INCIDENT 2026-08-29 22:40:54 trigger: php_rss=3001MB mysql_conn=19 ================================================================== load: 2.06 1.52 1.40 27/680 1515510 ncpu:10 mem_avail: 6434MB/13777MB (46.7%) swap_used:1786MB swapout:67/s blocked(D):0 running:20 iowait:0.1% steal:0.0% php: 20 procs / 3001MB heaviest user: corpkicks (18 procs, 2964MB) apache: 30 procs tcp_estab: 98 --- RSS by user (all processes) --- USER PROCS RSS_MB corpkicks 18 3212 mysql 1 2615 root 256 1012 nobody 29 447 netdata 7 192 mailman 20 148 cpanellogin 1 71 dovenull 6 48 evolution 11 47 wp-toolkit 3 34 aaa 2 30 lowrange 2 28 kurri 2 27 zabbix 1 22 dovecot 3 20 named 1 15 infinium 1 14 mailnull 1 6 polkitd 1 5 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB corpkicks 18 3251 root 1 23 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5140 MB Active(file): 3262 MB Inactive(file): 2182 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 572 MB CommitLimit: 10984 MB Committed_AS: 9856 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-20:22:14 6372 /usr/bin/imunify-agent-proxy 1501180 root 00:54 3148 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2678600 8.5 Ssl 1-20:21:44 /usr/sbin/mariadbd 1515450 1498061 corpkicks 279212 39.2 S 00:04 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1515451 1499275 corpkicks 273608 43.0 R 00:04 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1515464 1515446 corpkicks 270068 51.0 R 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1515472 1515432 corpkicks 246520 64.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1515463 1515449 corpkicks 246140 52.3 R 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1515461 1515448 corpkicks 240496 47.6 R 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1515468 1499691 corpkicks 223524 58.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1515466 1499272 corpkicks 217484 46.6 R 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1515471 1499681 corpkicks 214152 51.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1515467 1515431 corpkicks 204664 37.6 S 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1515465 1500825 corpkicks 186680 34.0 S 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 508924 1 netdata 175256 1.9 Ssl 1-20:21:13 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1515469 1499276 corpkicks 169276 44.5 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 83639 1451906 root 168724 0.0 S 06:43:21 spamd child 1515470 1515429 corpkicks 167596 46.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1502904 1451906 root 161432 0.0 S 20:04:33 spamd child 1515475 1500826 corpkicks 132108 54.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 509266 1 root 118344 0.0 Ss 1-20:21:10 /usr/lib/systemd/systemd-journald 1515473 1498060 corpkicks 116836 28.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1451906 1 root 114528 0.0 Ss 20:17:48 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1515474 1499653 corpkicks 101752 44.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1515476 1499310 corpkicks 83816 32.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1136288 1353308 cpanellogin 72860 0.0 S 01:43:23 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 509236 509098 root 59256 0.0 Sl 1-20:21:10 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1515525 1504459 corpkicks 52912 9.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 509640 508992 root 40960 0.0 Sl 1-20:21:08 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 39924 0.1 Ss 38-19:59:36 cpsrvd (SSL) - waiting for connections 1451116 1 root 31748 0.0 Ss 20:18:41 lfd - sleeping 1515556 510022 madalice 28148 10.0 R 00:01 php-fpm: pool madalice_com_au 510022 1 root 24208 0.0 Ss 1-20:21:06 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 23488 0.2 Ssl 1-20:22:27 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1499276 506832 nobody 21504 0.0 S 03:20 /usr/sbin/httpd -k start 1499272 506832 nobody 21436 0.0 S 03:20 /usr/sbin/httpd -k start 1498060 506832 nobody 21260 0.0 S 05:32 /usr/sbin/httpd -k start 1499275 506832 nobody 21232 0.0 S 03:20 /usr/sbin/httpd -k start 1499310 506832 nobody 21216 0.0 S 03:13 /usr/sbin/httpd -k start 1499653 506832 nobody 21208 0.0 S 03:12 /usr/sbin/httpd -k start 1469 1 root 20452 0.1 Ss 61-12:31:05 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 938582 1 wp-toolkit 20324 0.0 Ss 1-18:28:47 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1463 1 root 20244 0.0 Ss 61-12:31:05 tailwatchd 1499681 506832 nobody 20208 0.0 S 03:11 /usr/sbin/httpd -k start 1499691 506832 nobody 19920 0.0 S 03:11 /usr/sbin/httpd -k start 1498061 506832 nobody 19720 0.0 S 05:32 /usr/sbin/httpd -k start 1500826 506832 nobody 19664 0.0 S 01:29 /usr/sbin/httpd -k start 1500825 506832 nobody 18752 0.0 S 01:29 /usr/sbin/httpd -k start 1504459 506832 nobody 18464 0.0 S 00:52 /usr/sbin/httpd -k start 1515431 506832 nobody 17248 0.2 S 00:05 /usr/sbin/httpd -k start 1515429 506832 nobody 17200 0.1 S 00:06 /usr/sbin/httpd -k start 1515447 506832 nobody 17184 0.0 S 00:04 /usr/sbin/httpd -k start 1515432 506832 nobody 17120 0.0 S 00:05 /usr/sbin/httpd -k start 1464700 1471 root 16732 0.0 S 14:29 cPhulkd - dbprocessor 1515453 506832 nobody 16712 0.0 S 00:03 /usr/sbin/httpd -k start 1515448 506832 nobody 16708 0.0 S 00:04 /usr/sbin/httpd -k start 1515446 506832 nobody 16688 0.2 S 00:04 /usr/sbin/httpd -k start 1515449 506832 nobody 16624 0.0 S 00:04 /usr/sbin/httpd -k start 1515454 506832 nobody 16600 0.3 S 00:03 /usr/sbin/httpd -k start 1446347 508511 aaa 15916 0.0 S 19:50 dovecot/imap 509671 508992 netdata 15808 2.1 Sl 1-20:21:08 /usr/libexec/netdata/plugins.d/apps.plugin 1 1471 1 root 15684 0.0 Ss 61-12:31:05 cPhulkd - processor --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4216261 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 181 kurri/kurrimotorinn.com.au-ssl_log 59 nrg/nrgservices.net.au-ssl_log 58 aaa/aaadownunder.com.au-ssl_log 57 evolution/portal.evolutionerp.com.au-ssl_log 24 alison/alisonarts.com.au-ssl_log 6 corpkicks/corporatekicks.com.au-ssl_log 2 infinium/infinium.net.au-ssl_log 2 customc/customcentral.com.au-ssl_log 1 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 173 20.100.175.163 114 52.139.37.240 59 20.63.81.20 24 203.54.180.238 3 62.60.130.128 3 118.127.40.55 2 50.6.169.131 2 114.119.150.154 2 114.119.137.101 2 114.119.131.88 1 52.167.144.143 1 34.196.51.17 1 2a03:2880:f802:32:: 1 158.23.184.117 1 114.119.159.70 --- top request paths across all vhosts (last 3 min) --- 24 GET /heartbeat.php 3 POST /wp-cron.php 3 GET /wp-includes/images/media/ 3 GET /wp-admin/css/colors/modern/ 3 GET /222.php 3 GET / 2 GET /zoom1.php 2 GET /yanz.php 2 GET /xxx.php 2 GET /wp-mail.php 2 GET /wp-login.php 2 GET /wp-includes/Text/Diff/Engine/ 2 GET /wp-includes/PHPMailer/ 2 GET /wp-includes/interactivity-api/index.php 2 GET /wp-includes/customize/index.php 2 GET /wp-cron.php 2 GET /wp-content/file.php 2 GET /wp-content/admin.php 2 GET /wp-blog.php 2 GET /wp-admin/user/index.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 2 GET /store/hand-painted-nike-af1-roosters/ 2 GET /store/hand-painted-nike-af1-pink-pastel-flower/ 2 GET /222.php 1 GET /zoom1.php 1 GET /yanz.php 1 GET /xxx.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-themes.php -- last 10 requests -- 20.100.175.163 - - [29/Aug/2026:22:40:25 +1000] "GET /init.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:22:40:25 +1000] "GET /wp-includes/js/codemirror/about.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/5 20.100.175.163 - - [29/Aug/2026:22:40:25 +1000] "GET /wp-admin/css/colors/blue/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:22:40:26 +1000] "GET /wp-includes/Requests/library/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:22:40:26 +1000] "GET /wp-content/admin.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:22:40:26 +1000] "GET /wp-configs.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:22:40:27 +1000] "GET /wp-includes/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:22:40:27 +1000] "GET /wp-admin/a.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.100.175.163 - - [29/Aug/2026:22:40:27 +1000] "GET /wp-includes/sitemaps/providers/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 20.100.175.163 - - [29/Aug/2026:22:40:28 +1000] "GET /wp-includes/Text/about.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == kurri/kurrimotorinn.com.au-ssl_log == -- top paths -- 1 GET /xmini4.php 1 GET /xl2023.php 1 GET /wp_xiPu52Ut.php 1 GET /wp-ws68.php 1 GET /wp-theme.php 1 GET /wp_n5VD7XDh.php 1 GET /wp-mini.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-kz.php 1 GET /wp_KwIW0U5F.php 1 GET /wp-includes/ID3/getid.php -- last 10 requests -- 20.63.81.20 - - [29/Aug/2026:22:38:21 +1000] "GET /hd.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [29/Aug/2026:22:38:22 +1000] "GET /xl2023.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [29/Aug/2026:22:38:22 +1000] "GET /V2.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [29/Aug/2026:22:38:22 +1000] "GET /mad.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [29/Aug/2026:22:38:23 +1000] "GET /st.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [29/Aug/2026:22:38:23 +1000] "GET /alfanew.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [29/Aug/2026:22:38:24 +1000] "GET /ioxi.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [29/Aug/2026:22:38:24 +1000] "GET /TNT.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [29/Aug/2026:22:38:25 +1000] "GET /cd.php HTTP/1.1" 401 36 "-" "-" 20.63.81.20 - - [29/Aug/2026:22:38:25 +1000] "GET /luuf.php HTTP/1.1" 401 36 "-" "-" == nrg/nrgservices.net.au-ssl_log == -- top paths -- 1 GET /zwso.php 1 GET /zoom1.php 1 GET /yanz.php 1 GET /wp-sigunq.php 1 GET /wp-includes/rest-api/ 1 GET /wp-includes/PHPMailer/ 1 GET /wp-includes/images/media/ 1 GET /wp-includes/images/crystal/ 1 GET /wp-includes/customize/index.php 1 GET /wp-content/themes/alera/alpha.php 1 GET /wp-content/file.php 1 GET /wp-content/admin.php -- last 10 requests -- 52.139.37.240 - - [29/Aug/2026:22:39:39 +1000] "GET /wp-content/themes/alera/alpha.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537. 52.139.37.240 - - [29/Aug/2026:22:39:39 +1000] "GET /mah.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:39:39 +1000] "GET /about.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:39:39 +1000] "GET /sid3.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:39:40 +1000] "GET /blog.php7 HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:39:40 +1000] "GET /GOD.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:39:40 +1000] "GET /alumni_reg.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:39:40 +1000] "GET /depotcv.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:39:41 +1000] "GET /admin.php7 HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:22:39:41 +1000] "GET /ini.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-29 22:38:33 L1=2.83 run=1 blk=0 avail=7913 (57.4%) swpO=0 conn=3 myRSS=2615 php=9 phpRSS=899 ap=51 tcp=34 topuser=madalice 2026-08-29 22:38:34 L1=2.84 run=2 blk=0 avail=7920 (57.5%) swpO=0 conn=4 myRSS=2615 php=9 phpRSS=899 ap=50 tcp=34 topuser=madalice 2026-08-29 22:38:44 L1=2.78 run=1 blk=0 avail=8124 (59.0%) swpO=0 conn=3 myRSS=2615 php=8 phpRSS=743 ap=41 tcp=31 topuser=madalice 2026-08-29 22:38:44 L1=2.71 run=3 blk=0 avail=8131 (59.0%) swpO=0 conn=4 myRSS=2615 php=8 phpRSS=743 ap=40 tcp=31 topuser=madalice 2026-08-29 22:38:54 L1=2.82 run=1 blk=0 avail=8204 (59.5%) swpO=0 conn=3 myRSS=2615 php=8 phpRSS=743 ap=31 tcp=30 topuser=madalice 2026-08-29 22:38:54 L1=2.59 run=2 blk=0 avail=8210 (59.6%) swpO=0 conn=3 myRSS=2615 php=8 phpRSS=743 ap=30 tcp=30 topuser=madalice 2026-08-29 22:39:04 L1=2.38 run=2 blk=0 avail=8679 (63.0%) swpO=0 conn=3 myRSS=2615 php=5 phpRSS=274 ap=21 tcp=29 topuser=madalice 2026-08-29 22:39:04 L1=2.19 run=1 blk=0 avail=8686 (63.0%) swpO=0 conn=3 myRSS=2615 php=5 phpRSS=274 ap=20 tcp=29 topuser=madalice 2026-08-29 22:39:14 L1=2.02 run=1 blk=0 avail=8841 (64.2%) swpO=0 conn=3 myRSS=2615 php=4 phpRSS=117 ap=16 tcp=31 topuser=evolution 2026-08-29 22:39:14 L1=1.85 run=1 blk=0 avail=8840 (64.2%) swpO=0 conn=3 myRSS=2615 php=4 phpRSS=117 ap=16 tcp=31 topuser=evolution 2026-08-29 22:39:24 L1=1.72 run=1 blk=0 avail=8721 (63.3%) swpO=0 conn=3 myRSS=2615 php=5 phpRSS=251 ap=16 tcp=36 topuser=madalice 2026-08-29 22:39:24 L1=1.72 run=2 blk=0 avail=8685 (63.0%) swpO=0 conn=3 myRSS=2615 php=6 phpRSS=306 ap=17 tcp=36 topuser=madalice 2026-08-29 22:39:34 L1=1.46 run=1 blk=0 avail=8706 (63.2%) swpO=0 conn=3 myRSS=2615 php=5 phpRSS=251 ap=18 tcp=32 topuser=madalice 2026-08-29 22:39:34 L1=1.46 run=1 blk=0 avail=8705 (63.2%) swpO=0 conn=3 myRSS=2615 php=5 phpRSS=251 ap=18 tcp=32 topuser=madalice 2026-08-29 22:39:44 L1=1.39 run=3 blk=0 avail=8574 (62.2%) swpO=0 conn=3 myRSS=2615 php=6 phpRSS=442 ap=17 tcp=35 topuser=madalice 2026-08-29 22:39:44 L1=1.39 run=4 blk=0 avail=8517 (61.8%) swpO=0 conn=3 myRSS=2615 php=6 phpRSS=494 ap=17 tcp=34 topuser=madalice 2026-08-29 22:39:54 L1=1.18 run=1 blk=0 avail=8721 (63.3%) swpO=0 conn=3 myRSS=2615 php=5 phpRSS=274 ap=15 tcp=31 topuser=madalice 2026-08-29 22:39:54 L1=1.18 run=1 blk=0 avail=8723 (63.3%) swpO=0 conn=3 myRSS=2615 php=5 phpRSS=274 ap=15 tcp=29 topuser=madalice 2026-08-29 22:40:04 L1=1.07 run=3 blk=0 avail=8693 (63.1%) swpO=0 conn=3 myRSS=2615 php=6 phpRSS=314 ap=16 tcp=33 topuser=madalice 2026-08-29 22:40:04 L1=1.07 run=3 blk=0 avail=8664 (62.9%) swpO=0 conn=3 myRSS=2615 php=6 phpRSS=344 ap=16 tcp=33 topuser=madalice 2026-08-29 22:40:14 L1=1.06 run=5 blk=0 avail=8638 (62.7%) swpO=0 conn=3 myRSS=2615 php=6 phpRSS=375 ap=16 tcp=34 topuser=madalice 2026-08-29 22:40:14 L1=1.06 run=2 blk=0 avail=8599 (62.4%) swpO=0 conn=3 myRSS=2615 php=6 phpRSS=417 ap=16 tcp=35 topuser=infinium 2026-08-29 22:40:24 L1=0.90 run=1 blk=0 avail=8708 (63.2%) swpO=0 conn=3 myRSS=2615 php=5 phpRSS=275 ap=16 tcp=35 topuser=madalice 2026-08-29 22:40:24 L1=0.90 run=1 blk=0 avail=8721 (63.3%) swpO=0 conn=3 myRSS=2615 php=4 phpRSS=234 ap=16 tcp=35 topuser=madalice 2026-08-29 22:40:34 L1=0.76 run=1 blk=0 avail=8724 (63.3%) swpO=0 conn=3 myRSS=2615 php=5 phpRSS=274 ap=15 tcp=28 topuser=madalice 2026-08-29 22:40:34 L1=0.76 run=1 blk=0 avail=8736 (63.4%) swpO=0 conn=3 myRSS=2615 php=4 phpRSS=233 ap=15 tcp=28 topuser=madalice 2026-08-29 22:40:44 L1=0.64 run=2 blk=0 avail=8687 (63.1%) swpO=0 conn=3 myRSS=2615 php=6 phpRSS=342 ap=15 tcp=29 topuser=madalice 2026-08-29 22:40:44 L1=0.64 run=2 blk=0 avail=8678 (63.0%) swpO=0 conn=3 myRSS=2615 php=5 phpRSS=323 ap=15 tcp=29 topuser=madalice 2026-08-29 22:40:54 L1=2.06 run=20 blk=0 avail=6434 (46.7%) swpO=67 conn=19 myRSS=2615 php=20 phpRSS=3001 ap=30 tcp=98 topuser=corpkicks 2026-08-29 22:40:54 L1=2.06 run=26 blk=0 avail=6086 (44.2%) swpO=68 conn=19 myRSS=2615 php=21 phpRSS=3458 ap=30 tcp=98 topuser=corpkicks