INCIDENT 2026-08-18 15:25:38 trigger: php_procs=26 ================================================================== load: 4.60 4.22 3.32 11/706 1669714 ncpu:10 mem_avail: 6349MB/11729MB (54.1%) swap_used:2779MB swapout:0/s blocked(D):0 running:5 iowait:0.0% steal:0.0% php: 26 procs / 1275MB heaviest user: evolution (25 procs, 1131MB) apache: 61 procs tcp_estab: 48 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2175 evolution 29 1145 nobody 60 887 root 237 751 netdata 8 263 corpkicks 1 152 cpanellogin 1 107 kurri 5 57 dovenull 6 26 mailnull 3 22 aaa 2 22 wp-toolkit 6 18 zabbix 1 13 alison 1 13 mailman 20 12 nscd 1 7 dovecot 3 7 named 1 5 dbus 1 2 cpanelconnecttrack 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 26 1160 corpkicks 1 155 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5524 MB Active(file): 4634 MB Inactive(file): 1053 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 342 MB CommitLimit: 9960 MB Committed_AS: 11157 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 955450 root 14:14:22 1120 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2228188 10.1 Ssl 3-07:35:01 /usr/sbin/mariadbd 1220 1 netdata 203088 2.5 Ssl 50-05:15:43 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1669674 1669665 corpkicks 167912 78.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1000361 998750 root 153320 0.0 S 13:00:49 spamd child 1638383 1353308 cpanellogin 110188 0.0 S 34:29 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 2575382 1 root 92680 0.0 Ss 3-07:35:04 /usr/lib/systemd/systemd-journald 998750 1 root 90204 0.0 Ss 13:02:54 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1578009 998750 root 87872 0.0 S 01:43:10 spamd child 1669655 1659365 evolution 69424 9.0 S 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1658731 1658711 evolution 59092 0.7 S 11:30 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1658820 1658284 evolution 59088 0.7 S 11:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1660119 1660117 evolution 57564 0.6 S 10:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1661971 1661923 evolution 56032 0.6 S 08:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1662694 1662154 evolution 55628 0.6 S 07:32 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1666918 1666256 evolution 54048 0.5 S 03:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663347 1663338 evolution 43156 0.0 S 06:56 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663808 1663363 evolution 43084 0.0 S 06:14 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663804 1663711 evolution 43072 0.0 S 06:15 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663661 1663314 evolution 43012 0.0 S 06:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663613 1658938 evolution 42996 0.0 S 06:32 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663197 1662151 evolution 42984 0.0 S 07:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663383 1663357 evolution 42956 0.0 S 06:54 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669525 1669080 evolution 42916 0.2 S 00:15 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669524 1669082 evolution 42808 0.2 S 00:15 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669526 1669065 evolution 42756 0.2 S 00:15 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 42632 0.1 Sl 50-05:15:38 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1353308 1 root 42104 0.0 Ss 27-12:44:13 cpsrvd (SSL) - waiting for connections 1669683 1669675 evolution 40852 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 40396 0.0 Sl 50-05:15:42 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1664109 1663969 evolution 39712 0.0 S 05:42 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663166 1661359 evolution 39700 0.0 S 07:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663645 1663336 evolution 39700 0.0 S 06:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663658 1661021 evolution 39672 0.0 S 06:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665393 1663680 evolution 39612 0.0 S 04:46 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665409 1664796 evolution 39592 0.0 S 04:44 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669719 1667856 evolution 39440 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663678 1662119 evolution 39196 0.0 S 06:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669684 1469 root 32584 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1669694 1469 root 32580 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1469 1 root 27144 0.1 Ss 50-05:15:42 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1659365 1276780 nobody 21864 0.0 S 10:57 /usr/sbin/httpd -k start 1667064 1276780 nobody 19824 0.0 S 02:58 /usr/sbin/httpd -k start 998083 1 root 19812 0.0 Ss 13:03:27 lfd - sleeping 1667078 1276780 nobody 19436 0.0 S 02:57 /usr/sbin/httpd -k start 1663968 1276780 nobody 19404 0.0 S 05:58 /usr/sbin/httpd -k start 1661021 1276780 nobody 19236 0.0 S 09:22 /usr/sbin/httpd -k start 1664798 1276780 nobody 19020 0.0 S 04:56 /usr/sbin/httpd -k start 1658938 1276780 nobody 18884 0.0 S 11:17 /usr/sbin/httpd -k start 1666994 1276780 nobody 18364 0.0 S 03:01 /usr/sbin/httpd -k start 1663680 1276780 nobody 18088 0.0 S 06:23 /usr/sbin/httpd -k start 1667889 1276780 nobody 18056 0.0 S 01:59 /usr/sbin/httpd -k start 1662151 1276780 nobody 17908 0.0 S 07:57 /usr/sbin/httpd -k start 1669080 1276780 nobody 17788 0.0 S 00:44 /usr/sbin/httpd -k start 1667890 1276780 nobody 17596 0.0 S 01:59 /usr/sbin/httpd -k start 1668037 1276780 nobody 17460 0.0 S 01:45 /usr/sbin/httpd -k start 1669335 1276780 nobody 17408 0.0 S 00:32 /usr/sbin/httpd -k start 1463 1 root 17128 0.0 Ss 50-05:15:42 tailwatchd 1668036 1276780 nobody 17020 0.0 S 01:45 /usr/sbin/httpd -k start 1667856 1276780 nobody 16780 0.0 S 02:01 /usr/sbin/httpd -k start 1666256 1276780 nobody 16772 0.0 S 03:37 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9313438 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 9313437 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9313436 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9313435 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9313434 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9313433 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9313432 | root | 85-1525752154 | Execute | 0 | Sending data | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9313409 | root | 108-1481181613 | Execute | 0 | Sending data | SELECT GROUP_CONCAT(DISTINCT srcid) as d FROM stockmovement WHERE src = ? AND type = ? AND jobitemid IN (SELECT id FROM jobInventory WHERE jobid = ?) ORDER BY srcid | +---------+------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9313443 | 85-1525752154 | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadd | | 9313442 | 85-1525752154 | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadd | | 9313440 | 85-1525752154 | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadd | | 9313439 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 343 whiz/whizengineering.com.au-ssl_log 138 lowrange/lowrange.com.au-ssl_log 89 evolution/portal.evolutionerp.com.au-ssl_log 42 otter2/otterfencing.net.au-ssl_log 21 aaa/aaadownunder.com.au-ssl_log 10 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 215 203.54.180.238 138 4.184.238.176 89 20.7.73.61 49 103.104.164.114 38 182.239.240.254 32 203.214.146.60 27 103.104.165.99 21 20.151.128.234 9 147.161.213.78 9 116.91.221.198 4 101.182.108.127 3 180.181.236.49 3 115.128.106.35 2 91.92.243.249 2 52.167.144.156 --- top request paths across all vhosts (last 3 min) --- 173 POST /functions.php 49 GET /app/ajax.php 41 GET /heartbeat.php 27 GET /index.php 18 POST /plugins/csvexporter/plugin.php 11 POST /app/ajax/selectFilter.php 9 POST /app/ajax/selectFilterSingle.php 8 POST //functions.php 8 POST /app/ajax.php 5 GET //app/ajax.php 4 POST /quoteditsave.php 4 POST /purchaseaddsave.php 4 POST /clienteditsave.php 3 POST /print.php 3 POST /inveditsave.php 3 GET /plugins/fensa/fensa-ajax.php 3 GET //index.php 3 GET /222.php 2 POST /wp-login.php 2 POST /tasksave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 173 POST /functions.php 49 GET /app/ajax.php 26 GET /index.php 18 POST /plugins/csvexporter/plugin.php 11 POST /app/ajax/selectFilter.php 9 POST /app/ajax/selectFilterSingle.php 8 POST //functions.php 8 POST /app/ajax.php 5 GET //app/ajax.php 4 POST /quoteditsave.php 4 POST /purchaseaddsave.php 4 POST /clienteditsave.php -- last 10 requests -- 182.239.240.254 - - [18/Aug/2026:15:25:25 +1000] "POST //functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au//index.php?page=purchaseadd&purchaseid=3456" "Mozilla/5.0 (Windows NT 10.0; Win64; x 203.54.180.238 - - [18/Aug/2026:15:25:25 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78511§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 103.104.164.114 - - [18/Aug/2026:15:25:27 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=090502&cursel=1757&curseltext=090502&fromMS=1&&nolimit=LIMIT%2050&include=1757&supplierid=620&contactid=620&tid=%25% 180.181.236.49 - - [18/Aug/2026:15:25:32 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=2053&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; W 203.54.180.238 - - [18/Aug/2026:15:25:33 +1000] "GET /index.php?page=jobregister HTTP/1.1" 200 8213 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 203.54.180.238 - - [18/Aug/2026:15:25:33 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78505§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 203.54.180.238 - - [18/Aug/2026:15:25:33 +1000] "GET /index.php?page=jobregister HTTP/1.1" 200 16022 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 103.104.165.99 - - [18/Aug/2026:15:25:34 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12024&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 103.104.164.114 - - [18/Aug/2026:15:25:34 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=2686&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; 203.54.180.238 - - [18/Aug/2026:15:25:34 +1000] "POST /tasksave.php?id=11223&call=getTask HTTP/1.1" 200 379 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec == whiz/whizengineering.com.au-ssl_log == -- top paths -- 2 GET /thui.php 2 GET /ms.php 1 GET /zz.php 1 GET /zxin.php 1 GET /zwq13.php 1 GET /z.php 1 GET /ze.php 1 GET /zc-318.php 1 GET /xxx.php 1 GET /xqq.php 1 GET /xmy.php 1 GET /xleet.php -- last 10 requests -- 4.184.238.176 - - [18/Aug/2026:15:25:10 +1000] "GET /666.php HTTP/1.1" 401 36 "-" "-" 4.184.238.176 - - [18/Aug/2026:15:25:11 +1000] "GET /thui.php HTTP/1.1" 401 36 "-" "-" 4.184.238.176 - - [18/Aug/2026:15:25:11 +1000] "GET /agg.php HTTP/1.1" 401 36 "-" "-" 4.184.238.176 - - [18/Aug/2026:15:25:12 +1000] "GET /erty.php HTTP/1.1" 401 36 "-" "-" 4.184.238.176 - - [18/Aug/2026:15:25:13 +1000] "GET /mini.php HTTP/1.1" 401 36 "-" "-" 4.184.238.176 - - [18/Aug/2026:15:25:13 +1000] "GET /sid3.php HTTP/1.1" 401 36 "-" "-" 4.184.238.176 - - [18/Aug/2026:15:25:14 +1000] "GET /moon.php HTTP/1.1" 401 36 "-" "-" 4.184.238.176 - - [18/Aug/2026:15:25:15 +1000] "GET /ms.php HTTP/1.1" 401 36 "-" "-" 4.184.238.176 - - [18/Aug/2026:15:25:15 +1000] "GET /wsws.php HTTP/1.1" 401 36 "-" "-" 4.184.238.176 - - [18/Aug/2026:15:25:16 +1000] "GET /motu.php HTTP/1.1" 401 36 "-" "-" == lowrange/lowrange.com.au-ssl_log == -- top paths -- 1 GET /zxz.php 1 GET /xmlrpc.php 1 GET /www.php 1 GET /wp-login.php 1 GET /wp-includes/rest-api/ 1 GET /wp-includes/pomo/ 1 GET /wp-includes/js/tinymce/plugins/compat3x/css/ 1 GET /wp-includes/js/ 1 GET /wp-includes/images/smilies/ 1 GET /wp-includes/images/ 1 GET /wp-includes/ID3/index.php 1 GET /wp-includes/ID3/ -- last 10 requests -- 20.7.73.61 - - [18/Aug/2026:15:24:41 +1000] "GET /files/index.php HTTP/1.1" 404 5750 "-" "-" 20.7.73.61 - - [18/Aug/2026:15:24:42 +1000] "GET /images/images/about.php HTTP/1.1" 404 5750 "-" "-" 20.7.73.61 - - [18/Aug/2026:15:24:42 +1000] "GET /ms-edit.php HTTP/1.1" 404 5750 "-" "-" 20.7.73.61 - - [18/Aug/2026:15:24:43 +1000] "GET /rip.php HTTP/1.1" 404 5750 "-" "-" 20.7.73.61 - - [18/Aug/2026:15:24:43 +1000] "GET /wp-content/uploads/ HTTP/1.1" 404 5750 "-" "-" 20.7.73.61 - - [18/Aug/2026:15:24:43 +1000] "GET /xmlrpc.php HTTP/1.1" 404 5750 "-" "-" 20.7.73.61 - - [18/Aug/2026:15:24:44 +1000] "GET /moon.php HTTP/1.1" 404 5750 "-" "-" 20.7.73.61 - - [18/Aug/2026:15:24:44 +1000] "GET /cache.php HTTP/1.1" 404 5750 "-" "-" 20.7.73.61 - - [18/Aug/2026:15:24:45 +1000] "GET /wp-includes/block-bindings/ HTTP/1.1" 404 5750 "-" "-" 20.7.73.61 - - [18/Aug/2026:15:24:45 +1000] "GET /vendor/ HTTP/1.1" 404 5750 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-18 15:23:10 L1=4.54 run=7 blk=0 avail=6522 (55.6%) swpO=0 conn=7 myRSS=2175 php=22 phpRSS=1032 ap=53 tcp=48 topuser=evolution 2026-08-18 15:23:18 L1=4.26 run=4 blk=0 avail=6608 (56.3%) swpO=0 conn=7 myRSS=2175 php=21 phpRSS=912 ap=53 tcp=43 topuser=evolution 2026-08-18 15:23:20 L1=4.32 run=9 blk=0 avail=6445 (55.0%) swpO=0 conn=7 myRSS=2175 php=23 phpRSS=1152 ap=54 tcp=38 topuser=evolution 2026-08-18 15:23:28 L1=4.45 run=2 blk=0 avail=6606 (56.3%) swpO=0 conn=8 myRSS=2175 php=20 phpRSS=898 ap=54 tcp=35 topuser=evolution 2026-08-18 15:23:30 L1=4.42 run=2 blk=0 avail=6631 (56.5%) swpO=0 conn=7 myRSS=2175 php=20 phpRSS=898 ap=51 tcp=33 topuser=evolution 2026-08-18 15:23:38 L1=4.22 run=11 blk=0 avail=6659 (56.8%) swpO=0 conn=8 myRSS=2175 php=20 phpRSS=898 ap=47 tcp=39 topuser=evolution 2026-08-18 15:23:40 L1=4.04 run=5 blk=0 avail=6452 (55.0%) swpO=0 conn=7 myRSS=2175 php=22 phpRSS=1134 ap=53 tcp=40 topuser=evolution 2026-08-18 15:23:48 L1=4.04 run=4 blk=0 avail=6640 (56.6%) swpO=3 conn=8 myRSS=2175 php=20 phpRSS=898 ap=50 tcp=35 topuser=evolution 2026-08-18 15:23:50 L1=3.96 run=3 blk=0 avail=6630 (56.5%) swpO=3 conn=7 myRSS=2175 php=20 phpRSS=898 ap=50 tcp=37 topuser=evolution 2026-08-18 15:23:58 L1=3.80 run=9 blk=0 avail=6406 (54.6%) swpO=0 conn=8 myRSS=2175 php=23 phpRSS=1125 ap=56 tcp=47 topuser=evolution 2026-08-18 15:24:00 L1=4.14 run=7 blk=0 avail=6444 (54.9%) swpO=0 conn=7 myRSS=2175 php=21 phpRSS=1028 ap=57 tcp=46 topuser=evolution 2026-08-18 15:24:08 L1=4.05 run=2 blk=0 avail=6534 (55.7%) swpO=0 conn=8 myRSS=2175 php=21 phpRSS=964 ap=54 tcp=48 topuser=evolution 2026-08-18 15:24:11 L1=4.04 run=12 blk=0 avail=6596 (56.2%) swpO=0 conn=7 myRSS=2175 php=20 phpRSS=898 ap=54 tcp=38 topuser=evolution 2026-08-18 15:24:18 L1=3.88 run=8 blk=0 avail=6650 (56.7%) swpO=0 conn=8 myRSS=2175 php=20 phpRSS=898 ap=47 tcp=30 topuser=evolution 2026-08-18 15:24:21 L1=3.81 run=3 blk=0 avail=6666 (56.8%) swpO=0 conn=7 myRSS=2175 php=20 phpRSS=898 ap=45 tcp=29 topuser=evolution 2026-08-18 15:24:28 L1=3.98 run=3 blk=0 avail=6646 (56.7%) swpO=0 conn=7 myRSS=2175 php=20 phpRSS=898 ap=47 tcp=41 topuser=evolution 2026-08-18 15:24:31 L1=3.90 run=8 blk=0 avail=6628 (56.5%) swpO=0 conn=7 myRSS=2175 php=21 phpRSS=941 ap=48 tcp=40 topuser=evolution 2026-08-18 15:24:38 L1=3.67 run=10 blk=0 avail=6631 (56.5%) swpO=0 conn=7 myRSS=2175 php=20 phpRSS=898 ap=48 tcp=40 topuser=evolution 2026-08-18 15:24:41 L1=3.86 run=5 blk=0 avail=6579 (56.1%) swpO=0 conn=7 myRSS=2175 php=21 phpRSS=965 ap=51 tcp=52 topuser=evolution 2026-08-18 15:24:48 L1=4.19 run=5 blk=0 avail=6555 (55.9%) swpO=0 conn=7 myRSS=2175 php=20 phpRSS=898 ap=61 tcp=44 topuser=evolution 2026-08-18 15:24:51 L1=4.01 run=10 blk=0 avail=6519 (55.6%) swpO=0 conn=7 myRSS=2175 php=22 phpRSS=1006 ap=59 tcp=46 topuser=evolution 2026-08-18 15:24:58 L1=3.77 run=4 blk=0 avail=6545 (55.8%) swpO=0 conn=7 myRSS=2175 php=21 phpRSS=940 ap=63 tcp=44 topuser=evolution 2026-08-18 15:25:01 L1=3.71 run=4 blk=0 avail=6166 (52.6%) swpO=0 conn=7 myRSS=2175 php=22 phpRSS=1340 ap=62 tcp=43 topuser=evolution 2026-08-18 15:25:08 L1=3.57 run=5 blk=0 avail=6503 (55.4%) swpO=2 conn=7 myRSS=2175 php=22 phpRSS=1014 ap=58 tcp=44 topuser=evolution 2026-08-18 15:25:11 L1=4.01 run=7 blk=0 avail=6502 (55.4%) swpO=2 conn=7 myRSS=2175 php=23 phpRSS=1046 ap=56 tcp=45 topuser=evolution 2026-08-18 15:25:18 L1=4.49 run=3 blk=0 avail=6618 (56.4%) swpO=0 conn=7 myRSS=2175 php=20 phpRSS=898 ap=51 tcp=37 topuser=evolution 2026-08-18 15:25:21 L1=4.85 run=8 blk=0 avail=6421 (54.7%) swpO=0 conn=7 myRSS=2175 php=21 phpRSS=1137 ap=48 tcp=38 topuser=evolution 2026-08-18 15:25:28 L1=4.78 run=4 blk=0 avail=6564 (56.0%) swpO=0 conn=8 myRSS=2175 php=24 phpRSS=1063 ap=51 tcp=34 topuser=evolution 2026-08-18 15:25:31 L1=4.48 run=2 blk=0 avail=6594 (56.2%) swpO=0 conn=7 myRSS=2175 php=23 phpRSS=1023 ap=48 tcp=28 topuser=evolution 2026-08-18 15:25:38 L1=4.60 run=5 blk=0 avail=6349 (54.1%) swpO=0 conn=10 myRSS=2175 php=26 phpRSS=1275 ap=61 tcp=48 topuser=evolution