INCIDENT 2026-09-08 11:12:18 trigger: php_rss=3060MB ================================================================== load: 3.44 3.28 3.14 7/671 3728850 ncpu:10 mem_avail: 7224MB/13777MB (52.4%) swap_used:1940MB swapout:129/s blocked(D):1 running:14 iowait:8.2% steal:0.0% php: 16 procs / 3060MB heaviest user: corpkicks (13 procs, 3058MB) apache: 54 procs tcp_estab: 76 --- RSS by user (all processes) --- USER PROCS RSS_MB corpkicks 13 3096 mysql 1 1672 nobody 53 913 root 252 754 netdata 8 229 alison 5 56 cpanellogin 1 54 mailman 20 36 dovenull 6 22 mailnull 3 15 wp-toolkit 3 12 candyfabcom 1 12 kurri 1 10 evolution 10 9 dovecot 3 9 zabbix 1 8 named 1 6 nscd 1 4 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB corpkicks 13 3108 root 1 2 evolution 2 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6090 MB Active(file): 3081 MB Inactive(file): 3229 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 420 MB CommitLimit: 10984 MB Committed_AS: 11192 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 7-08:49:53 4724 /usr/bin/imunify-agent-proxy 4109079 root 3-06:27:31 1388 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 3-06:27:31 77528 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 1712772 18.1 Ssl 06:26:50 /usr/sbin/mariadbd 3728284 3710785 corpkicks 289328 4.4 S 00:40 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3728052 3727476 corpkicks 289084 3.1 S 00:55 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3727172 3726639 corpkicks 288412 2.3 S 01:20 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3727366 3727158 corpkicks 284580 2.3 S 01:11 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3728190 3727122 corpkicks 282120 3.6 S 00:47 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3728220 3726431 corpkicks 282088 3.9 S 00:43 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3727442 3711579 corpkicks 280880 2.5 S 01:08 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3728808 3710460 corpkicks 237824 118 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3728809 3727095 corpkicks 232260 112 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3728813 3728474 corpkicks 217864 106 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3728810 3728476 corpkicks 195004 113 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3728811 3726631 corpkicks 194296 114 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3728812 3710516 corpkicks 193200 114 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1911708 1859745 root 185704 0.1 S 08:35:08 spamd child 166870 1 netdata 185588 2.8 Ssl 2-08:49:59 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1911709 1859745 root 131128 0.0 S 08:35:08 spamd child 2328754 1 root 107136 0.0 Ss 06:27:00 /usr/lib/systemd/systemd-journald 4109105 4109079 root 77528 1.1 Sl 3-06:27:31 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 3673446 1353308 cpanellogin 56020 0.0 S 13:43 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 1353308 1 root 42292 0.0 Ss 48-08:31:05 cpsrvd (SSL) - waiting for connections 509236 509098 root 36368 0.0 Sl 11-08:52:39 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 167562 166914 netdata 31660 0.1 Sl 2-08:49:54 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1859745 1 root 27840 0.0 Ss 08:49:30 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3709796 506832 nobody 22096 0.1 S 04:25 /usr/sbin/httpd -k start 3710342 506832 nobody 21252 0.1 S 03:40 /usr/sbin/httpd -k start 3710960 506832 nobody 21056 0.0 S 03:04 /usr/sbin/httpd -k start 3709763 506832 nobody 21024 0.1 S 04:29 /usr/sbin/httpd -k start 3711617 506832 nobody 20836 0.0 S 02:23 /usr/sbin/httpd -k start 3723873 506832 nobody 20616 0.0 S 02:07 /usr/sbin/httpd -k start 3711461 506832 nobody 20564 0.0 S 02:33 /usr/sbin/httpd -k start 3725388 506832 nobody 20560 0.1 S 02:06 /usr/sbin/httpd -k start 3710865 506832 nobody 20356 0.0 S 03:10 /usr/sbin/httpd -k start 3711653 506832 nobody 20088 0.1 S 02:20 /usr/sbin/httpd -k start 3726671 506832 nobody 20016 0.1 S 01:51 /usr/sbin/httpd -k start 3710460 506832 nobody 20000 0.1 S 03:31 /usr/sbin/httpd -k start 3727001 506832 nobody 19968 0.1 S 01:29 /usr/sbin/httpd -k start 3726432 506832 nobody 19916 0.1 S 02:05 /usr/sbin/httpd -k start 3726631 506832 nobody 19880 0.1 S 01:53 /usr/sbin/httpd -k start 3711318 506832 nobody 19672 0.1 S 02:43 /usr/sbin/httpd -k start 3727123 506832 nobody 19140 0.1 S 01:22 /usr/sbin/httpd -k start 3727451 506832 nobody 19052 0.1 S 01:07 /usr/sbin/httpd -k start 3710785 506832 nobody 19016 0.0 S 03:14 /usr/sbin/httpd -k start 3710516 506832 nobody 18980 0.0 S 03:29 /usr/sbin/httpd -k start 3727095 506832 nobody 18584 0.1 S 01:23 /usr/sbin/httpd -k start 3728800 506832 nobody 18580 2.0 S 00:02 /usr/sbin/httpd -k start 3726640 506832 nobody 18524 0.0 S 01:52 /usr/sbin/httpd -k start 3728472 506832 nobody 18412 0.1 S 00:29 /usr/sbin/httpd -k start 3726673 506832 nobody 18380 0.1 S 01:51 /usr/sbin/httpd -k start 3728476 506832 nobody 18376 0.0 S 00:29 /usr/sbin/httpd -k start 3709807 506832 nobody 18204 0.0 S 04:24 /usr/sbin/httpd -k start 3727449 506832 nobody 17996 0.0 S 01:07 /usr/sbin/httpd -k start 3728471 506832 nobody 17976 0.3 S 00:29 /usr/sbin/httpd -k start 3727450 506832 nobody 17884 0.1 S 01:07 /usr/sbin/httpd -k start 3728815 506832 nobody 17844 1.0 S 00:01 /usr/sbin/httpd -k start 3728475 506832 nobody 17288 0.0 S 00:29 /usr/sbin/httpd -k start 3728474 506832 nobody 17148 0.0 S 00:29 /usr/sbin/httpd -k start 3711761 506832 nobody 17032 0.0 S 02:17 /usr/sbin/httpd -k start 3727122 506832 nobody 16960 0.0 S 01:22 /usr/sbin/httpd -k start 3726431 506832 nobody 16800 0.0 S 02:05 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 1582687 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 1582674 | corpkicks_wp_iwddf | corpkicks_wp_baolr | Query | 0 | Statistics | SELECT option_value FROM MPHOrV_options WHERE option_name = 'elementor_experiment-e_assets_manager' LIMIT 1 | +---------+--------------------+--------------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 385 evolution/portal.evolutionerp.com.au-ssl_log 323 vinesit/vinesit.com.au-ssl_log 119 customkidscom/customkids.com.au-ssl_log 67 corpkicks/corporatekicks.com.au-ssl_log 49 whiz/whizengineering.com.au-ssl_log 41 bigdeals/bigdeals.com.au-ssl_log 17 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 418 203.54.180.238 119 34.85.16.151 87 103.104.165.99 67 4.204.224.164 67 103.104.164.114 64 120.21.58.67 41 34.23.23.144 37 1.144.107.82 20 116.91.221.245 17 34.125.26.76 13 182.239.240.254 12 180.181.236.49 11 203.166.236.147 9 120.21.154.188 9 118.127.40.55 --- top request paths across all vhosts (last 3 min) --- 178 POST /functions.php 131 GET /factory_session_checker.php 69 GET /factory_session_processed_qty.php 69 GET /factory_session_joiner.php 67 GET /autodiscover/autodiscover.xml 60 GET /app/ajax.php 41 GET /index.php 41 GET /heartbeat.php 20 POST /wp-admin/admin-ajax.php 18 GET / 17 POST /plugins/csvexporter/plugin.php 15 POST /clienteditsave.php 15 POST /app/ajax/selectFilterSingle.php 13 POST /wp-admin/async-upload.php 10 POST /app/ajax/selectFilter.php 7 POST /app/ajax.php 6 POST /wp-admin/admin-post.php 6 POST /logsave.php 5 POST /print.php 5 POST /mfreqsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 178 POST /functions.php 60 GET /app/ajax.php 31 GET /index.php 17 POST /plugins/csvexporter/plugin.php 15 POST /clienteditsave.php 15 POST /app/ajax/selectFilterSingle.php 10 POST /app/ajax/selectFilter.php 7 POST /app/ajax.php 6 POST /logsave.php 5 POST /print.php 5 POST /mfreqsave.php 5 POST /leadeditsave.php -- last 10 requests -- 180.181.236.49 - - [08/Sep/2026:11:12:11 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=timesheetHistory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 203.54.180.238 - - [08/Sep/2026:11:12:12 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 116.91.221.245 - - [08/Sep/2026:11:12:12 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=P40MB HTTP/1.1" 200 924 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2323§ionid=582" "Mozilla/ 116.91.221.245 - - [08/Sep/2026:11:12:13 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2325§ionid=571" "Mozilla/5.0 (Windows NT 10.0; Win 116.91.221.245 - - [08/Sep/2026:11:12:14 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=4466" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0 103.104.165.99 - - [08/Sep/2026:11:12:16 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 103.104.164.114 - - [08/Sep/2026:11:12:16 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4919&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; 116.91.221.245 - - [08/Sep/2026:11:12:16 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter= HTTP/1.1" 200 13331 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2323§ionid=582" "Mozilla/5.0 116.91.221.245 - - [08/Sep/2026:11:12:16 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=P40MB-6500 HTTP/1.1" 200 924 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2323§ionid=582" "Moz 182.239.240.254 - - [08/Sep/2026:11:12:17 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=4228&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; x == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 131 GET /factory_session_checker.php 69 GET /factory_session_processed_qty.php 69 GET /factory_session_joiner.php 41 GET /heartbeat.php 10 GET /index.php 2 POST /portal/register 1 POST /factory_functions.php -- last 10 requests -- 203.54.180.238 - - [08/Sep/2026:11:12:12 +1000] "GET /heartbeat.php?sentAt=1788829932&bytes=106,159,96,236&_=1788820329495 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [08/Sep/2026:11:12:13 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:11:12:14 +1000] "GET /factory_session_joiner.php?id=35192 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [08/Sep/2026:11:12:14 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [08/Sep/2026:11:12:15 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 124 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [08/Sep/2026:11:12:15 +1000] "GET /factory_session_joiner.php?id=35173 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [08/Sep/2026:11:12:16 +1000] "GET /factory_session_joiner.php?id=35196 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [08/Sep/2026:11:12:16 +1000] "GET /factory_session_joiner.php?id=35194 HTTP/1.1" 200 102 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleW 203.54.180.238 - - [08/Sep/2026:11:12:16 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [08/Sep/2026:11:12:16 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 127 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb == vinesit/vinesit.com.au-ssl_log == -- top paths -- 5 POST / 5 GET / 3 POST /php/php.exe 3 POST /php/php-cgi.exe 3 POST /php-cgi/php-cgi.exe 3 POST /cgi-bin/php-cgi.exe 3 POST /cgi-bin/php-cgi 3 POST /cgi-bin/php8.exe 3 POST /cgi-bin/php8 3 POST /cgi-bin/php5 3 POST /cgi-bin/php 3 GET /@fs/proc/self/environ -- last 10 requests -- 34.85.16.151 - - [08/Sep/2026:11:11:08 +1000] "POST /cgi-bin/php8.exe?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Ge 34.85.16.151 - - [08/Sep/2026:11:11:08 +1000] "POST /cgi-bin/php8.exe HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.85.16.151 - - [08/Sep/2026:11:11:08 +1000] "POST /cgi-bin/php5?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Ge 34.85.16.151 - - [08/Sep/2026:11:11:08 +1000] "POST /cgi-bin/php5?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) 34.85.16.151 - - [08/Sep/2026:11:11:08 +1000] "POST /cgi-bin/php5 HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.85.16.151 - - [08/Sep/2026:11:11:09 +1000] "POST /cgi-bin/php8?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Ge 34.85.16.151 - - [08/Sep/2026:11:11:09 +1000] "POST /cgi-bin/php8?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) 34.85.16.151 - - [08/Sep/2026:11:11:09 +1000] "POST /cgi-bin/php8 HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.85.16.151 - - [08/Sep/2026:11:11:09 +1000] "POST /cgi/php?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) 34.85.16.151 - - [08/Sep/2026:11:11:10 +1000] "POST /cgi/php?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chro --- last 30 samples (run-up to this incident) --- 2026-09-08 11:09:48 L1=3.71 run=4 blk=1 avail=9837 (71.4%) swpO=0 conn=2 myRSS=1682 php=4 phpRSS=25 ap=53 tcp=100 topuser=evolution 2026-09-08 11:09:56 L1=3.58 run=2 blk=1 avail=9559 (69.4%) swpO=19 conn=4 myRSS=1682 php=5 phpRSS=319 ap=59 tcp=71 topuser=corpkicks 2026-09-08 11:09:58 L1=3.45 run=1 blk=1 avail=9583 (69.6%) swpO=19 conn=2 myRSS=1682 php=4 phpRSS=263 ap=59 tcp=55 topuser=corpkicks 2026-09-08 11:10:06 L1=3.50 run=3 blk=0 avail=9694 (70.4%) swpO=0 conn=2 myRSS=1682 php=4 phpRSS=190 ap=54 tcp=53 topuser=corpkicks 2026-09-08 11:10:08 L1=3.37 run=5 blk=1 avail=9729 (70.6%) swpO=0 conn=2 myRSS=1682 php=6 phpRSS=208 ap=52 tcp=58 topuser=alison 2026-09-08 11:10:16 L1=3.59 run=4 blk=0 avail=9731 (70.6%) swpO=0 conn=2 myRSS=1682 php=6 phpRSS=170 ap=56 tcp=73 topuser=evolution 2026-09-08 11:10:18 L1=3.46 run=5 blk=1 avail=9722 (70.6%) swpO=0 conn=2 myRSS=1682 php=8 phpRSS=229 ap=55 tcp=61 topuser=evolution 2026-09-08 11:10:26 L1=3.34 run=1 blk=1 avail=9817 (71.3%) swpO=0 conn=2 myRSS=1682 php=4 phpRSS=59 ap=53 tcp=66 topuser=evolution 2026-09-08 11:10:29 L1=3.15 run=3 blk=0 avail=9838 (71.4%) swpO=0 conn=1 myRSS=1682 php=3 phpRSS=2 ap=57 tcp=50 topuser=root 2026-09-08 11:10:36 L1=3.06 run=3 blk=1 avail=9676 (70.2%) swpO=0 conn=2 myRSS=1682 php=5 phpRSS=299 ap=49 tcp=55 topuser=corpkicks 2026-09-08 11:10:39 L1=3.06 run=2 blk=1 avail=9925 (72.0%) swpO=0 conn=1 myRSS=1682 php=4 phpRSS=29 ap=47 tcp=57 topuser=evolution 2026-09-08 11:10:46 L1=3.05 run=2 blk=1 avail=9972 (72.4%) swpO=0 conn=2 myRSS=1682 php=3 phpRSS=2 ap=40 tcp=54 topuser=root 2026-09-08 11:10:49 L1=3.93 run=6 blk=0 avail=9926 (72.0%) swpO=0 conn=1 myRSS=1682 php=6 phpRSS=138 ap=41 tcp=63 topuser=evolution 2026-09-08 11:10:56 L1=3.77 run=3 blk=1 avail=9590 (69.6%) swpO=0 conn=2 myRSS=1682 php=6 phpRSS=409 ap=49 tcp=70 topuser=corpkicks 2026-09-08 11:10:59 L1=3.87 run=3 blk=1 avail=9135 (66.3%) swpO=0 conn=1 myRSS=1682 php=8 phpRSS=902 ap=53 tcp=67 topuser=corpkicks 2026-09-08 11:11:06 L1=3.72 run=2 blk=1 avail=9145 (66.4%) swpO=14 conn=4 myRSS=1682 php=6 phpRSS=900 ap=46 tcp=67 topuser=corpkicks 2026-09-08 11:11:09 L1=3.66 run=3 blk=1 avail=9251 (67.2%) swpO=14 conn=1 myRSS=1682 php=7 phpRSS=827 ap=44 tcp=79 topuser=corpkicks 2026-09-08 11:11:17 L1=3.69 run=7 blk=1 avail=8021 (58.2%) swpO=293 conn=10 myRSS=1671 php=12 phpRSS=2154 ap=52 tcp=98 topuser=corpkicks 2026-09-08 11:11:19 L1=4.04 run=3 blk=1 avail=8216 (59.6%) swpO=323 conn=9 myRSS=1671 php=13 phpRSS=1949 ap=53 tcp=86 topuser=corpkicks 2026-09-08 11:11:28 L1=3.72 run=8 blk=1 avail=7764 (56.4%) swpO=215 conn=11 myRSS=1667 php=13 phpRSS=2460 ap=48 tcp=106 topuser=corpkicks 2026-09-08 11:11:29 L1=3.72 run=2 blk=1 avail=7665 (55.6%) swpO=237 conn=11 myRSS=1667 php=13 phpRSS=2580 ap=47 tcp=96 topuser=corpkicks 2026-09-08 11:11:38 L1=3.85 run=4 blk=0 avail=7399 (53.7%) swpO=295 conn=12 myRSS=1657 php=15 phpRSS=2899 ap=43 tcp=95 topuser=corpkicks 2026-09-08 11:11:39 L1=3.85 run=2 blk=1 avail=7347 (53.3%) swpO=295 conn=12 myRSS=1657 php=14 phpRSS=2961 ap=43 tcp=105 topuser=corpkicks 2026-09-08 11:11:48 L1=3.65 run=4 blk=1 avail=7962 (57.8%) swpO=0 conn=10 myRSS=1657 php=13 phpRSS=2296 ap=44 tcp=67 topuser=corpkicks 2026-09-08 11:11:49 L1=3.65 run=4 blk=1 avail=8117 (58.9%) swpO=0 conn=10 myRSS=1657 php=12 phpRSS=2103 ap=48 tcp=78 topuser=corpkicks 2026-09-08 11:11:58 L1=3.55 run=2 blk=1 avail=7757 (56.3%) swpO=0 conn=11 myRSS=1675 php=12 phpRSS=2379 ap=55 tcp=68 topuser=corpkicks 2026-09-08 11:11:59 L1=3.55 run=3 blk=1 avail=8036 (58.3%) swpO=0 conn=9 myRSS=1675 php=11 phpRSS=2043 ap=55 tcp=68 topuser=corpkicks 2026-09-08 11:12:08 L1=3.23 run=2 blk=1 avail=8123 (59.0%) swpO=0 conn=8 myRSS=1675 php=10 phpRSS=1951 ap=51 tcp=63 topuser=corpkicks 2026-09-08 11:12:09 L1=3.23 run=1 blk=0 avail=8120 (58.9%) swpO=0 conn=8 myRSS=1675 php=10 phpRSS=1951 ap=51 tcp=63 topuser=corpkicks 2026-09-08 11:12:18 L1=3.44 run=14 blk=1 avail=7224 (52.4%) swpO=129 conn=14 myRSS=1672 php=16 phpRSS=3060 ap=54 tcp=76 topuser=corpkicks