INCIDENT 2026-08-31 06:03:58 trigger: php_rss=2650MB mysql_conn=16 ================================================================== load: 2.77 1.55 1.23 21/690 3759607 ncpu:10 mem_avail: 5919MB/13777MB (43.0%) swap_used:2027MB swapout:498/s blocked(D):1 running:6 iowait:0.3% steal:0.0% php: 19 procs / 2650MB heaviest user: corpkicks (13 procs, 2097MB) apache: 42 procs tcp_estab: 79 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3215 corpkicks 13 2401 root 254 1080 nobody 42 749 madalice 3 477 netdata 7 205 mailman 20 79 cpanellogin 1 74 evolution 6 52 speedlin 1 50 dovenull 6 46 lowrange 3 42 mailnull 2 33 kurri 2 25 wp-toolkit 3 23 zabbix 1 19 dovecot 3 18 infinium 1 14 named 1 12 sshd 1 6 --- php workers by user --- USER PROCS RSS_MB corpkicks 13 2436 madalice 3 477 evolution 3 63 speedlin 1 52 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4674 MB Active(file): 4276 MB Inactive(file): 697 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 557 MB CommitLimit: 10984 MB Committed_AS: 10245 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-03:45:20 4740 /usr/bin/imunify-agent-proxy 3741562 root 03:58 1256 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3757908 root 02:18 60252 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3292836 6.5 Ssl 3-03:44:49 /usr/sbin/mariadbd 3759562 3758305 corpkicks 278668 74.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3759561 3757550 corpkicks 240664 68.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3759554 3759257 corpkicks 240492 45.6 R 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3759567 3759539 corpkicks 214100 54.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3759569 3757423 corpkicks 194444 89.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3036527 3002570 root 189976 0.0 S 03:32:17 spamd child 508924 1 netdata 186732 1.9 Ssl 3-03:44:18 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3002570 1 root 176032 0.0 Ss 03:41:13 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3759565 3759246 corpkicks 169296 43.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3036528 3002570 root 167780 0.0 S 03:32:17 spamd child 3740863 510022 madalice 167612 9.6 R 04:43 php-fpm: pool madalice_com_au 3740535 510022 madalice 162624 9.3 S 05:12 php-fpm: pool madalice_com_au 3758821 510022 madalice 160436 16.4 S 01:08 php-fpm: pool madalice_com_au 3759573 3757158 corpkicks 143752 60.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3759568 3745697 corpkicks 121216 55.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3759571 3758329 corpkicks 121208 53.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3759574 3758835 corpkicks 120968 44.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3532240 1353308 cpanellogin 75880 0.0 S 01:05:26 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 3759575 3758662 speedlin 60600 24.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 3757908 1 root 60252 1.4 Ssl 02:18 /opt/imunify360/venv/bin/python3 -m imav.run 509640 508992 root 57932 0.0 Sl 3-03:44:13 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509266 1 root 44828 0.0 Ss 3-03:44:15 /usr/lib/systemd/systemd-journald 509236 509098 root 44156 0.0 Sl 3-03:44:15 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42376 0.1 Ss 40-03:22:41 cpsrvd (SSL) - waiting for connections 3759614 3759546 evolution 40492 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3759604 3759516 evolution 40392 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3001917 1 root 35296 0.0 Ss 03:41:45 lfd - sleeping 3759596 1469 root 29920 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1463 1 root 25988 0.0 Ss 62-19:54:10 tailwatchd 3739339 506832 nobody 23876 0.0 S 07:21 /usr/sbin/httpd -k start 3757550 506832 nobody 23468 0.1 S 02:24 /usr/sbin/httpd -k start 3758329 506832 nobody 23292 0.1 S 01:53 /usr/sbin/httpd -k start 1469 1 root 22692 0.1 Ss 62-19:54:10 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 22600 0.0 Ss 3-03:44:11 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3745697 506832 nobody 22416 0.2 S 03:54 /usr/sbin/httpd -k start 3757423 506832 nobody 21904 0.1 S 02:40 /usr/sbin/httpd -k start 3757158 506832 nobody 21732 0.3 S 02:52 /usr/sbin/httpd -k start 3739946 506832 nobody 21176 0.1 S 06:15 /usr/sbin/httpd -k start 3759258 506832 nobody 21124 0.1 S 00:28 /usr/sbin/httpd -k start 3758305 506832 nobody 21100 0.0 R 01:55 /usr/sbin/httpd -k start 3759281 506832 nobody 20828 0.4 R 00:27 /usr/sbin/httpd -k start 3759276 506832 nobody 20592 0.2 S 00:27 /usr/sbin/httpd -k start 3758326 506832 nobody 20512 0.0 S 01:53 /usr/sbin/httpd -k start 3758835 506832 nobody 20500 0.1 S 01:07 /usr/sbin/httpd -k start 3758668 506832 nobody 20172 0.0 S 01:22 /usr/sbin/httpd -k start 483898 1 zabbix 20036 0.2 Ssl 3-03:45:32 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3759237 506832 nobody 19944 0.1 S 00:30 /usr/sbin/httpd -k start 3759516 506832 nobody 19708 0.5 S 00:07 /usr/sbin/httpd -k start 3759259 506832 nobody 19704 0.1 S 00:28 /usr/sbin/httpd -k start 3759246 506832 nobody 19600 0.1 S 00:29 /usr/sbin/httpd -k start 3759511 506832 nobody 19500 0.3 S 00:08 /usr/sbin/httpd -k start 3759515 506832 nobody 19480 0.2 S 00:07 /usr/sbin/httpd -k start 3759524 506832 nobody 19336 0.0 S 00:06 /usr/sbin/httpd -k start 3759525 506832 nobody 19196 0.0 S 00:06 /usr/sbin/httpd -k start 3759282 506832 nobody 18964 0.0 S 00:27 /usr/sbin/httpd -k start 3758834 506832 nobody 18884 0.1 S 01:07 /usr/sbin/httpd -k start 3759278 506832 nobody 18868 0.0 S 00:27 /usr/sbin/httpd -k start 3759275 506832 nobody 18824 0.0 S 00:27 /usr/sbin/httpd -k start 508720 1 mailnull 18724 0.0 Ss 3-03:44:22 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4927964 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 235 evolution/my.evolutionerp.com.au-ssl_log 206 cosgrovecreative/cosgrovecreative.com.au-ssl_log 117 customc/customcentral.com.au-ssl_log 82 madalice/madalice.com.au-ssl_log 66 whiz/whizengineering.com.au-ssl_log 38 evolution/portal.evolutionerp.com.au-ssl_log 37 corpkicks/corporatekicks.com.au-ssl_log 31 coscom/coscom.com.au 18 alison/alisonarts.com.au-ssl_log 2 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 235 40.115.94.245 135 103.104.165.99 117 20.104.50.220 80 158.158.54.35 70 203.54.180.238 52 146.70.36.140 39 34.24.1.149 38 158.23.184.117 26 182.239.240.254 18 149.102.230.136 7 103.104.164.114 6 118.127.40.55 3 52.167.144.188 2 83.99.206.183 2 52.167.144.141 --- top request paths across all vhosts (last 3 min) --- 123 GET /api/getItem/LWFBW2001KG 117 GET /autodiscover/autodiscover.xml 67 POST /functions.php 41 GET /app/ajax.php 38 GET /index.php 34 GET /heartbeat.php 29 POST /plugins/csvexporter/plugin.php 14 POST /pickingsave.php 10 GET / 6 GET /store/swarovski-crystal-am90/ 4 POST /wp-cron.php 3 POST /print.php 2 POST /inveditsave.php 2 POST /clienteditsave.php 2 POST /app/ajax.php 2 POST / 2 HEAD / 2 GET /wp-login.php 2 GET /wp-includes/images/media/ 2 GET /wp-includes/fonts/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 123 GET /api/getItem/LWFBW2001KG 2 GET /api/getItem/IPC2525 2 GET /api/getItem/GEB12-DL 1 GET /api/getItem/SPHDG15040 1 GET /api/getItem/SGC-100 1 GET /api/getItem/S6 1 GET /api/getItem/S5 1 GET /api/getItem/S4 1 GET /api/getItem/S3 1 GET /api/getItem/S2 1 GET /api/getItem/S1 1 GET /api/getItem/RGW90 -- last 10 requests -- 40.115.94.245 - - [31/Aug/2026:06:01:16 +1000] "GET /api/getItem/PC15050 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [31/Aug/2026:06:01:16 +1000] "GET /api/getItem/PC16 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [31/Aug/2026:06:01:16 +1000] "GET /api/getItem/PC19 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [31/Aug/2026:06:01:16 +1000] "GET /api/getItem/PC5025BL HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [31/Aug/2026:06:01:16 +1000] "GET /api/getItem/PC7550 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [31/Aug/2026:06:01:17 +1000] "GET /api/getItem/HCR-32 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [31/Aug/2026:06:01:17 +1000] "GET /api/getItem/HCR-25 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [31/Aug/2026:06:01:17 +1000] "GET /api/getItem/HCR-40 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [31/Aug/2026:06:01:17 +1000] "GET /api/getItem/L2 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [31/Aug/2026:06:01:17 +1000] "GET /api/getItem/FBM1230G HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 67 POST /functions.php 41 GET /app/ajax.php 37 GET /index.php 29 POST /plugins/csvexporter/plugin.php 14 POST /pickingsave.php 3 POST /print.php 2 POST /inveditsave.php 2 POST /clienteditsave.php 2 POST /app/ajax.php 2 GET /download.php 2 GET / 1 POST /logsave.php -- last 10 requests -- 103.104.165.99 - - [31/Aug/2026:06:03:53 +1000] "GET /index.php?page=pickingedit&pickingid=16389 HTTP/1.1" 200 16694 "https://my.evolutionerp.com.au/index.php?page=picking" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 103.104.165.99 - - [31/Aug/2026:06:03:53 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=pickingedit&pickingid=16389" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 103.104.165.99 - - [31/Aug/2026:06:03:54 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dpickingedit%26pickingid%3D16389&call=getUserSetting&caller=ajaxSubmitLocal&seq=15238045486 HTTP/1.1" 200 104 "https://my.evoluti 103.104.165.99 - - [31/Aug/2026:06:03:55 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=pickingedit&pickingid=16389" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 103.104.165.99 - - [31/Aug/2026:06:03:56 +1000] "GET /index.php?page=picking HTTP/1.1" 200 13699 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K 103.104.165.99 - - [31/Aug/2026:06:03:57 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=picking" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 103.104.165.99 - - [31/Aug/2026:06:03:57 +1000] "POST /pickingsave.php?call=getPicking HTTP/1.1" 200 1271 "https://my.evolutionerp.com.au/index.php?page=picking" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 103.104.165.99 - - [31/Aug/2026:06:03:57 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dpicking&call=getUserSetting&caller=ajaxSubmitLocal&seq=13181582392 HTTP/1.1" 200 89 "https://my.evolutionerp.com.au/index.php?pa 103.104.165.99 - - [31/Aug/2026:06:03:58 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=picking" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 182.239.240.254 - - [31/Aug/2026:06:03:57 +1000] "GET /index.php?page=dispatchedit&dispatchid=3840 HTTP/1.1" 200 38122 "https://my.evolutionerp.com.au/index.php?page=dispatch" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) A == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 117 GET /autodiscover/autodiscover.xml -- last 10 requests -- 20.104.50.220 - - [31/Aug/2026:06:03:05 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [31/Aug/2026:06:03:06 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [31/Aug/2026:06:03:07 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [31/Aug/2026:06:03:08 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [31/Aug/2026:06:03:09 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [31/Aug/2026:06:03:09 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [31/Aug/2026:06:03:10 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [31/Aug/2026:06:03:11 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [31/Aug/2026:06:03:12 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [31/Aug/2026:06:03:13 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-31 06:01:38 L1=1.71 run=1 blk=0 avail=7959 (57.8%) swpO=0 conn=1 myRSS=3228 php=4 phpRSS=311 ap=26 tcp=32 topuser=madalice 2026-08-31 06:01:38 L1=1.71 run=3 blk=0 avail=7829 (56.8%) swpO=0 conn=2 myRSS=3228 php=6 phpRSS=501 ap=26 tcp=31 topuser=madalice 2026-08-31 06:01:48 L1=1.68 run=1 blk=0 avail=7851 (57.0%) swpO=0 conn=1 myRSS=3228 php=4 phpRSS=345 ap=21 tcp=32 topuser=madalice 2026-08-31 06:01:48 L1=1.68 run=2 blk=0 avail=7798 (56.6%) swpO=0 conn=2 myRSS=3228 php=5 phpRSS=432 ap=21 tcp=32 topuser=madalice 2026-08-31 06:01:58 L1=1.57 run=4 blk=0 avail=7721 (56.0%) swpO=1 conn=1 myRSS=3228 php=5 phpRSS=522 ap=19 tcp=29 topuser=madalice 2026-08-31 06:01:58 L1=1.57 run=4 blk=0 avail=7889 (57.3%) swpO=1 conn=2 myRSS=3228 php=4 phpRSS=351 ap=19 tcp=29 topuser=madalice 2026-08-31 06:02:08 L1=1.71 run=1 blk=0 avail=7896 (57.3%) swpO=2 conn=1 myRSS=3227 php=4 phpRSS=347 ap=26 tcp=35 topuser=madalice 2026-08-31 06:02:08 L1=1.71 run=2 blk=0 avail=7799 (56.6%) swpO=2 conn=2 myRSS=3227 php=5 phpRSS=475 ap=26 tcp=36 topuser=madalice 2026-08-31 06:02:18 L1=1.68 run=2 blk=0 avail=7870 (57.1%) swpO=0 conn=1 myRSS=3227 php=5 phpRSS=390 ap=29 tcp=41 topuser=madalice 2026-08-31 06:02:19 L1=1.68 run=2 blk=0 avail=7762 (56.3%) swpO=0 conn=2 myRSS=3227 php=5 phpRSS=493 ap=29 tcp=39 topuser=madalice 2026-08-31 06:02:28 L1=1.73 run=3 blk=0 avail=7747 (56.2%) swpO=0 conn=1 myRSS=3227 php=5 phpRSS=532 ap=25 tcp=29 topuser=madalice 2026-08-31 06:02:29 L1=1.73 run=2 blk=0 avail=7898 (57.3%) swpO=0 conn=2 myRSS=3227 php=5 phpRSS=386 ap=25 tcp=31 topuser=madalice 2026-08-31 06:02:38 L1=1.61 run=4 blk=0 avail=7748 (56.2%) swpO=0 conn=1 myRSS=3227 php=5 phpRSS=513 ap=27 tcp=30 topuser=madalice 2026-08-31 06:02:39 L1=1.61 run=1 blk=0 avail=7894 (57.3%) swpO=0 conn=2 myRSS=3227 php=4 phpRSS=347 ap=27 tcp=30 topuser=madalice 2026-08-31 06:02:48 L1=1.59 run=1 blk=0 avail=7910 (57.4%) swpO=0 conn=1 myRSS=3228 php=4 phpRSS=347 ap=23 tcp=33 topuser=madalice 2026-08-31 06:02:49 L1=1.59 run=2 blk=0 avail=7907 (57.4%) swpO=0 conn=2 myRSS=3228 php=4 phpRSS=349 ap=23 tcp=31 topuser=madalice 2026-08-31 06:02:58 L1=1.42 run=2 blk=0 avail=7696 (55.9%) swpO=0 conn=1 myRSS=3228 php=6 phpRSS=584 ap=28 tcp=29 topuser=madalice 2026-08-31 06:02:59 L1=1.42 run=4 blk=0 avail=7647 (55.5%) swpO=0 conn=2 myRSS=3228 php=7 phpRSS=678 ap=27 tcp=30 topuser=madalice 2026-08-31 06:03:08 L1=1.20 run=1 blk=0 avail=7784 (56.5%) swpO=1 conn=1 myRSS=3228 php=5 phpRSS=507 ap=22 tcp=32 topuser=madalice 2026-08-31 06:03:09 L1=1.20 run=1 blk=0 avail=7783 (56.5%) swpO=1 conn=2 myRSS=3228 php=5 phpRSS=507 ap=22 tcp=37 topuser=madalice 2026-08-31 06:03:18 L1=1.31 run=2 blk=0 avail=7705 (55.9%) swpO=0 conn=1 myRSS=3228 php=6 phpRSS=591 ap=25 tcp=33 topuser=madalice 2026-08-31 06:03:19 L1=1.31 run=2 blk=0 avail=7651 (55.5%) swpO=0 conn=2 myRSS=3228 php=6 phpRSS=644 ap=25 tcp=33 topuser=madalice 2026-08-31 06:03:28 L1=1.49 run=3 blk=0 avail=7711 (56.0%) swpO=0 conn=1 myRSS=3228 php=7 phpRSS=633 ap=24 tcp=31 topuser=madalice 2026-08-31 06:03:29 L1=1.49 run=4 blk=0 avail=7682 (55.8%) swpO=0 conn=2 myRSS=3228 php=7 phpRSS=643 ap=24 tcp=32 topuser=madalice 2026-08-31 06:03:38 L1=1.56 run=4 blk=0 avail=7522 (54.6%) swpO=0 conn=1 myRSS=3229 php=5 phpRSS=631 ap=38 tcp=39 topuser=madalice 2026-08-31 06:03:39 L1=1.56 run=3 blk=0 avail=7522 (54.6%) swpO=0 conn=2 myRSS=3229 php=7 phpRSS=721 ap=37 tcp=39 topuser=madalice 2026-08-31 06:03:48 L1=1.86 run=1 blk=0 avail=7723 (56.1%) swpO=0 conn=1 myRSS=3229 php=5 phpRSS=512 ap=28 tcp=38 topuser=madalice 2026-08-31 06:03:49 L1=1.86 run=4 blk=0 avail=7599 (55.2%) swpO=0 conn=3 myRSS=3229 php=7 phpRSS=703 ap=27 tcp=37 topuser=madalice 2026-08-31 06:03:58 L1=2.77 run=6 blk=1 avail=5919 (43.0%) swpO=498 conn=16 myRSS=3215 php=19 phpRSS=2650 ap=42 tcp=79 topuser=corpkicks 2026-08-31 06:03:59 L1=2.77 run=19 blk=0 avail=5987 (43.5%) swpO=498 conn=14 myRSS=3215 php=17 phpRSS=2205 ap=43 tcp=66 topuser=corpkicks