INCIDENT 2026-09-01 16:20:24 trigger: php_rss=1512MB ================================================================== load: 2.40 1.30 1.26 1/693 2742474 ncpu:10 mem_avail: 6610MB/13777MB (48.0%) swap_used:2497MB swapout:1277/s blocked(D):0 running:2 iowait:0.7% steal:0.0% php: 13 procs / 1512MB heaviest user: madalice (10 procs, 1432MB) apache: 59 procs tcp_estab: 40 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3312 madalice 10 1432 root 252 1026 nobody 58 910 netdata 7 216 cpanellogin 1 114 mailman 20 86 wp-toolkit 3 82 dovenull 6 46 alison 2 29 evolution 7 26 mailnull 2 21 zabbix 1 18 dovecot 3 18 aaa 1 16 infinium 1 14 kurri 1 13 named 1 11 polkitd 1 4 nscd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1432 root 1 33 evolution 1 8 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5434 MB Active(file): 3962 MB Inactive(file): 1721 MB Dirty: 3 MB Writeback: 0 MB SReclaimable: 474 MB CommitLimit: 10984 MB Committed_AS: 8843 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2727304 root 01:32 59104 /opt/imunify360/venv/bin/python3 -m imav.run 2728249 root 00:22 3076 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : 3926885 root 13:57:54 4916 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3392192 11.0 Ssl 4-14:01:15 /usr/sbin/mariadbd 508924 1 netdata 196792 1.9 Ssl 4-14:00:44 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2001035 3930335 root 175596 0.1 S 03:25:08 spamd child 2742268 3929444 madalice 164880 42.0 S 00:12 php-fpm: pool madalice_com_au 2742318 3929444 madalice 163148 45.8 S 00:09 php-fpm: pool madalice_com_au 2742317 3929444 madalice 163068 46.1 S 00:09 php-fpm: pool madalice_com_au 2742333 3929444 madalice 162652 35.1 S 00:08 php-fpm: pool madalice_com_au 3963222 3930335 root 151236 0.0 S 13:50:07 spamd child 2742349 3929444 madalice 141204 19.5 S 00:07 php-fpm: pool madalice_com_au 2742348 3929444 madalice 141200 19.4 S 00:07 php-fpm: pool madalice_com_au 2742347 3929444 madalice 141164 19.8 S 00:07 php-fpm: pool madalice_com_au 2742365 3929444 madalice 138316 27.5 S 00:06 php-fpm: pool madalice_com_au 2742363 3929444 madalice 138312 26.1 S 00:06 php-fpm: pool madalice_com_au 509266 1 root 117192 0.0 Ss 4-14:00:41 /usr/lib/systemd/systemd-journald 2552785 1353308 cpanellogin 117168 0.0 S 51:15 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 2742364 3929444 madalice 112916 18.3 S 00:06 php-fpm: pool madalice_com_au 3930335 1 root 85980 0.0 Ss 13:57:13 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509640 508992 root 60884 0.0 Sl 4-14:00:39 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 2727304 1 root 59104 1.8 Ssl 01:33 /opt/imunify360/venv/bin/python3 -m imav.run 509236 509098 root 52720 0.0 Sl 4-14:00:41 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3929420 1 wp-toolkit 45536 0.0 Ss 13:57:46 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1353308 1 root 42352 0.1 Ss 41-13:39:07 cpsrvd (SSL) - waiting for connections 3929444 1 root 34532 0.0 Ss 13:57:46 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3929564 1 wp-toolkit 34136 0.0 Ss 13:57:45 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3929532 1 root 24552 0.0 Ss 13:57:45 lfd - sleeping 2726169 506832 nobody 22620 0.1 S 03:50 /usr/sbin/httpd -k start 2725766 506832 nobody 22052 0.0 S 04:42 /usr/sbin/httpd -k start 2727186 506832 nobody 21320 0.0 S 01:49 /usr/sbin/httpd -k start 2727398 506832 nobody 21252 0.0 S 01:29 /usr/sbin/httpd -k start 2727428 506832 nobody 21184 0.0 S 01:24 /usr/sbin/httpd -k start 2727015 506832 nobody 21172 0.1 S 02:10 /usr/sbin/httpd -k start 2727779 506832 nobody 21148 0.1 S 00:50 /usr/sbin/httpd -k start 2727690 506832 nobody 20964 0.1 S 00:55 /usr/sbin/httpd -k start 1463 1 root 20780 0.0 Ss 64-06:10:36 tailwatchd 1469 1 root 20744 0.1 Ss 64-06:10:36 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2727157 506832 nobody 20744 0.1 S 01:52 /usr/sbin/httpd -k start 2727022 506832 nobody 20316 0.0 S 02:09 /usr/sbin/httpd -k start 2727776 506832 nobody 20200 0.0 S 00:50 /usr/sbin/httpd -k start 2726652 506832 nobody 19988 0.1 S 02:51 /usr/sbin/httpd -k start 2726827 506832 nobody 19980 0.1 S 02:25 /usr/sbin/httpd -k start 2727014 506832 nobody 19724 0.0 S 02:10 /usr/sbin/httpd -k start 2727427 506832 nobody 19004 0.0 S 01:24 /usr/sbin/httpd -k start 483898 1 zabbix 18776 0.2 Ssl 4-14:01:58 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3929469 1 root 18760 0.0 Ss 13:57:46 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 2742339 506832 nobody 18724 0.1 S 00:07 /usr/sbin/httpd -k start 2742338 506832 nobody 18676 0.1 S 00:07 /usr/sbin/httpd -k start 2742357 506832 nobody 18676 0.1 S 00:06 /usr/sbin/httpd -k start 2742340 506832 nobody 18668 0.1 S 00:07 /usr/sbin/httpd -k start 2742355 506832 nobody 18616 0.1 S 00:06 /usr/sbin/httpd -k start 2742360 506832 nobody 18616 0.1 S 00:06 /usr/sbin/httpd -k start 2727700 506832 nobody 18612 0.0 S 00:54 /usr/sbin/httpd -k start 2742358 506832 nobody 18548 0.3 S 00:06 /usr/sbin/httpd -k start 2742361 506832 nobody 18488 0.1 S 00:06 /usr/sbin/httpd -k start 2726166 506832 nobody 18464 0.1 S 03:51 /usr/sbin/httpd -k start 2727598 506832 nobody 18452 0.0 S 01:05 /usr/sbin/httpd -k start 2727020 506832 nobody 18376 0.0 S 02:09 /usr/sbin/httpd -k start 2742359 506832 nobody 18204 0.0 S 00:06 /usr/sbin/httpd -k start 2727417 506832 nobody 18188 0.0 S 01:25 /usr/sbin/httpd -k start 2727482 506832 nobody 17792 0.2 S 01:22 /usr/sbin/httpd -k start 2728361 506832 nobody 17268 0.0 S 00:23 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 14953961 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min customkidscom/customkids.com.au-ssl_log 261 evolution/my.evolutionerp.com.au-ssl_log 182 evolution/app.evolutionerp.com.au-ssl_log 117 alison/alisonarts.com.au-ssl_log 96 nrg/nrgservices.net.au-ssl_log 67 nrg/nrgservices.net.au 54 speedlin/speedlinefencing.com.au 45 coscom/swms.coscom.com.au-ssl_log 37 evolution/portal.evolutionerp.com.au-ssl_log 29 speedlin/speedlinefencing.com.au-ssl_log 28 vinesit/vinesit.com.au-ssl_log 21 olympic/olympicfencing.com.au-ssl_log 14 madalice/madalice.com.au-ssl_log 5 corpkicks/corporatekicks.com.au-ssl_log 2 infinium/infinium.net.au-ssl_log 1 (total vhosts taking traffic: 15) --- top client IPs across all vhosts (last 3 min) --- 261 34.174.169.53 121 20.63.81.20 117 40.115.94.245 91 20.151.10.161 74 203.54.180.238 73 20.104.49.130 63 180.181.236.49 37 158.23.184.117 25 103.104.165.99 21 91.98.156.201 13 182.239.240.254 13 1.144.107.82 8 150.228.151.47 5 195.178.110.48 5 103.104.164.114 --- top request paths across all vhosts (last 3 min) --- 79 POST /functions.php 30 POST /app/ajax.php 27 GET /heartbeat.php 13 GET / 11 GET /app/ajax.php 10 POST //functions.php 9 POST /app/ajax/selectFilter.php 9 GET /index.php 6 GET /simple.php 5 POST /timesheets.php 5 GET /media.php 5 GET /mac.php 5 GET /abcd.php 5 GET /1.php 4 POST /wp-cron.php 4 POST / 4 GET /dex.php 3 POST /api/session/reset_password 3 GET /wp.php 3 GET /wp-content/plugins/hellopress/wp_filemanager.php --- busiest 3 vhosts: top paths + last 10 requests --- == customkidscom/customkids.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env -- last 10 requests -- 34.174.169.53 - - [01/Sep/2026:16:19:15 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.174.169.53 - - [01/Sep/2026:16:19:16 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.174.169.53 - - [01/Sep/2026:16:19:16 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.174.169.53 - - [01/Sep/2026:16:19:16 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.174.169.53 - - [01/Sep/2026:16:19:16 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.174.169.53 - - [01/Sep/2026:16:19:17 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.174.169.53 - - [01/Sep/2026:16:19:17 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.174.169.53 - - [01/Sep/2026:16:19:17 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.174.169.53 - - [01/Sep/2026:16:19:17 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.174.169.53 - - [01/Sep/2026:16:19:18 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 79 POST /functions.php 30 POST /app/ajax.php 11 GET /app/ajax.php 10 POST //functions.php 9 POST /app/ajax/selectFilter.php 9 GET /index.php 6 GET / 5 POST /timesheets.php 3 GET /plugins/fensa/fensa-ajax.php 3 GET //index.php 2 POST /plugins/csvexporter/plugin.php 2 POST /login.php -- last 10 requests -- 103.104.165.99 - - [01/Sep/2026:16:20:13 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=11916" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 103.104.165.99 - - [01/Sep/2026:16:20:13 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 103.104.165.99 - - [01/Sep/2026:16:20:13 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=activities&date=2026-10-02&focus=2063" "Mozilla/5.0 (Windows NT 10.0; W 103.104.165.99 - - [01/Sep/2026:16:20:13 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12074&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 180.181.236.49 - - [01/Sep/2026:16:20:14 +1000] "POST /timesheets.php?call=getTimesheetDetails&staffid=38&date=2026-09-01 HTTP/1.1" 200 1698 "https://my.evolutionerp.com.au/index.php?page=timesheetHistory" "Mozilla/5.0 ( 203.54.180.238 - - [01/Sep/2026:16:20:14 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78933§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 180.181.236.49 - - [01/Sep/2026:16:20:17 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 150.228.151.47 - - [01/Sep/2026:16:20:18 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 52 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chr 52.167.144.175 - - [01/Sep/2026:16:20:20 +1000] "GET / HTTP/1.1" 200 5232 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537 180.181.236.49 - - [01/Sep/2026:16:20:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=timesheetHistory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 2 GET /api/getItem/SHSG656520 2 GET /api/getItem/SHSG656516 2 GET /api/getItem/SHSG3030208 2 GET /api/getItem/SHSG125125508 2 GET /api/getItem/SHSG125125408 2 GET /api/getItem/SHSG10010050 2 GET /api/getItem/SHSG10010040 -- last 10 requests -- 40.115.94.245 - - [01/Sep/2026:16:19:43 +1000] "GET /api/getItem/RHSG5025258 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:16:19:43 +1000] "GET /api/getItem/RHSG5025308 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:16:19:43 +1000] "GET /api/getItem/RHSG6535168 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:16:19:44 +1000] "GET /api/getItem/RHSG6535208 HTTP/1.1" 200 1344 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:16:19:44 +1000] "GET /api/getItem/RHSG6535258 HTTP/1.1" 200 1168 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:16:19:45 +1000] "GET /api/getItem/RHSG6535308 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:16:19:45 +1000] "GET /api/getItem/RHSG6535408 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:16:19:45 +1000] "GET /api/getItem/RHSG7525168 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:16:19:46 +1000] "GET /api/getItem/RHSG7525208 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:16:19:46 +1000] "GET /api/getItem/RHSG7525258 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-01 16:18:00 L1=0.70 run=1 blk=0 avail=7917 (57.5%) swpO=0 conn=2 myRSS=3350 php=3 phpRSS=201 ap=24 tcp=30 topuser=madalice 2026-09-01 16:18:03 L1=0.70 run=1 blk=0 avail=7909 (57.4%) swpO=0 conn=2 myRSS=3350 php=4 phpRSS=242 ap=23 tcp=35 topuser=madalice 2026-09-01 16:18:10 L1=0.59 run=1 blk=0 avail=8055 (58.5%) swpO=0 conn=2 myRSS=3350 php=2 phpRSS=42 ap=23 tcp=34 topuser=root 2026-09-01 16:18:13 L1=0.59 run=2 blk=0 avail=7975 (57.9%) swpO=0 conn=2 myRSS=3350 php=4 phpRSS=169 ap=24 tcp=44 topuser=olympic 2026-09-01 16:18:21 L1=0.57 run=3 blk=0 avail=7896 (57.3%) swpO=0 conn=2 myRSS=3350 php=3 phpRSS=176 ap=29 tcp=34 topuser=madalice 2026-09-01 16:18:23 L1=0.57 run=2 blk=0 avail=7917 (57.5%) swpO=0 conn=2 myRSS=3350 php=5 phpRSS=254 ap=26 tcp=30 topuser=madalice 2026-09-01 16:18:31 L1=0.48 run=1 blk=0 avail=7968 (57.8%) swpO=0 conn=2 myRSS=3350 php=3 phpRSS=176 ap=22 tcp=35 topuser=madalice 2026-09-01 16:18:33 L1=0.48 run=3 blk=0 avail=7900 (57.3%) swpO=0 conn=2 myRSS=3350 php=5 phpRSS=293 ap=23 tcp=39 topuser=madalice 2026-09-01 16:18:41 L1=0.41 run=3 blk=0 avail=7893 (57.3%) swpO=0 conn=2 myRSS=3350 php=4 phpRSS=281 ap=23 tcp=33 topuser=madalice 2026-09-01 16:18:43 L1=0.41 run=2 blk=0 avail=7911 (57.4%) swpO=0 conn=2 myRSS=3350 php=5 phpRSS=292 ap=21 tcp=36 topuser=madalice 2026-09-01 16:18:51 L1=0.58 run=2 blk=0 avail=7815 (56.7%) swpO=0 conn=2 myRSS=3350 php=4 phpRSS=222 ap=22 tcp=40 topuser=madalice 2026-09-01 16:18:53 L1=0.58 run=1 blk=0 avail=7848 (57.0%) swpO=0 conn=2 myRSS=3350 php=4 phpRSS=239 ap=22 tcp=41 topuser=madalice 2026-09-01 16:19:01 L1=0.73 run=3 blk=0 avail=7789 (56.5%) swpO=0 conn=2 myRSS=3350 php=4 phpRSS=292 ap=28 tcp=41 topuser=madalice 2026-09-01 16:19:03 L1=0.73 run=4 blk=0 avail=7748 (56.2%) swpO=0 conn=2 myRSS=3350 php=5 phpRSS=349 ap=29 tcp=40 topuser=madalice 2026-09-01 16:19:11 L1=0.85 run=4 blk=0 avail=7575 (55.0%) swpO=0 conn=2 myRSS=3350 php=6 phpRSS=583 ap=26 tcp=33 topuser=corpkicks 2026-09-01 16:19:13 L1=0.85 run=8 blk=0 avail=7819 (56.8%) swpO=0 conn=2 myRSS=3350 php=5 phpRSS=316 ap=24 tcp=38 topuser=madalice 2026-09-01 16:19:21 L1=0.80 run=4 blk=0 avail=7876 (57.2%) swpO=0 conn=2 myRSS=3350 php=4 phpRSS=232 ap=25 tcp=34 topuser=madalice 2026-09-01 16:19:23 L1=0.80 run=2 blk=0 avail=8007 (58.1%) swpO=0 conn=2 myRSS=3350 php=4 phpRSS=102 ap=24 tcp=36 topuser=evolution 2026-09-01 16:19:31 L1=1.06 run=2 blk=0 avail=7814 (56.7%) swpO=0 conn=2 myRSS=3350 php=4 phpRSS=280 ap=28 tcp=39 topuser=madalice 2026-09-01 16:19:33 L1=1.06 run=3 blk=0 avail=7673 (55.7%) swpO=0 conn=2 myRSS=3350 php=6 phpRSS=445 ap=31 tcp=42 topuser=speedlin 2026-09-01 16:19:41 L1=1.22 run=4 blk=0 avail=7502 (54.5%) swpO=0 conn=5 myRSS=3351 php=7 phpRSS=617 ap=35 tcp=44 topuser=corpkicks 2026-09-01 16:19:44 L1=1.22 run=4 blk=0 avail=7743 (56.2%) swpO=0 conn=2 myRSS=3351 php=5 phpRSS=297 ap=35 tcp=42 topuser=madalice 2026-09-01 16:19:51 L1=1.18 run=3 blk=0 avail=7673 (55.7%) swpO=0 conn=5 myRSS=3351 php=4 phpRSS=362 ap=34 tcp=36 topuser=madalice 2026-09-01 16:19:54 L1=1.18 run=4 blk=0 avail=7656 (55.6%) swpO=0 conn=2 myRSS=3351 php=8 phpRSS=510 ap=32 tcp=43 topuser=evolution 2026-09-01 16:20:01 L1=1.62 run=15 blk=0 avail=7581 (55.0%) swpO=0 conn=5 myRSS=3351 php=5 phpRSS=412 ap=36 tcp=48 topuser=speedlin 2026-09-01 16:20:04 L1=1.62 run=6 blk=0 avail=7591 (55.1%) swpO=0 conn=2 myRSS=3351 php=7 phpRSS=470 ap=40 tcp=43 topuser=olympic 2026-09-01 16:20:11 L1=1.99 run=4 blk=0 avail=7803 (56.6%) swpO=0 conn=5 myRSS=3351 php=4 phpRSS=230 ap=34 tcp=35 topuser=madalice 2026-09-01 16:20:14 L1=1.99 run=2 blk=0 avail=7752 (56.3%) swpO=0 conn=2 myRSS=3351 php=5 phpRSS=327 ap=31 tcp=44 topuser=madalice 2026-09-01 16:20:21 L1=2.40 run=1 blk=0 avail=6598 (47.9%) swpO=1277 conn=5 myRSS=3312 php=12 phpRSS=1475 ap=62 tcp=45 topuser=madalice 2026-09-01 16:20:24 L1=2.40 run=2 blk=0 avail=6610 (48.0%) swpO=1277 conn=1 myRSS=3312 php=13 phpRSS=1512 ap=59 tcp=40 topuser=madalice