INCIDENT 2026-08-31 15:06:34 trigger: php_rss=1531MB ================================================================== load: 2.68 1.94 1.79 3/754 1612955 ncpu:10 mem_avail: 5930MB/13777MB (43.0%) swap_used:2245MB swapout:0/s blocked(D):0 running:3 iowait:0.1% steal:0.0% php: 14 procs / 1531MB heaviest user: madalice (9 procs, 1378MB) apache: 113 procs tcp_estab: 49 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3407 nobody 112 1918 madalice 9 1378 root 259 857 netdata 7 211 evolution 10 170 cpanellogin 1 73 mailman 20 72 dovenull 6 46 zabbix 1 19 wp-toolkit 3 19 dovecot 3 18 mailnull 1 15 lowrange 1 14 alison 1 14 kurri 1 12 named 1 11 nscd 1 4 polkitd 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 9 1378 evolution 4 155 root 1 21 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4851 MB Active(file): 4304 MB Inactive(file): 756 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 556 MB CommitLimit: 10984 MB Committed_AS: 10250 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 3-12:47:55 4060 /usr/bin/imunify-agent-proxy 1578349 root 06:33 1256 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3489260 9.3 Ssl 3-12:47:24 /usr/sbin/mariadbd 508924 1 netdata 192256 1.9 Ssl 3-12:46:53 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1247229 3002570 root 167436 0.1 S 01:36:25 spamd child 1611416 510022 madalice 164284 18.2 S 01:10 php-fpm: pool madalice_com_au 1611413 510022 madalice 162348 18.0 S 01:11 php-fpm: pool madalice_com_au 1611411 510022 madalice 161968 15.5 S 01:11 php-fpm: pool madalice_com_au 1612403 510022 madalice 160848 16.1 S 00:33 php-fpm: pool madalice_com_au 1611935 510022 madalice 160432 16.4 S 00:47 php-fpm: pool madalice_com_au 1611444 510022 madalice 159004 16.6 S 01:10 php-fpm: pool madalice_com_au 1612402 510022 madalice 158224 8.1 S 00:33 php-fpm: pool madalice_com_au 1612903 510022 madalice 154656 33.1 S 00:08 php-fpm: pool madalice_com_au 1612915 510022 madalice 129680 62.5 S 00:02 php-fpm: pool madalice_com_au 3002570 1 root 113212 0.0 Ss 12:43:48 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3036528 3002570 root 111252 0.0 S 12:34:52 spamd child 873062 1353308 cpanellogin 75436 0.0 S 03:15:16 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 1612926 1611688 evolution 68708 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509640 508992 root 67116 0.0 Sl 3-12:46:48 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 509266 1 root 66700 0.0 Ss 3-12:46:50 /usr/lib/systemd/systemd-journald 509236 509098 root 47768 0.0 Sl 3-12:46:50 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1612923 1611565 evolution 40580 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1612924 1611981 evolution 40356 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 39632 0.1 Ss 40-12:25:16 cpsrvd (SSL) - waiting for connections 3001917 1 root 33764 0.0 Ss 12:44:20 lfd - sleeping 1463 1 root 22452 0.0 Ss 63-04:56:45 tailwatchd 510022 1 root 22392 0.0 Ss 3-12:46:46 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1577774 506832 nobody 22384 0.0 S 07:20 /usr/sbin/httpd -k start 1577696 506832 nobody 22180 0.0 S 07:22 /usr/sbin/httpd -k start 1577830 506832 nobody 21420 0.0 S 07:19 /usr/sbin/httpd -k start 1469 1 root 21168 0.1 Ss 63-04:56:45 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1597352 506832 nobody 21084 0.0 S 01:42 /usr/sbin/httpd -k start 1595225 506832 nobody 20992 0.0 S 04:25 /usr/sbin/httpd -k start 1596481 506832 nobody 20868 0.1 S 02:56 /usr/sbin/httpd -k start 1611988 506832 nobody 20720 0.2 S 00:41 /usr/sbin/httpd -k start 1596480 506832 nobody 20420 0.0 S 02:56 /usr/sbin/httpd -k start 1596249 506832 nobody 20376 0.0 S 03:09 /usr/sbin/httpd -k start 1596464 506832 nobody 20256 0.0 S 02:57 /usr/sbin/httpd -k start 1611405 506832 nobody 20168 0.0 S 01:13 /usr/sbin/httpd -k start 1597229 506832 nobody 20076 0.0 S 01:58 /usr/sbin/httpd -k start 1597335 506832 nobody 19984 0.0 S 01:44 /usr/sbin/httpd -k start 1611638 506832 nobody 19868 0.0 S 00:56 /usr/sbin/httpd -k start 483898 1 zabbix 19764 0.2 Ssl 3-12:48:07 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1611486 506832 nobody 19632 0.0 S 01:06 /usr/sbin/httpd -k start 1611624 506832 nobody 19580 0.0 S 00:57 /usr/sbin/httpd -k start 1597356 506832 nobody 19508 0.0 S 01:41 /usr/sbin/httpd -k start 1611980 506832 nobody 19484 0.1 S 00:41 /usr/sbin/httpd -k start 1611516 506832 nobody 19476 0.0 S 01:01 /usr/sbin/httpd -k start 1596919 506832 nobody 19400 0.0 S 02:26 /usr/sbin/httpd -k start 1596914 506832 nobody 19384 0.0 S 02:26 /usr/sbin/httpd -k start 1611689 506832 nobody 19168 0.0 S 00:54 /usr/sbin/httpd -k start 1611627 506832 nobody 19148 0.1 S 00:57 /usr/sbin/httpd -k start 1611401 506832 nobody 19132 0.0 S 01:14 /usr/sbin/httpd -k start 1611716 506832 nobody 19132 0.0 S 00:54 /usr/sbin/httpd -k start 1596916 506832 nobody 19060 0.0 S 02:26 /usr/sbin/httpd -k start 1597334 506832 nobody 19020 0.0 S 01:44 /usr/sbin/httpd -k start 1611640 506832 nobody 18980 0.0 S 00:56 /usr/sbin/httpd -k start 1611992 506832 nobody 18980 0.0 S 00:41 /usr/sbin/httpd -k start 1611454 506832 nobody 18960 0.0 S 01:09 /usr/sbin/httpd -k start 1611487 506832 nobody 18960 0.0 S 01:05 /usr/sbin/httpd -k start 1611699 506832 nobody 18876 0.0 S 00:54 /usr/sbin/httpd -k start 1611986 506832 nobody 18872 0.0 S 00:41 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9066952 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 9066951 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 399 aaa/aaadownunder.com.au-ssl_log 138 coscom/coscom.com.au-ssl_log 135 evolution/portal.evolutionerp.com.au-ssl_log 134 cosgrovecreative/cosgrovecreative.com.au 133 evolution/evolutionerp.com.au-ssl_log 114 alison/alisonarts.com.au-ssl_log 58 madalice/madalice.com.au-ssl_log 49 corpkicks/corporatekicks.com.au-ssl_log 13 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 318 203.54.180.238 193 158.23.184.117 133 20.151.10.161 128 195.178.110.28 114 34.17.143.84 98 103.104.165.99 51 182.239.240.254 40 2001:8004:14b3:854f:c8a:67fe:b808:8beb 24 150.228.243.152 16 103.104.164.114 11 147.161.213.78 7 118.127.40.55 6 180.181.236.49 5 203.40.84.196 4 1.144.107.82 --- top request paths across all vhosts (last 3 min) --- 204 POST /functions.php 73 GET /heartbeat.php 65 GET /app/ajax.php 29 GET /factory_session_checker.php 28 GET /index.php 18 POST /plugins/csvexporter/plugin.php 18 POST /clienteditsave.php 15 POST /wp-admin/admin-ajax.php 14 GET /factory_session_processed_qty.php 14 GET /factory_session_joiner.php 12 POST /app/ajax/selectFilterSingle.php 10 POST /app/ajax.php 8 POST /quoteditsave.php 8 POST /logsave.php 6 POST /itemModify.php 6 GET /wp-json/wc-admin/options 6 GET / 5 POST /inveditsave.php 5 POST /app/ajax/selectFilter.php 4 POST /wp-cron.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 204 POST /functions.php 65 GET /app/ajax.php 25 GET /index.php 18 POST /plugins/csvexporter/plugin.php 18 POST /clienteditsave.php 12 POST /app/ajax/selectFilterSingle.php 10 POST /app/ajax.php 8 POST /quoteditsave.php 8 POST /logsave.php 6 POST /itemModify.php 5 POST /inveditsave.php 5 POST /app/ajax/selectFilter.php -- last 10 requests -- 147.161.213.78 - - [31/Aug/2026:15:06:25 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=siteadd&clientid=1616" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 203.54.180.238 - - [31/Aug/2026:15:06:25 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=mfshoporderdetail&id=43838" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 203.54.180.238 - - [31/Aug/2026:15:06:26 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 21908 "https://my.evolutionerp.com.au/index.php?page=mfshoporderdetail&id=43838" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [31/Aug/2026:15:06:26 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29577&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [31/Aug/2026:15:06:29 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78714" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 203.54.180.238 - - [31/Aug/2026:15:06:31 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=13575" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 103.104.165.99 - - [31/Aug/2026:15:06:33 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=purchasereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 103.104.165.99 - - [31/Aug/2026:15:06:33 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12044" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 203.54.180.238 - - [31/Aug/2026:15:06:34 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78542" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 203.54.180.238 - - [31/Aug/2026:15:06:34 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 233 "https://my.evolutionerp.com.au/index.php?page=invedit&id=6431&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 2 GET / 1 POST /wp-login.php 1 POST /wp-cron.php 1 GET //wp/wp-content/mysql.sql 1 GET /wp-login.php 1 GET //web/.env 1 GET //v2/.env 1 GET //user/.env 1 GET //test/.env 1 GET //stripe.env 1 GET //.stripe/ 1 GET //staging/.env -- last 10 requests -- 195.178.110.28 - - [31/Aug/2026:15:05:52 +1000] "GET //backend/wp-content/mysql.sql HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.28 - - [31/Aug/2026:15:05:52 +1000] "GET //_profiler/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.28 - - [31/Aug/2026:15:05:52 +1000] "GET //credentials.ini HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.28 - - [31/Aug/2026:15:05:52 +1000] "GET //app/config/parameters.yml.dist HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.28 - - [31/Aug/2026:15:05:52 +1000] "GET //fe/wp-content/mysql.sql HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.28 - - [31/Aug/2026:15:05:52 +1000] "GET //API/.git/config HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.28 - - [31/Aug/2026:15:05:52 +1000] "GET //constants.yml HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.28 - - [31/Aug/2026:15:05:52 +1000] "GET //api/wp-content/mysql.sql HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.28 - - [31/Aug/2026:15:05:56 +1000] "GET //%2F.env HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.28 - - [31/Aug/2026:15:05:58 +1000] "GET //beta/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == coscom/coscom.com.au-ssl_log == -- top paths -- 2 GET /www.php 2 GET /wp-includes/Requests/library/index.php 2 GET /wp-includes/IXR 2 GET /wp-includes/interactivity-api/index.php 2 GET /wp-includes/css 2 GET /wp-includes/assets 2 GET /wp-content/plugins/index.php 2 GET /wp-content/plugins/beteng88/ws83.php 2 GET /wp-config.php 2 GET /wp-admin/user/index.php 2 GET /wp-admin/network/about.php 2 GET /wp-admin/maint/index.php -- last 10 requests -- 158.23.184.117 - - [31/Aug/2026:15:06:14 +1000] "GET /work.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [31/Aug/2026:15:06:14 +1000] "GET /wp-access.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [31/Aug/2026:15:06:14 +1000] "GET /wp-admin/css/colors/blue HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [31/Aug/2026:15:06:15 +1000] "GET /wp-admin/css/colors/modern HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [31/Aug/2026:15:06:15 +1000] "GET /wp-admin/images/admin.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [31/Aug/2026:15:06:15 +1000] "GET /wp-admin/images/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [31/Aug/2026:15:06:15 +1000] "GET /wp-admin/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [31/Aug/2026:15:06:15 +1000] "GET /wp-admin/js/index.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [31/Aug/2026:15:06:16 +1000] "GET /wp-config.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.23.184.117 - - [31/Aug/2026:15:06:16 +1000] "GET /wp-content/plugins/beteng88/ws83.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/ --- last 30 samples (run-up to this incident) --- 2026-08-31 15:04:06 L1=1.24 run=2 blk=0 avail=7641 (55.5%) swpO=0 conn=2 myRSS=3447 php=5 phpRSS=381 ap=33 tcp=43 topuser=madalice 2026-08-31 15:04:14 L1=1.65 run=1 blk=0 avail=7579 (55.0%) swpO=0 conn=1 myRSS=3447 php=4 phpRSS=341 ap=45 tcp=48 topuser=madalice 2026-08-31 15:04:16 L1=1.65 run=3 blk=0 avail=7528 (54.6%) swpO=0 conn=2 myRSS=3447 php=5 phpRSS=381 ap=45 tcp=48 topuser=madalice 2026-08-31 15:04:24 L1=1.40 run=1 blk=0 avail=7757 (56.3%) swpO=0 conn=1 myRSS=3447 php=3 phpRSS=188 ap=39 tcp=33 topuser=madalice 2026-08-31 15:04:26 L1=1.40 run=1 blk=0 avail=7766 (56.4%) swpO=0 conn=2 myRSS=3447 php=4 phpRSS=228 ap=37 tcp=32 topuser=madalice 2026-08-31 15:04:34 L1=1.18 run=2 blk=0 avail=7888 (57.3%) swpO=0 conn=1 myRSS=3447 php=3 phpRSS=135 ap=29 tcp=30 topuser=madalice 2026-08-31 15:04:36 L1=1.18 run=2 blk=0 avail=7769 (56.4%) swpO=0 conn=2 myRSS=3447 php=5 phpRSS=320 ap=28 tcp=33 topuser=madalice 2026-08-31 15:04:44 L1=1.07 run=1 blk=0 avail=7846 (56.9%) swpO=0 conn=1 myRSS=3447 php=4 phpRSS=193 ap=33 tcp=26 topuser=madalice 2026-08-31 15:04:46 L1=1.07 run=2 blk=0 avail=7699 (55.9%) swpO=0 conn=3 myRSS=3447 php=5 phpRSS=388 ap=31 tcp=29 topuser=customc 2026-08-31 15:04:54 L1=1.07 run=1 blk=0 avail=7569 (54.9%) swpO=0 conn=1 myRSS=3447 php=4 phpRSS=453 ap=35 tcp=37 topuser=corpkicks 2026-08-31 15:04:56 L1=1.07 run=1 blk=0 avail=7556 (54.8%) swpO=0 conn=3 myRSS=3447 php=5 phpRSS=493 ap=35 tcp=36 topuser=corpkicks 2026-08-31 15:05:04 L1=1.06 run=3 blk=0 avail=7813 (56.7%) swpO=0 conn=1 myRSS=3447 php=3 phpRSS=189 ap=32 tcp=31 topuser=madalice 2026-08-31 15:05:06 L1=1.06 run=3 blk=0 avail=7680 (55.7%) swpO=0 conn=3 myRSS=3447 php=5 phpRSS=390 ap=31 tcp=27 topuser=corpkicks 2026-08-31 15:05:14 L1=0.97 run=3 blk=1 avail=7859 (57.0%) swpO=0 conn=1 myRSS=3447 php=3 phpRSS=189 ap=28 tcp=30 topuser=madalice 2026-08-31 15:05:16 L1=0.97 run=1 blk=0 avail=7855 (57.0%) swpO=0 conn=3 myRSS=3447 php=4 phpRSS=228 ap=27 tcp=30 topuser=madalice 2026-08-31 15:05:24 L1=0.82 run=4 blk=0 avail=7709 (56.0%) swpO=0 conn=1 myRSS=3447 php=5 phpRSS=360 ap=30 tcp=42 topuser=madalice 2026-08-31 15:05:26 L1=0.82 run=1 blk=0 avail=7346 (53.3%) swpO=0 conn=3 myRSS=3447 php=7 phpRSS=725 ap=36 tcp=45 topuser=madalice 2026-08-31 15:05:34 L1=0.86 run=2 blk=0 avail=7388 (53.6%) swpO=3 conn=1 myRSS=3447 php=8 phpRSS=680 ap=40 tcp=39 topuser=madalice 2026-08-31 15:05:36 L1=0.86 run=3 blk=0 avail=7315 (53.1%) swpO=3 conn=3 myRSS=3447 php=8 phpRSS=746 ap=41 tcp=388 topuser=madalice 2026-08-31 15:05:44 L1=2.23 run=4 blk=0 avail=6457 (46.9%) swpO=647 conn=1 myRSS=3426 php=13 phpRSS=1367 ap=101 tcp=74 topuser=madalice 2026-08-31 15:05:46 L1=2.23 run=6 blk=0 avail=6816 (49.5%) swpO=647 conn=4 myRSS=3426 php=8 phpRSS=861 ap=99 tcp=53 topuser=madalice 2026-08-31 15:05:54 L1=2.19 run=5 blk=0 avail=6177 (44.8%) swpO=0 conn=1 myRSS=3426 php=11 phpRSS=1218 ap=153 tcp=100 topuser=madalice 2026-08-31 15:05:56 L1=2.19 run=2 blk=0 avail=6258 (45.4%) swpO=0 conn=4 myRSS=3426 php=9 phpRSS=1092 ap=151 tcp=91 topuser=madalice 2026-08-31 15:06:04 L1=2.72 run=2 blk=0 avail=6001 (43.6%) swpO=584 conn=3 myRSS=3407 php=11 phpRSS=1167 ap=143 tcp=83 topuser=madalice 2026-08-31 15:06:06 L1=2.72 run=1 blk=0 avail=6042 (43.9%) swpO=584 conn=4 myRSS=3407 php=10 phpRSS=1105 ap=141 tcp=79 topuser=madalice 2026-08-31 15:06:14 L1=2.54 run=2 blk=0 avail=6090 (44.2%) swpO=0 conn=3 myRSS=3407 php=12 phpRSS=1176 ap=133 tcp=66 topuser=madalice 2026-08-31 15:06:16 L1=2.54 run=1 blk=0 avail=6113 (44.4%) swpO=0 conn=4 myRSS=3407 php=10 phpRSS=1109 ap=131 tcp=60 topuser=madalice 2026-08-31 15:06:24 L1=2.46 run=5 blk=0 avail=5892 (42.8%) swpO=0 conn=3 myRSS=3407 php=13 phpRSS=1467 ap=123 tcp=72 topuser=madalice 2026-08-31 15:06:26 L1=2.46 run=7 blk=0 avail=6000 (43.6%) swpO=0 conn=4 myRSS=3407 php=10 phpRSS=1285 ap=121 tcp=64 topuser=madalice 2026-08-31 15:06:34 L1=2.68 run=3 blk=0 avail=5930 (43.0%) swpO=0 conn=3 myRSS=3407 php=14 phpRSS=1531 ap=113 tcp=49 topuser=madalice