INCIDENT 2026-09-08 11:13:19 trigger: php_rss=1884MB ================================================================== load: 3.24 3.19 3.12 4/665 3730096 ncpu:10 mem_avail: 8281MB/13777MB (60.1%) swap_used:1926MB swapout:0/s blocked(D):1 running:8 iowait:7.8% steal:0.0% php: 16 procs / 1884MB heaviest user: corpkicks (7 procs, 1660MB) apache: 52 procs tcp_estab: 73 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1710 corpkicks 8 1689 nobody 51 888 root 251 789 netdata 8 229 evolution 14 177 infinium 4 158 cpanellogin 1 56 alison 5 56 mailman 20 36 dovenull 6 22 mailnull 3 15 wp-toolkit 3 12 kurri 1 10 dovecot 3 9 zabbix 1 8 named 1 6 nscd 1 4 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB corpkicks 7 1683 evolution 6 167 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6235 MB Active(file): 3329 MB Inactive(file): 3129 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 421 MB CommitLimit: 10984 MB Committed_AS: 9974 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 7-08:50:54 4724 /usr/bin/imunify-agent-proxy 4109079 root 3-06:28:32 1388 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 3-06:28:32 87216 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 1751764 18.1 Ssl 06:27:51 /usr/sbin/mariadbd 3727366 3727158 corpkicks 296264 1.5 S 02:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3728284 3710785 corpkicks 289328 1.7 S 01:41 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3728052 3727476 corpkicks 289084 1.4 S 01:56 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3728190 3727122 corpkicks 282120 1.6 S 01:48 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3728220 3726431 corpkicks 282088 1.6 S 01:44 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1911708 1859745 root 185704 0.1 S 08:36:09 spamd child 166870 1 netdata 185272 2.8 Ssl 2-08:51:00 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3730057 3728472 corpkicks 156704 60.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3730054 3729072 corpkicks 154360 65.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1911709 1859745 root 131128 0.0 S 08:36:09 spamd child 2328754 1 root 107400 0.0 Ss 06:28:01 /usr/lib/systemd/systemd-journald 4109105 4109079 root 87216 1.1 Sl 3-06:28:32 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 3730010 3728387 evolution 61532 5.4 S 00:05 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3673446 1353308 cpanellogin 57528 0.0 S 14:44 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 3729329 1353308 infinium 56356 0.4 S 00:41 webmaild - serving 1.41.252.211 3729376 1353308 infinium 56204 0.3 S 00:40 webmaild - serving 1.41.252.211 1353308 1 root 42388 0.0 Ss 48-08:32:06 cpsrvd (SSL) - waiting for connections 3730044 3728497 evolution 37032 2.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3730043 3710865 evolution 36840 2.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3730039 3728474 evolution 36420 1.5 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 509236 509098 root 36368 0.0 Sl 11-08:53:40 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3730040 1353308 root 32540 0.0 S 00:02 whostmgrd - serving 34.83.121.152 167562 166914 netdata 31660 0.1 Sl 2-08:50:55 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3729335 1542095 infinium 29468 0.4 S 00:41 php-fpm: pool user_infinium 1859745 1 root 27840 0.0 Ss 08:50:31 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3711617 506832 nobody 21768 0.0 S 03:24 /usr/sbin/httpd -k start 3711318 506832 nobody 21172 0.1 S 03:44 /usr/sbin/httpd -k start 3709763 506832 nobody 21116 0.1 S 05:30 /usr/sbin/httpd -k start 3727095 506832 nobody 21012 0.1 S 02:24 /usr/sbin/httpd -k start 3723873 506832 nobody 20888 0.0 S 03:08 /usr/sbin/httpd -k start 3710865 506832 nobody 20852 0.0 S 04:11 /usr/sbin/httpd -k start 3710516 506832 nobody 20668 0.0 S 04:30 /usr/sbin/httpd -k start 3725388 506832 nobody 20668 0.1 S 03:07 /usr/sbin/httpd -k start 3729427 1542095 infinium 20660 0.1 S 00:39 php-fpm: pool user_infinium 3727001 506832 nobody 20640 0.0 S 02:30 /usr/sbin/httpd -k start 3728472 506832 nobody 20468 0.1 S 01:30 /usr/sbin/httpd -k start 3727449 506832 nobody 20396 0.1 S 02:08 /usr/sbin/httpd -k start 3711653 506832 nobody 20212 0.0 S 03:21 /usr/sbin/httpd -k start 3728476 506832 nobody 20092 0.1 S 01:30 /usr/sbin/httpd -k start 3726631 506832 nobody 20056 0.1 S 02:54 /usr/sbin/httpd -k start 3709807 506832 nobody 20020 0.0 S 05:25 /usr/sbin/httpd -k start 3728474 506832 nobody 19960 0.1 S 01:30 /usr/sbin/httpd -k start 3728814 506832 nobody 19752 0.1 S 01:02 /usr/sbin/httpd -k start 3728388 506832 nobody 19668 0.0 S 01:32 /usr/sbin/httpd -k start 3728891 506832 nobody 19392 0.0 S 01:01 /usr/sbin/httpd -k start 3727123 506832 nobody 19280 0.1 S 02:23 /usr/sbin/httpd -k start 3728426 506832 nobody 19120 0.0 S 01:31 /usr/sbin/httpd -k start 3710785 506832 nobody 19016 0.0 S 04:15 /usr/sbin/httpd -k start 3728375 506832 nobody 19012 0.1 S 01:33 /usr/sbin/httpd -k start 3729072 506832 nobody 18888 0.0 S 01:00 /usr/sbin/httpd -k start 3728892 506832 nobody 18816 0.0 S 01:01 /usr/sbin/httpd -k start 3729466 506832 nobody 18736 0.1 S 00:36 /usr/sbin/httpd -k start 3726640 506832 nobody 18688 0.0 S 02:53 /usr/sbin/httpd -k start 3726673 506832 nobody 18564 0.1 S 02:52 /usr/sbin/httpd -k start 3726639 506832 nobody 18516 0.0 S 02:53 /usr/sbin/httpd -k start 3728475 506832 nobody 18448 0.0 S 01:30 /usr/sbin/httpd -k start 3729465 506832 nobody 18188 0.0 S 00:36 /usr/sbin/httpd -k start 3729911 506832 nobody 18156 0.0 S 00:12 /usr/sbin/httpd -k start 3728889 506832 nobody 17528 0.0 S 01:01 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 1588214 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 1588213 | root | 108-1481181613 | Execute | 0 | Sending data | SELECT SUM(mfbom.cost * mfbom.qty) AS cost FROM mfbom, inventory WHERE mfbom.mfsoid = '44087' AND mfbom.itemid = inventory.id AND inventory.uom NOT IN ('p/hr','p/h','p/day','p/hou','p/hour','hour | +---------+------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 363 evolution/portal.evolutionerp.com.au-ssl_log 317 aaa/aaadownunder.com.au-ssl_log 144 corpkicks/corporatekicks.com.au-ssl_log 85 vinesit/vinesit.com.au-ssl_log 35 bigdeals/bigdeals.com.au-ssl_log 6 customkidscom/customkids.com.au-ssl_log 2 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 385 203.54.180.238 127 34.83.121.152 89 120.21.58.67 68 1.144.107.82 62 103.104.165.99 46 103.104.164.114 36 116.91.221.245 35 34.85.16.151 23 34.130.246.123 14 180.181.236.49 12 118.127.40.55 11 182.239.240.254 10 203.166.236.147 10 120.21.154.188 6 34.125.26.76 --- top request paths across all vhosts (last 3 min) --- 171 POST /functions.php 133 GET /factory_session_checker.php 65 GET /factory_session_processed_qty.php 65 GET /factory_session_joiner.php 55 GET /app/ajax.php 41 GET /heartbeat.php 40 GET /index.php 35 POST /wp-admin/admin-ajax.php 17 POST /clienteditsave.php 17 POST /app/ajax/selectFilter.php 12 POST /wp-admin/async-upload.php 11 GET / 10 POST /plugins/csvexporter/plugin.php 9 POST /app/ajax/selectFilterSingle.php 9 POST /app/ajax.php 8 POST /invoiceaddsave.php 7 POST /wp-admin/admin-post.php 7 POST /plugins/shopify/plugin.php 6 POST /php/php.exe 6 POST /php/php-cgi.exe --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 171 POST /functions.php 55 GET /app/ajax.php 30 GET /index.php 17 POST /clienteditsave.php 17 POST /app/ajax/selectFilter.php 10 POST /plugins/csvexporter/plugin.php 9 POST /app/ajax/selectFilterSingle.php 9 POST /app/ajax.php 8 POST /invoiceaddsave.php 7 POST /plugins/shopify/plugin.php 6 POST /logsave.php 4 POST /itemModify.php -- last 10 requests -- 103.104.164.114 - - [08/Sep/2026:11:13:18 +1000] "POST /clienteditsave.php?clientid=982&call=getCategoryDiscounts HTTP/1.1" 200 25 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4109&tab=maintab" "Mo 203.54.180.238 - - [08/Sep/2026:11:13:18 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=28250&tab=invoicingtab" "Mozilla/5.0 (Windows NT 10.0; Win6 203.54.180.238 - - [08/Sep/2026:11:13:16 +1000] "POST /logsave.php?call=getHistory&id=28250&module=job HTTP/1.1" 200 1073 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=28250&tab=invoicingtab" "Mozilla/5.0 (Wi 103.104.164.114 - - [08/Sep/2026:11:13:18 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvoiceadd%26invoiceid%3D4109%26tab%3Dmaintab&call=getUserSetting&caller=ajaxSubmitLocal&seq=17747392418 HTTP/1.1" 200 112 "htt 203.54.180.238 - - [08/Sep/2026:11:13:19 +1000] "GET /app/ajax.php?cn=&furi=true&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=14348949786 HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=jobedit&id 103.104.164.114 - - [08/Sep/2026:11:13:18 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4109&tab=maintab" "Mozilla/5.0 (Windows NT 203.54.180.238 - - [08/Sep/2026:11:13:19 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 24747 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=28250&tab=invoicingtab" "Mozilla/5.0 (Windows NT 10.0; 203.54.180.238 - - [08/Sep/2026:11:13:19 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Djobedit%26id%3D28250%26tab%3Dinvoicingtab&call=getUserSetting&caller=ajaxSubmitLocal&seq=17329514471 HTTP/1.1" 203.54.180.238 - - [08/Sep/2026:11:13:19 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobedit%26id%3D28250%26tab%3Dinvoicingtab&call=getUserSetting&caller=ajaxSubmitLocal&seq=12931401176 HTTP/1.1" 200 114 "https:// 203.54.180.238 - - [08/Sep/2026:11:13:19 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=17996008526 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 133 GET /factory_session_checker.php 65 GET /factory_session_processed_qty.php 65 GET /factory_session_joiner.php 41 GET /heartbeat.php 10 GET /index.php 2 POST /portal/register 1 POST /factory_functions.php -- last 10 requests -- 203.54.180.238 - - [08/Sep/2026:11:13:09 +1000] "GET /factory_session_joiner.php?id=35197 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [08/Sep/2026:11:13:09 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:11:13:09 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:11:13:09 +1000] "GET /heartbeat.php?sentAt=1788829989&bytes=106,159,97,37&_=1788786031476 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [08/Sep/2026:11:13:10 +1000] "GET /heartbeat.php?sentAt=1788829991&bytes=106,159,97,39&_=1788829020985 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=11" 203.54.180.238 - - [08/Sep/2026:11:13:12 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:11:13:12 +1000] "GET /heartbeat.php?sentAt=1788829992&bytes=106,159,97,40&_=1788820329501 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [08/Sep/2026:11:13:13 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:11:13:14 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:11:13:14 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 5 POST / 5 GET / 3 POST /php/php.exe 3 POST /php/php-cgi.exe 3 POST /php-cgi/php-cgi.exe 3 POST /php-cgi/php-cgi 3 POST /cgi/php-cgi 3 POST /cgi/php 3 POST /cgi-bin/php-cgi.exe 3 POST /cgi-bin/php-cgi 3 POST /cgi-bin/php8.exe 3 POST /cgi-bin/php8 -- last 10 requests -- 34.83.121.152 - - [08/Sep/2026:11:13:00 +1000] "POST /cgi/php?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KH 34.83.121.152 - - [08/Sep/2026:11:13:00 +1000] "POST /cgi/php?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, 34.83.121.152 - - [08/Sep/2026:11:13:00 +1000] "POST /cgi/php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.83.121.152 - - [08/Sep/2026:11:13:00 +1000] "POST /cgi/php-cgi?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 34.83.121.152 - - [08/Sep/2026:11:13:00 +1000] "POST /cgi/php-cgi?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KH 34.83.121.152 - - [08/Sep/2026:11:13:01 +1000] "POST /cgi/php-cgi HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.83.121.152 - - [08/Sep/2026:11:13:01 +1000] "POST /php-cgi/php-cgi?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/53 34.83.121.152 - - [08/Sep/2026:11:13:01 +1000] "POST /php-cgi/php-cgi?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 34.83.121.152 - - [08/Sep/2026:11:13:01 +1000] "POST /php-cgi/php-cgi HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.83.121.152 - - [08/Sep/2026:11:13:01 +1000] "POST /php-cgi.exe?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 --- last 30 samples (run-up to this incident) --- 2026-09-08 11:10:49 L1=3.93 run=6 blk=0 avail=9926 (72.0%) swpO=0 conn=1 myRSS=1682 php=6 phpRSS=138 ap=41 tcp=63 topuser=evolution 2026-09-08 11:10:56 L1=3.77 run=3 blk=1 avail=9590 (69.6%) swpO=0 conn=2 myRSS=1682 php=6 phpRSS=409 ap=49 tcp=70 topuser=corpkicks 2026-09-08 11:10:59 L1=3.87 run=3 blk=1 avail=9135 (66.3%) swpO=0 conn=1 myRSS=1682 php=8 phpRSS=902 ap=53 tcp=67 topuser=corpkicks 2026-09-08 11:11:06 L1=3.72 run=2 blk=1 avail=9145 (66.4%) swpO=14 conn=4 myRSS=1682 php=6 phpRSS=900 ap=46 tcp=67 topuser=corpkicks 2026-09-08 11:11:09 L1=3.66 run=3 blk=1 avail=9251 (67.2%) swpO=14 conn=1 myRSS=1682 php=7 phpRSS=827 ap=44 tcp=79 topuser=corpkicks 2026-09-08 11:11:17 L1=3.69 run=7 blk=1 avail=8021 (58.2%) swpO=293 conn=10 myRSS=1671 php=12 phpRSS=2154 ap=52 tcp=98 topuser=corpkicks 2026-09-08 11:11:19 L1=4.04 run=3 blk=1 avail=8216 (59.6%) swpO=323 conn=9 myRSS=1671 php=13 phpRSS=1949 ap=53 tcp=86 topuser=corpkicks 2026-09-08 11:11:28 L1=3.72 run=8 blk=1 avail=7764 (56.4%) swpO=215 conn=11 myRSS=1667 php=13 phpRSS=2460 ap=48 tcp=106 topuser=corpkicks 2026-09-08 11:11:29 L1=3.72 run=2 blk=1 avail=7665 (55.6%) swpO=237 conn=11 myRSS=1667 php=13 phpRSS=2580 ap=47 tcp=96 topuser=corpkicks 2026-09-08 11:11:38 L1=3.85 run=4 blk=0 avail=7399 (53.7%) swpO=295 conn=12 myRSS=1657 php=15 phpRSS=2899 ap=43 tcp=95 topuser=corpkicks 2026-09-08 11:11:39 L1=3.85 run=2 blk=1 avail=7347 (53.3%) swpO=295 conn=12 myRSS=1657 php=14 phpRSS=2961 ap=43 tcp=105 topuser=corpkicks 2026-09-08 11:11:48 L1=3.65 run=4 blk=1 avail=7962 (57.8%) swpO=0 conn=10 myRSS=1657 php=13 phpRSS=2296 ap=44 tcp=67 topuser=corpkicks 2026-09-08 11:11:49 L1=3.65 run=4 blk=1 avail=8117 (58.9%) swpO=0 conn=10 myRSS=1657 php=12 phpRSS=2103 ap=48 tcp=78 topuser=corpkicks 2026-09-08 11:11:58 L1=3.55 run=2 blk=1 avail=7757 (56.3%) swpO=0 conn=11 myRSS=1675 php=12 phpRSS=2379 ap=55 tcp=68 topuser=corpkicks 2026-09-08 11:11:59 L1=3.55 run=3 blk=1 avail=8036 (58.3%) swpO=0 conn=9 myRSS=1675 php=11 phpRSS=2043 ap=55 tcp=68 topuser=corpkicks 2026-09-08 11:12:08 L1=3.23 run=2 blk=1 avail=8123 (59.0%) swpO=0 conn=8 myRSS=1675 php=10 phpRSS=1951 ap=51 tcp=63 topuser=corpkicks 2026-09-08 11:12:09 L1=3.23 run=1 blk=0 avail=8120 (58.9%) swpO=0 conn=8 myRSS=1675 php=10 phpRSS=1951 ap=51 tcp=63 topuser=corpkicks 2026-09-08 11:12:18 L1=3.44 run=14 blk=1 avail=7224 (52.4%) swpO=129 conn=14 myRSS=1672 php=16 phpRSS=3060 ap=54 tcp=76 topuser=corpkicks 2026-09-08 11:12:19 L1=3.44 run=3 blk=1 avail=7828 (56.8%) swpO=129 conn=10 myRSS=1672 php=12 phpRSS=2260 ap=66 tcp=79 topuser=corpkicks 2026-09-08 11:12:29 L1=3.14 run=4 blk=1 avail=7849 (57.0%) swpO=0 conn=10 myRSS=1672 php=12 phpRSS=2284 ap=60 tcp=60 topuser=corpkicks 2026-09-08 11:12:29 L1=3.14 run=4 blk=1 avail=7913 (57.4%) swpO=0 conn=10 myRSS=1672 php=12 phpRSS=2207 ap=59 tcp=70 topuser=corpkicks 2026-09-08 11:12:39 L1=2.81 run=8 blk=1 avail=8123 (59.0%) swpO=0 conn=11 myRSS=1672 php=13 phpRSS=1979 ap=52 tcp=71 topuser=corpkicks 2026-09-08 11:12:39 L1=2.81 run=7 blk=1 avail=7593 (55.1%) swpO=0 conn=15 myRSS=1672 php=16 phpRSS=2706 ap=51 tcp=81 topuser=corpkicks 2026-09-08 11:12:49 L1=3.07 run=5 blk=1 avail=8285 (60.1%) swpO=0 conn=7 myRSS=1672 php=9 phpRSS=1689 ap=56 tcp=91 topuser=corpkicks 2026-09-08 11:12:50 L1=3.07 run=2 blk=1 avail=8133 (59.0%) swpO=0 conn=9 myRSS=1672 php=11 phpRSS=1917 ap=56 tcp=81 topuser=corpkicks 2026-09-08 11:12:59 L1=2.91 run=1 blk=1 avail=8534 (61.9%) swpO=0 conn=7 myRSS=1692 php=9 phpRSS=1430 ap=56 tcp=76 topuser=corpkicks 2026-09-08 11:13:00 L1=2.91 run=1 blk=1 avail=8526 (61.9%) swpO=0 conn=9 myRSS=1693 php=9 phpRSS=1448 ap=56 tcp=74 topuser=corpkicks 2026-09-08 11:13:09 L1=2.62 run=4 blk=0 avail=8497 (61.7%) swpO=0 conn=6 myRSS=1694 php=8 phpRSS=1407 ap=57 tcp=68 topuser=corpkicks 2026-09-08 11:13:10 L1=2.62 run=2 blk=1 avail=8505 (61.7%) swpO=0 conn=9 myRSS=1694 php=9 phpRSS=1448 ap=57 tcp=63 topuser=corpkicks 2026-09-08 11:13:19 L1=3.24 run=8 blk=1 avail=8281 (60.1%) swpO=0 conn=9 myRSS=1710 php=16 phpRSS=1884 ap=52 tcp=73 topuser=corpkicks