INCIDENT 2026-09-08 07:14:09 trigger: php_rss=1895MB ================================================================== load: 2.09 1.80 1.98 8/703 2842711 ncpu:10 mem_avail: 8464MB/13777MB (61.4%) swap_used:1802MB swapout:170/s blocked(D):2 running:8 iowait:5.3% steal:0.0% php: 14 procs / 1895MB heaviest user: madalice (10 procs, 1810MB) apache: 97 procs tcp_estab: 107 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 10 1697 nobody 96 1522 mysql 1 1287 root 247 641 netdata 8 239 speedlin 1 88 cpanellogin 1 69 aaa 4 47 kurri 4 44 mailman 20 36 dovenull 6 23 infinium 2 22 evolution 11 20 mailnull 3 18 wp-toolkit 3 15 zabbix 1 11 dovecot 3 9 named 1 4 lowrange 1 4 nscd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1687 speedlin 1 89 evolution 3 26 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 8154 MB Active(file): 5006 MB Inactive(file): 3283 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 328 MB CommitLimit: 10984 MB Committed_AS: 10776 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2824784 root 06:04 59764 /opt/imunify360/venv/bin/python3 -m imav.run 3926885 root 7-04:51:44 5712 /usr/bin/imunify-agent-proxy 4109079 root 3-02:29:22 0 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 3-02:29:22 97032 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 1318468 5.5 Ssl 02:28:41 /usr/sbin/mariadbd 2842595 167896 madalice 226808 51.0 R 00:07 php-fpm: pool madalice_com_au 2842471 167896 madalice 222004 45.8 R 00:11 php-fpm: pool madalice_com_au 166870 1 netdata 189424 2.8 Ssl 2-04:51:50 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2842473 167896 madalice 179044 43.1 R 00:11 php-fpm: pool madalice_com_au 2841304 167896 madalice 167568 8.8 R 02:09 php-fpm: pool madalice_com_au 2840921 167896 madalice 161432 9.5 S 02:58 php-fpm: pool madalice_com_au 2842476 167896 madalice 159572 46.9 S 00:11 php-fpm: pool madalice_com_au 2842533 167896 madalice 159540 38.9 S 00:10 php-fpm: pool madalice_com_au 2842474 167896 madalice 159508 48.8 S 00:11 php-fpm: pool madalice_com_au 2842472 167896 madalice 158424 47.8 S 00:11 php-fpm: pool madalice_com_au 2842478 167896 madalice 157600 46.0 S 00:11 php-fpm: pool madalice_com_au 1911708 1859745 root 154080 0.0 S 04:36:59 spamd child 2842655 2842588 speedlin 99112 66.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4109105 4109079 root 97032 1.1 Sl 3-02:29:22 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2684593 1353308 cpanellogin 70992 0.0 S 48:09 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 2824784 1 root 59764 0.4 Ssl 06:04 /opt/imunify360/venv/bin/python3 -m imav.run 2328754 1 root 49068 0.0 Ss 02:28:51 /usr/lib/systemd/systemd-journald 1353308 1 root 41872 0.0 Ss 48-04:32:56 cpsrvd (SSL) - waiting for connections 509236 509098 root 38188 0.0 Sl 11-04:54:30 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 167562 166914 netdata 34360 0.1 Sl 2-04:51:45 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1859745 1 root 26996 0.0 Ss 04:51:21 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2825841 506832 nobody 21668 0.0 S 04:15 /usr/sbin/httpd -k start 2825469 506832 nobody 20844 0.0 S 05:02 /usr/sbin/httpd -k start 2840641 506832 nobody 19892 0.0 S 03:25 /usr/sbin/httpd -k start 2842454 506832 nobody 19440 0.1 S 00:17 /usr/sbin/httpd -k start 2824717 506832 nobody 19312 0.0 S 06:09 /usr/sbin/httpd -k start 2840644 506832 nobody 19084 0.0 S 03:25 /usr/sbin/httpd -k start 2842588 506832 nobody 18980 0.1 S 00:07 /usr/sbin/httpd -k start 2842546 506832 nobody 18844 0.3 S 00:08 /usr/sbin/httpd -k start 2842455 506832 nobody 18660 0.1 S 00:17 /usr/sbin/httpd -k start 2825132 506832 nobody 18572 0.0 S 05:34 /usr/sbin/httpd -k start 2842593 506832 nobody 18436 0.1 S 00:07 /usr/sbin/httpd -k start 2841939 506832 nobody 18424 0.0 S 01:18 /usr/sbin/httpd -k start 2841176 506832 nobody 18412 0.0 S 02:22 /usr/sbin/httpd -k start 2841836 506832 nobody 18192 0.0 S 01:30 /usr/sbin/httpd -k start 2842456 506832 nobody 18188 0.0 S 00:17 /usr/sbin/httpd -k start 167566 166914 netdata 18108 2.2 Sl 2-04:51:45 /usr/libexec/netdata/plugins.d/apps.plugin 1 2841938 506832 nobody 18028 0.0 S 01:18 /usr/sbin/httpd -k start 2842448 506832 nobody 17992 0.1 S 00:18 /usr/sbin/httpd -k start 2842435 506832 nobody 17916 0.1 S 00:20 /usr/sbin/httpd -k start 2842549 506832 nobody 17856 0.1 S 00:08 /usr/sbin/httpd -k start 2842445 506832 nobody 17772 0.1 S 00:18 /usr/sbin/httpd -k start 2842589 506832 nobody 17748 0.2 S 00:07 /usr/sbin/httpd -k start 2842548 506832 nobody 17732 0.2 S 00:08 /usr/sbin/httpd -k start 2842550 506832 nobody 17712 0.1 S 00:08 /usr/sbin/httpd -k start 2842583 506832 nobody 17712 0.2 S 00:07 /usr/sbin/httpd -k start 2842545 506832 nobody 17708 0.2 S 00:08 /usr/sbin/httpd -k start 2842547 506832 nobody 17708 0.1 S 00:08 /usr/sbin/httpd -k start 2842625 506832 nobody 17708 0.1 S 00:06 /usr/sbin/httpd -k start 2842587 506832 nobody 17688 0.2 S 00:07 /usr/sbin/httpd -k start 2842544 506832 nobody 17680 0.1 S 00:08 /usr/sbin/httpd -k start 2842532 506832 nobody 17620 0.2 S 00:10 /usr/sbin/httpd -k start 2842607 506832 nobody 17580 0.1 S 00:06 /usr/sbin/httpd -k start 2842585 506832 nobody 17512 0.1 S 00:07 /usr/sbin/httpd -k start 2841940 506832 nobody 17480 0.0 S 01:18 /usr/sbin/httpd -k start 2841929 506832 nobody 17424 0.0 S 01:19 /usr/sbin/httpd -k start 2842584 506832 nobody 17420 0.1 S 00:07 /usr/sbin/httpd -k start 2841772 506832 nobody 17408 0.0 S 01:32 /usr/sbin/httpd -k start 2841838 506832 nobody 17404 0.0 S 01:30 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 2824784 Dsl - /opt/imunify360/venv/bin/python3 -m imav.run --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 155927 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 135 evolution/portal.evolutionerp.com.au-ssl_log 126 madalice/madalice.com.au-ssl_log 48 evolution/pdev.evolutionerp.com.au-ssl_log 33 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 152 203.54.180.238 44 103.104.165.99 38 101.182.108.127 33 34.39.213.32 23 91.199.118.49 20 34.63.119.187 9 103.104.164.114 5 180.181.236.49 4 182.239.240.254 2 64.233.173.196 2 157.55.39.193 2 116.91.221.245 1 64.233.173.198 1 64.233.173.197 1 52.167.144.193 --- top request paths across all vhosts (last 3 min) --- 53 POST /functions.php 40 GET /heartbeat.php 38 GET /factory_session_checker.php 19 GET /factory_session_processed_qty.php 19 GET /factory_session_joiner.php 17 GET /app/ajax.php 13 POST /quoteditsave.php 12 POST /app/ajax/selectFilter.php 11 POST /itemModify.php 9 GET /index.php 5 GET /store/custom-nike-af1-sunflower-kids/ 4 POST /plugins/csvexporter/plugin.php 4 POST /clienteditsave.php 3 POST /plugins/fencecosting/plugin.php 3 POST /app/ajax/selectFilterSingle.php 3 POST /app/ajax.php 3 GET /userlogin.php 2 POST /portal/register 2 POST /logsave.php 2 POST //functions.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 53 POST /functions.php 17 GET /app/ajax.php 13 POST /quoteditsave.php 12 POST /app/ajax/selectFilter.php 11 POST /itemModify.php 6 GET /index.php 4 POST /plugins/csvexporter/plugin.php 4 POST /clienteditsave.php 3 POST /plugins/fencecosting/plugin.php 3 POST /app/ajax/selectFilterSingle.php 3 POST /app/ajax.php 2 POST /logsave.php -- last 10 requests -- 180.181.236.49 - - [08/Sep/2026:07:13:53 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 233 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=6953" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 116.91.221.245 - - [08/Sep/2026:07:13:54 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 280 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=70&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 101.182.108.127 - - [08/Sep/2026:07:13:57 +1000] "POST /quoteditsave.php?call=addLineItem HTTP/1.1" 200 320 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79201" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 203.54.180.238 - - [08/Sep/2026:07:13:57 +1000] "GET / HTTP/1.1" 200 5367 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0" 203.54.180.238 - - [08/Sep/2026:07:13:58 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=mfshoporderdetail&id=43826" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 101.182.108.127 - - [08/Sep/2026:07:14:00 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=H502 HTTP/1.1" 200 4150 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79201" "Mozilla/5.0 (Windows 203.54.180.238 - - [08/Sep/2026:07:14:00 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29673&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 101.182.108.127 - - [08/Sep/2026:07:14:01 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=H5025P HTTP/1.1" 200 2186 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79201" "Mozilla/5.0 (Windo 101.182.108.127 - - [08/Sep/2026:07:14:03 +1000] "POST /quoteditsave.php?itemid=4724&call=getSupplier&baseprice=9.5048 HTTP/1.1" 200 329 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79201" "Mozilla/5.0 101.182.108.127 - - [08/Sep/2026:07:14:03 +1000] "POST /itemModify.php?call=getInvMFMeta&modifyid=4724 HTTP/1.1" 200 221 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79201" "Mozilla/5.0 (Windows NT 10. == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 40 GET /heartbeat.php 38 GET /factory_session_checker.php 19 GET /factory_session_processed_qty.php 19 GET /factory_session_joiner.php 3 GET /userlogin.php 3 GET /index.php 2 POST /portal/register 2 POST /factory_functions.php -- last 10 requests -- 203.54.180.238 - - [08/Sep/2026:07:13:52 +1000] "GET /heartbeat.php?sentAt=1788815632&bytes=106,159,41,16&_=1788815251900 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=4" 203.54.180.238 - - [08/Sep/2026:07:13:54 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:07:13:58 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:07:13:59 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [08/Sep/2026:07:13:59 +1000] "GET /factory_session_joiner.php?id=35183 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [08/Sep/2026:07:13:59 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:07:14:00 +1000] "GET /heartbeat.php?sentAt=1788815639&bytes=106,159,41,23&_=1788786030041 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [08/Sep/2026:07:14:03 +1000] "GET /factory_session_joiner.php?id=35169 HTTP/1.1" 200 86 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [08/Sep/2026:07:14:03 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 127 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [08/Sep/2026:07:14:03 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == madalice/madalice.com.au-ssl_log == -- top paths -- 5 GET /store/custom-nike-af1-sunflower-kids/ 2 GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au 2 GET /secrets.yml 2 GET /rclone.conf 2 GET /.env.old 2 GET /.env.bak 1 POST /graphql 1 GET /wp-content/plugins/woocommerce/src/wp-content/plugins/woocommerce/ 1 GET /wp-content/plugins/woocommerce/src//wp-content/plugins/woocommerce/ 1 GET /wp-content/plugins/woocommerce/src/Internal/RestApiControllerBase.php 1 GET /wp-content/plugins/woocommerce/src/Internal/OrderCouponDataMigrator.php 1 GET /wp-content/plugins/woocommerce/src/Internal/McStats.php -- last 10 requests -- 34.63.119.187 - - [08/Sep/2026:07:13:59 +1000] "GET /.env.bak HTTP/1.1" 301 1 "-" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)" 34.63.119.187 - - [08/Sep/2026:07:14:01 +1000] "GET /backend/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)" 34.63.119.187 - - [08/Sep/2026:07:14:02 +1000] "GET /config/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)" 34.63.119.187 - - [08/Sep/2026:07:14:01 +1000] "GET /z9x8c7v6b5-debug-trigger-www.madalice.com.au HTTP/1.1" 404 36695 "https://www.madalice.com.au/z9x8c7v6b5-debug-trigger-www.madalice.com.au" "DuckAssistBot/1.1 (https:/ 34.63.119.187 - - [08/Sep/2026:07:14:01 +1000] "GET /rclone.conf HTTP/1.1" 404 36671 "https://www.madalice.com.au/rclone.conf" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claudebot@a 34.63.119.187 - - [08/Sep/2026:07:14:02 +1000] "GET /.env.bak HTTP/1.1" 404 36672 "https://www.madalice.com.au/.env.bak" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)" 34.63.119.187 - - [08/Sep/2026:07:14:02 +1000] "GET /.env.old HTTP/1.1" 404 36672 "https://www.madalice.com.au/.env.old" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)" 34.63.119.187 - - [08/Sep/2026:07:14:03 +1000] "GET /secrets.yml HTTP/1.1" 301 1 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claudebot@anthropic.com)" 34.63.119.187 - - [08/Sep/2026:07:14:05 +1000] "POST /graphql HTTP/1.1" 404 36623 "https://www.madalice.com.au" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/53 34.63.119.187 - - [08/Sep/2026:07:14:05 +1000] "GET /secrets.yml HTTP/1.1" 404 36672 "https://www.madalice.com.au/secrets.yml" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claudebot@a --- last 30 samples (run-up to this incident) --- 2026-09-08 07:11:48 L1=1.43 run=2 blk=1 avail=10462(75.9%) swpO=0 conn=1 myRSS=1282 php=4 phpRSS=157 ap=24 tcp=40 topuser=madalice 2026-09-08 07:11:48 L1=1.43 run=2 blk=1 avail=10462(75.9%) swpO=0 conn=1 myRSS=1282 php=4 phpRSS=157 ap=24 tcp=40 topuser=madalice 2026-09-08 07:11:58 L1=1.36 run=2 blk=1 avail=10448(75.8%) swpO=0 conn=1 myRSS=1282 php=5 phpRSS=188 ap=25 tcp=35 topuser=evolution 2026-09-08 07:11:58 L1=1.36 run=4 blk=1 avail=10449(75.8%) swpO=0 conn=1 myRSS=1282 php=5 phpRSS=192 ap=25 tcp=35 topuser=evolution 2026-09-08 07:12:08 L1=1.46 run=3 blk=1 avail=10356(75.2%) swpO=0 conn=3 myRSS=1282 php=7 phpRSS=303 ap=27 tcp=38 topuser=madalice 2026-09-08 07:12:08 L1=1.46 run=4 blk=1 avail=10350(75.1%) swpO=0 conn=1 myRSS=1282 php=7 phpRSS=311 ap=27 tcp=38 topuser=madalice 2026-09-08 07:12:18 L1=1.39 run=2 blk=1 avail=10366(75.2%) swpO=0 conn=3 myRSS=1282 php=5 phpRSS=243 ap=27 tcp=38 topuser=madalice 2026-09-08 07:12:18 L1=1.39 run=3 blk=1 avail=10363(75.2%) swpO=0 conn=1 myRSS=1282 php=5 phpRSS=244 ap=27 tcp=38 topuser=madalice 2026-09-08 07:12:28 L1=1.49 run=2 blk=1 avail=10337(75.0%) swpO=0 conn=3 myRSS=1282 php=6 phpRSS=295 ap=25 tcp=40 topuser=madalice 2026-09-08 07:12:28 L1=1.49 run=4 blk=1 avail=10331(75.0%) swpO=0 conn=1 myRSS=1282 php=6 phpRSS=295 ap=25 tcp=40 topuser=madalice 2026-09-08 07:12:38 L1=1.49 run=2 blk=1 avail=10299(74.8%) swpO=0 conn=3 myRSS=1282 php=9 phpRSS=406 ap=27 tcp=43 topuser=madalice 2026-09-08 07:12:38 L1=1.49 run=3 blk=1 avail=10298(74.8%) swpO=0 conn=1 myRSS=1282 php=9 phpRSS=406 ap=27 tcp=43 topuser=madalice 2026-09-08 07:12:48 L1=1.48 run=7 blk=1 avail=10132(73.5%) swpO=3 conn=3 myRSS=1283 php=7 phpRSS=551 ap=27 tcp=45 topuser=corpkicks 2026-09-08 07:12:48 L1=1.48 run=3 blk=1 avail=10130(73.5%) swpO=3 conn=3 myRSS=1283 php=7 phpRSS=552 ap=27 tcp=45 topuser=corpkicks 2026-09-08 07:12:58 L1=1.56 run=3 blk=1 avail=10285(74.7%) swpO=6 conn=3 myRSS=1283 php=6 phpRSS=316 ap=34 tcp=47 topuser=madalice 2026-09-08 07:12:58 L1=1.56 run=2 blk=1 avail=10280(74.6%) swpO=6 conn=3 myRSS=1283 php=6 phpRSS=320 ap=34 tcp=47 topuser=madalice 2026-09-08 07:13:08 L1=1.55 run=3 blk=1 avail=10231(74.3%) swpO=0 conn=3 myRSS=1283 php=7 phpRSS=445 ap=27 tcp=43 topuser=corpkicks 2026-09-08 07:13:08 L1=1.55 run=5 blk=1 avail=10226(74.2%) swpO=0 conn=3 myRSS=1283 php=8 phpRSS=476 ap=27 tcp=44 topuser=corpkicks 2026-09-08 07:13:18 L1=1.54 run=1 blk=1 avail=10499(76.2%) swpO=0 conn=3 myRSS=1283 php=5 phpRSS=123 ap=27 tcp=43 topuser=madalice 2026-09-08 07:13:18 L1=1.54 run=2 blk=1 avail=10497(76.2%) swpO=0 conn=3 myRSS=1283 php=5 phpRSS=123 ap=27 tcp=43 topuser=madalice 2026-09-08 07:13:28 L1=1.46 run=2 blk=1 avail=10403(75.5%) swpO=0 conn=3 myRSS=1283 php=5 phpRSS=218 ap=26 tcp=39 topuser=madalice 2026-09-08 07:13:28 L1=1.46 run=2 blk=1 avail=10411(75.6%) swpO=0 conn=3 myRSS=1283 php=5 phpRSS=218 ap=26 tcp=39 topuser=madalice 2026-09-08 07:13:38 L1=1.39 run=2 blk=1 avail=10500(76.2%) swpO=0 conn=3 myRSS=1283 php=5 phpRSS=149 ap=22 tcp=34 topuser=madalice 2026-09-08 07:13:38 L1=1.39 run=3 blk=1 avail=10511(76.3%) swpO=0 conn=3 myRSS=1283 php=5 phpRSS=149 ap=22 tcp=34 topuser=madalice 2026-09-08 07:13:49 L1=1.33 run=4 blk=1 avail=10386(75.4%) swpO=0 conn=3 myRSS=1283 php=7 phpRSS=337 ap=21 tcp=39 topuser=madalice 2026-09-08 07:13:49 L1=1.33 run=5 blk=1 avail=10388(75.4%) swpO=0 conn=2 myRSS=1283 php=7 phpRSS=338 ap=21 tcp=40 topuser=madalice 2026-09-08 07:13:59 L1=1.57 run=9 blk=1 avail=9489 (68.9%) swpO=31 conn=3 myRSS=1283 php=12 phpRSS=1256 ap=34 tcp=61 topuser=madalice 2026-09-08 07:13:59 L1=1.57 run=13 blk=1 avail=9461 (68.7%) swpO=31 conn=2 myRSS=1283 php=12 phpRSS=1316 ap=34 tcp=62 topuser=madalice 2026-09-08 07:14:09 L1=2.09 run=8 blk=2 avail=8464 (61.4%) swpO=170 conn=7 myRSS=1287 php=14 phpRSS=1895 ap=97 tcp=107 topuser=madalice 2026-09-08 07:14:09 L1=2.09 run=9 blk=1 avail=8452 (61.3%) swpO=199 conn=6 myRSS=1287 php=14 phpRSS=1832 ap=97 tcp=107 topuser=madalice