INCIDENT 2026-09-07 15:40:44 trigger: php_rss=2177MB ================================================================== load: 2.48 2.53 2.33 5/707 3828038 ncpu:10 mem_avail: 7244MB/13777MB (52.6%) swap_used:2712MB swapout:719/s blocked(D):1 running:6 iowait:8.8% steal:0.0% php: 15 procs / 2177MB heaviest user: corpkicks (9 procs, 1969MB) apache: 49 procs tcp_estab: 101 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2255 corpkicks 9 2009 root 249 937 nobody 48 817 netdata 8 255 madalice 1 154 cpanellogin 1 116 mailman 20 98 dovenull 6 66 wp-toolkit 3 56 kurri 2 28 dovecot 3 28 alison 1 14 aaa 1 14 zabbix 1 10 mailnull 1 10 evolution 11 9 named 1 7 polkitd 1 6 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB corpkicks 9 2018 madalice 1 154 root 1 22 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6482 MB Active(file): 3516 MB Inactive(file): 3116 MB Dirty: 2 MB Writeback: 0 MB SReclaimable: 572 MB CommitLimit: 10984 MB Committed_AS: 10277 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 6-13:18:19 4840 /usr/bin/imunify-agent-proxy 4109079 root 2-10:55:57 1956 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-10:55:57 83292 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 2309316 8.1 Ssl 1-20:04:14 /usr/sbin/mariadbd 3827718 3827629 corpkicks 290304 8.4 S 00:19 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3827760 3812052 corpkicks 288528 9.1 S 00:16 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3827799 3812054 corpkicks 285784 11.9 S 00:13 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3827925 3812023 corpkicks 282460 19.7 S 00:07 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3827863 3827626 corpkicks 281960 14.7 S 00:10 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3827964 3827952 corpkicks 279956 36.5 S 00:04 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3828000 3811311 corpkicks 256232 117 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 166870 1 netdata 196572 2.6 Ssl 1-13:18:25 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3368408 904997 root 160468 0.0 S 02:00:53 spamd child 3811953 167896 madalice 158688 7.7 S 01:45 php-fpm: pool madalice_com_au 923653 904997 root 152836 0.0 S 13:11:00 spamd child 3752943 1353308 cpanellogin 119776 0.1 S 20:20 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 904997 1 root 114976 0.0 Ss 13:17:48 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4109105 4109079 root 83292 1.3 Sl 2-10:55:57 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 3828006 3827615 corpkicks 73700 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3828017 3827614 corpkicks 61920 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1353308 1 root 41868 0.1 Ss 47-12:59:31 cpsrvd (SSL) - waiting for connections 1469 1 root 41588 0.1 Ss 70-05:31:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 509236 509098 root 34912 0.0 Sl 10-13:21:05 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 167562 166914 netdata 34644 0.1 Sl 1-13:18:20 /usr/libexec/netdata/plugins.d/go.d.plugin 1 167871 1 root 32040 0.0 Ss 1-13:18:18 /usr/lib/systemd/systemd-journald 166645 1 wp-toolkit 31760 0.0 Ss 1-13:18:29 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 904447 1 root 29904 0.0 Ss 13:18:20 lfd - sleeping 1463 1 root 23780 0.0 Ss 70-05:31:00 tailwatchd 167896 1 root 23300 0.0 Ss 1-13:18:17 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 3812018 506832 nobody 22988 0.5 S 01:43 /usr/sbin/httpd -k start 3810505 506832 nobody 22352 0.1 S 03:34 /usr/sbin/httpd -k start 3811964 506832 nobody 22116 0.2 S 01:44 /usr/sbin/httpd -k start 3812052 506832 nobody 21988 0.1 S 01:42 /usr/sbin/httpd -k start 3811311 506832 nobody 21440 0.1 S 02:32 /usr/sbin/httpd -k start 3811966 506832 nobody 21172 0.0 S 01:44 /usr/sbin/httpd -k start 3812021 506832 nobody 20884 0.0 S 01:43 /usr/sbin/httpd -k start 3812023 506832 nobody 20640 0.0 S 01:43 /usr/sbin/httpd -k start 3827625 506832 nobody 20460 0.2 S 00:21 /usr/sbin/httpd -k start 3811313 506832 nobody 20084 0.0 S 02:32 /usr/sbin/httpd -k start 3812043 506832 nobody 19900 0.0 S 01:42 /usr/sbin/httpd -k start 3811534 506832 nobody 19876 0.0 S 02:21 /usr/sbin/httpd -k start 3812051 506832 nobody 19648 0.0 S 01:42 /usr/sbin/httpd -k start 3808264 506832 nobody 19600 0.0 S 05:32 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19556 0.0 Ss 1-13:18:18 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 3827614 506832 nobody 19084 0.2 S 00:22 /usr/sbin/httpd -k start 3827573 506832 nobody 19040 0.0 S 00:27 /usr/sbin/httpd -k start 3811496 506832 nobody 19000 0.0 S 02:22 /usr/sbin/httpd -k start 3827615 506832 nobody 18952 0.0 S 00:22 /usr/sbin/httpd -k start 3827630 506832 nobody 18940 0.0 S 00:21 /usr/sbin/httpd -k start 3811965 506832 nobody 18820 0.0 S 01:44 /usr/sbin/httpd -k start 3827495 506832 nobody 18736 0.3 S 00:31 /usr/sbin/httpd -k start 3827483 506832 nobody 18504 0.0 S 00:32 /usr/sbin/httpd -k start 167566 166914 netdata 18140 2.2 Sl 1-13:18:20 /usr/libexec/netdata/plugins.d/apps.plugin 1 3810801 506832 nobody 18092 0.0 S 03:12 /usr/sbin/httpd -k start 3827594 506832 nobody 18080 0.0 S 00:24 /usr/sbin/httpd -k start 3812054 506832 nobody 17344 0.0 S 01:42 /usr/sbin/httpd -k start 3812050 506832 nobody 17312 0.0 S 01:42 /usr/sbin/httpd -k start 3827574 506832 nobody 17000 0.0 S 00:27 /usr/sbin/httpd -k start 3812819 506832 nobody 16928 0.0 S 01:08 /usr/sbin/httpd -k start 3827626 506832 nobody 16780 0.0 S 00:21 /usr/sbin/httpd -k start 3827601 506832 nobody 16600 0.0 S 00:23 /usr/sbin/httpd -k start 3827602 506832 nobody 16512 0.0 S 00:23 /usr/sbin/httpd -k start 3827628 506832 nobody 16504 0.0 S 00:21 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4556033 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 4556002 | corpkicks_wp_iwddf | corpkicks_wp_baolr | Query | 0 | Writing to net | SELECT option_value FROM MPHOrV_options WHERE option_name = 'yaymail_next_recommendation_suggest_addons_notice_time' LIMIT 1 | +---------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 594 customkidscom/customkids.com.au-ssl_log 193 evolution/app.evolutionerp.com.au-ssl_log 126 corpkicks/corporatekicks.com.au-ssl_log 81 evolution/portal.evolutionerp.com.au-ssl_log 55 madalice/madalice.com.au-ssl_log 8 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 357 203.54.180.238 126 40.115.94.245 94 115.128.106.35 78 158.69.55.82 75 158.69.117.45 75 116.91.221.245 71 1.144.107.82 58 1.145.70.156 39 158.69.55.148 30 182.239.240.254 13 103.104.164.114 9 118.127.40.55 5 203.166.236.147 5 101.166.96.210 3 147.161.213.78 --- top request paths across all vhosts (last 3 min) --- 212 POST /functions.php 193 GET / 129 GET /app/ajax.php 85 GET /api/getItem/LWHG2001KG 55 GET /heartbeat.php 48 GET /index.php 36 POST /plugins/csvexporter/plugin.php 35 POST /quoteditsave.php 25 POST /app/ajax.php 24 POST /wp-admin/admin-ajax.php 21 POST /app/ajax/selectFilterSingle.php 21 POST /app/ajax/selectFilter.php 11 POST /clienteditsave.php 10 POST /itemModify.php 10 POST /inveditsave.php 7 POST /wp-admin/async-upload.php 6 POST /plugins/fencecosting/plugin.php 6 POST /opportunityeditsave.php 5 POST /wp-cron.php 5 GET /resetpass --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 212 POST /functions.php 129 GET /app/ajax.php 48 GET /index.php 36 POST /plugins/csvexporter/plugin.php 35 POST /quoteditsave.php 25 POST /app/ajax.php 21 POST /app/ajax/selectFilterSingle.php 21 POST /app/ajax/selectFilter.php 11 POST /clienteditsave.php 10 POST /itemModify.php 10 POST /inveditsave.php 6 POST /plugins/fencecosting/plugin.php -- last 10 requests -- 116.91.221.245 - - [07/Sep/2026:15:40:40 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=2461" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 116.91.221.245 - - [07/Sep/2026:15:40:40 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 116.91.221.245 - - [07/Sep/2026:15:40:41 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=invedit&id=2461&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 203.54.180.238 - - [07/Sep/2026:15:40:40 +1000] "GET /index.php?page=quotedit"eid=79196§ionid=0 HTTP/1.1" 200 184998 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79196§ionid=0" "Mozilla/5.0 203.54.180.238 - - [07/Sep/2026:15:40:43 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79196§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win 203.54.180.238 - - [07/Sep/2026:15:40:43 +1000] "GET /plugins/fensa/fensa-ajax.php?function_name=load_fensa_modal HTTP/1.1" 200 357 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79196§ionid=0" "Mozi 203.54.180.238 - - [07/Sep/2026:15:40:43 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dquotedit%26quoteid%3D79196%26sectionid%3D0&call=getUserSetting&caller=ajaxSubmitLocal&seq=19106004770 HTTP/1.1 203.54.180.238 - - [07/Sep/2026:15:40:43 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=15928743844 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 203.54.180.238 - - [07/Sep/2026:15:40:43 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=18253152504 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 203.54.180.238 - - [07/Sep/2026:15:40:43 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotedit%26quoteid79196&call=getUserSetting&caller=ajaxSubmitLocal&seq=16381826725 HTTP/1.1" 200 100 "https://my.evolutionerp.co == customkidscom/customkids.com.au-ssl_log == -- top paths -- 188 GET / 5 GET /resetpass -- last 10 requests -- 158.69.117.45 - - [07/Sep/2026:15:39:37 +1000] "GET /?locale=zh HTTP/1.1" 200 12809 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.117.45 - - [07/Sep/2026:15:39:37 +1000] "GET /?locale=zh_tw HTTP/1.1" 200 12871 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.117.45 - - [07/Sep/2026:15:39:37 +1000] "GET /?locale=th HTTP/1.1" 200 12872 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.117.45 - - [07/Sep/2026:15:39:37 +1000] "GET /?locale=sv HTTP/1.1" 200 12605 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.117.45 - - [07/Sep/2026:15:39:37 +1000] "GET /resetpass?start=1 HTTP/1.1" 200 1188 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.117.45 - - [07/Sep/2026:15:39:37 +1000] "GET /?locale=tr HTTP/1.1" 200 12717 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.117.45 - - [07/Sep/2026:15:39:37 +1000] "GET /?locale=uk HTTP/1.1" 200 12891 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.117.45 - - [07/Sep/2026:15:39:37 +1000] "GET /resetpass?start=1 HTTP/1.1" 200 1188 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.117.45 - - [07/Sep/2026:15:39:37 +1000] "GET /?locale=vi HTTP/1.1" 200 12696 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 158.69.117.45 - - [07/Sep/2026:15:39:37 +1000] "GET /?locale=zh HTTP/1.1" 200 12816 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 85 GET /api/getItem/LWHG2001KG 4 GET /api/getItem/PWFBW3151KG 1 GET /api/getItem/CLSGNSTD45250KK 1 GET /api/getItem/CLSGNSTD40250KK 1 GET /api/getItem/CLSGNSTD32350KK 1 GET /api/getItem/CLPGNSTD50315KK 1 GET /api/getItem/CLPGNSTD50250KK 1 GET /api/getItem/CLPGNSTD45315KK 1 GET /api/getItem/CLPGNSTD45250KK 1 GET /api/getItem/CLPGNSTD40315KK 1 GET /api/getItem/CLPGNSTD40250KK 1 GET /api/getItem/CLPGNSTD32315KK -- last 10 requests -- 40.115.94.245 - - [07/Sep/2026:15:40:30 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:15:40:31 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:15:40:31 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:15:40:32 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:15:40:32 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:15:40:32 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:15:40:33 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:15:40:33 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:15:40:33 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [07/Sep/2026:15:40:34 +1000] "GET /api/getItem/LWHG2001KG HTTP/1.1" 200 1363 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-07 15:38:14 L1=2.39 run=3 blk=1 avail=8387 (60.9%) swpO=0 conn=1 myRSS=2271 php=8 phpRSS=828 ap=45 tcp=42 topuser=corpkicks 2026-09-07 15:38:24 L1=2.25 run=2 blk=1 avail=8869 (64.4%) swpO=229 conn=4 myRSS=2269 php=6 phpRSS=199 ap=57 tcp=37 topuser=madalice 2026-09-07 15:38:24 L1=2.25 run=2 blk=1 avail=8850 (64.2%) swpO=229 conn=1 myRSS=2269 php=7 phpRSS=251 ap=57 tcp=36 topuser=madalice 2026-09-07 15:38:34 L1=2.13 run=4 blk=1 avail=8944 (64.9%) swpO=0 conn=4 myRSS=2269 php=5 phpRSS=158 ap=48 tcp=43 topuser=madalice 2026-09-07 15:38:34 L1=2.13 run=1 blk=1 avail=8949 (65.0%) swpO=0 conn=1 myRSS=2269 php=5 phpRSS=158 ap=47 tcp=42 topuser=madalice 2026-09-07 15:38:44 L1=2.03 run=1 blk=1 avail=9021 (65.5%) swpO=0 conn=4 myRSS=2269 php=5 phpRSS=154 ap=38 tcp=36 topuser=madalice 2026-09-07 15:38:45 L1=2.03 run=1 blk=1 avail=9027 (65.5%) swpO=0 conn=1 myRSS=2269 php=5 phpRSS=154 ap=37 tcp=34 topuser=madalice 2026-09-07 15:38:54 L1=2.03 run=2 blk=1 avail=8869 (64.4%) swpO=0 conn=4 myRSS=2269 php=6 phpRSS=390 ap=30 tcp=38 topuser=corpkicks 2026-09-07 15:38:55 L1=2.03 run=2 blk=2 avail=8858 (64.3%) swpO=0 conn=1 myRSS=2269 php=7 phpRSS=412 ap=30 tcp=36 topuser=corpkicks 2026-09-07 15:39:04 L1=2.78 run=5 blk=2 avail=8272 (60.0%) swpO=0 conn=4 myRSS=2269 php=9 phpRSS=727 ap=61 tcp=61 topuser=madalice 2026-09-07 15:39:05 L1=2.78 run=4 blk=1 avail=8219 (59.7%) swpO=0 conn=1 myRSS=2269 php=8 phpRSS=691 ap=60 tcp=55 topuser=madalice 2026-09-07 15:39:14 L1=3.54 run=4 blk=1 avail=7885 (57.2%) swpO=234 conn=6 myRSS=2266 php=11 phpRSS=1320 ap=54 tcp=61 topuser=corpkicks 2026-09-07 15:39:15 L1=3.54 run=7 blk=1 avail=8105 (58.8%) swpO=234 conn=1 myRSS=2266 php=13 phpRSS=1173 ap=54 tcp=55 topuser=corpkicks 2026-09-07 15:39:24 L1=3.52 run=1 blk=1 avail=8888 (64.5%) swpO=0 conn=6 myRSS=2266 php=6 phpRSS=199 ap=50 tcp=53 topuser=madalice 2026-09-07 15:39:25 L1=3.52 run=2 blk=1 avail=8881 (64.5%) swpO=0 conn=1 myRSS=2266 php=6 phpRSS=226 ap=50 tcp=52 topuser=madalice 2026-09-07 15:39:34 L1=3.21 run=1 blk=1 avail=8964 (65.1%) swpO=0 conn=6 myRSS=2267 php=5 phpRSS=177 ap=42 tcp=44 topuser=madalice 2026-09-07 15:39:35 L1=3.21 run=2 blk=1 avail=8955 (65.0%) swpO=0 conn=1 myRSS=2267 php=5 phpRSS=177 ap=41 tcp=47 topuser=madalice 2026-09-07 15:39:44 L1=2.95 run=1 blk=1 avail=8976 (65.2%) swpO=0 conn=6 myRSS=2268 php=5 phpRSS=178 ap=39 tcp=41 topuser=madalice 2026-09-07 15:39:45 L1=2.95 run=2 blk=1 avail=8888 (64.5%) swpO=0 conn=1 myRSS=2268 php=6 phpRSS=299 ap=38 tcp=44 topuser=madalice 2026-09-07 15:39:54 L1=2.80 run=1 blk=1 avail=9028 (65.5%) swpO=0 conn=6 myRSS=2268 php=5 phpRSS=178 ap=33 tcp=38 topuser=madalice 2026-09-07 15:39:55 L1=2.80 run=2 blk=1 avail=9040 (65.6%) swpO=0 conn=1 myRSS=2268 php=5 phpRSS=178 ap=32 tcp=36 topuser=madalice 2026-09-07 15:40:04 L1=2.83 run=2 blk=1 avail=9048 (65.7%) swpO=0 conn=6 myRSS=2268 php=5 phpRSS=177 ap=30 tcp=39 topuser=madalice 2026-09-07 15:40:05 L1=2.83 run=4 blk=1 avail=9049 (65.7%) swpO=0 conn=1 myRSS=2268 php=6 phpRSS=192 ap=30 tcp=37 topuser=madalice 2026-09-07 15:40:14 L1=2.62 run=1 blk=1 avail=9035 (65.6%) swpO=0 conn=1 myRSS=2268 php=5 phpRSS=177 ap=32 tcp=37 topuser=madalice 2026-09-07 15:40:15 L1=2.62 run=2 blk=1 avail=8915 (64.7%) swpO=0 conn=1 myRSS=2268 php=6 phpRSS=327 ap=32 tcp=38 topuser=madalice 2026-09-07 15:40:24 L1=2.37 run=9 blk=1 avail=8673 (63.0%) swpO=0 conn=1 myRSS=2268 php=9 phpRSS=498 ap=50 tcp=57 topuser=corpkicks 2026-09-07 15:40:25 L1=2.37 run=7 blk=1 avail=8453 (61.4%) swpO=0 conn=1 myRSS=2268 php=9 phpRSS=768 ap=50 tcp=56 topuser=corpkicks 2026-09-07 15:40:34 L1=2.48 run=2 blk=1 avail=7951 (57.7%) swpO=0 conn=1 myRSS=2269 php=9 phpRSS=1270 ap=47 tcp=76 topuser=corpkicks 2026-09-07 15:40:35 L1=2.48 run=3 blk=1 avail=7829 (56.8%) swpO=0 conn=6 myRSS=2269 php=10 phpRSS=1416 ap=46 tcp=79 topuser=corpkicks 2026-09-07 15:40:44 L1=2.48 run=6 blk=1 avail=7244 (52.6%) swpO=719 conn=9 myRSS=2255 php=15 phpRSS=2177 ap=49 tcp=101 topuser=corpkicks