574 506832 nobody 21524 0.0 S 01:09 /usr/sbin/httpd -k start 1677583 506832 nobody 21364 0.0 S 01:08 /usr/sbin/httpd -k start 1677931 506832 nobody 21160 0.1 S 00:37 /usr/sbin/httpd -k start 938585 1 wp-toolkit 20696 0.0 Ss 23:16:57 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1676805 506832 nobody 20476 0.0 S 02:26 /usr/sbin/httpd -k start 1677486 506832 nobody 20460 0.0 S 01:16 /usr/sbin/httpd -k start 1677932 506832 nobody 20320 0.0 S 00:37 /usr/sbin/httpd -k start 1677937 506832 nobody 20096 0.0 S 00:36 /usr/sbin/httpd -k start 1677939 506832 nobody 19336 0.0 S 00:36 /usr/sbin/httpd -k start 1677940 506832 nobody 17944 0.2 S 00:36 /usr/sbin/httpd -k start 509671 508992 netdata 17796 2.1 Sl 1-01:09:18 /usr/libexec/netdata/plugins.d/apps.plugin 1 1677938 506832 nobody 17776 0.1 S 00:36 /usr/sbin/httpd -k start 1678332 506832 nobody 17768 0.0 S 00:07 /usr/sbin/httpd -k start 481558 1 root 17692 0.1 Ssl 1-01:11:47 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 508634 1 named 17164 0.0 Ssl 1-01:09:28 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1607924 1471 root 16716 0.0 S 22:31 cPhulkd - dbprocessor 1239685 508511 aaa 15852 0.0 S 02:06:25 dovecot/imap 1471 1 root 15688 0.0 Ss 60-17:19:15 cPhulkd - processor 1645262 1471 root 15240 0.0 S 09:28 cPhulkd - processor - http socket 607605 508511 lowrange 15160 0.0 S 05:07:47 dovecot/imap 798382 508511 lowrange 15120 0.0 S 04:13:01 dovecot/imap 1678341 508511 kurri 14920 0.2 S 00:05 dovecot/imap 4180059 4180015 evolution 14896 0.0 Ss 1-03:29:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 1660660 508511 infinium 14760 0.0 S 06:10 dovecot/imap 504012 508511 kurri 14648 0.0 S 05:38:51 dovecot/imap 508856 508814 mailman 14644 0.0 S 1-01:09:26 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3792585 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min corpkicks/corporatekicks.com.au-ssl_log 124 tubesupplies/tubesupplies.com.au-ssl_log 93 aaa/aaadownunder.com.au-ssl_log 89 evolution/portal.evolutionerp.com.au-ssl_log 24 madalice/madalice.com.au-ssl_log 12 alison/alisonarts.com.au-ssl_log 3 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 122 20.104.50.220 93 158.158.54.35 84 20.104.68.135 21 203.54.180.238 2 52.167.144.141 2 157.55.39.11 2 118.127.40.55 2 114.119.146.16 1 91.92.243.239 1 65.111.7.39 1 65.111.3.75 1 65.111.31.129 1 65.111.3.109 1 65.111.30.113 1 52.73.6.26 --- top request paths across all vhosts (last 3 min) --- 21 GET /heartbeat.php 3 GET / 2 POST /wp-cron.php 2 GET /wp-login.php 2 GET /wp-includes/fonts/ 2 GET /store/drippy-air-max-90-custom-shoes/ 2 GET /NewFile.php 2 GET /a.php 2 GET /about.php 2 GET /abcd.php 2 GET /aa.php 2 GET /aaa.php 1 POST /wp-login.php 1 HEAD / 1 GET /Ysuyo.php 1 GET /Yetix.php 1 GET /Xzd.php 1 GET /XxX.php 1 GET /x.php 1 GET /xleet.php --- busiest 3 vhosts: top paths + last 10 requests --- == corpkicks/corporatekicks.com.au-ssl_log == -- top paths -- 1 POST /wp-cron.php 1 HEAD / 1 GET /wp-includes/pomo/up 1 GET /wp-includes/media.php 1 GET /wp-includes/js/mpvloi.php 1 GET /wp-includes/js/codemirror/hehe.php 1 GET /wp-includes/fonts/ 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp-content/plugins/defaults.php 1 GET /wp-content/mu-plugins/jp.php 1 GET /wp-content/languages/wp-damin.php 1 GET /wp-content/f35.php -- last 10 requests -- 20.104.50.220 - - [29/Aug/2026:03:28:40 +1000] "GET /update/02.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [29/Aug/2026:03:28:41 +1000] "GET /update/go.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [29/Aug/2026:03:28:41 +1000] "GET /mpvloi.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [29/Aug/2026:03:28:42 +1000] "GET /images/mar.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [29/Aug/2026:03:28:42 +1000] "GET /files/moon.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [29/Aug/2026:03:28:43 +1000] "GET /img/ty.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [29/Aug/2026:03:28:43 +1000] "GET /js/wp-login.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [29/Aug/2026:03:28:44 +1000] "GET /index/link.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [29/Aug/2026:03:28:44 +1000] "GET /index/cong.php HTTP/1.1" 401 36 "-" "-" 20.104.50.220 - - [29/Aug/2026:03:28:45 +1000] "GET /update/simple.php HTTP/1.1" 401 36 "-" "-" == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 1 GET /x.php 1 GET /xleet.php 1 GET /xda.php 1 GET /ws54.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-includes/SimplePie/wp-login.php 1 GET /wp-includes/Requests/library/index.php 1 GET /wp-includes/fonts/index.php 1 GET /wp-includes/fonts/ 1 GET /wp-includes/customize/index.php -- last 10 requests -- 158.158.54.35 - - [29/Aug/2026:03:28:57 +1000] "GET /wp-login.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [29/Aug/2026:03:28:57 +1000] "GET /default.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [29/Aug/2026:03:28:57 +1000] "GET /i.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [29/Aug/2026:03:28:58 +1000] "GET /wp-content/uploads/ HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [29/Aug/2026:03:28:58 +1000] "GET /wp-includes/Requests/library/index.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari 158.158.54.35 - - [29/Aug/2026:03:28:58 +1000] "GET /wp-content/themes/index.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [29/Aug/2026:03:28:58 +1000] "GET /gecko-new.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [29/Aug/2026:03:28:59 +1000] "GET /NewFile.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [29/Aug/2026:03:28:59 +1000] "GET /wp-Blogs.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [29/Aug/2026:03:28:59 +1000] "GET /wp-includes/fonts/index.php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 1 POST /wp-cron.php 1 GET /Ysuyo.php 1 GET /Yetix.php 1 GET /Xzd.php 1 GET /XxX.php 1 GET /WSOEnigma.php 1 GET /wp-login.php 1 GET /WordPressCore/index.php 1 GET /WordPressCore/include.php 1 GET /WordPressCore/cong.php 1 GET /WebShell.php 1 GET /V5.php -- last 10 requests -- 20.104.68.135 - - [29/Aug/2026:03:28:35 +1000] "GET /admbypass.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:03:28:35 +1000] "GET /admiin.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:03:28:35 +1000] "GET /admin%201.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:03:28:35 +1000] "GET /admin-ajax.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:03:28:36 +1000] "GET /admin-footer.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:03:28:36 +1000] "GET /admin-functions.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:03:28:36 +1000] "GET /admin-heade.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:03:28:36 +1000] "GET /admin-header.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:03:28:36 +1000] "GET /admin-post.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.104.68.135 - - [29/Aug/2026:03:28:37 +1000] "GET /admin-wolf.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-29 03:26:41 L1=0.93 run=2 blk=0 avail=8130 (59.0%) swpO=0 conn=1 myRSS=2771 php=6 phpRSS=572 ap=21 tcp=36 topuser=madalice 2026-08-29 03:26:44 L1=0.93 run=2 blk=0 avail=8230 (59.7%) swpO=0 conn=3 myRSS=2771 php=7 phpRSS=477 ap=21 tcp=37 topuser=madalice 2026-08-29 03:26:51 L1=0.86 run=3 blk=0 avail=8224 (59.7%) swpO=0 conn=2 myRSS=2771 php=6 phpRSS=473 ap=21 tcp=35 topuser=madalice 2026-08-29 03:26:54 L1=0.86 run=1 blk=0 avail=8414 (61.1%) swpO=0 conn=3 myRSS=2771 php=4 phpRSS=217 ap=21 tcp=39 topuser=madalice 2026-08-29 03:27:01 L1=0.73 run=3 blk=0 avail=8422 (61.1%) swpO=0 conn=2 myRSS=2771 php=4 phpRSS=224 ap=21 tcp=35 topuser=madalice 2026-08-29 03:27:04 L1=0.73 run=2 blk=0 avail=8418 (61.1%) swpO=0 conn=3 myRSS=2771 php=4 phpRSS=218 ap=21 tcp=32 topuser=madalice 2026-08-29 03:27:11 L1=0.62 run=1 blk=0 avail=8429 (61.2%) swpO=0 conn=2 myRSS=2771 php=3 phpRSS=201 ap=18 tcp=30 topuser=madalice 2026-08-29 03:27:15 L1=0.62 run=1 blk=0 avail=8484 (61.6%) swpO=0 conn=3 myRSS=2771 php=4 phpRSS=241 ap=16 tcp=31 topuser=madalice 2026-08-29 03:27:21 L1=0.60 run=1 blk=0 avail=8492 (61.6%) swpO=0 conn=2 myRSS=2771 php=3 phpRSS=201 ap=16 tcp=30 topuser=madalice 2026-08-29 03:27:25 L1=0.60 run=1 blk=0 avail=8480 (61.6%) swpO=0 conn=3 myRSS=2771 php=4 phpRSS=240 ap=16 tcp=32 topuser=madalice 2026-08-29 03:27:31 L1=0.51 run=1 blk=0 avail=8490 (61.6%) swpO=0 conn=2 myRSS=2771 php=3 phpRSS=200 ap=16 tcp=30 topuser=madalice 2026-08-29 03:27:35 L1=0.51 run=1 blk=0 avail=8495 (61.7%) swpO=0 conn=2 myRSS=2771 php=4 phpRSS=239 ap=14 tcp=31 topuser=madalice 2026-08-29 03:27:41 L1=0.51 run=1 blk=0 avail=8510 (61.8%) swpO=0 conn=2 myRSS=2771 php=3 phpRSS=200 ap=14 tcp=30 topuser=madalice 2026-08-29 03:27:45 L1=0.51 run=1 blk=0 avail=8496 (61.7%) swpO=0 conn=2 myRSS=2771 php=3 phpRSS=200 ap=14 tcp=31 topuser=madalice 2026-08-29 03:27:51 L1=0.51 run=1 blk=0 avail=8645 (62.8%) swpO=0 conn=1 myRSS=2771 php=2 phpRSS=46 ap=15 tcp=30 topuser=root 2026-08-29 03:27:55 L1=0.51 run=2 blk=0 avail=8503 (61.7%) swpO=0 conn=2 myRSS=2771 php=4 phpRSS=225 ap=15 tcp=34 topuser=madalice 2026-08-29 03:28:01 L1=0.59 run=3 blk=0 avail=8249 (59.9%) swpO=0 conn=1 myRSS=2771 php=6 phpRSS=518 ap=18 tcp=33 topuser=madalice 2026-08-29 03:28:05 L1=0.59 run=3 blk=0 avail=8260 (60.0%) swpO=0 conn=2 myRSS=2771 php=6 phpRSS=513 ap=17 tcp=34 topuser=madalice 2026-08-29 03:28:11 L1=0.81 run=2 blk=0 avail=8244 (59.8%) swpO=0 conn=1 myRSS=2771 php=6 phpRSS=523 ap=17 tcp=32 topuser=madalice 2026-08-29 03:28:15 L1=0.81 run=1 blk=0 avail=8398 (61.0%) swpO=0 conn=2 myRSS=2771 php=4 phpRSS=310 ap=17 tcp=31 topuser=madalice 2026-08-29 03:28:21 L1=0.83 run=1 blk=0 avail=8509 (61.8%) swpO=0 conn=1 myRSS=2771 php=3 phpRSS=178 ap=17 tcp=32 topuser=madalice 2026-08-29 03:28:25 L1=0.84 run=3 blk=0 avail=8507 (61.7%) swpO=0 conn=2 myRSS=2771 php=3 phpRSS=181 ap=17 tcp=35 topuser=madalice 2026-08-29 03:28:31 L1=0.78 run=2 blk=0 avail=8401 (61.0%) swpO=0 conn=1 myRSS=2771 php=3 phpRSS=243 ap=24 tcp=37 topuser=madalice 2026-08-29 03:28:35 L1=0.71 run=2 blk=0 avail=8439 (61.3%) swpO=0 conn=1 myRSS=2771 php=3 phpRSS=201 ap=24 tcp=40 topuser=madalice 2026-08-29 03:28:41 L1=0.66 run=2 blk=0 avail=8431 (61.2%) swpO=0 conn=1 myRSS=2771 php=3 phpRSS=201 ap=24 tcp=36 topuser=madalice 2026-08-29 03:28:45 L1=0.68 run=2 blk=0 avail=8305 (60.3%) swpO=0 conn=1 myRSS=2771 php=4 phpRSS=384 ap=22 tcp=40 topuser=corpkicks 2026-08-29 03:28:51 L1=0.71 run=3 blk=0 avail=8289 (60.2%) swpO=0 conn=2 myRSS=2771 php=4 phpRSS=392 ap=22 tcp=37 topuser=madalice 2026-08-29 03:28:55 L1=0.73 run=3 blk=0 avail=8294 (60.2%) swpO=0 conn=1 myRSS=2771 php=5 phpRSS=411 ap=22 tcp=42 topuser=olympic 2026-08-29 03:29:02 L1=0.67 run=1 blk=0 avail=8347 (60.6%) swpO=0 conn=2 myRSS=2771 php=4 phpRSS=313 ap=23 tcp=38 topuser=madalice 2026-08-29 03:29:05 L1=1.74 run=12 blk=0 avail=6821 (49.5%) swpO=22 conn=9 myRSS=2770 php=13 phpRSS=1812 ap=25 tcp=48 topuser=madalice