INCIDENT 2026-08-29 11:45:11 trigger: php_rss=2443MB ================================================================== load: 3.81 2.12 1.48 18/700 3418744 ncpu:10 mem_avail: 6597MB/13777MB (47.9%) swap_used:1270MB swapout:0/s blocked(D):0 running:20 iowait:0.1% steal:0.0% php: 20 procs / 2443MB heaviest user: corpkicks (9 procs, 1368MB) apache: 26 procs tcp_estab: 49 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2810 corpkicks 11 1598 root 287 1141 madalice 6 817 nobody 25 468 mailman 20 221 netdata 7 202 evolution 9 121 olympic 1 113 cpanellogin 1 102 dovenull 6 59 wp-toolkit 3 50 zabbix 1 23 dovecot 3 23 mailnull 2 20 named 1 16 kurri 1 9 polkitd 1 7 nscd 1 5 rpc 1 4 --- php workers by user --- USER PROCS RSS_MB corpkicks 11 1642 madalice 6 817 evolution 3 119 olympic 1 114 root 1 30 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4989 MB Active(file): 4273 MB Inactive(file): 1357 MB Dirty: 0 MB Writeback: 1 MB SReclaimable: 696 MB CommitLimit: 10984 MB Committed_AS: 9531 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-09:26:32 7768 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2860352 10.0 Ssl 1-09:26:01 /usr/sbin/mariadbd 3418277 3404014 corpkicks 227592 57.5 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3418281 3411391 corpkicks 222304 60.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3418265 3412894 corpkicks 220560 57.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3418276 3388047 corpkicks 217480 53.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1502903 1451906 root 209972 0.1 S 09:08:50 spamd child 3418271 3404333 corpkicks 206512 51.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3418358 3412893 corpkicks 206216 51.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 508924 1 netdata 177344 2.0 Ssl 1-09:25:30 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3418278 3411393 corpkicks 172360 40.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3418273 3404028 corpkicks 171020 47.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1502904 1451906 root 166392 0.0 S 09:08:50 spamd child 3387052 510022 madalice 165436 14.2 S 06:36 php-fpm: pool madalice_com_au 1451906 1 root 164012 0.0 Ss 09:22:05 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3403948 510022 madalice 162868 10.7 S 01:55 php-fpm: pool madalice_com_au 3387436 510022 madalice 159396 13.3 S 06:03 php-fpm: pool madalice_com_au 3387018 510022 madalice 137476 15.2 S 06:44 php-fpm: pool madalice_com_au 3418106 3404328 olympic 120136 51.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3387462 510022 madalice 107628 13.1 S 06:03 php-fpm: pool madalice_com_au 2971632 1353308 cpanellogin 105412 0.0 S 02:08:17 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 3388187 510022 madalice 104160 13.0 S 05:14 php-fpm: pool madalice_com_au 509266 1 root 96372 0.0 Ss 1-09:25:27 /usr/lib/systemd/systemd-journald 3418711 3412892 corpkicks 92800 34.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3404749 3404724 evolution 71448 2.3 Ss 00:12 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 3418729 3418706 corpkicks 68192 20.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 509236 509098 root 63996 0.0 Sl 1-09:25:27 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3418738 3412895 corpkicks 60448 16.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1353308 1 root 41964 0.1 Ss 38-09:03:53 cpsrvd (SSL) - waiting for connections 509640 508992 root 35804 0.0 Sl 1-09:25:25 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 34880 0.0 Ss 09:22:58 lfd - sleeping 510022 1 root 30812 0.0 Ss 1-09:25:23 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 29672 0.0 Ss 1-07:33:04 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 483898 1 zabbix 24316 0.2 Ssl 1-09:26:44 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1469 1 root 23900 0.1 Ss 61-01:35:22 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3388047 506832 nobody 23468 0.0 S 05:26 /usr/sbin/httpd -k start 3402576 506832 nobody 23228 0.0 S 04:21 /usr/sbin/httpd -k start 3404333 506832 nobody 22032 0.0 S 01:05 /usr/sbin/httpd -k start 3386981 506832 nobody 22028 0.0 S 06:48 /usr/sbin/httpd -k start 3386701 506832 nobody 22024 0.0 S 07:29 /usr/sbin/httpd -k start 3404028 506832 nobody 21768 0.0 S 01:45 /usr/sbin/httpd -k start 3404014 506832 nobody 21736 0.0 S 01:47 /usr/sbin/httpd -k start 1463 1 root 21720 0.0 Ss 61-01:35:22 tailwatchd 3404323 506832 nobody 21500 0.2 S 01:06 /usr/sbin/httpd -k start 3404318 506832 nobody 21408 0.0 S 01:07 /usr/sbin/httpd -k start 3404020 506832 nobody 21300 0.0 S 01:46 /usr/sbin/httpd -k start 3404034 506832 nobody 21076 0.0 S 01:45 /usr/sbin/httpd -k start 3404026 506832 nobody 21024 0.0 S 01:46 /usr/sbin/httpd -k start 3404328 506832 nobody 20908 0.0 S 01:05 /usr/sbin/httpd -k start 3387206 506832 nobody 20392 0.0 S 06:13 /usr/sbin/httpd -k start 3404316 506832 nobody 20340 0.1 S 01:08 /usr/sbin/httpd -k start 3411391 506832 nobody 19608 0.0 S 00:06 /usr/sbin/httpd -k start 3411393 506832 nobody 19572 0.0 S 00:06 /usr/sbin/httpd -k start 3412892 506832 nobody 19512 0.2 S 00:05 /usr/sbin/httpd -k start 938585 1 wp-toolkit 19272 0.0 Ss 1-07:33:04 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3409790 506832 nobody 19248 0.1 S 00:07 /usr/sbin/httpd -k start 509671 508992 netdata 17576 2.1 Sl 1-09:25:25 /usr/libexec/netdata/plugins.d/apps.plugin 1 481558 1 root 17072 0.1 Ssl 1-09:27:54 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 3412893 506832 nobody 17032 0.0 S 00:05 /usr/sbin/httpd -k start 3418706 506832 nobody 17020 0.0 S 00:01 /usr/sbin/httpd -k start 3412894 506832 nobody 16972 0.2 S 00:05 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3953223 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 141 madalice/madalice.com.au-ssl_log 128 olympic/olympicfencing.com.au-ssl_log 49 coscom/swms.coscom.com.au 47 infinium/infinium.net.au-ssl_log 23 olympic/olympicfencing.com.au 21 evolution/portal.evolutionerp.com.au-ssl_log 19 corpkicks/corporatekicks.com.au-ssl_log 8 aaa/aaadownunder.com.au-ssl_log 3 evolution/my.evolutionerp.com.au-ssl_log 2 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 141 40.115.94.245 105 140.245.103.252 67 20.220.204.93 47 20.63.81.20 26 118.127.40.55 19 203.54.180.238 12 34.146.82.187 6 136.108.71.68 3 100.48.78.137 2 2001:8003:1636:a200:104a:60be:4c01:937a 2 175.36.227.212 2 162.144.21.160 2 143.244.57.120 1 91.92.243.251 1 65.111.13.63 --- top request paths across all vhosts (last 3 min) --- 70 GET /wp-admin/index.php 36 POST /wp-login.php 19 POST / 19 GET /heartbeat.php 8 POST /wp-cron.php 3 GET /zxekqlxb.php 3 GET /xsox.php 3 GET /wp-scr1pts.php 3 GET /tfm.php 3 GET /term.php 3 GET /num.php 3 GET /ms.php 3 GET /init.php 3 GET /grsiuk.php 3 GET /Geforce.php 3 GET /gdn.php 3 GET /galer.php 3 GET /f2.php 3 GET /error_log.php 3 GET /cytyr.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 2 GET /api/getItem/SHSG656520 2 GET /api/getItem/SHSG656516 2 GET /api/getItem/SHSG125125508 2 GET /api/getItem/SHSG125125408 2 GET /api/getItem/SHSG100100508 2 GET /api/getItem/SHSG100100408 2 GET /api/getItem/SHSG100100308 -- last 10 requests -- 40.115.94.245 - - [29/Aug/2026:11:45:09 +1000] "GET /api/getItem/RHSG1257530 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:11:45:09 +1000] "GET /api/getItem/RHSG12575408 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:11:45:09 +1000] "GET /api/getItem/RHSG12575508 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:11:45:09 +1000] "GET /api/getItem/RHSP12575608 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:11:45:09 +1000] "GET /api/getItem/RHSG15050208 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:11:45:09 +1000] "GET /api/getItem/RHSG15050258 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:11:45:10 +1000] "GET /api/getItem/RHSG15050308 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:11:45:10 +1000] "GET /api/getItem/RHSG15050408 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:11:45:10 +1000] "GET /api/getItem/RHSG15050508 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:11:45:10 +1000] "GET /api/getItem/RHSP15050608 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == madalice/madalice.com.au-ssl_log == -- top paths -- 70 GET /wp-admin/index.php 35 POST /wp-login.php 17 POST / 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /wp-json/wp/v2/product/31596 1 GET /design-your-own-shoes/ 1 GET / -- last 10 requests -- 140.245.103.252 - - [29/Aug/2026:11:44:55 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 6745 "https://madalice.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko 140.245.103.252 - - [29/Aug/2026:11:44:57 +1000] "POST /wp-login.php HTTP/1.1" 503 6559 "https://madalice.com.au/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 140.245.103.252 - - [29/Aug/2026:11:44:57 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 6745 "https://madalice.com.au/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515 140.245.103.252 - - [29/Aug/2026:11:44:58 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 6745 "https://madalice.com.au/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515 140.245.103.252 - - [29/Aug/2026:11:45:00 +1000] "POST /wp-login.php HTTP/1.1" 503 6559 "https://madalice.com.au/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64; rv:92.0) Gecko/20100101 Firefox/92.0" 140.245.103.252 - - [29/Aug/2026:11:45:00 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 6745 "https://madalice.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) 140.245.103.252 - - [29/Aug/2026:11:45:02 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 6745 "https://madalice.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) 118.127.40.55 - - [29/Aug/2026:11:45:02 +1000] "POST /?wordfence_syncAttackData=1787967902.8622 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://madalice.com.au" 140.245.103.252 - - [29/Aug/2026:11:45:04 +1000] "POST /wp-login.php HTTP/1.1" 503 6559 "https://madalice.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Ver 140.245.103.252 - - [29/Aug/2026:11:45:05 +1000] "GET /wp-admin/index.php HTTP/1.1" 503 6745 "https://madalice.com.au/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:91.0) Gecko/20100101 Firefox/91.0" == olympic/olympicfencing.com.au-ssl_log == -- top paths -- 2 POST /wp-cron.php 2 GET /zxekqlxb.php 2 GET /xsox.php 2 GET /wp-scr1pts.php 2 GET /tfm.php 2 GET /term.php 2 GET /num.php 2 GET /ms.php 2 GET /lkui.php 2 GET /init.php 2 GET /grsiuk.php 2 GET /Geforce.php -- last 10 requests -- 20.220.204.93 - - [29/Aug/2026:11:44:05 +1000] "GET /term.php HTTP/1.1" 301 - "-" "-" 20.220.204.93 - - [29/Aug/2026:11:44:06 +1000] "GET /term.php HTTP/1.1" 404 56918 "-" "-" 20.220.204.93 - - [29/Aug/2026:11:44:08 +1000] "GET /aaa.php HTTP/1.1" 301 - "-" "-" 20.220.204.93 - - [29/Aug/2026:11:44:10 +1000] "GET /aaa.php HTTP/1.1" 404 56918 "-" "-" 20.220.204.93 - - [29/Aug/2026:11:44:12 +1000] "GET /xsox.php HTTP/1.1" 301 - "-" "-" 20.220.204.93 - - [29/Aug/2026:11:44:13 +1000] "GET /xsox.php HTTP/1.1" 404 56918 "-" "-" 20.220.204.93 - - [29/Aug/2026:11:44:16 +1000] "GET /lkui.php HTTP/1.1" 301 - "-" "-" 118.127.40.55 - - [29/Aug/2026:11:44:14 +1000] "POST /wp-cron.php?doing_wp_cron=1787967854.8161880970001220703125 HTTP/1.1" 200 1 "-" "WordPress/6.9.7; https://www.olympicfencing.com.au" 20.220.204.93 - - [29/Aug/2026:11:44:17 +1000] "GET /lkui.php HTTP/1.1" 404 56918 "-" "-" 20.220.204.93 - - [29/Aug/2026:11:44:19 +1000] "GET /wp-admin/css/colors/blue/about.php HTTP/1.1" 301 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-29 11:42:49 L1=1.59 run=2 blk=0 avail=7877 (57.2%) swpO=0 conn=1 myRSS=2810 php=8 phpRSS=802 ap=20 tcp=28 topuser=madalice 2026-08-29 11:42:51 L1=1.59 run=5 blk=0 avail=7586 (55.1%) swpO=0 conn=3 myRSS=2810 php=11 phpRSS=1184 ap=20 tcp=35 topuser=madalice 2026-08-29 11:42:59 L1=1.88 run=3 blk=0 avail=7883 (57.2%) swpO=0 conn=1 myRSS=2810 php=8 phpRSS=784 ap=21 tcp=29 topuser=madalice 2026-08-29 11:43:01 L1=1.88 run=5 blk=0 avail=7734 (56.1%) swpO=0 conn=3 myRSS=2810 php=8 phpRSS=936 ap=21 tcp=25 topuser=madalice 2026-08-29 11:43:09 L1=1.98 run=3 blk=0 avail=7665 (55.6%) swpO=0 conn=4 myRSS=2810 php=9 phpRSS=1052 ap=19 tcp=29 topuser=madalice 2026-08-29 11:43:11 L1=1.98 run=4 blk=0 avail=7853 (57.0%) swpO=0 conn=3 myRSS=2810 php=8 phpRSS=831 ap=19 tcp=26 topuser=madalice 2026-08-29 11:43:19 L1=1.90 run=4 blk=0 avail=7531 (54.7%) swpO=1 conn=4 myRSS=2810 php=9 phpRSS=1170 ap=22 tcp=30 topuser=madalice 2026-08-29 11:43:21 L1=1.90 run=7 blk=0 avail=7652 (55.5%) swpO=1 conn=3 myRSS=2810 php=9 phpRSS=1044 ap=22 tcp=28 topuser=madalice 2026-08-29 11:43:29 L1=2.07 run=3 blk=0 avail=7431 (53.9%) swpO=0 conn=4 myRSS=2810 php=9 phpRSS=1057 ap=52 tcp=43 topuser=madalice 2026-08-29 11:43:31 L1=2.22 run=4 blk=0 avail=7456 (54.1%) swpO=0 conn=3 myRSS=2810 php=9 phpRSS=1018 ap=52 tcp=67 topuser=madalice 2026-08-29 11:43:39 L1=2.21 run=3 blk=0 avail=7460 (54.1%) swpO=0 conn=4 myRSS=2810 php=9 phpRSS=1004 ap=52 tcp=46 topuser=madalice 2026-08-29 11:43:41 L1=2.11 run=2 blk=0 avail=7544 (54.8%) swpO=0 conn=3 myRSS=2810 php=8 phpRSS=901 ap=51 tcp=31 topuser=madalice 2026-08-29 11:43:49 L1=2.10 run=2 blk=0 avail=7644 (55.5%) swpO=0 conn=4 myRSS=2810 php=9 phpRSS=887 ap=42 tcp=29 topuser=madalice 2026-08-29 11:43:51 L1=2.01 run=2 blk=0 avail=7674 (55.7%) swpO=0 conn=3 myRSS=2810 php=8 phpRSS=850 ap=40 tcp=28 topuser=madalice 2026-08-29 11:43:59 L1=1.93 run=5 blk=0 avail=7651 (55.5%) swpO=0 conn=4 myRSS=2810 php=9 phpRSS=971 ap=32 tcp=27 topuser=madalice 2026-08-29 11:44:01 L1=1.86 run=4 blk=0 avail=7781 (56.5%) swpO=0 conn=3 myRSS=2810 php=8 phpRSS=826 ap=30 tcp=25 topuser=madalice 2026-08-29 11:44:09 L1=1.87 run=3 blk=0 avail=7579 (55.0%) swpO=0 conn=3 myRSS=2810 php=9 phpRSS=986 ap=42 tcp=35 topuser=madalice 2026-08-29 11:44:11 L1=1.96 run=3 blk=0 avail=7642 (55.5%) swpO=0 conn=3 myRSS=2810 php=9 phpRSS=922 ap=40 tcp=36 topuser=madalice 2026-08-29 11:44:19 L1=1.96 run=7 blk=0 avail=7572 (55.0%) swpO=0 conn=3 myRSS=2810 php=11 phpRSS=1114 ap=32 tcp=36 topuser=madalice 2026-08-29 11:44:21 L1=1.97 run=4 blk=0 avail=7684 (55.8%) swpO=0 conn=3 myRSS=2810 php=9 phpRSS=956 ap=30 tcp=31 topuser=madalice 2026-08-29 11:44:29 L1=1.81 run=2 blk=0 avail=7853 (57.0%) swpO=0 conn=3 myRSS=2810 php=8 phpRSS=832 ap=22 tcp=23 topuser=madalice 2026-08-29 11:44:31 L1=1.90 run=3 blk=0 avail=7755 (56.3%) swpO=0 conn=3 myRSS=2810 php=9 phpRSS=954 ap=22 tcp=22 topuser=madalice 2026-08-29 11:44:39 L1=1.75 run=1 blk=0 avail=7871 (57.1%) swpO=0 conn=3 myRSS=2810 php=8 phpRSS=816 ap=20 tcp=22 topuser=madalice 2026-08-29 11:44:41 L1=1.69 run=4 blk=0 avail=7826 (56.8%) swpO=0 conn=3 myRSS=2810 php=9 phpRSS=892 ap=20 tcp=24 topuser=madalice 2026-08-29 11:44:49 L1=1.55 run=3 blk=0 avail=7789 (56.5%) swpO=0 conn=3 myRSS=2810 php=9 phpRSS=927 ap=20 tcp=25 topuser=madalice 2026-08-29 11:44:51 L1=1.51 run=3 blk=0 avail=7763 (56.3%) swpO=0 conn=3 myRSS=2810 php=9 phpRSS=959 ap=20 tcp=21 topuser=madalice 2026-08-29 11:44:59 L1=1.63 run=3 blk=0 avail=7727 (56.1%) swpO=0 conn=3 myRSS=2810 php=10 phpRSS=1016 ap=19 tcp=25 topuser=madalice 2026-08-29 11:45:01 L1=2.46 run=6 blk=0 avail=7795 (56.6%) swpO=0 conn=3 myRSS=2810 php=10 phpRSS=921 ap=19 tcp=25 topuser=madalice 2026-08-29 11:45:10 L1=2.74 run=5 blk=0 avail=7629 (55.4%) swpO=0 conn=4 myRSS=2810 php=10 phpRSS=1063 ap=26 tcp=32 topuser=madalice 2026-08-29 11:45:11 L1=3.81 run=20 blk=0 avail=6597 (47.9%) swpO=0 conn=12 myRSS=2810 php=20 phpRSS=2443 ap=26 tcp=49 topuser=corpkicks