INCIDENT 2026-08-14 14:01:52 trigger: php_rss=1610MB ================================================================== load: 3.60 2.29 1.88 18/618 1938704 ncpu:10 mem_avail: 6435MB/11729MB (54.9%) swap_used:1153MB swapout:0/s blocked(D):0 running:15 iowait:0.0% steal:0.0% php: 15 procs / 1610MB heaviest user: customc (14 procs, 1351MB) apache: 37 procs tcp_estab: 76 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1895 customc 12 1111 root 238 849 nobody 38 610 corpkicks 2 272 netdata 8 266 cpanellogin 1 89 kurri 3 36 dovenull 6 28 wp-toolkit 6 20 mailman 20 15 infinium 1 13 alison 1 13 vinesit 1 12 mailnull 3 12 lowrange 1 12 zabbix 1 11 dovecot 3 8 named 1 6 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB customc 11 1061 corpkicks 1 259 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4926 MB Active(file): 4464 MB Inactive(file): 654 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 356 MB CommitLimit: 9960 MB Committed_AS: 8086 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1404480 root 12:50:36 2676 /usr/bin/imunify-agent-proxy 1937202 root 01:52 1232 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 1420296 1 mysql 1941072 17.3 Ssl 12:22:51 /usr/sbin/mariadbd 1938651 1938302 corpkicks 265472 64.5 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1220 1 netdata 215700 2.5 Ssl 46-03:51:54 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1451534 1444234 root 179468 0.0 S 11:24:45 spamd child 1938668 1937507 customc 157908 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1938666 1937080 customc 155928 71.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1938662 1937809 customc 151636 73.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 159820 1 root 146800 0.0 Rs 25-04:15:02 /usr/lib/systemd/systemd-journald 1938665 1937087 customc 140252 60.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1938664 1937694 customc 131780 56.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1938669 1935065 customc 130904 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1444234 1 root 126428 0.0 Ss 11:39:04 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1938661 1938534 customc 123620 57.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1910802 1444234 root 119508 0.0 S 33:18 spamd child 1938670 1938512 customc 113752 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1902528 1353308 cpanellogin 91164 0.0 S 42:18 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 1938682 1938294 customc 91104 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1938701 1933967 customc 85344 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1938713 1935562 customc 65696 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1353308 1 root 42204 0.0 Ss 23-11:20:24 cpsrvd (SSL) - waiting for connections 1469 1 root 41892 0.1 Ss 46-03:51:53 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1938730 1937480 customc 39296 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2223 1201 root 38208 0.0 Sl 46-03:51:53 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1938739 1938200 customc 38188 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4922 2431 netdata 33700 0.1 Sl 46-03:51:49 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1443709 1 root 25868 0.0 Ss 11:39:39 lfd - sleeping 1935065 1276780 nobody 22512 0.0 S 04:07 /usr/sbin/httpd -k start 1935562 1276780 nobody 22236 0.0 S 03:31 /usr/sbin/httpd -k start 1934548 1276780 nobody 20960 0.0 S 04:37 /usr/sbin/httpd -k start 1931531 1276780 nobody 20920 0.0 S 08:39 /usr/sbin/httpd -k start 1935884 1276780 nobody 20260 0.0 S 03:12 /usr/sbin/httpd -k start 1933967 1276780 nobody 20148 0.0 S 05:32 /usr/sbin/httpd -k start 1936942 1276780 nobody 20036 0.0 S 02:18 /usr/sbin/httpd -k start 1934359 1276780 nobody 19956 0.0 S 04:52 /usr/sbin/httpd -k start 1936232 1276780 nobody 19896 0.0 S 03:03 /usr/sbin/httpd -k start 1937507 1276780 nobody 19884 0.0 S 01:40 /usr/sbin/httpd -k start 1937877 1276780 nobody 19520 0.0 S 01:10 /usr/sbin/httpd -k start 1936292 1276780 nobody 19172 0.0 S 03:01 /usr/sbin/httpd -k start 1935066 1276780 nobody 18964 0.0 S 04:07 /usr/sbin/httpd -k start 1938200 1276780 nobody 18616 0.0 S 00:41 /usr/sbin/httpd -k start 1937823 1276780 nobody 18200 0.0 S 01:13 /usr/sbin/httpd -k start 1937087 1276780 nobody 18172 0.0 S 02:02 /usr/sbin/httpd -k start 1937480 1276780 nobody 17860 0.0 S 01:41 /usr/sbin/httpd -k start 1938238 1276780 nobody 17832 0.0 S 00:40 /usr/sbin/httpd -k start 1937809 1276780 nobody 17692 0.0 S 01:14 /usr/sbin/httpd -k start 1937080 1276780 nobody 17204 0.0 S 02:03 /usr/sbin/httpd -k start 1937694 1276780 nobody 16928 0.0 S 01:22 /usr/sbin/httpd -k start 1938302 1276780 nobody 16796 0.0 S 00:34 /usr/sbin/httpd -k start 1937876 1276780 nobody 16216 0.0 S 01:10 /usr/sbin/httpd -k start 1938280 1276780 nobody 15740 0.0 S 00:38 /usr/sbin/httpd -k start 1938294 1276780 nobody 15680 0.0 S 00:35 /usr/sbin/httpd -k start 1938507 1276780 nobody 15564 0.1 S 00:16 /usr/sbin/httpd -k start 1938612 1276780 nobody 15552 0.1 S 00:09 /usr/sbin/httpd -k start 1938511 1276780 nobody 15520 0.0 S 00:15 /usr/sbin/httpd -k start 1938534 1276780 nobody 15456 0.0 S 00:14 /usr/sbin/httpd -k start 1938512 1276780 nobody 15428 0.0 S 00:15 /usr/sbin/httpd -k start 1938536 1276780 nobody 15372 0.0 S 00:14 /usr/sbin/httpd -k start 1601939 1471 root 15360 0.0 S 06:48:54 cPhulkd - dbprocessor 1938613 1276780 nobody 15252 0.1 S 00:09 /usr/sbin/httpd -k start 1938033 1471 root 15104 0.0 S 00:56 cPhulkd - processor - http socket --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3157454 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 657 evolution/portal.evolutionerp.com.au-ssl_log 126 customc/customcentral.com.au-ssl_log 76 aaa/aaadownunder.com.au-ssl_log 25 madalice/madalice.com.au-ssl_log 7 corpkicks/corporatekicks.com.au-ssl_log 4 alison/alisonarts.com.au-ssl_log 3 olympic/olympicfencing.com.au-ssl_log 2 alison/alisonarts.com.au 1 olympic/olympicfencing.com.au 1 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 381 203.54.180.238 169 103.104.164.114 125 103.104.165.99 75 34.126.80.180 49 116.91.223.103 24 120.19.183.39 19 165.225.233.109 16 147.161.215.89 8 180.181.236.49 6 147.161.213.98 5 182.239.240.254 5 118.127.40.55 4 114.119.137.101 2 91.92.243.249 2 43.155.27.244 --- top request paths across all vhosts (last 3 min) --- 288 POST /functions.php 113 GET /app/ajax.php 54 GET /index.php 48 POST /app/ajax/selectFilter.php 47 GET /heartbeat.php 30 GET /factory_session_checker.php 26 POST /clienteditsave.php 20 POST /plugins/csvexporter/plugin.php 20 POST /app/ajax.php 18 POST /jobeditsave.php 16 POST /app/ajax/selectFilterSingle.php 15 POST /quoteditsave.php 15 GET /factory_session_processed_qty.php 15 GET /factory_session_joiner.php 11 POST /dispatchsave.php 10 GET / 8 POST /logsave.php 5 POST /wp-cron.php 5 GET //app/ajax.php 4 POST /testTagUploadsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 288 POST /functions.php 113 GET /app/ajax.php 48 POST /app/ajax/selectFilter.php 40 GET /index.php 26 POST /clienteditsave.php 20 POST /plugins/csvexporter/plugin.php 20 POST /app/ajax.php 18 POST /jobeditsave.php 16 POST /app/ajax/selectFilterSingle.php 15 POST /quoteditsave.php 11 POST /dispatchsave.php 8 POST /logsave.php -- last 10 requests -- 147.161.215.89 - - [14/Aug/2026:14:01:46 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=siteedit&siteid=3209" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 103.104.164.114 - - [14/Aug/2026:14:01:47 +1000] "POST /quoteditsave.php?call=addLineItem HTTP/1.1" 200 264 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=1628§ionid=0" "Mozilla/5.0 (Windows NT 10.0; 120.19.183.39 - - [14/Aug/2026:14:01:49 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=invedit&id=4888&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 120.19.183.39 - - [14/Aug/2026:14:01:49 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=invedit&id=4921&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 120.19.183.39 - - [14/Aug/2026:14:01:49 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=28921" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 120.19.183.39 - - [14/Aug/2026:14:01:49 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29132" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 120.19.183.39 - - [14/Aug/2026:14:01:49 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 285 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29045" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 120.19.183.39 - - [14/Aug/2026:14:01:49 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=13598" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 120.19.183.39 - - [14/Aug/2026:14:01:49 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=28288" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 120.19.183.39 - - [14/Aug/2026:14:01:49 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 285 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29049" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 47 GET /heartbeat.php 30 GET /factory_session_checker.php 15 GET /factory_session_processed_qty.php 15 GET /factory_session_joiner.php 14 GET /index.php 3 GET /uploadsave.php 2 POST /portal/register -- last 10 requests -- 203.54.180.238 - - [14/Aug/2026:14:01:20 +1000] "GET /heartbeat.php?sentAt=1786680080&bytes=106,126,147,16&_=1786602375116 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:14:01:22 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:14:01:22 +1000] "GET /heartbeat.php?sentAt=1786680082&bytes=106,126,147,18&_=1786679352252 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=5" 203.54.180.238 - - [14/Aug/2026:14:01:25 +1000] "GET /heartbeat.php?sentAt=1786680083&bytes=106,126,147,19&_=1786676060347 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:14:01:27 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:14:01:28 +1000] "GET /factory_session_joiner.php?id=34614 HTTP/1.1" 200 79 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [14/Aug/2026:14:01:29 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 127 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [14/Aug/2026:14:01:30 +1000] "GET /heartbeat.php?sentAt=1786680090&bytes=106,126,147,26&_=1786602375117 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [14/Aug/2026:14:01:32 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [14/Aug/2026:14:01:32 +1000] "GET /heartbeat.php?sentAt=1786680092&bytes=106,126,147,28&_=1786679352253 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=5" == customc/customcentral.com.au-ssl_log == -- top paths -- 6 GET / 2 GET /@fs/root/terraform.tfstate 2 GET /@fs/root/rootkey.csv 2 GET /@fs/root/.aws/credentials.bak 2 GET /@fs/proc/self/environ 2 GET /@fs/etc/passwd 2 GET /@fs/app/terraform.tfvars 2 GET /@fs/app/terraform.tfstate 2 GET /@fs/app/.terraform/terraform.tfstate 2 GET /@fs/app/serverless.yml 2 GET /@fs/app/rootkey.csv 2 GET /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ -- last 10 requests -- 34.126.80.180 - - [14/Aug/2026:14:01:51 +1000] "GET /@fs/var/www/html/wp-config.php?raw?? HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" 34.126.80.180 - - [14/Aug/2026:14:01:51 +1000] "GET /@fs/etc/nginx/nginx.conf?raw?? HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.126.80.180 - - [14/Aug/2026:14:01:51 +1000] "GET /@fs/var/run/secrets/kubernetes.io/serviceaccount/token?raw?? HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 34.126.80.180 - - [14/Aug/2026:14:01:51 +1000] "GET /@fs/etc/apache2/apache2.conf?raw?? HTTP/1.1" 301 - "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 34.126.80.180 - - [14/Aug/2026:14:01:51 +1000] "GET /@fs/proc/self/cmdline?raw?? HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 34.126.80.180 - - [14/Aug/2026:14:01:52 +1000] "GET /@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ?raw?? HTTP/1.1" 301 - "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://op 34.126.80.180 - - [14/Aug/2026:14:01:52 +1000] "GET /@fs/..%2f..%2f..%2f..%2f..%2froot/.env?raw?? HTTP/1.1" 301 - "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com 34.126.80.180 - - [14/Aug/2026:14:01:52 +1000] "GET /@fs/../../../../../app/.env?raw?? HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 34.126.80.180 - - [14/Aug/2026:14:01:53 +1000] "GET /@fs/home/ec2-user/.aws/config?raw?? HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 34.126.80.180 - - [14/Aug/2026:14:01:52 +1000] "GET /@fs/..%2f..%2f..%2f..%2f..%2fapp/.env?raw?? HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" --- last 30 samples (run-up to this incident) --- 2026-08-14 13:59:31 L1=3.13 run=2 blk=0 avail=7470 (63.7%) swpO=0 conn=1 myRSS=1895 php=2 phpRSS=107 ap=35 tcp=33 topuser=evolution 2026-08-14 13:59:32 L1=2.96 run=2 blk=0 avail=7470 (63.7%) swpO=0 conn=2 myRSS=1895 php=3 phpRSS=143 ap=35 tcp=36 topuser=evolution 2026-08-14 13:59:41 L1=2.81 run=1 blk=0 avail=7492 (63.9%) swpO=0 conn=1 myRSS=1895 php=0 phpRSS=0 ap=39 tcp=38 topuser=- 2026-08-14 13:59:43 L1=2.66 run=1 blk=0 avail=7481 (63.8%) swpO=0 conn=2 myRSS=1895 php=1 phpRSS=40 ap=39 tcp=39 topuser=evolution 2026-08-14 13:59:52 L1=2.45 run=2 blk=0 avail=7361 (62.8%) swpO=0 conn=1 myRSS=1895 php=1 phpRSS=113 ap=46 tcp=51 topuser=madalice 2026-08-14 13:59:53 L1=2.33 run=2 blk=0 avail=7247 (61.8%) swpO=0 conn=2 myRSS=1895 php=2 phpRSS=253 ap=46 tcp=48 topuser=madalice 2026-08-14 14:00:02 L1=2.22 run=3 blk=1 avail=7334 (62.5%) swpO=0 conn=4 myRSS=1895 php=3 phpRSS=178 ap=41 tcp=41 topuser=evolution 2026-08-14 14:00:03 L1=2.29 run=3 blk=0 avail=7368 (62.8%) swpO=0 conn=2 myRSS=1895 php=3 phpRSS=174 ap=41 tcp=42 topuser=evolution 2026-08-14 14:00:12 L1=2.10 run=1 blk=0 avail=7439 (63.4%) swpO=0 conn=4 myRSS=1895 php=1 phpRSS=69 ap=39 tcp=42 topuser=evolution 2026-08-14 14:00:13 L1=2.10 run=2 blk=0 avail=7376 (62.9%) swpO=0 conn=4 myRSS=1895 php=3 phpRSS=176 ap=41 tcp=45 topuser=evolution 2026-08-14 14:00:22 L1=2.01 run=2 blk=0 avail=7402 (63.1%) swpO=0 conn=4 myRSS=1895 php=2 phpRSS=164 ap=36 tcp=35 topuser=madalice 2026-08-14 14:00:23 L1=1.93 run=4 blk=0 avail=7297 (62.2%) swpO=0 conn=4 myRSS=1895 php=3 phpRSS=295 ap=35 tcp=33 topuser=madalice 2026-08-14 14:00:32 L1=1.85 run=5 blk=0 avail=7391 (63.0%) swpO=0 conn=4 myRSS=1895 php=5 phpRSS=233 ap=40 tcp=41 topuser=evolution 2026-08-14 14:00:33 L1=1.94 run=4 blk=0 avail=7401 (63.1%) swpO=0 conn=4 myRSS=1895 php=5 phpRSS=201 ap=40 tcp=44 topuser=evolution 2026-08-14 14:00:42 L1=1.95 run=3 blk=0 avail=7407 (63.1%) swpO=0 conn=4 myRSS=1895 php=2 phpRSS=78 ap=47 tcp=56 topuser=evolution 2026-08-14 14:00:43 L1=1.87 run=2 blk=0 avail=7382 (62.9%) swpO=0 conn=4 myRSS=1895 php=2 phpRSS=84 ap=49 tcp=52 topuser=evolution 2026-08-14 14:00:52 L1=1.88 run=4 blk=0 avail=7424 (63.3%) swpO=0 conn=4 myRSS=1895 php=1 phpRSS=43 ap=45 tcp=43 topuser=evolution 2026-08-14 14:00:53 L1=1.89 run=4 blk=0 avail=7319 (62.4%) swpO=0 conn=4 myRSS=1895 php=5 phpRSS=258 ap=45 tcp=42 topuser=evolution 2026-08-14 14:01:02 L1=1.90 run=4 blk=0 avail=7447 (63.5%) swpO=0 conn=2 myRSS=1895 php=3 phpRSS=127 ap=39 tcp=37 topuser=evolution 2026-08-14 14:01:03 L1=1.83 run=2 blk=0 avail=7445 (63.5%) swpO=0 conn=4 myRSS=1895 php=3 phpRSS=127 ap=38 tcp=35 topuser=evolution 2026-08-14 14:01:12 L1=1.76 run=4 blk=0 avail=7355 (62.7%) swpO=0 conn=2 myRSS=1895 php=5 phpRSS=262 ap=35 tcp=50 topuser=evolution 2026-08-14 14:01:13 L1=1.78 run=1 blk=0 avail=7339 (62.6%) swpO=0 conn=6 myRSS=1895 php=6 phpRSS=303 ap=37 tcp=58 topuser=evolution 2026-08-14 14:01:22 L1=1.72 run=1 blk=0 avail=7462 (63.6%) swpO=0 conn=2 myRSS=1895 php=0 phpRSS=0 ap=41 tcp=43 topuser=- 2026-08-14 14:01:23 L1=1.74 run=2 blk=0 avail=7251 (61.8%) swpO=0 conn=6 myRSS=1895 php=4 phpRSS=321 ap=41 tcp=47 topuser=infinium 2026-08-14 14:01:32 L1=1.76 run=1 blk=0 avail=7528 (64.2%) swpO=0 conn=2 myRSS=1895 php=0 phpRSS=0 ap=35 tcp=33 topuser=- 2026-08-14 14:01:33 L1=1.62 run=3 blk=0 avail=7432 (63.4%) swpO=0 conn=6 myRSS=1895 php=2 phpRSS=162 ap=34 tcp=32 topuser=corpkicks 2026-08-14 14:01:42 L1=1.73 run=13 blk=0 avail=7172 (61.1%) swpO=0 conn=2 myRSS=1895 php=9 phpRSS=630 ap=36 tcp=53 topuser=customc 2026-08-14 14:01:43 L1=2.47 run=2 blk=0 avail=7499 (63.9%) swpO=0 conn=6 myRSS=1895 php=2 phpRSS=57 ap=36 tcp=55 topuser=customc 2026-08-14 14:01:52 L1=2.44 run=15 blk=0 avail=6435 (54.9%) swpO=0 conn=13 myRSS=1895 php=15 phpRSS=1610 ap=37 tcp=76 topuser=customc 2026-08-14 14:01:53 L1=3.60 run=21 blk=0 avail=6566 (56.0%) swpO=0 conn=6 myRSS=1895 php=13 phpRSS=1230 ap=39 tcp=87 topuser=customc