INCIDENT 2026-09-08 20:57:40 trigger: php_rss=1819MB ================================================================== load: 3.65 1.99 1.76 18/674 1626238 ncpu:10 mem_avail: 8323MB/13777MB (60.4%) swap_used:2064MB swapout:213/s blocked(D):0 running:20 iowait:6.8% steal:0.0% php: 18 procs / 1819MB heaviest user: otterfencing (14 procs, 1661MB) apache: 53 procs tcp_estab: 56 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1647 otterfencing 14 1642 root 253 1118 nobody 52 625 netdata 8 230 madalice 1 155 cpanellogin 1 58 mailman 20 35 dovenull 6 25 alison 1 12 wp-toolkit 3 11 lowrange 1 11 candyfabcom 1 11 kurri 1 10 evolution 10 9 dovecot 3 9 zabbix 1 8 sshd 1 6 named 1 5 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB otterfencing 14 1525 madalice 1 155 root 1 2 evolution 2 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 7100 MB Active(file): 5775 MB Inactive(file): 854 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 679 MB CommitLimit: 10984 MB Committed_AS: 9627 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1624786 root 02:11 63548 /opt/imunify360/venv/bin/python3 -m imav.run 1624879 root 02:07 8136 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 1624916 root 02:02 415588 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress 3926885 root 7-18:35:15 3200 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 1686756 17.7 Ssl 16:12:12 /usr/sbin/mariadbd 1624916 1624879 root 415588 4.4 Sl 02:02 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 166870 1 netdata 186972 2.8 Ssl 2-18:35:21 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1626173 1626171 otterfencing 176008 54.3 R 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1626161 1625942 otterfencing 164440 33.4 R 00:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1625671 167896 madalice 159244 10.3 S 00:56 php-fpm: pool madalice_com_au 1626166 1625707 otterfencing 157920 38.5 R 00:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1911709 1859745 root 153544 0.0 S 18:20:30 spamd child 2328754 1 root 142688 0.0 Ss 16:12:22 /usr/lib/systemd/systemd-journald 1626172 1626170 otterfencing 131760 38.0 S 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1626181 1626175 otterfencing 123976 50.5 R 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1626150 1625949 otterfencing 107248 35.8 R 00:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1626180 1626177 otterfencing 100696 36.5 R 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1626191 1626189 otterfencing 100572 70.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1626178 1626174 otterfencing 89444 29.5 R 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1626192 1625951 otterfencing 86228 50.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1626179 1626176 otterfencing 84456 24.5 R 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1626190 1626185 otterfencing 76356 39.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4101451 1859745 root 72504 0.0 S 08:06:47 spamd child 1624786 1 root 63548 1.4 Ssl 02:11 /opt/imunify360/venv/bin/python3 -m imav.run 1350929 1353308 cpanellogin 59500 0.0 S 01:22:32 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 1353308 1 root 38700 0.0 Ss 48-18:16:27 cpsrvd (SSL) - waiting for connections 509236 509098 root 36632 0.0 Sl 11-18:38:01 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 35456 0.1 Ss 71-10:47:56 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 167562 166914 netdata 31456 0.1 Sl 2-18:35:16 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1859745 1 root 24708 0.0 Ss 18:34:52 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1609333 506832 nobody 22584 0.0 S 04:36 /usr/sbin/httpd -k start 1609361 506832 nobody 21360 0.0 S 04:35 /usr/sbin/httpd -k start 1609371 506832 nobody 19940 0.0 S 04:35 /usr/sbin/httpd -k start 1625709 506832 nobody 18388 0.0 S 00:49 /usr/sbin/httpd -k start 1625951 506832 nobody 17808 0.1 S 00:18 /usr/sbin/httpd -k start 1609366 506832 nobody 17552 0.0 S 04:35 /usr/sbin/httpd -k start 1593104 506832 nobody 17072 0.0 S 08:42 /usr/sbin/httpd -k start 1625908 506832 nobody 16420 0.0 S 00:21 /usr/sbin/httpd -k start 1625867 506832 nobody 16308 0.0 S 00:30 /usr/sbin/httpd -k start 1625866 506832 nobody 16160 0.0 S 00:30 /usr/sbin/httpd -k start 167566 166914 netdata 16060 2.3 Sl 2-18:35:16 /usr/libexec/netdata/plugins.d/apps.plugin 1 1625707 506832 nobody 15896 0.0 S 00:50 /usr/sbin/httpd -k start 1625947 506832 nobody 15628 0.0 S 00:19 /usr/sbin/httpd -k start 1625941 506832 nobody 15572 0.0 S 00:20 /usr/sbin/httpd -k start 1625944 506832 nobody 15492 0.0 S 00:19 /usr/sbin/httpd -k start 1625950 506832 nobody 15396 0.0 S 00:18 /usr/sbin/httpd -k start 1625942 506832 nobody 15348 0.0 S 00:20 /usr/sbin/httpd -k start 1626164 506832 nobody 15272 0.0 S 00:04 /usr/sbin/httpd -k start 1625946 506832 nobody 15256 0.0 S 00:19 /usr/sbin/httpd -k start 1625949 506832 nobody 15244 0.0 S 00:18 /usr/sbin/httpd -k start 1626184 506832 nobody 15232 0.0 S 00:01 /usr/sbin/httpd -k start 1625945 506832 nobody 15224 0.0 S 00:19 /usr/sbin/httpd -k start 1626170 506832 nobody 14916 0.0 S 00:03 /usr/sbin/httpd -k start 1626185 506832 nobody 14884 0.0 S 00:01 /usr/sbin/httpd -k start 1626177 506832 nobody 14872 0.0 S 00:02 /usr/sbin/httpd -k start 1626171 506832 nobody 14852 0.0 S 00:03 /usr/sbin/httpd -k start 1626176 506832 nobody 14852 0.0 S 00:02 /usr/sbin/httpd -k start 1626189 506832 nobody 14808 0.0 S 00:01 /usr/sbin/httpd -k start 1626174 506832 nobody 14684 0.0 S 00:02 /usr/sbin/httpd -k start 1626175 506832 nobody 14652 0.0 S 00:02 /usr/sbin/httpd -k start 1463 1 root 13644 0.0 Ss 71-10:47:56 tailwatchd 1626182 506832 nobody 13640 0.0 S 00:01 /usr/sbin/httpd -k start 1626183 506832 nobody 13640 0.0 S 00:01 /usr/sbin/httpd -k start 1626186 506832 nobody 13640 0.0 S 00:01 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3834813 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min otterfencing/otterfencing.com.au-ssl_log 55 customc/customcentral.com.au-ssl_log 41 evolution/portal.evolutionerp.com.au-ssl_log 12 madalice/madalice.com.au-ssl_log 6 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 55 34.79.170.118 41 20.151.10.161 12 203.54.180.238 2 101.42.46.71 1 2a03:2880:f802:1a:: 1 114.119.159.70 1 114.119.143.14 1 114.119.140.234 --- top request paths across all vhosts (last 3 min) --- 12 GET /heartbeat.php 5 GET / 1 GET /z60.php 1 GET /xex.php 1 GET /wsd.php 1 GET /w.php 1 GET /wp-content/uploads/ 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp_blog_footer.php 1 GET /wp-ainefgskk.php 1 GET /wmore1.php 1 GET /wander.php 1 GET /vpn.php 1 GET /this_is_a_new_hello_world.php 1 GET /tag/custo/ 1 GET /store/mad-alice-custom-shoe-magnetic-drop-side-display-cases/ 1 GET /store/lakers-custom-af1-shoes/ 1 GET /store/kids-custom-af1-blippi/ 1 GET /sss.php 1 GET /run.php --- busiest 3 vhosts: top paths + last 10 requests --- == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 3 GET / 1 GET /@fs/var/www/html/wp-config.php 1 GET /@fs/var/www/html/.env 1 GET /@fs/var/www/html/.aws/credentials 1 GET /@fs/var/www/.env 1 GET /@fs/var/www/.aws/credentials 1 GET /@fs/var/run/secrets/kubernetes.io/serviceaccount/token 1 GET /@fs/usr/src/app/.env 1 GET /@fs/usr/src/app/.aws/credentials 1 GET /@fs/src/.env 1 GET /@fs/root/terraform.tfstate 1 GET /@fs/root/.ssh/id_rsa -- last 10 requests -- 34.79.170.118 - - [08/Sep/2026:20:57:26 +1000] "GET /@fs/app/terraform.tfvars?raw?? HTTP/1.1" 404 56650 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Claude-SearchBot/1.0; +https://www.anthropic.co 34.79.170.118 - - [08/Sep/2026:20:57:26 +1000] "GET /@fs/app/.terraform/terraform.tfstate?raw?? HTTP/1.1" 404 56676 "-" "Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.1536.3 34.79.170.118 - - [08/Sep/2026:20:57:27 +1000] "GET /@fs/app/serverless.yml?raw?? HTTP/1.1" 404 56646 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; 34.79.170.118 - - [08/Sep/2026:20:57:36 +1000] "GET /@fs/root/.ssh/id_rsa?raw?? HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 34.79.170.118 - - [08/Sep/2026:20:57:36 +1000] "GET /@fs/root/.ssh/id_ed25519?raw?? HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; 34.79.170.118 - - [08/Sep/2026:20:57:36 +1000] "GET /@fs/var/www/html/wp-config.php?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.8777.84 Safari/537.36; c 34.79.170.118 - - [08/Sep/2026:20:57:38 +1000] "GET /@fs/home/ec2-user/.aws/config?raw?? HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 34.79.170.118 - - [08/Sep/2026:20:57:36 +1000] "GET /@fs/root/.config/hcloud/cli.toml?raw?? HTTP/1.1" 404 56670 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:143.6) Gecko/20100101 Firefox/143.6; compatible; Disco 34.79.170.118 - - [08/Sep/2026:20:57:36 +1000] "GET /@fs/var/run/secrets/kubernetes.io/serviceaccount/token?raw?? HTTP/1.1" 404 56718 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like 34.79.170.118 - - [08/Sep/2026:20:57:36 +1000] "GET /@fs/etc/apache2/apache2.conf?raw?? HTTP/1.1" 404 56660 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:105.2) Gecko/20100101 Firefox/105.2; compatible; LinkedInBo == customc/customcentral.com.au-ssl_log == -- top paths -- 1 GET /z60.php 1 GET /xex.php 1 GET /wsd.php 1 GET /w.php 1 GET /wp-content/uploads/ 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wp_blog_footer.php 1 GET /wp-ainefgskk.php 1 GET /wmore1.php 1 GET /wander.php 1 GET /vpn.php 1 GET /this_is_a_new_hello_world.php -- last 10 requests -- 20.151.10.161 - - [08/Sep/2026:20:55:57 +1000] "GET /media.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [08/Sep/2026:20:55:58 +1000] "GET /images.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [08/Sep/2026:20:55:58 +1000] "GET /ops.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [08/Sep/2026:20:55:59 +1000] "GET /BDKR28WP.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [08/Sep/2026:20:55:59 +1000] "GET /mac.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [08/Sep/2026:20:56:00 +1000] "GET /wmore1.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [08/Sep/2026:20:56:00 +1000] "GET /wp-ainefgskk.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [08/Sep/2026:20:56:01 +1000] "GET /ab.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [08/Sep/2026:20:56:01 +1000] "GET /dairg.php HTTP/1.1" 401 36 "-" "-" 20.151.10.161 - - [08/Sep/2026:20:56:02 +1000] "GET /z60.php HTTP/1.1" 401 36 "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 12 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [08/Sep/2026:20:55:26 +1000] "GET /heartbeat.php?sentAt=1788864926&bytes=106,159,233,158&_=1788860752706 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [08/Sep/2026:20:55:36 +1000] "GET /heartbeat.php?sentAt=1788864936&bytes=106,159,233,168&_=1788860752707 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [08/Sep/2026:20:55:46 +1000] "GET /heartbeat.php?sentAt=1788864946&bytes=106,159,233,178&_=1788860752708 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [08/Sep/2026:20:55:56 +1000] "GET /heartbeat.php?sentAt=1788864956&bytes=106,159,233,188&_=1788860752709 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [08/Sep/2026:20:56:06 +1000] "GET /heartbeat.php?sentAt=1788864966&bytes=106,159,233,198&_=1788860752710 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [08/Sep/2026:20:56:16 +1000] "GET /heartbeat.php?sentAt=1788864976&bytes=106,159,233,208&_=1788860752711 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [08/Sep/2026:20:56:26 +1000] "GET /heartbeat.php?sentAt=1788864986&bytes=106,159,233,218&_=1788860752712 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [08/Sep/2026:20:56:36 +1000] "GET /heartbeat.php?sentAt=1788864996&bytes=106,159,233,228&_=1788860752713 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [08/Sep/2026:20:56:46 +1000] "GET /heartbeat.php?sentAt=1788865006&bytes=106,159,233,238&_=1788860752714 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [08/Sep/2026:20:56:56 +1000] "GET /heartbeat.php?sentAt=1788865016&bytes=106,159,233,248&_=1788860752715 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 --- last 30 samples (run-up to this incident) --- 2026-09-08 20:55:11 L1=1.47 run=2 blk=1 avail=9832 (71.4%) swpO=0 conn=1 myRSS=1653 php=4 phpRSS=135 ap=14 tcp=21 topuser=madalice 2026-09-08 20:55:19 L1=1.32 run=3 blk=0 avail=9830 (71.4%) swpO=0 conn=1 myRSS=1653 php=4 phpRSS=132 ap=15 tcp=26 topuser=olympic 2026-09-08 20:55:21 L1=1.32 run=4 blk=2 avail=9836 (71.4%) swpO=0 conn=1 myRSS=1653 php=4 phpRSS=131 ap=16 tcp=26 topuser=olympic 2026-09-08 20:55:29 L1=1.50 run=2 blk=1 avail=9945 (72.2%) swpO=0 conn=1 myRSS=1653 php=5 phpRSS=273 ap=16 tcp=23 topuser=alison 2026-09-08 20:55:31 L1=1.50 run=2 blk=0 avail=10091(73.2%) swpO=0 conn=1 myRSS=1653 php=4 phpRSS=135 ap=16 tcp=22 topuser=madalice 2026-09-08 20:55:39 L1=1.58 run=4 blk=1 avail=10075(73.1%) swpO=0 conn=1 myRSS=1653 php=4 phpRSS=135 ap=14 tcp=23 topuser=madalice 2026-09-08 20:55:41 L1=1.58 run=1 blk=0 avail=10000(72.6%) swpO=0 conn=1 myRSS=1653 php=4 phpRSS=135 ap=14 tcp=26 topuser=madalice 2026-09-08 20:55:49 L1=1.49 run=2 blk=1 avail=9803 (71.2%) swpO=0 conn=1 myRSS=1653 php=4 phpRSS=157 ap=14 tcp=25 topuser=madalice 2026-09-08 20:55:51 L1=1.49 run=1 blk=1 avail=9800 (71.1%) swpO=0 conn=1 myRSS=1653 php=4 phpRSS=157 ap=14 tcp=23 topuser=madalice 2026-09-08 20:55:59 L1=1.49 run=3 blk=1 avail=9743 (70.7%) swpO=0 conn=1 myRSS=1653 php=6 phpRSS=270 ap=14 tcp=27 topuser=madalice 2026-09-08 20:56:02 L1=1.49 run=1 blk=1 avail=9679 (70.3%) swpO=0 conn=1 myRSS=1653 php=5 phpRSS=279 ap=15 tcp=26 topuser=madalice 2026-09-08 20:56:09 L1=1.41 run=1 blk=1 avail=9907 (71.9%) swpO=0 conn=1 myRSS=1653 php=3 phpRSS=2 ap=15 tcp=24 topuser=root 2026-09-08 20:56:12 L1=1.41 run=1 blk=1 avail=9912 (71.9%) swpO=0 conn=1 myRSS=1653 php=3 phpRSS=2 ap=15 tcp=19 topuser=root 2026-09-08 20:56:19 L1=1.50 run=1 blk=1 avail=9898 (71.8%) swpO=0 conn=1 myRSS=1653 php=3 phpRSS=2 ap=15 tcp=26 topuser=root 2026-09-08 20:56:22 L1=1.50 run=1 blk=1 avail=9897 (71.8%) swpO=0 conn=1 myRSS=1653 php=3 phpRSS=2 ap=15 tcp=24 topuser=root 2026-09-08 20:56:29 L1=1.42 run=1 blk=1 avail=9914 (72.0%) swpO=0 conn=1 myRSS=1653 php=3 phpRSS=2 ap=14 tcp=25 topuser=root 2026-09-08 20:56:32 L1=1.42 run=1 blk=1 avail=9912 (71.9%) swpO=0 conn=1 myRSS=1653 php=3 phpRSS=2 ap=14 tcp=24 topuser=root 2026-09-08 20:56:40 L1=1.28 run=1 blk=1 avail=9920 (72.0%) swpO=0 conn=1 myRSS=1653 php=3 phpRSS=2 ap=14 tcp=23 topuser=root 2026-09-08 20:56:42 L1=1.28 run=1 blk=1 avail=9920 (72.0%) swpO=0 conn=1 myRSS=1653 php=3 phpRSS=2 ap=14 tcp=22 topuser=root 2026-09-08 20:56:50 L1=1.24 run=1 blk=1 avail=9807 (71.2%) swpO=0 conn=1 myRSS=1653 php=4 phpRSS=133 ap=14 tcp=33 topuser=madalice 2026-09-08 20:56:52 L1=1.24 run=1 blk=0 avail=9765 (70.9%) swpO=0 conn=1 myRSS=1653 php=4 phpRSS=133 ap=21 tcp=32 topuser=madalice 2026-09-08 20:57:00 L1=1.13 run=3 blk=1 avail=9789 (71.1%) swpO=0 conn=1 myRSS=1653 php=5 phpRSS=169 ap=17 tcp=24 topuser=madalice 2026-09-08 20:57:02 L1=1.13 run=3 blk=1 avail=9454 (68.6%) swpO=0 conn=1 myRSS=1653 php=6 phpRSS=528 ap=16 tcp=26 topuser=corpkicks 2026-09-08 20:57:10 L1=1.42 run=2 blk=0 avail=9545 (69.3%) swpO=0 conn=3 myRSS=1653 php=6 phpRSS=436 ap=15 tcp=32 topuser=otterfencing 2026-09-08 20:57:12 L1=1.42 run=1 blk=1 avail=9748 (70.8%) swpO=0 conn=1 myRSS=1653 php=4 phpRSS=157 ap=17 tcp=29 topuser=madalice 2026-09-08 20:57:20 L1=1.91 run=10 blk=1 avail=9189 (66.7%) swpO=0 conn=3 myRSS=1653 php=13 phpRSS=984 ap=17 tcp=59 topuser=otterfencing 2026-09-08 20:57:22 L1=1.91 run=2 blk=1 avail=9662 (70.1%) swpO=93 conn=1 myRSS=1650 php=4 phpRSS=157 ap=31 tcp=45 topuser=madalice 2026-09-08 20:57:30 L1=1.77 run=2 blk=1 avail=9702 (70.4%) swpO=93 conn=3 myRSS=1651 php=4 phpRSS=157 ap=27 tcp=42 topuser=madalice 2026-09-08 20:57:32 L1=1.77 run=1 blk=1 avail=9718 (70.5%) swpO=0 conn=1 myRSS=1651 php=4 phpRSS=157 ap=26 tcp=23 topuser=madalice 2026-09-08 20:57:40 L1=3.65 run=20 blk=0 avail=8323 (60.4%) swpO=213 conn=14 myRSS=1647 php=18 phpRSS=1819 ap=53 tcp=56 topuser=otterfencing