INCIDENT 2026-08-30 11:47:33 trigger: php_rss=2555MB ================================================================== load: 0.60 0.56 0.59 19/651 2537 ncpu:10 mem_avail: 6393MB/13777MB (46.4%) swap_used:1822MB swapout:0/s blocked(D):0 running:13 iowait:0.0% steal:0.0% php: 16 procs / 2555MB heaviest user: corpkicks (12 procs, 2210MB) apache: 22 procs tcp_estab: 58 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2927 corpkicks 12 2346 root 244 1122 nobody 21 363 madalice 2 308 netdata 7 201 mailman 20 121 mailnull 4 81 cpanellogin 1 63 kurri 4 56 dovenull 6 46 wp-toolkit 3 31 evolution 5 22 zabbix 1 21 dovecot 3 19 named 1 15 alison 1 14 polkitd 1 5 nscd 1 4 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB corpkicks 12 2387 madalice 2 308 root 1 22 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5169 MB Active(file): 4650 MB Inactive(file): 953 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 606 MB CommitLimit: 10984 MB Committed_AS: 8791 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-09:28:54 7704 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2995536 7.4 Ssl 2-09:28:24 /usr/sbin/mariadbd 2500 2280 corpkicks 255200 67.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2503 4180008 corpkicks 241520 59.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2495 4179385 corpkicks 236632 59.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2499 1939 corpkicks 226952 56.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2328310 2277352 root 208936 0.0 S 09:09:24 spamd child 2498 2375 corpkicks 182320 42.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 508924 1 netdata 181740 1.9 Ssl 2-09:27:53 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175488 0.0 Ss 09:24:30 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2501 2074 corpkicks 167752 35.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2328311 2277352 root 166576 0.0 S 09:09:24 spamd child 1867 510022 madalice 158920 8.3 S 01:22 php-fpm: pool madalice_com_au 2075 510022 madalice 156916 6.2 S 00:54 php-fpm: pool madalice_com_au 2497 2368 corpkicks 150384 35.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 509266 1 root 147228 0.0 Ss 2-09:27:50 /usr/lib/systemd/systemd-journald 2496 4179826 corpkicks 137360 31.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 4027958 1353308 cpanellogin 64836 0.0 S 49:21 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 509236 509098 root 52920 0.0 Sl 2-09:27:50 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 48364 0.0 Sl 2-09:27:48 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1353308 1 root 42424 0.1 Ss 39-09:06:16 cpsrvd (SSL) - waiting for connections 2275833 1 root 35924 0.0 Ss 09:25:20 lfd - sleeping 508720 1 mailnull 25296 0.0 Ss 2-09:27:57 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 24072 0.1 Ss 62-01:37:45 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23344 0.0 Ss 2-09:27:46 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 4179697 506832 nobody 23060 0.1 S 03:50 /usr/sbin/httpd -k start 4179826 506832 nobody 23000 0.1 S 03:32 /usr/sbin/httpd -k start 4164094 506832 nobody 21992 0.0 S 07:50 /usr/sbin/httpd -k start 1463 1 root 21972 0.0 Ss 62-01:37:45 tailwatchd 483898 1 zabbix 21604 0.2 Ssl 2-09:29:07 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 4179385 506832 nobody 21544 0.1 S 04:35 /usr/sbin/httpd -k start 4180006 506832 nobody 21284 0.1 S 03:30 /usr/sbin/httpd -k start 2412 508720 mailnull 20940 0.0 S 00:11 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2504 506832 nobody 20540 0.0 S 00:02 /usr/sbin/httpd -k start 2101 506832 nobody 20496 0.0 S 00:51 /usr/sbin/httpd -k start 1939 506832 nobody 20264 0.1 S 01:19 /usr/sbin/httpd -k start 1938 506832 nobody 20244 0.0 S 01:19 /usr/sbin/httpd -k start 4180008 506832 nobody 19488 0.0 S 03:30 /usr/sbin/httpd -k start 2505 508720 mailnull 19264 0.0 S 00:02 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 4180384 506832 nobody 19264 0.1 S 02:55 /usr/sbin/httpd -k start 2070 506832 nobody 18624 0.0 S 00:57 /usr/sbin/httpd -k start 2516 506832 nobody 18576 0.0 S 00:01 /usr/sbin/httpd -k start 2074 506832 nobody 18556 0.0 S 00:54 /usr/sbin/httpd -k start 2517 506832 nobody 18496 0.0 S 00:01 /usr/sbin/httpd -k start 938582 1 wp-toolkit 18068 0.0 Ss 2-07:35:27 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2280 506832 nobody 17812 0.0 S 00:27 /usr/sbin/httpd -k start 2506 508720 mailnull 17780 0.0 S 00:01 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2368 506832 nobody 17196 0.0 S 00:18 /usr/sbin/httpd -k start 2375 506832 nobody 17116 0.0 S 00:17 /usr/sbin/httpd -k start 1471 1 root 16996 0.0 Ss 62-01:37:45 cPhulkd - processor 3446928 1471 root 16820 0.0 S 03:41:45 cPhulkd - dbprocessor 509671 508992 netdata 15780 2.1 Sl 2-09:27:48 /usr/libexec/netdata/plugins.d/apps.plugin 1 508634 1 named 15648 0.0 Ssl 2-09:27:58 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 3960981 508511 kurri 15560 0.0 S 01:07:40 dovecot/imap 4128504 508511 kurri 15352 0.0 S 21:04 dovecot/imap 4146729 508511 alison 14984 0.0 S 14:14 dovecot/imap 4128914 508511 kurri 14548 0.0 S 20:35 dovecot/imap 2385 1471 root 14540 0.0 S 00:15 cPhulkd - processor - http socket 2374 506832 nobody 13636 0.0 S 00:17 /usr/sbin/httpd -k start 4180059 4180015 evolution 13364 0.0 Ss 2-11:47:35 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 4178326 508511 root 12808 0.0 S 06:52 dovecot/auth -w --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4483241 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 1072 alison/alisonarts.com.au-ssl_log 69 evolution/portal.evolutionerp.com.au-ssl_log 24 madalice/madalice.com.au-ssl_log 13 corpkicks/corporatekicks.com.au-ssl_log 8 infinium/infinium.net.au-ssl_log 4 olympic/olympicfencing.com.au 4 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 1072 40.115.94.245 64 52.139.37.240 24 203.54.180.238 5 34.74.242.206 4 118.127.40.55 3 169.58.146.39 3 114.119.143.104 2 34.75.72.74 2 34.196.51.17 2 142.93.10.93 2 114.119.131.88 1 66.116.251.167 1 54.225.98.148 1 43.173.182.64 1 43.173.180.42 --- top request paths across all vhosts (last 3 min) --- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 24 GET /heartbeat.php 9 GET /api/getItem/NA 7 GET /store/hand-painted-nike-af1-pink-pastel-flower/ 5 GET / 4 POST /wp-cron.php 4 GET /robots.txt 4 GET /api/getItem/PWFBW3151KG 2 HEAD / 2 GET /wp-login.php 2 GET /wp-includes/PHPMailer/ 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 9 GET /api/getItem/NA 4 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 -- last 10 requests -- 40.115.94.245 - - [30/Aug/2026:11:46:10 +1000] "GET /api/getItem/RGW90 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:11:46:10 +1000] "GET /api/getItem/RGW100 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:11:46:11 +1000] "GET /api/getItem/RGW120 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:11:46:11 +1000] "GET /api/getItem/RGW160 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:11:46:11 +1000] "GET /api/getItem/RGW117T HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:11:46:11 +1000] "GET /api/getItem/RGW80 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:11:46:11 +1000] "GET /api/getItem/GP150x200x8 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:11:46:11 +1000] "GET /api/getItem/K125MSGB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:11:46:11 +1000] "GET /api/getItem/253-40SP HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [30/Aug/2026:11:46:11 +1000] "GET /api/getItem/300558 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == alison/alisonarts.com.au-ssl_log == -- top paths -- 4 GET /robots.txt 1 GET /zoom1.php 1 GET /xx.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws81.php 1 GET /ws77.php 1 GET /ws37.php 1 GET /wp-the.php 1 GET /wp-signin.php 1 GET /wp-includes/PHPMailer/ 1 GET /wp-includes/ID3/index.php -- last 10 requests -- 52.139.37.240 - - [30/Aug/2026:11:47:22 +1000] "GET /ca5.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:47:22 +1000] "GET /install.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:47:22 +1000] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:47:22 +1000] "GET /wp-signin.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:47:23 +1000] "GET /Ov-Simple1.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:47:23 +1000] "GET /ftde.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:47:23 +1000] "GET /hplfuns.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [30/Aug/2026:11:47:23 +1000] "GET /log.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 34.74.242.206 - - [30/Aug/2026:11:47:22 +1000] "GET / HTTP/1.0" 301 - "-" "ZoominfoBot (zoominfobot at zoominfo dot com)" 52.139.37.240 - - [30/Aug/2026:11:47:24 +1000] "GET /txets.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 24 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [30/Aug/2026:11:46:13 +1000] "GET /heartbeat.php?sentAt=1788054373&bytes=106,147,139,101&_=1787897056088 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:11:46:13 +1000] "GET /heartbeat.php?sentAt=1788054373&bytes=106,147,139,101&_=1787918094573 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:11:46:23 +1000] "GET /heartbeat.php?sentAt=1788054383&bytes=106,147,139,111&_=1787897056089 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:11:46:23 +1000] "GET /heartbeat.php?sentAt=1788054383&bytes=106,147,139,111&_=1787918094574 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:11:46:33 +1000] "GET /heartbeat.php?sentAt=1788054393&bytes=106,147,139,121&_=1787897056090 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:11:46:33 +1000] "GET /heartbeat.php?sentAt=1788054393&bytes=106,147,139,121&_=1787918094575 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:11:46:43 +1000] "GET /heartbeat.php?sentAt=1788054403&bytes=106,147,139,131&_=1787897056091 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:11:46:43 +1000] "GET /heartbeat.php?sentAt=1788054403&bytes=106,147,139,131&_=1787918094576 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:11:46:53 +1000] "GET /heartbeat.php?sentAt=1788054413&bytes=106,147,139,141&_=1787897056092 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [30/Aug/2026:11:46:53 +1000] "GET /heartbeat.php?sentAt=1788054413&bytes=106,147,139,141&_=1787918094577 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 --- last 30 samples (run-up to this incident) --- 2026-08-30 11:45:13 L1=0.75 run=2 blk=0 avail=8320 (60.4%) swpO=0 conn=1 myRSS=2925 php=4 phpRSS=259 ap=16 tcp=27 topuser=madalice 2026-08-30 11:45:13 L1=0.75 run=2 blk=0 avail=8294 (60.2%) swpO=0 conn=2 myRSS=2925 php=7 phpRSS=364 ap=16 tcp=29 topuser=evolution 2026-08-30 11:45:23 L1=0.72 run=1 blk=0 avail=8329 (60.5%) swpO=0 conn=1 myRSS=2925 php=5 phpRSS=270 ap=16 tcp=25 topuser=madalice 2026-08-30 11:45:23 L1=0.72 run=2 blk=0 avail=8302 (60.3%) swpO=0 conn=2 myRSS=2925 php=6 phpRSS=339 ap=16 tcp=25 topuser=evolution 2026-08-30 11:45:33 L1=0.77 run=3 blk=0 avail=8362 (60.7%) swpO=0 conn=1 myRSS=2925 php=4 phpRSS=211 ap=15 tcp=26 topuser=madalice 2026-08-30 11:45:33 L1=0.77 run=1 blk=0 avail=8345 (60.6%) swpO=0 conn=4 myRSS=2925 php=6 phpRSS=284 ap=15 tcp=27 topuser=madalice 2026-08-30 11:45:43 L1=0.72 run=2 blk=0 avail=8383 (60.8%) swpO=1 conn=1 myRSS=2925 php=4 phpRSS=225 ap=15 tcp=20 topuser=madalice 2026-08-30 11:45:43 L1=0.72 run=1 blk=0 avail=8363 (60.7%) swpO=1 conn=4 myRSS=2925 php=5 phpRSS=267 ap=14 tcp=23 topuser=madalice 2026-08-30 11:45:53 L1=0.77 run=1 blk=0 avail=8386 (60.9%) swpO=0 conn=1 myRSS=2925 php=4 phpRSS=207 ap=14 tcp=23 topuser=madalice 2026-08-30 11:45:53 L1=0.77 run=3 blk=0 avail=8349 (60.6%) swpO=0 conn=4 myRSS=2925 php=5 phpRSS=269 ap=14 tcp=24 topuser=madalice 2026-08-30 11:46:03 L1=0.65 run=3 blk=0 avail=8374 (60.8%) swpO=0 conn=1 myRSS=2925 php=5 phpRSS=255 ap=14 tcp=23 topuser=madalice 2026-08-30 11:46:04 L1=0.65 run=1 blk=0 avail=8357 (60.7%) swpO=0 conn=4 myRSS=2925 php=6 phpRSS=284 ap=14 tcp=23 topuser=madalice 2026-08-30 11:46:13 L1=0.86 run=2 blk=0 avail=8359 (60.7%) swpO=0 conn=1 myRSS=2925 php=5 phpRSS=273 ap=14 tcp=23 topuser=evolution 2026-08-30 11:46:14 L1=0.86 run=2 blk=0 avail=8271 (60.0%) swpO=0 conn=4 myRSS=2925 php=6 phpRSS=390 ap=14 tcp=26 topuser=evolution 2026-08-30 11:46:23 L1=0.81 run=2 blk=0 avail=8181 (59.4%) swpO=0 conn=1 myRSS=2925 php=6 phpRSS=462 ap=17 tcp=27 topuser=infinium 2026-08-30 11:46:24 L1=0.81 run=2 blk=0 avail=8302 (60.3%) swpO=0 conn=4 myRSS=2925 php=6 phpRSS=341 ap=16 tcp=25 topuser=evolution 2026-08-30 11:46:33 L1=0.68 run=2 blk=0 avail=8373 (60.8%) swpO=0 conn=1 myRSS=2925 php=4 phpRSS=235 ap=14 tcp=25 topuser=madalice 2026-08-30 11:46:34 L1=0.68 run=5 blk=0 avail=8317 (60.4%) swpO=0 conn=4 myRSS=2925 php=5 phpRSS=319 ap=13 tcp=26 topuser=madalice 2026-08-30 11:46:43 L1=0.58 run=1 blk=0 avail=8248 (59.9%) swpO=0 conn=1 myRSS=2925 php=6 phpRSS=393 ap=15 tcp=30 topuser=madalice 2026-08-30 11:46:44 L1=0.58 run=2 blk=0 avail=8240 (59.8%) swpO=0 conn=4 myRSS=2925 php=6 phpRSS=393 ap=16 tcp=29 topuser=madalice 2026-08-30 11:46:53 L1=0.49 run=1 blk=0 avail=8238 (59.8%) swpO=0 conn=3 myRSS=2925 php=6 phpRSS=392 ap=17 tcp=26 topuser=madalice 2026-08-30 11:46:54 L1=0.49 run=1 blk=0 avail=8236 (59.8%) swpO=0 conn=4 myRSS=2925 php=6 phpRSS=392 ap=16 tcp=26 topuser=madalice 2026-08-30 11:47:03 L1=0.41 run=1 blk=0 avail=8241 (59.8%) swpO=1 conn=3 myRSS=2925 php=6 phpRSS=392 ap=15 tcp=25 topuser=madalice 2026-08-30 11:47:04 L1=0.41 run=1 blk=0 avail=8239 (59.8%) swpO=1 conn=4 myRSS=2925 php=6 phpRSS=392 ap=15 tcp=25 topuser=madalice 2026-08-30 11:47:13 L1=0.65 run=2 blk=0 avail=8032 (58.3%) swpO=0 conn=3 myRSS=2925 php=8 phpRSS=638 ap=16 tcp=27 topuser=madalice 2026-08-30 11:47:14 L1=0.65 run=3 blk=0 avail=8129 (59.0%) swpO=0 conn=4 myRSS=2925 php=7 phpRSS=514 ap=16 tcp=26 topuser=madalice 2026-08-30 11:47:23 L1=0.63 run=2 blk=0 avail=8128 (59.0%) swpO=0 conn=3 myRSS=2925 php=7 phpRSS=500 ap=19 tcp=30 topuser=madalice 2026-08-30 11:47:24 L1=0.63 run=2 blk=0 avail=8075 (58.6%) swpO=0 conn=4 myRSS=2925 php=8 phpRSS=580 ap=19 tcp=34 topuser=madalice 2026-08-30 11:47:33 L1=0.60 run=13 blk=0 avail=6393 (46.4%) swpO=0 conn=13 myRSS=2925 php=16 phpRSS=2555 ap=22 tcp=58 topuser=corpkicks 2026-08-30 11:47:34 L1=0.60 run=10 blk=0 avail=6919 (50.2%) swpO=163 conn=7 myRSS=2925 php=11 phpRSS=1566 ap=22 tcp=64 topuser=corpkicks