INCIDENT 2026-09-08 11:14:20 trigger: php_rss=2075MB ================================================================== load: 3.08 3.18 3.12 4/653 3731114 ncpu:10 mem_avail: 8115MB/13777MB (58.9%) swap_used:1925MB swapout:0/s blocked(D):1 running:3 iowait:8.4% steal:0.0% php: 13 procs / 2075MB heaviest user: corpkicks (7 procs, 1903MB) apache: 48 procs tcp_estab: 50 --- RSS by user (all processes) --- USER PROCS RSS_MB corpkicks 7 1907 mysql 1 1711 nobody 47 779 root 249 756 netdata 8 228 madalice 1 118 cpanellogin 1 56 alison 5 56 evolution 11 49 mailman 20 36 dovenull 6 22 mailnull 3 21 wp-toolkit 3 12 kurri 1 10 dovecot 3 9 zabbix 1 7 named 1 6 nscd 1 4 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB corpkicks 7 1907 madalice 1 118 evolution 3 39 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6369 MB Active(file): 3515 MB Inactive(file): 3076 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 421 MB CommitLimit: 10984 MB Committed_AS: 10041 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 7-08:51:55 4724 /usr/bin/imunify-agent-proxy 4109079 root 3-06:29:33 1388 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 3-06:29:33 85988 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 1752776 18.1 Ssl 06:28:52 /usr/sbin/mariadbd 3727366 3727158 corpkicks 296264 1.0 S 03:13 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3728284 3710785 corpkicks 289328 1.0 S 02:42 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3728052 3727476 corpkicks 289084 0.9 S 02:57 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3728190 3727122 corpkicks 282120 1.0 S 02:49 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3728220 3726431 corpkicks 282088 1.0 S 02:45 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3731075 3730756 corpkicks 267756 65.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3731076 3731040 corpkicks 254132 64.0 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1911708 1859745 root 185704 0.1 S 08:37:10 spamd child 166870 1 netdata 184848 2.8 Ssl 2-08:52:01 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1911709 1859745 root 131128 0.0 S 08:37:10 spamd child 3731072 167896 madalice 121500 57.0 S 00:02 php-fpm: pool madalice_com_au 2328754 1 root 107664 0.0 Ss 06:29:02 /usr/lib/systemd/systemd-journald 4109105 4109079 root 85988 1.1 Sl 3-06:29:33 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 3673446 1353308 cpanellogin 57552 0.0 S 15:45 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 1353308 1 root 42388 0.0 Ss 48-08:33:07 cpsrvd (SSL) - waiting for connections 3731081 3730667 evolution 40532 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3731142 3728475 evolution 38760 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 509236 509098 root 36368 0.0 Sl 11-08:54:41 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 167562 166914 netdata 31660 0.1 Sl 2-08:51:56 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1859745 1 root 27840 0.0 Ss 08:51:32 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3725388 506832 nobody 21684 0.0 S 04:08 /usr/sbin/httpd -k start 3728388 506832 nobody 21196 0.1 S 02:33 /usr/sbin/httpd -k start 3709763 506832 nobody 21180 0.1 S 06:31 /usr/sbin/httpd -k start 3728475 506832 nobody 20948 0.0 S 02:31 /usr/sbin/httpd -k start 3727001 506832 nobody 20712 0.0 S 03:31 /usr/sbin/httpd -k start 3727449 506832 nobody 20604 0.1 S 03:09 /usr/sbin/httpd -k start 3730388 506832 nobody 20492 0.0 S 00:58 /usr/sbin/httpd -k start 3728476 506832 nobody 20264 0.1 S 02:31 /usr/sbin/httpd -k start 3730384 506832 nobody 20032 0.1 S 00:58 /usr/sbin/httpd -k start 3728891 506832 nobody 19620 0.1 S 02:02 /usr/sbin/httpd -k start 3728387 506832 nobody 19504 0.0 S 02:33 /usr/sbin/httpd -k start 3728892 506832 nobody 19472 0.0 S 02:02 /usr/sbin/httpd -k start 3730364 506832 nobody 19416 0.0 S 01:00 /usr/sbin/httpd -k start 3729466 506832 nobody 19124 0.0 S 01:37 /usr/sbin/httpd -k start 3710785 506832 nobody 19016 0.0 S 05:16 /usr/sbin/httpd -k start 3730382 506832 nobody 18668 0.1 S 00:58 /usr/sbin/httpd -k start 3730738 506832 nobody 18612 0.0 S 00:29 /usr/sbin/httpd -k start 3730389 506832 nobody 18468 0.0 S 00:58 /usr/sbin/httpd -k start 3729537 506832 nobody 18292 0.0 S 01:33 /usr/sbin/httpd -k start 3730387 506832 nobody 18240 0.0 S 00:58 /usr/sbin/httpd -k start 3730748 506832 nobody 18068 0.0 S 00:28 /usr/sbin/httpd -k start 3729698 506832 nobody 18052 0.1 S 01:23 /usr/sbin/httpd -k start 3728889 506832 nobody 17992 0.0 S 02:02 /usr/sbin/httpd -k start 3729077 506832 nobody 17488 0.0 S 02:01 /usr/sbin/httpd -k start 3730316 506832 nobody 17204 0.0 S 01:01 /usr/sbin/httpd -k start 3729459 506832 nobody 17200 0.0 S 01:38 /usr/sbin/httpd -k start 3727122 506832 nobody 16960 0.0 S 03:24 /usr/sbin/httpd -k start 3729538 506832 nobody 16880 0.0 S 01:33 /usr/sbin/httpd -k start 3730667 506832 nobody 16864 0.0 S 00:31 /usr/sbin/httpd -k start 3729684 506832 nobody 16852 0.0 S 01:24 /usr/sbin/httpd -k start 3726431 506832 nobody 16800 0.0 S 04:07 /usr/sbin/httpd -k start 3730660 506832 nobody 16556 0.0 S 00:32 /usr/sbin/httpd -k start 3730363 506832 nobody 16504 0.0 S 01:00 /usr/sbin/httpd -k start 3730756 506832 nobody 16476 0.1 S 00:27 /usr/sbin/httpd -k start 3727158 506832 nobody 16464 0.0 S 03:23 /usr/sbin/httpd -k start 3730758 506832 nobody 16440 0.1 S 00:27 /usr/sbin/httpd -k start 3730371 506832 nobody 16316 0.0 S 00:59 /usr/sbin/httpd -k start 3730669 506832 nobody 16280 0.0 S 00:31 /usr/sbin/httpd -k start 3731042 506832 nobody 15984 0.0 S 00:07 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+---------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+---------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 1591258 | root | 85-1559715131 | Killed | 0 | | NULL | | 1591256 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+---------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 384 evolution/portal.evolutionerp.com.au-ssl_log 335 aaa/aaadownunder.com.au-ssl_log 138 corpkicks/corporatekicks.com.au-ssl_log 83 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 460 203.54.180.238 127 34.83.121.152 65 1.144.107.82 57 120.21.58.67 57 103.104.165.99 44 116.91.221.245 31 103.104.164.114 28 34.130.246.123 25 203.166.236.147 11 180.181.236.49 10 120.21.154.188 8 118.127.40.55 6 182.239.240.254 4 165.225.233.87 3 101.166.96.210 --- top request paths across all vhosts (last 3 min) --- 169 POST /functions.php 135 GET /factory_session_checker.php 66 GET /factory_session_processed_qty.php 66 GET /factory_session_joiner.php 51 GET /app/ajax.php 47 GET /index.php 44 POST /wp-admin/admin-ajax.php 41 GET /heartbeat.php 19 POST /plugins/csvexporter/plugin.php 19 POST /app/ajax/selectFilter.php 11 POST /quoteditsave.php 11 POST /clienteditsave.php 10 POST /app/ajax.php 9 POST /itemModify.php 9 POST /inveditsave.php 8 POST /portal/register 8 POST /app/ajax/selectFilterSingle.php 8 GET / 6 POST /wp-cron.php 6 POST /opportunityeditsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 169 POST /functions.php 51 GET /app/ajax.php 32 GET /index.php 19 POST /plugins/csvexporter/plugin.php 19 POST /app/ajax/selectFilter.php 11 POST /quoteditsave.php 11 POST /clienteditsave.php 10 POST /app/ajax.php 9 POST /itemModify.php 9 POST /inveditsave.php 8 POST /app/ajax/selectFilterSingle.php 6 POST /opportunityeditsave.php -- last 10 requests -- 203.54.180.238 - - [08/Sep/2026:11:14:12 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:11:14:12 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invedithist&id=3640&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 203.54.180.238 - - [08/Sep/2026:11:14:12 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 285 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29468" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 120.21.58.67 - - [08/Sep/2026:11:14:12 +1000] "POST /quoteditsave.php?call=getTheQuotes HTTP/1.1" 200 14826 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 203.166.236.147 - - [08/Sep/2026:11:14:12 +1000] "POST /quoteditsave.php?call=addLineItem HTTP/1.1" 200 303 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=37115§ionid=32989" "Mozilla/5.0 (Windows NT 203.54.180.238 - - [08/Sep/2026:11:14:14 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=28937&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 103.104.165.99 - - [08/Sep/2026:11:14:16 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 203.54.180.238 - - [08/Sep/2026:11:14:17 +1000] "GET /index.php?page=invedit&id=255&tab=generaltab HTTP/1.1" 200 36812 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 203.54.180.238 - - [08/Sep/2026:11:14:17 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invedit&id=255&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 203.54.180.238 - - [08/Sep/2026:11:14:17 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvedit%26id%3D255%26tab%3Dgeneraltab&call=getUserSetting&caller=ajaxSubmitLocal&seq=10045705259 HTTP/1.1" 200 108 "https://my.e == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 135 GET /factory_session_checker.php 66 GET /factory_session_processed_qty.php 66 GET /factory_session_joiner.php 41 GET /heartbeat.php 15 GET /index.php 8 POST /portal/register 1 POST /login.php 1 POST /factory_functions.php 1 GET /userlogin.php 1 GET /logoff.php -- last 10 requests -- 203.54.180.238 - - [08/Sep/2026:11:14:12 +1000] "GET /heartbeat.php?sentAt=1788830052&bytes=106,159,97,100&_=1788820329507 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [08/Sep/2026:11:14:13 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:11:14:14 +1000] "GET /index.php?page=inventory_picking HTTP/1.1" 200 9477 "https://portal.evolutionerp.com.au/index.php" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like 203.54.180.238 - - [08/Sep/2026:11:14:14 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php?page=inventory_picking" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, 203.54.180.238 - - [08/Sep/2026:11:14:15 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:11:14:15 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:11:14:16 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [08/Sep/2026:11:14:16 +1000] "GET /factory_session_joiner.php?id=35192 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [08/Sep/2026:11:14:16 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [08/Sep/2026:11:14:16 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 5 POST / 5 GET / 3 POST /php/php.exe 3 POST /php/php-cgi.exe 3 POST /php-cgi/php-cgi.exe 3 POST /php-cgi/php-cgi 3 POST /cgi/php-cgi 3 POST /cgi/php 3 POST /cgi-bin/php-cgi.exe 3 POST /cgi-bin/php-cgi 3 POST /cgi-bin/php8.exe 3 POST /cgi-bin/php8 -- last 10 requests -- 34.83.121.152 - - [08/Sep/2026:11:13:00 +1000] "POST /cgi/php?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KH 34.83.121.152 - - [08/Sep/2026:11:13:00 +1000] "POST /cgi/php?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, 34.83.121.152 - - [08/Sep/2026:11:13:00 +1000] "POST /cgi/php HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.83.121.152 - - [08/Sep/2026:11:13:00 +1000] "POST /cgi/php-cgi?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 34.83.121.152 - - [08/Sep/2026:11:13:00 +1000] "POST /cgi/php-cgi?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KH 34.83.121.152 - - [08/Sep/2026:11:13:01 +1000] "POST /cgi/php-cgi HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.83.121.152 - - [08/Sep/2026:11:13:01 +1000] "POST /php-cgi/php-cgi?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/53 34.83.121.152 - - [08/Sep/2026:11:13:01 +1000] "POST /php-cgi/php-cgi?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 34.83.121.152 - - [08/Sep/2026:11:13:01 +1000] "POST /php-cgi/php-cgi HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.83.121.152 - - [08/Sep/2026:11:13:01 +1000] "POST /php-cgi.exe?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 404 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 --- last 30 samples (run-up to this incident) --- 2026-09-08 11:11:49 L1=3.65 run=4 blk=1 avail=8117 (58.9%) swpO=0 conn=10 myRSS=1657 php=12 phpRSS=2103 ap=48 tcp=78 topuser=corpkicks 2026-09-08 11:11:58 L1=3.55 run=2 blk=1 avail=7757 (56.3%) swpO=0 conn=11 myRSS=1675 php=12 phpRSS=2379 ap=55 tcp=68 topuser=corpkicks 2026-09-08 11:11:59 L1=3.55 run=3 blk=1 avail=8036 (58.3%) swpO=0 conn=9 myRSS=1675 php=11 phpRSS=2043 ap=55 tcp=68 topuser=corpkicks 2026-09-08 11:12:08 L1=3.23 run=2 blk=1 avail=8123 (59.0%) swpO=0 conn=8 myRSS=1675 php=10 phpRSS=1951 ap=51 tcp=63 topuser=corpkicks 2026-09-08 11:12:09 L1=3.23 run=1 blk=0 avail=8120 (58.9%) swpO=0 conn=8 myRSS=1675 php=10 phpRSS=1951 ap=51 tcp=63 topuser=corpkicks 2026-09-08 11:12:18 L1=3.44 run=14 blk=1 avail=7224 (52.4%) swpO=129 conn=14 myRSS=1672 php=16 phpRSS=3060 ap=54 tcp=76 topuser=corpkicks 2026-09-08 11:12:19 L1=3.44 run=3 blk=1 avail=7828 (56.8%) swpO=129 conn=10 myRSS=1672 php=12 phpRSS=2260 ap=66 tcp=79 topuser=corpkicks 2026-09-08 11:12:29 L1=3.14 run=4 blk=1 avail=7849 (57.0%) swpO=0 conn=10 myRSS=1672 php=12 phpRSS=2284 ap=60 tcp=60 topuser=corpkicks 2026-09-08 11:12:29 L1=3.14 run=4 blk=1 avail=7913 (57.4%) swpO=0 conn=10 myRSS=1672 php=12 phpRSS=2207 ap=59 tcp=70 topuser=corpkicks 2026-09-08 11:12:39 L1=2.81 run=8 blk=1 avail=8123 (59.0%) swpO=0 conn=11 myRSS=1672 php=13 phpRSS=1979 ap=52 tcp=71 topuser=corpkicks 2026-09-08 11:12:39 L1=2.81 run=7 blk=1 avail=7593 (55.1%) swpO=0 conn=15 myRSS=1672 php=16 phpRSS=2706 ap=51 tcp=81 topuser=corpkicks 2026-09-08 11:12:49 L1=3.07 run=5 blk=1 avail=8285 (60.1%) swpO=0 conn=7 myRSS=1672 php=9 phpRSS=1689 ap=56 tcp=91 topuser=corpkicks 2026-09-08 11:12:50 L1=3.07 run=2 blk=1 avail=8133 (59.0%) swpO=0 conn=9 myRSS=1672 php=11 phpRSS=1917 ap=56 tcp=81 topuser=corpkicks 2026-09-08 11:12:59 L1=2.91 run=1 blk=1 avail=8534 (61.9%) swpO=0 conn=7 myRSS=1692 php=9 phpRSS=1430 ap=56 tcp=76 topuser=corpkicks 2026-09-08 11:13:00 L1=2.91 run=1 blk=1 avail=8526 (61.9%) swpO=0 conn=9 myRSS=1693 php=9 phpRSS=1448 ap=56 tcp=74 topuser=corpkicks 2026-09-08 11:13:09 L1=2.62 run=4 blk=0 avail=8497 (61.7%) swpO=0 conn=6 myRSS=1694 php=8 phpRSS=1407 ap=57 tcp=68 topuser=corpkicks 2026-09-08 11:13:10 L1=2.62 run=2 blk=1 avail=8505 (61.7%) swpO=0 conn=9 myRSS=1694 php=9 phpRSS=1448 ap=57 tcp=63 topuser=corpkicks 2026-09-08 11:13:19 L1=3.24 run=8 blk=1 avail=8281 (60.1%) swpO=0 conn=9 myRSS=1710 php=16 phpRSS=1884 ap=52 tcp=73 topuser=corpkicks 2026-09-08 11:13:20 L1=3.24 run=11 blk=1 avail=8006 (58.1%) swpO=0 conn=11 myRSS=1710 php=19 phpRSS=2233 ap=53 tcp=76 topuser=corpkicks 2026-09-08 11:13:29 L1=3.26 run=2 blk=1 avail=8449 (61.3%) swpO=0 conn=9 myRSS=1711 php=9 phpRSS=1470 ap=63 tcp=50 topuser=corpkicks 2026-09-08 11:13:30 L1=3.26 run=2 blk=1 avail=8394 (60.9%) swpO=0 conn=8 myRSS=1711 php=10 phpRSS=1553 ap=62 tcp=50 topuser=corpkicks 2026-09-08 11:13:39 L1=3.22 run=1 blk=1 avail=8525 (61.9%) swpO=0 conn=9 myRSS=1711 php=9 phpRSS=1464 ap=52 tcp=60 topuser=corpkicks 2026-09-08 11:13:40 L1=3.22 run=2 blk=0 avail=8535 (62.0%) swpO=0 conn=8 myRSS=1711 php=10 phpRSS=1504 ap=52 tcp=59 topuser=corpkicks 2026-09-08 11:13:49 L1=3.35 run=9 blk=1 avail=8444 (61.3%) swpO=0 conn=9 myRSS=1711 php=11 phpRSS=1658 ap=54 tcp=69 topuser=corpkicks 2026-09-08 11:13:50 L1=3.35 run=5 blk=2 avail=8131 (59.0%) swpO=0 conn=11 myRSS=1711 php=13 phpRSS=2003 ap=54 tcp=70 topuser=corpkicks 2026-09-08 11:13:59 L1=3.37 run=1 blk=1 avail=8471 (61.5%) swpO=0 conn=7 myRSS=1711 php=10 phpRSS=1585 ap=57 tcp=66 topuser=corpkicks 2026-09-08 11:14:00 L1=3.37 run=3 blk=1 avail=8438 (61.3%) swpO=0 conn=7 myRSS=1711 php=11 phpRSS=1641 ap=57 tcp=64 topuser=corpkicks 2026-09-08 11:14:10 L1=3.46 run=2 blk=1 avail=8466 (61.5%) swpO=0 conn=8 myRSS=1711 php=11 phpRSS=1666 ap=48 tcp=60 topuser=corpkicks 2026-09-08 11:14:10 L1=3.46 run=2 blk=1 avail=8357 (60.7%) swpO=0 conn=8 myRSS=1711 php=11 phpRSS=1775 ap=48 tcp=60 topuser=corpkicks 2026-09-08 11:14:20 L1=3.08 run=3 blk=1 avail=8115 (58.9%) swpO=0 conn=9 myRSS=1711 php=13 phpRSS=2075 ap=48 tcp=50 topuser=corpkicks