INCIDENT 2026-09-08 11:11:17 trigger: php_rss=2154MB ================================================================== load: 3.69 3.26 3.13 7/658 3727554 ncpu:10 mem_avail: 8021MB/13777MB (58.2%) swap_used:1935MB swapout:293/s blocked(D):1 running:7 iowait:8.4% steal:0.0% php: 12 procs / 2154MB heaviest user: corpkicks (8 procs, 2107MB) apache: 52 procs tcp_estab: 98 --- RSS by user (all processes) --- USER PROCS RSS_MB corpkicks 8 2124 mysql 1 1671 root 252 866 nobody 51 863 netdata 8 229 evolution 11 54 mailman 20 36 cpanellogin 1 24 dovenull 6 22 wp-toolkit 3 12 alison 1 11 kurri 1 10 candyfabcom 1 10 dovecot 3 9 zabbix 1 8 mailnull 2 7 named 1 6 nscd 1 4 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB corpkicks 8 2019 evolution 3 44 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7454 MB Active(file): 3642 MB Inactive(file): 4076 MB Dirty: 5 MB Writeback: 0 MB SReclaimable: 422 MB CommitLimit: 10984 MB Committed_AS: 10043 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3708357 root 05:06 59108 /opt/imunify360/venv/bin/python3 -m imav.run 3926885 root 7-08:48:51 5020 /usr/bin/imunify-agent-proxy 4109079 root 3-06:26:29 1388 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 3-06:26:29 86720 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 1711436 18.1 Ssl 06:25:49 /usr/sbin/mariadbd 3727172 3726639 corpkicks 288412 9.7 S 00:19 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3727265 3725388 corpkicks 287336 11.8 S 00:16 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3727366 3727158 corpkicks 284572 16.3 S 00:10 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3727442 3711579 corpkicks 280196 24.1 S 00:07 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3727484 3710865 corpkicks 279800 50.0 S 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3727494 3727450 corpkicks 278300 77.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3727509 3727095 corpkicks 230716 58.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1911708 1859745 root 185844 0.1 S 08:34:07 spamd child 166870 1 netdata 185828 2.8 Ssl 2-08:48:58 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1911709 1859745 root 135160 0.0 S 08:34:07 spamd child 2328754 1 root 108728 0.0 Ss 06:25:59 /usr/lib/systemd/systemd-journald 4109105 4109079 root 86720 1.1 Sl 3-06:26:30 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 3708357 1 root 59108 0.5 Ssl 05:07 /opt/imunify360/venv/bin/python3 -m imav.run 3727523 3711318 evolution 45696 7.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1353308 1 root 42292 0.0 Ss 48-08:30:04 cpsrvd (SSL) - waiting for connections 509236 509098 root 36512 0.0 Sl 11-08:51:38 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3727363 1353308 root 33316 0.0 S 00:10 webmaild - serving 66.132.172.195 167562 166914 netdata 31684 0.1 Sl 2-08:48:53 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1859745 1 root 27856 0.0 Ss 08:48:29 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3673446 1353308 cpanellogin 25556 0.0 S 12:42 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 3710557 506832 nobody 22332 0.1 S 02:24 /usr/sbin/httpd -k start 3709796 506832 nobody 22024 0.1 S 03:24 /usr/sbin/httpd -k start 3709763 506832 nobody 20956 0.1 S 03:28 /usr/sbin/httpd -k start 3710960 506832 nobody 20608 0.1 S 02:03 /usr/sbin/httpd -k start 3711618 506832 nobody 20408 0.0 S 01:22 /usr/sbin/httpd -k start 3725388 506832 nobody 20300 0.1 S 01:05 /usr/sbin/httpd -k start 3711461 506832 nobody 20252 0.0 S 01:32 /usr/sbin/httpd -k start 3710865 506832 nobody 20188 0.1 S 02:09 /usr/sbin/httpd -k start 3710342 506832 nobody 20032 0.1 S 02:39 /usr/sbin/httpd -k start 3711653 506832 nobody 19980 0.1 S 01:19 /usr/sbin/httpd -k start 3710460 506832 nobody 19940 0.1 S 02:30 /usr/sbin/httpd -k start 3726432 506832 nobody 19840 0.1 S 01:04 /usr/sbin/httpd -k start 3723873 506832 nobody 19716 0.1 S 01:06 /usr/sbin/httpd -k start 3711617 506832 nobody 19644 0.0 S 01:22 /usr/sbin/httpd -k start 3711551 506832 nobody 19496 0.0 S 01:28 /usr/sbin/httpd -k start 3710552 506832 nobody 19232 0.1 S 02:25 /usr/sbin/httpd -k start 3710785 506832 nobody 19024 0.1 S 02:13 /usr/sbin/httpd -k start 3726433 506832 nobody 18848 0.1 S 01:04 /usr/sbin/httpd -k start 3726671 506832 nobody 18804 0.1 R 00:50 /usr/sbin/httpd -k start 3726631 506832 nobody 18480 0.1 S 00:52 /usr/sbin/httpd -k start 3710516 506832 nobody 18456 0.0 S 02:28 /usr/sbin/httpd -k start 3709807 506832 nobody 18192 0.0 S 03:23 /usr/sbin/httpd -k start 3727416 506832 nobody 17992 0.0 S 00:08 /usr/sbin/httpd -k start 3709711 506832 nobody 17984 0.0 S 03:31 /usr/sbin/httpd -k start 3727095 506832 nobody 17964 0.2 S 00:22 /usr/sbin/httpd -k start 3709150 506832 nobody 17760 0.0 S 04:13 /usr/sbin/httpd -k start 3726673 506832 nobody 17644 0.2 S 00:50 /usr/sbin/httpd -k start 3711318 506832 nobody 17104 0.0 S 01:42 /usr/sbin/httpd -k start 3727001 506832 nobody 17092 0.1 S 00:28 /usr/sbin/httpd -k start 3727122 506832 nobody 16788 0.0 S 00:21 /usr/sbin/httpd -k start 3726640 506832 nobody 16776 0.0 S 00:51 /usr/sbin/httpd -k start 3711761 506832 nobody 16724 0.0 S 01:16 /usr/sbin/httpd -k start 3711579 506832 nobody 16716 0.0 S 01:25 /usr/sbin/httpd -k start 3726431 506832 nobody 16660 0.1 S 01:04 /usr/sbin/httpd -k start 3726639 506832 nobody 16492 0.0 S 00:51 /usr/sbin/httpd -k start 3727158 506832 nobody 16464 0.1 S 00:20 /usr/sbin/httpd -k start 3727123 506832 nobody 16308 0.0 S 00:21 /usr/sbin/httpd -k start 3727160 506832 nobody 16168 0.0 S 00:20 /usr/sbin/httpd -k start 3727433 506832 nobody 16156 0.0 S 00:07 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 1577382 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 1577381 | root | 85-1525752154 | Execute | 0 | Sending data | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29487' AND dispatchitems.j | +---------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 575 whiz/whizengineering.com.au-ssl_log 319 evolution/portal.evolutionerp.com.au-ssl_log 314 vinesit/vinesit.com.au-ssl_log 119 customkidscom/customkids.com.au-ssl_log 111 corpkicks/corporatekicks.com.au-ssl_log 32 aaa/aaadownunder.com.au-ssl_log 2 bigdeals/bigdeals.com.au-ssl_log 2 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 450 203.54.180.238 319 34.23.23.144 161 103.104.165.99 119 34.85.16.151 111 4.204.224.164 68 116.91.221.245 60 103.104.164.114 54 182.239.240.254 47 120.21.58.67 18 180.181.236.49 17 1.144.107.82 15 203.166.236.147 11 120.21.154.188 8 34.130.246.123 5 118.127.40.55 --- top request paths across all vhosts (last 3 min) --- 193 POST /functions.php 130 GET /factory_session_checker.php 124 GET /app/ajax.php 111 GET /autodiscover/autodiscover.xml 65 GET /factory_session_processed_qty.php 65 GET /factory_session_joiner.php 59 GET /index.php 42 GET /heartbeat.php 36 POST /plugins/csvexporter/plugin.php 31 POST /app/ajax/selectFilterSingle.php 25 POST /app/ajax.php 18 POST /clienteditsave.php 17 GET / 13 POST /wp-admin/admin-ajax.php 12 POST /app/ajax/selectFilter.php 9 POST /logsave.php 9 POST /jobeditsave.php 8 POST /mfreqsave.php 6 POST /itemModify.php 6 POST /factory_functions.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 193 POST /functions.php 124 GET /app/ajax.php 53 GET /index.php 36 POST /plugins/csvexporter/plugin.php 31 POST /app/ajax/selectFilterSingle.php 25 POST /app/ajax.php 18 POST /clienteditsave.php 12 POST /app/ajax/selectFilter.php 9 POST /logsave.php 9 POST /jobeditsave.php 8 POST /mfreqsave.php 6 POST /itemModify.php -- last 10 requests -- 180.181.236.49 - - [08/Sep/2026:11:11:11 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=6027" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 103.104.164.114 - - [08/Sep/2026:11:11:11 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 180.181.236.49 - - [08/Sep/2026:11:11:11 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=invedit&id=84&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 180.181.236.49 - - [08/Sep/2026:11:11:11 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=timesheetHistory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 203.54.180.238 - - [08/Sep/2026:11:11:12 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 116.91.221.245 - - [08/Sep/2026:11:11:13 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=invedit&id=4455&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 203.54.180.238 - - [08/Sep/2026:11:11:13 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29713&tab=jobeditmf" "Mozilla/5.0 (Windows NT 10.0; Win64; x 182.239.240.254 - - [08/Sep/2026:11:11:15 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=4228&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; x 120.21.58.67 - - [08/Sep/2026:11:11:13 +1000] "GET /index.php?page=jobedit&id=29487 HTTP/1.1" 200 175812 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, li 120.21.58.67 - - [08/Sep/2026:11:11:14 +1000] "POST /logsave.php?call=getHistory&id=29487&module=job HTTP/1.1" 200 449 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29487" "Mozilla/5.0 (Windows NT 10.0; Win64 == whiz/whizengineering.com.au-ssl_log == -- top paths -- 10 GET / 2 GET /read 1 GET /.zsh_history 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-config.php.save 1 GET /wp-config.php.old 1 GET /wp-config.php.bak 1 GET /wp-config.php 1 GET /wordpress/.env 1 GET /web/.env 1 GET /web.config -- last 10 requests -- 34.23.23.144 - - [08/Sep/2026:11:10:04 +1000] "GET /?command=%3B+echo+GSCAN_CMDI+%23 HTTP/1.1" 200 658 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 34.23.23.144 - - [08/Sep/2026:11:10:04 +1000] "GET /?host=%3B+echo+GSCAN_CMDI+%23 HTTP/1.1" 200 658 "-" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amzn-SearchBot/1.0; +h 34.23.23.144 - - [08/Sep/2026:11:10:04 +1000] "GET /?cmd=%3B+echo+GSCAN_CMDI+%23 HTTP/1.1" 200 658 "-" "Mozilla/5.0 (compatible; TelegramBot/1.0)" 34.23.23.144 - - [08/Sep/2026:11:10:07 +1000] "GET /?exec=%60echo+GSCAN_CMDI%60 HTTP/1.1" 200 658 "-" "Mozilla/5.0 (Linux; Android 15; SM-S918B) AppleWebKit/537.36 (KHTML, like Gecko; compatible; OAI-SearchBot/1.3; +http 34.23.23.144 - - [08/Sep/2026:11:10:07 +1000] "GET /?host=%60echo+GSCAN_CMDI%60 HTTP/1.1" 200 658 "-" "Mozilla/5.0 (compatible; Twitterbot/1.0)" 34.23.23.144 - - [08/Sep/2026:11:10:07 +1000] "GET /?command=%60echo+GSCAN_CMDI%60 HTTP/1.1" 200 658 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 34.23.23.144 - - [08/Sep/2026:11:10:07 +1000] "GET /?cmd=%60echo+GSCAN_CMDI%60 HTTP/1.1" 200 658 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.6468.61 Safari/537.36; c 34.23.23.144 - - [08/Sep/2026:11:10:10 +1000] "GET /?ip=%3B+echo+GSCAN_CMDI+%23 HTTP/1.1" 200 658 "-" "Mozilla/5.0 (compatible; LinkedInBot/1.0; +http://www.linkedin.com)" 34.23.23.144 - - [08/Sep/2026:11:10:10 +1000] "GET /api/exec?cmd=%3B+echo+GSCAN_CMDI+%23 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.5928.155 Mobile S 34.23.23.144 - - [08/Sep/2026:11:10:10 +1000] "GET /api/ping?host=%3B+echo+GSCAN_CMDI+%23 HTTP/1.1" 404 - "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GrokBot/1.0; +https://x.ai/grokbot" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 130 GET /factory_session_checker.php 65 GET /factory_session_processed_qty.php 65 GET /factory_session_joiner.php 42 GET /heartbeat.php 6 POST /factory_functions.php 6 GET /index.php -- last 10 requests -- 203.54.180.238 - - [08/Sep/2026:11:11:07 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [08/Sep/2026:11:11:07 +1000] "GET /factory_session_joiner.php?id=35197 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [08/Sep/2026:11:11:09 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:11:11:10 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:11:11:11 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:11:11:10 +1000] "GET /heartbeat.php?sentAt=1788829869&bytes=106,159,96,173&_=1788786031464 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [08/Sep/2026:11:11:11 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:11:11:10 +1000] "GET /heartbeat.php?sentAt=1788829871&bytes=106,159,96,175&_=1788829020973 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=11 203.54.180.238 - - [08/Sep/2026:11:11:11 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:11:11:12 +1000] "GET /heartbeat.php?sentAt=1788829872&bytes=106,159,96,176&_=1788820329489 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-09-08 11:08:48 L1=3.18 run=4 blk=1 avail=9774 (70.9%) swpO=0 conn=1 myRSS=1680 php=10 phpRSS=305 ap=53 tcp=63 topuser=evolution 2026-09-08 11:08:56 L1=3.01 run=5 blk=1 avail=9685 (70.3%) swpO=0 conn=2 myRSS=1680 php=6 phpRSS=223 ap=62 tcp=85 topuser=alison 2026-09-08 11:08:58 L1=3.57 run=2 blk=1 avail=9749 (70.8%) swpO=0 conn=1 myRSS=1680 php=5 phpRSS=104 ap=63 tcp=79 topuser=evolution 2026-09-08 11:09:06 L1=3.60 run=10 blk=2 avail=9469 (68.7%) swpO=0 conn=4 myRSS=1680 php=6 phpRSS=227 ap=68 tcp=76 topuser=corpkicks 2026-09-08 11:09:08 L1=3.79 run=5 blk=1 avail=9698 (70.4%) swpO=0 conn=1 myRSS=1680 php=4 phpRSS=40 ap=71 tcp=68 topuser=evolution 2026-09-08 11:09:16 L1=3.57 run=3 blk=0 avail=9718 (70.5%) swpO=0 conn=4 myRSS=1680 php=5 phpRSS=82 ap=68 tcp=65 topuser=evolution 2026-09-08 11:09:18 L1=3.52 run=3 blk=1 avail=9705 (70.4%) swpO=0 conn=1 myRSS=1680 php=6 phpRSS=119 ap=67 tcp=63 topuser=evolution 2026-09-08 11:09:26 L1=3.48 run=5 blk=1 avail=9717 (70.5%) swpO=0 conn=4 myRSS=1681 php=6 phpRSS=164 ap=62 tcp=69 topuser=evolution 2026-09-08 11:09:28 L1=3.52 run=2 blk=1 avail=9771 (70.9%) swpO=0 conn=2 myRSS=1681 php=4 phpRSS=57 ap=60 tcp=90 topuser=evolution 2026-09-08 11:09:36 L1=3.56 run=4 blk=1 avail=9688 (70.3%) swpO=0 conn=4 myRSS=1681 php=5 phpRSS=216 ap=56 tcp=54 topuser=corpkicks 2026-09-08 11:09:38 L1=3.36 run=5 blk=0 avail=9811 (71.2%) swpO=0 conn=2 myRSS=1681 php=4 phpRSS=58 ap=54 tcp=79 topuser=evolution 2026-09-08 11:09:46 L1=3.17 run=4 blk=1 avail=9611 (69.8%) swpO=0 conn=4 myRSS=1682 php=8 phpRSS=385 ap=54 tcp=68 topuser=otterfencing 2026-09-08 11:09:48 L1=3.71 run=4 blk=1 avail=9837 (71.4%) swpO=0 conn=2 myRSS=1682 php=4 phpRSS=25 ap=53 tcp=100 topuser=evolution 2026-09-08 11:09:56 L1=3.58 run=2 blk=1 avail=9559 (69.4%) swpO=19 conn=4 myRSS=1682 php=5 phpRSS=319 ap=59 tcp=71 topuser=corpkicks 2026-09-08 11:09:58 L1=3.45 run=1 blk=1 avail=9583 (69.6%) swpO=19 conn=2 myRSS=1682 php=4 phpRSS=263 ap=59 tcp=55 topuser=corpkicks 2026-09-08 11:10:06 L1=3.50 run=3 blk=0 avail=9694 (70.4%) swpO=0 conn=2 myRSS=1682 php=4 phpRSS=190 ap=54 tcp=53 topuser=corpkicks 2026-09-08 11:10:08 L1=3.37 run=5 blk=1 avail=9729 (70.6%) swpO=0 conn=2 myRSS=1682 php=6 phpRSS=208 ap=52 tcp=58 topuser=alison 2026-09-08 11:10:16 L1=3.59 run=4 blk=0 avail=9731 (70.6%) swpO=0 conn=2 myRSS=1682 php=6 phpRSS=170 ap=56 tcp=73 topuser=evolution 2026-09-08 11:10:18 L1=3.46 run=5 blk=1 avail=9722 (70.6%) swpO=0 conn=2 myRSS=1682 php=8 phpRSS=229 ap=55 tcp=61 topuser=evolution 2026-09-08 11:10:26 L1=3.34 run=1 blk=1 avail=9817 (71.3%) swpO=0 conn=2 myRSS=1682 php=4 phpRSS=59 ap=53 tcp=66 topuser=evolution 2026-09-08 11:10:29 L1=3.15 run=3 blk=0 avail=9838 (71.4%) swpO=0 conn=1 myRSS=1682 php=3 phpRSS=2 ap=57 tcp=50 topuser=root 2026-09-08 11:10:36 L1=3.06 run=3 blk=1 avail=9676 (70.2%) swpO=0 conn=2 myRSS=1682 php=5 phpRSS=299 ap=49 tcp=55 topuser=corpkicks 2026-09-08 11:10:39 L1=3.06 run=2 blk=1 avail=9925 (72.0%) swpO=0 conn=1 myRSS=1682 php=4 phpRSS=29 ap=47 tcp=57 topuser=evolution 2026-09-08 11:10:46 L1=3.05 run=2 blk=1 avail=9972 (72.4%) swpO=0 conn=2 myRSS=1682 php=3 phpRSS=2 ap=40 tcp=54 topuser=root 2026-09-08 11:10:49 L1=3.93 run=6 blk=0 avail=9926 (72.0%) swpO=0 conn=1 myRSS=1682 php=6 phpRSS=138 ap=41 tcp=63 topuser=evolution 2026-09-08 11:10:56 L1=3.77 run=3 blk=1 avail=9590 (69.6%) swpO=0 conn=2 myRSS=1682 php=6 phpRSS=409 ap=49 tcp=70 topuser=corpkicks 2026-09-08 11:10:59 L1=3.87 run=3 blk=1 avail=9135 (66.3%) swpO=0 conn=1 myRSS=1682 php=8 phpRSS=902 ap=53 tcp=67 topuser=corpkicks 2026-09-08 11:11:06 L1=3.72 run=2 blk=1 avail=9145 (66.4%) swpO=14 conn=4 myRSS=1682 php=6 phpRSS=900 ap=46 tcp=67 topuser=corpkicks 2026-09-08 11:11:09 L1=3.66 run=3 blk=1 avail=9251 (67.2%) swpO=14 conn=1 myRSS=1682 php=7 phpRSS=827 ap=44 tcp=79 topuser=corpkicks 2026-09-08 11:11:17 L1=3.69 run=7 blk=1 avail=8021 (58.2%) swpO=293 conn=10 myRSS=1671 php=12 phpRSS=2154 ap=52 tcp=98 topuser=corpkicks