INCIDENT 2026-09-06 07:14:22 trigger: php_rss=1738MB mysql_conn=15 ================================================================== load: 2.74 1.70 1.64 21/629 1167089 ncpu:10 mem_avail: 9246MB/13777MB (67.1%) swap_used:1963MB swapout:198/s blocked(D):1 running:18 iowait:5.7% steal:0.0% php: 19 procs / 1738MB heaviest user: otterfencing (14 procs, 1576MB) apache: 29 procs tcp_estab: 60 --- RSS by user (all processes) --- USER PROCS RSS_MB otterfencing 15 1741 root 251 879 mysql 1 794 nobody 28 404 mailman 20 263 netdata 8 243 madalice 1 132 wp-toolkit 3 69 mailnull 3 56 dovenull 6 55 cpanellogin 1 47 named 1 36 dovecot 3 21 polkitd 1 15 lowrange 1 15 evolution 11 13 zabbix 1 11 kurri 1 10 rpc 1 4 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB otterfencing 15 1791 madalice 1 132 root 1 29 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 9268 MB Active(file): 3298 MB Inactive(file): 5401 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 613 MB CommitLimit: 10984 MB Committed_AS: 9760 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 5-04:51:57 5628 /usr/bin/imunify-agent-proxy 4109079 root 1-02:29:35 1764 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 1-02:29:35 81488 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 813228 2.7 Ssl 11:37:52 /usr/sbin/mariadbd 166870 1 netdata 178660 2.7 Ssl 04:52:03 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 220206 168913 root 176376 0.0 S 04:36:05 spamd child 1167005 1165255 otterfencing 168604 56.3 R 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1167015 1150117 otterfencing 159540 55.3 R 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1167012 1167002 otterfencing 156644 53.6 R 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1167009 1167001 otterfencing 150884 48.3 R 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1167014 1166887 otterfencing 135872 43.0 R 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1166860 167896 madalice 135648 6.0 S 00:19 php-fpm: pool madalice_com_au 1167027 1132291 otterfencing 131656 58.5 R 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 167871 1 root 116856 0.0 Ss 04:51:56 /usr/lib/systemd/systemd-journald 1167030 1166994 otterfencing 116560 96.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1167032 1148587 otterfencing 101500 76.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 168913 1 root 99124 0.0 Ss 04:50:53 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1167029 1132224 otterfencing 95196 33.5 R 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4109105 4109079 root 81488 2.0 Sl 1-02:29:35 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1167034 1148641 otterfencing 77624 42.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1167033 1166995 otterfencing 75904 40.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1167087 1148640 otterfencing 65228 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1167096 1167004 otterfencing 52440 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1150011 1353308 cpanellogin 48752 0.1 S 05:05 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 1469 1 root 41864 0.1 Ss 68-21:04:38 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 41864 0.1 Ss 46-04:33:09 cpsrvd (SSL) - waiting for connections 167562 166914 netdata 41232 0.1 Sl 04:51:58 /usr/libexec/netdata/plugins.d/go.d.plugin 1 166645 1 wp-toolkit 38000 0.0 Ss 04:52:07 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 166809 1 named 36948 0.0 Ssl 04:52:05 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 509236 509098 root 34704 0.0 Sl 9-04:54:43 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 220207 168913 root 33904 0.0 S 04:36:05 spamd child 167896 1 root 29928 0.0 Ss 04:51:55 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 167845 1 wp-toolkit 27020 0.0 Ss 04:51:56 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1463 1 root 24628 0.0 Ss 68-21:04:38 tailwatchd 1132291 506832 nobody 23096 0.0 S 11:43 /usr/sbin/httpd -k start 1132224 506832 nobody 22740 0.0 S 11:45 /usr/sbin/httpd -k start 1148640 506832 nobody 22644 0.0 S 07:53 /usr/sbin/httpd -k start 508720 1 mailnull 22540 0.0 Ss 9-04:54:50 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1148587 506832 nobody 22168 0.1 S 07:55 /usr/sbin/httpd -k start 167814 1 root 22156 0.0 Ss 04:51:56 lfd - sleeping 1150177 506832 nobody 22032 0.1 S 04:51 /usr/sbin/httpd -k start 1148641 506832 nobody 21760 0.0 S 07:53 /usr/sbin/httpd -k start 1164930 506832 nobody 21592 0.0 S 03:37 /usr/sbin/httpd -k start 1150117 506832 nobody 21548 0.0 S 04:53 /usr/sbin/httpd -k start 167017 1 root 21308 0.1 Ssl 04:52:02 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1165255 506832 nobody 21300 0.0 S 03:20 /usr/sbin/httpd -k start 1148602 506832 nobody 20808 0.0 S 07:54 /usr/sbin/httpd -k start 1167016 508720 mailnull 18532 0.0 S 00:02 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 166757 1 root 17864 0.0 Ss 04:52:06 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 1167028 508720 mailnull 16932 0.0 S 00:02 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1166887 506832 nobody 16716 0.0 S 00:14 /usr/sbin/httpd -k start 167566 166914 netdata 16652 2.1 Sl 04:51:58 /usr/libexec/netdata/plugins.d/apps.plugin 1 1166987 506832 nobody 16204 0.2 S 00:05 /usr/sbin/httpd -k start 166667 1 polkitd 16160 0.0 Ssl 04:52:07 /usr/lib/polkit-1/polkitd --no-debug 1166995 506832 nobody 16124 0.2 S 00:04 /usr/sbin/httpd -k start 1166994 506832 nobody 16096 0.0 S 00:04 /usr/sbin/httpd -k start 1167004 506832 nobody 15928 0.3 S 00:03 /usr/sbin/httpd -k start 1167003 506832 nobody 15916 0.3 S 00:03 /usr/sbin/httpd -k start 1167002 506832 nobody 15892 0.3 S 00:03 /usr/sbin/httpd -k start 1167001 506832 nobody 15852 0.0 S 00:03 /usr/sbin/httpd -k start 780574 167382 lowrange 15752 0.0 S 01:51:00 dovecot/imap 167770 167758 mailman 15524 0.0 S 04:51:57 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 167776 167758 mailman 15436 0.0 S 04:51:57 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 305726 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 132 madalice/madalice.com.au-ssl_log 5 evolution/evolutionerp.com.au-ssl_log 4 alison/alisonarts.com.au-ssl_log 1 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 132 40.115.94.245 4 169.58.198.240 1 66.198.240.48 1 34.82.243.129 1 173.252.82.60 1 118.127.40.55 1 114.119.137.101 1 103.183.118.35 --- top request paths across all vhosts (last 3 min) --- 36 GET /api/getItem/LWFBW2001KG 3 GET /api/getItem/GEB12-DL 2 GET /wp-login.php 2 GET /api/getItem/IPC2525 1 POST /wp-cron.php 1 GET /wp-admin/css/colors/modern/ 1 GET /wp-admin/css/colors/midnight/ 1 GET /wp-admin/css/colors/light/ 1 GET /wp-admin/css/colors/ectoplasm/ 1 GET /store/custom-parramatta-eels-kids/ 1 GET /category/work/page/17/ 1 GET /api/getItem/SPHDG15040 1 GET /api/getItem/SGC-100 1 GET /api/getItem/S6 1 GET /api/getItem/S5 1 GET /api/getItem/S4 1 GET /api/getItem/S3 1 GET /api/getItem/S2 1 GET /api/getItem/S1 1 GET /api/getItem/RGW90 --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 36 GET /api/getItem/LWFBW2001KG 3 GET /api/getItem/GEB12-DL 2 GET /api/getItem/IPC2525 1 GET /api/getItem/SPHDG15040 1 GET /api/getItem/SGC-100 1 GET /api/getItem/S6 1 GET /api/getItem/S5 1 GET /api/getItem/S4 1 GET /api/getItem/S3 1 GET /api/getItem/S2 1 GET /api/getItem/S1 1 GET /api/getItem/RGW90 -- last 10 requests -- 40.115.94.245 - - [06/Sep/2026:07:14:08 +1000] "GET /api/getItem/SGC-100 HTTP/1.1" 200 1354 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:14:09 +1000] "GET /api/getItem/IPC2020 HTTP/1.1" 200 1352 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:14:09 +1000] "GET /api/getItem/IPC2525 HTTP/1.1" 200 1621 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:14:10 +1000] "GET /api/getItem/IPC25NB HTTP/1.1" 200 1470 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:14:10 +1000] "GET /api/getItem/IPC32NB HTTP/1.1" 200 1491 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:14:10 +1000] "GET /api/getItem/IPC3825 HTTP/1.1" 200 1467 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:14:11 +1000] "GET /api/getItem/IPC4040-1 HTTP/1.1" 404 111 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:14:11 +1000] "GET /api/getItem/IPC40NB HTTP/1.1" 200 1342 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:14:11 +1000] "GET /api/getItem/IPC5050 HTTP/1.1" 200 1740 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:07:14:12 +1000] "GET /api/getItem/IPC50NB HTTP/1.1" 200 1498 "-" "RestSharp/106.13.0.0" == madalice/madalice.com.au-ssl_log == -- top paths -- 1 GET /wp-admin/css/colors/modern/ 1 GET /wp-admin/css/colors/midnight/ 1 GET /wp-admin/css/colors/light/ 1 GET /wp-admin/css/colors/ectoplasm/ 1 GET /store/custom-parramatta-eels-kids/ -- last 10 requests -- 169.58.198.240 - - [06/Sep/2026:07:12:05 +1000] "GET /wp-admin/css/colors/ectoplasm/ HTTP/1.1" 200 355 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 S 169.58.198.240 - - [06/Sep/2026:07:12:12 +1000] "GET /wp-admin/css/colors/light/ HTTP/1.1" 200 349 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safar 114.119.137.101 - - [06/Sep/2026:07:12:16 +1000] "GET /store/custom-parramatta-eels-kids/?wcpr_image=1&wcpr_verified=1&wcpr_rating=3&rating=1 HTTP/1.1" 404 36671 "https://madalice.com.au/store/custom-parramatta-eels-kids 169.58.198.240 - - [06/Sep/2026:07:12:22 +1000] "GET /wp-admin/css/colors/midnight/ HTTP/1.1" 200 351 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Sa 169.58.198.240 - - [06/Sep/2026:07:12:31 +1000] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 200 359 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safa == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /wp-login.php 1 POST /wp-cron.php 1 GET / -- last 10 requests -- 103.183.118.35 - - [06/Sep/2026:07:12:16 +1000] "GET /wp-login.php HTTP/1.1" 200 4008 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 34.82.243.129 - - [06/Sep/2026:07:13:06 +1000] "GET / HTTP/1.1" 200 12484 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0" 118.127.40.55 - - [06/Sep/2026:07:13:15 +1000] "POST /wp-cron.php?doing_wp_cron=1788642795.1486029624938964843750 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://evolutionerp.com.au" 66.198.240.48 - - [06/Sep/2026:07:13:13 +1000] "GET /wp-login.php HTTP/1.1" 200 3035 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-06 07:12:02 L1=1.52 run=2 blk=1 avail=10573(76.7%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=183 ap=14 tcp=26 topuser=madalice 2026-09-06 07:12:02 L1=1.52 run=1 blk=1 avail=10575(76.8%) swpO=0 conn=2 myRSS=797 php=5 phpRSS=183 ap=14 tcp=26 topuser=madalice 2026-09-06 07:12:12 L1=1.44 run=3 blk=1 avail=10430(75.7%) swpO=0 conn=2 myRSS=797 php=7 phpRSS=391 ap=14 tcp=27 topuser=customc 2026-09-06 07:12:12 L1=1.44 run=2 blk=1 avail=10404(75.5%) swpO=0 conn=2 myRSS=797 php=7 phpRSS=409 ap=14 tcp=27 topuser=customc 2026-09-06 07:12:22 L1=1.37 run=1 blk=1 avail=10563(76.7%) swpO=0 conn=2 myRSS=797 php=5 phpRSS=184 ap=14 tcp=28 topuser=madalice 2026-09-06 07:12:22 L1=1.37 run=1 blk=1 avail=10562(76.7%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=184 ap=14 tcp=28 topuser=madalice 2026-09-06 07:12:32 L1=1.39 run=1 blk=1 avail=10565(76.7%) swpO=0 conn=2 myRSS=797 php=5 phpRSS=184 ap=14 tcp=25 topuser=madalice 2026-09-06 07:12:32 L1=1.39 run=1 blk=1 avail=10565(76.7%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=184 ap=14 tcp=25 topuser=madalice 2026-09-06 07:12:42 L1=1.41 run=2 blk=1 avail=10353(75.1%) swpO=0 conn=2 myRSS=797 php=6 phpRSS=377 ap=14 tcp=31 topuser=corpkicks 2026-09-06 07:12:42 L1=1.41 run=2 blk=1 avail=10330(75.0%) swpO=0 conn=1 myRSS=797 php=6 phpRSS=399 ap=14 tcp=32 topuser=corpkicks 2026-09-06 07:12:52 L1=1.35 run=1 blk=1 avail=10523(76.4%) swpO=0 conn=2 myRSS=797 php=5 phpRSS=161 ap=14 tcp=25 topuser=madalice 2026-09-06 07:12:52 L1=1.35 run=3 blk=1 avail=10524(76.4%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=163 ap=14 tcp=25 topuser=madalice 2026-09-06 07:13:02 L1=1.29 run=1 blk=1 avail=10483(76.1%) swpO=0 conn=2 myRSS=797 php=5 phpRSS=184 ap=14 tcp=25 topuser=madalice 2026-09-06 07:13:02 L1=1.29 run=1 blk=1 avail=10483(76.1%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=184 ap=14 tcp=25 topuser=madalice 2026-09-06 07:13:12 L1=1.25 run=4 blk=1 avail=10497(76.2%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=184 ap=14 tcp=23 topuser=madalice 2026-09-06 07:13:12 L1=1.25 run=1 blk=1 avail=10497(76.2%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=184 ap=14 tcp=23 topuser=madalice 2026-09-06 07:13:22 L1=1.28 run=1 blk=1 avail=10527(76.4%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=161 ap=14 tcp=20 topuser=madalice 2026-09-06 07:13:22 L1=1.28 run=1 blk=1 avail=10526(76.4%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=161 ap=14 tcp=20 topuser=madalice 2026-09-06 07:13:32 L1=1.24 run=1 blk=1 avail=10535(76.5%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=161 ap=13 tcp=24 topuser=madalice 2026-09-06 07:13:32 L1=1.24 run=1 blk=1 avail=10534(76.5%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=161 ap=13 tcp=24 topuser=madalice 2026-09-06 07:13:42 L1=1.20 run=2 blk=1 avail=10554(76.6%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=184 ap=13 tcp=21 topuser=madalice 2026-09-06 07:13:42 L1=1.20 run=1 blk=1 avail=10553(76.6%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=184 ap=13 tcp=21 topuser=madalice 2026-09-06 07:13:52 L1=1.17 run=1 blk=1 avail=10552(76.6%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=184 ap=13 tcp=21 topuser=madalice 2026-09-06 07:13:52 L1=1.17 run=1 blk=1 avail=10552(76.6%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=184 ap=13 tcp=21 topuser=madalice 2026-09-06 07:14:02 L1=1.22 run=1 blk=1 avail=10708(77.7%) swpO=0 conn=1 myRSS=797 php=4 phpRSS=29 ap=13 tcp=20 topuser=root 2026-09-06 07:14:02 L1=1.22 run=3 blk=1 avail=10704(77.7%) swpO=0 conn=1 myRSS=797 php=5 phpRSS=69 ap=13 tcp=20 topuser=evolution 2026-09-06 07:14:12 L1=1.35 run=2 blk=1 avail=10405(75.5%) swpO=0 conn=4 myRSS=797 php=8 phpRSS=413 ap=14 tcp=23 topuser=tubesupplies 2026-09-06 07:14:12 L1=1.35 run=2 blk=1 avail=10394(75.4%) swpO=0 conn=1 myRSS=797 php=7 phpRSS=415 ap=14 tcp=23 topuser=tubesupplies 2026-09-06 07:14:22 L1=2.74 run=18 blk=1 avail=9246 (67.1%) swpO=198 conn=15 myRSS=794 php=19 phpRSS=1738 ap=29 tcp=60 topuser=otterfencing 2026-09-06 07:14:22 L1=2.74 run=24 blk=1 avail=9323 (67.7%) swpO=198 conn=15 myRSS=794 php=19 phpRSS=1783 ap=29 tcp=60 topuser=otterfencing