INCIDENT 2026-09-07 05:52:23 trigger: php_rss=1861MB ================================================================== load: 3.42 1.80 1.61 17/713 1622483 ncpu:10 mem_avail: 8101MB/13777MB (58.8%) swap_used:2784MB swapout:765/s blocked(D):1 running:15 iowait:8.7% steal:0.0% php: 19 procs / 1861MB heaviest user: corpkicks (8 procs, 1450MB) apache: 47 procs tcp_estab: 51 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1678 corpkicks 10 1623 root 245 985 nobody 46 745 evolution 17 251 netdata 8 243 infinium 3 173 mailman 20 100 cpanellogin 1 89 madalice 1 79 wp-toolkit 3 56 dovenull 6 55 kurri 4 52 dovecot 3 23 mailnull 3 21 lowrange 1 13 zabbix 1 10 named 1 9 polkitd 1 6 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB corpkicks 9 1608 evolution 9 241 infinium 2 174 madalice 1 82 root 1 23 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6967 MB Active(file): 4057 MB Inactive(file): 2991 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 618 MB CommitLimit: 10984 MB Committed_AS: 9874 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-03:29:58 4624 /usr/bin/imunify-agent-proxy 4109079 root 2-01:07:36 1824 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-01:07:36 133656 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 1718500 2.9 Ssl 1-10:15:53 /usr/sbin/mariadbd 1622414 1622360 corpkicks 277904 67.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1622415 1589933 corpkicks 240648 114 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1622416 1622365 corpkicks 238120 109 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1622417 1621613 corpkicks 217196 96.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1622418 1622278 corpkicks 215108 93.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 166870 1 netdata 184640 2.6 Ssl 1-03:30:04 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 167871 1 root 149196 0.0 Ss 1-03:29:57 /usr/lib/systemd/systemd-journald 923652 904997 root 144500 0.0 S 03:22:40 spamd child 4109105 4109079 root 133656 1.5 Sl 2-01:07:36 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 904997 1 root 133520 0.0 Ss 03:29:27 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1622412 1622272 infinium 127572 27.5 S 00:02 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1622449 167896 madalice 117204 50.0 R 00:01 php-fpm: pool madalice_com_au 1622450 1622243 corpkicks 108620 38.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1315751 1353308 cpanellogin 91172 0.0 S 01:30:05 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 1622479 1622362 infinium 63416 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1622480 1622342 corpkicks 62292 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1622492 1622343 corpkicks 60160 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 923653 904997 root 59956 0.0 S 03:22:39 spamd child 1622276 1605528 evolution 58704 1.2 S 00:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1469 1 root 41472 0.1 Ss 69-19:42:39 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1622496 1621928 evolution 37456 0.0 S 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1353308 1 root 37188 0.1 Ss 47-03:11:10 cpsrvd (SSL) - waiting for connections 1622391 1622368 evolution 37112 0.7 S 00:04 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1622392 1622237 evolution 37052 0.5 S 00:04 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1622393 1622369 evolution 36784 0.5 S 00:04 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1622408 1622367 evolution 36784 1.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 167562 166914 netdata 34932 0.1 Sl 1-03:29:59 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 34532 0.0 Sl 10-03:32:44 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166645 1 wp-toolkit 31820 0.0 Ss 1-03:30:08 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29848 0.0 Ss 03:29:59 lfd - sleeping 167896 1 root 23732 0.0 Ss 1-03:29:56 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1463 1 root 23360 0.0 Ss 69-19:42:39 tailwatchd 1605530 506832 nobody 21328 0.0 S 04:57 /usr/sbin/httpd -k start 1605542 506832 nobody 20352 0.0 S 04:56 /usr/sbin/httpd -k start 1605528 506832 nobody 20160 0.0 S 04:57 /usr/sbin/httpd -k start 1622339 506832 nobody 20004 0.2 S 00:09 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19744 0.0 Ss 1-03:29:57 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1622333 506832 nobody 19600 0.0 S 00:10 /usr/sbin/httpd -k start 1589933 506832 nobody 19216 0.0 S 07:56 /usr/sbin/httpd -k start 1622363 506832 nobody 19136 0.1 S 00:08 /usr/sbin/httpd -k start 1622342 506832 nobody 19084 0.2 S 00:09 /usr/sbin/httpd -k start 1622343 506832 nobody 19000 0.2 S 00:09 /usr/sbin/httpd -k start 1622251 506832 nobody 18992 0.1 R 00:15 /usr/sbin/httpd -k start 1622243 506832 nobody 18924 0.1 S 00:16 /usr/sbin/httpd -k start 1621928 506832 nobody 18876 0.0 S 00:54 /usr/sbin/httpd -k start 1622356 506832 nobody 18776 0.2 S 00:08 /usr/sbin/httpd -k start 1622365 506832 nobody 18764 0.2 S 00:08 /usr/sbin/httpd -k start 1622237 506832 nobody 18728 0.0 S 00:17 /usr/sbin/httpd -k start 1622340 506832 nobody 18684 0.0 S 00:09 /usr/sbin/httpd -k start 1621725 506832 nobody 18664 0.0 S 01:18 /usr/sbin/httpd -k start 1622355 506832 nobody 18536 0.1 S 00:08 /usr/sbin/httpd -k start 1621620 506832 nobody 17888 0.0 S 01:23 /usr/sbin/httpd -k start 1622345 506832 nobody 17832 0.2 S 00:09 /usr/sbin/httpd -k start 1621613 506832 nobody 17816 0.0 S 01:24 /usr/sbin/httpd -k start 1622358 506832 nobody 17800 0.0 S 00:08 /usr/sbin/httpd -k start 1622359 506832 nobody 17684 0.0 S 00:08 /usr/sbin/httpd -k start 167566 166914 netdata 17664 2.1 Sl 1-03:29:59 /usr/libexec/netdata/plugins.d/apps.plugin 1 1622362 506832 nobody 17664 0.2 S 00:08 /usr/sbin/httpd -k start 1622364 506832 nobody 17632 0.0 S 00:08 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 973919 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 973918 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min vinesit/westpanel.vinesit.com.au-ssl_log 202 evolution/app.evolutionerp.com.au-ssl_log 76 evolution/my.evolutionerp.com.au-ssl_log 62 corpkicks/corporatekicks.com.au-ssl_log 37 madalice/madalice.com.au-ssl_log 4 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 202 34.95.14.18 76 40.115.94.245 37 103.104.165.99 34 34.75.226.236 18 203.54.180.238 4 40.77.167.67 2 118.127.40.55 2 114.119.143.14 2 114.119.137.101 1 40.77.167.149 1 34.196.51.17 1 182.239.240.254 1 157.55.39.7 --- top request paths across all vhosts (last 3 min) --- 17 GET /app/templates/ajax.php 16 POST /functions.php 11 GET /app/ajax.php 9 GET /index.php 3 POST /plugins/csvexporter/plugin.php 3 GET / 2 POST /wp-cron.php 2 POST /clienteditsave.php 2 GET /z9x8c7v6b5-debug-trigger-www.corporatekicks.com.au 2 GET /rclone.conf 2 GET /.github/workflows/deploy.yml 2 GET /.git/HEAD 2 GET /.git-credentials 2 GET /.gitconfig 2 GET /.git/config 2 GET /api/getItem/SHSG252516-8 2 GET /api/getItem/SHSG252516-6.5 2 GET /api/getItem/RHSG15050308 2 GET /api/getItem/RHSG15050208 2 GET /api/getItem/RHSG150100408 --- busiest 3 vhosts: top paths + last 10 requests --- == vinesit/westpanel.vinesit.com.au-ssl_log == -- top paths -- 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /vue/.env 1 GET /vite/.env -- last 10 requests -- 34.95.14.18 - - [07/Sep/2026:05:50:53 +1000] "GET /qa/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.95.14.18 - - [07/Sep/2026:05:50:53 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.95.14.18 - - [07/Sep/2026:05:50:53 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.95.14.18 - - [07/Sep/2026:05:50:53 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.95.14.18 - - [07/Sep/2026:05:50:53 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.95.14.18 - - [07/Sep/2026:05:50:54 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.95.14.18 - - [07/Sep/2026:05:50:54 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.95.14.18 - - [07/Sep/2026:05:50:54 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.95.14.18 - - [07/Sep/2026:05:50:54 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.95.14.18 - - [07/Sep/2026:05:50:55 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /api/getItem/SHSG252516-8 2 GET /api/getItem/SHSG252516-6.5 2 GET /api/getItem/RHSG15050308 2 GET /api/getItem/RHSG15050208 2 GET /api/getItem/RHSG150100408 2 GET /api/getItem/RHSG12575408 2 GET /api/getItem/RHSG12575308 2 GET /api/getItem/RHSG1257530 2 GET /api/getItem/RHSG10050208 2 GET /api/getItem/19R-8000 2 GET /api/getItem/19R-7320 1 GET /api/getItem/SHSG10010030-8 -- last 10 requests -- 40.115.94.245 - - [07/Sep/2026:05:51:13 +1000] "GET /api/getItem/RHSG502520-8 HTTP/1.1" 200 1452 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:05:51:13 +1000] "GET /api/getItem/RHSG65161255 HTTP/1.1" 200 1358 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:05:51:14 +1000] "GET /api/getItem/RHSG7550208 HTTP/1.1" 200 1709 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:05:51:14 +1000] "GET /api/getItem/RHSG7550258 HTTP/1.1" 200 1340 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:05:51:14 +1000] "GET /api/getItem/RHSG7550308 HTTP/1.1" 200 1340 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:05:51:15 +1000] "GET /api/getItem/SHSG10010020-8 HTTP/1.1" 200 1788 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:05:51:15 +1000] "GET /api/getItem/SHSG10010020-DP25-8 HTTP/1.1" 200 1541 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:05:51:16 +1000] "GET /api/getItem/SHSG10010020-SP25-8 HTTP/1.1" 200 1541 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:05:51:16 +1000] "GET /api/getItem/SHSG10010025-RDP25-8-DI HTTP/1.1" 200 1472 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:05:51:16 +1000] "GET /api/getItem/SHSG10010030-8 HTTP/1.1" 200 1988 "-" "RestSharp/106.13.0.0" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 17 GET /app/templates/ajax.php 16 POST /functions.php 11 GET /app/ajax.php 9 GET /index.php 3 POST /plugins/csvexporter/plugin.php 2 POST /clienteditsave.php 1 POST /plugins/fencecosting/plugin.php 1 POST /logsave.php 1 POST /app/ajax.php 1 GET /modalload.php -- last 10 requests -- 103.104.165.99 - - [07/Sep/2026:05:52:08 +1000] "POST /clienteditsave.php?clientid=3565&call=getCategoryDiscounts HTTP/1.1" 200 256 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12061" "Mozilla/5.0 (Windows N 103.104.165.99 - - [07/Sep/2026:05:52:08 +1000] "POST /plugins/fencecosting/plugin.php HTTP/1.1" 200 3913 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12061" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 103.104.165.99 - - [07/Sep/2026:05:52:08 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=13138405762 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 103.104.165.99 - - [07/Sep/2026:05:52:08 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=12311523849 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 103.104.165.99 - - [07/Sep/2026:05:52:08 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Djobedit%26id%3D12061&call=getUserSetting&caller=ajaxSubmitLocal&seq=18356506552 HTTP/1.1" 200 112 "https://my. 103.104.165.99 - - [07/Sep/2026:05:52:08 +1000] "GET /app/ajax.php?cn=&furi=true&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=19653528908 HTTP/1.1" 200 202 "https://my.evolutionerp.com.au/index.php?page=jobedit&id 103.104.165.99 - - [07/Sep/2026:05:52:08 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobedit%26id%3D12061&call=getUserSetting&caller=ajaxSubmitLocal&seq=10941054950 HTTP/1.1" 200 160 "https://my.evolutionerp.com.a 103.104.165.99 - - [07/Sep/2026:05:52:08 +1000] "GET /app/ajax.php?cn=tsExportSettingstimesheet&furi=false&uri=%2F&call=getUserSetting&caller=ajaxSubmitLocal&seq=15462344624 HTTP/1.1" 200 101 "https://my.evolutionerp.com 203.54.180.238 - - [07/Sep/2026:05:52:09 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=dispatchedit&dispatchid=34110" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Geck 103.104.165.99 - - [07/Sep/2026:05:52:09 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 3608 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12061" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK --- last 30 samples (run-up to this incident) --- 2026-09-07 05:50:02 L1=1.57 run=4 blk=1 avail=9677 (70.2%) swpO=0 conn=1 myRSS=1587 php=6 phpRSS=299 ap=17 tcp=31 topuser=madalice 2026-09-07 05:50:02 L1=1.57 run=2 blk=1 avail=9705 (70.4%) swpO=0 conn=1 myRSS=1587 php=6 phpRSS=299 ap=17 tcp=31 topuser=madalice 2026-09-07 05:50:12 L1=1.56 run=1 blk=1 avail=9750 (70.8%) swpO=0 conn=1 myRSS=1587 php=6 phpRSS=299 ap=14 tcp=27 topuser=madalice 2026-09-07 05:50:12 L1=1.56 run=2 blk=1 avail=9750 (70.8%) swpO=0 conn=1 myRSS=1587 php=6 phpRSS=299 ap=14 tcp=27 topuser=madalice 2026-09-07 05:50:22 L1=1.47 run=2 blk=1 avail=9878 (71.7%) swpO=0 conn=1 myRSS=1587 php=5 phpRSS=145 ap=14 tcp=34 topuser=madalice 2026-09-07 05:50:22 L1=1.47 run=1 blk=1 avail=9970 (72.4%) swpO=0 conn=1 myRSS=1587 php=4 phpRSS=23 ap=15 tcp=35 topuser=root 2026-09-07 05:50:32 L1=1.40 run=1 blk=1 avail=9720 (70.5%) swpO=0 conn=1 myRSS=1587 php=6 phpRSS=299 ap=17 tcp=30 topuser=madalice 2026-09-07 05:50:32 L1=1.40 run=1 blk=1 avail=9720 (70.6%) swpO=0 conn=1 myRSS=1587 php=6 phpRSS=299 ap=17 tcp=30 topuser=madalice 2026-09-07 05:50:42 L1=1.34 run=1 blk=1 avail=9748 (70.8%) swpO=0 conn=1 myRSS=1587 php=6 phpRSS=299 ap=13 tcp=30 topuser=madalice 2026-09-07 05:50:42 L1=1.34 run=3 blk=1 avail=9749 (70.8%) swpO=0 conn=1 myRSS=1587 php=6 phpRSS=299 ap=13 tcp=29 topuser=madalice 2026-09-07 05:50:52 L1=1.28 run=1 blk=1 avail=9852 (71.5%) swpO=0 conn=1 myRSS=1587 php=5 phpRSS=176 ap=13 tcp=31 topuser=madalice 2026-09-07 05:50:52 L1=1.28 run=1 blk=1 avail=9853 (71.5%) swpO=0 conn=1 myRSS=1587 php=5 phpRSS=176 ap=13 tcp=31 topuser=madalice 2026-09-07 05:51:02 L1=1.24 run=1 blk=1 avail=9842 (71.4%) swpO=0 conn=1 myRSS=1587 php=5 phpRSS=176 ap=16 tcp=32 topuser=madalice 2026-09-07 05:51:02 L1=1.24 run=1 blk=1 avail=9841 (71.4%) swpO=0 conn=1 myRSS=1587 php=6 phpRSS=205 ap=16 tcp=32 topuser=madalice 2026-09-07 05:51:12 L1=1.28 run=1 blk=1 avail=9845 (71.5%) swpO=89 conn=1 myRSS=1584 php=5 phpRSS=177 ap=17 tcp=28 topuser=madalice 2026-09-07 05:51:13 L1=1.28 run=2 blk=1 avail=9845 (71.5%) swpO=81 conn=1 myRSS=1584 php=5 phpRSS=177 ap=17 tcp=29 topuser=madalice 2026-09-07 05:51:22 L1=1.24 run=1 blk=1 avail=9853 (71.5%) swpO=0 conn=1 myRSS=1585 php=5 phpRSS=177 ap=16 tcp=27 topuser=madalice 2026-09-07 05:51:23 L1=1.24 run=1 blk=1 avail=9851 (71.5%) swpO=0 conn=1 myRSS=1585 php=5 phpRSS=177 ap=16 tcp=27 topuser=madalice 2026-09-07 05:51:32 L1=1.20 run=1 blk=1 avail=10000(72.6%) swpO=1 conn=1 myRSS=1585 php=4 phpRSS=23 ap=15 tcp=29 topuser=root 2026-09-07 05:51:33 L1=1.20 run=1 blk=1 avail=9998 (72.6%) swpO=1 conn=1 myRSS=1585 php=4 phpRSS=23 ap=15 tcp=29 topuser=root 2026-09-07 05:51:42 L1=1.17 run=1 blk=1 avail=10005(72.6%) swpO=0 conn=1 myRSS=1585 php=4 phpRSS=23 ap=14 tcp=28 topuser=root 2026-09-07 05:51:43 L1=1.17 run=1 blk=1 avail=10004(72.6%) swpO=0 conn=1 myRSS=1585 php=4 phpRSS=23 ap=14 tcp=29 topuser=root 2026-09-07 05:51:52 L1=1.14 run=1 blk=1 avail=10004(72.6%) swpO=0 conn=1 myRSS=1585 php=4 phpRSS=23 ap=14 tcp=28 topuser=root 2026-09-07 05:51:53 L1=1.14 run=2 blk=1 avail=9996 (72.6%) swpO=0 conn=1 myRSS=1585 php=5 phpRSS=23 ap=14 tcp=29 topuser=root 2026-09-07 05:52:02 L1=1.12 run=2 blk=1 avail=9819 (71.3%) swpO=0 conn=1 myRSS=1585 php=5 phpRSS=231 ap=14 tcp=30 topuser=corpkicks 2026-09-07 05:52:03 L1=1.12 run=2 blk=1 avail=9749 (70.8%) swpO=0 conn=3 myRSS=1585 php=6 phpRSS=327 ap=14 tcp=32 topuser=corpkicks 2026-09-07 05:52:12 L1=1.50 run=2 blk=2 avail=9684 (70.3%) swpO=239 conn=1 myRSS=1590 php=6 phpRSS=314 ap=24 tcp=45 topuser=corpkicks 2026-09-07 05:52:13 L1=1.50 run=7 blk=1 avail=9822 (71.3%) swpO=239 conn=3 myRSS=1596 php=8 phpRSS=228 ap=24 tcp=57 topuser=corpkicks 2026-09-07 05:52:22 L1=3.42 run=10 blk=1 avail=8730 (63.4%) swpO=765 conn=11 myRSS=1678 php=18 phpRSS=1349 ap=47 tcp=51 topuser=corpkicks 2026-09-07 05:52:23 L1=3.42 run=15 blk=1 avail=8101 (58.8%) swpO=765 conn=13 myRSS=1678 php=19 phpRSS=1861 ap=47 tcp=51 topuser=corpkicks