INCIDENT 2026-08-18 15:27:41 trigger: php_procs=26 ================================================================== load: 5.32 4.74 3.64 7/741 1672224 ncpu:10 mem_avail: 6296MB/11729MB (53.7%) swap_used:2695MB swapout:0/s blocked(D):0 running:10 iowait:0.2% steal:0.0% php: 26 procs / 1168MB heaviest user: evolution (26 procs, 1168MB) apache: 69 procs tcp_estab: 56 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2260 evolution 30 1187 nobody 68 999 root 249 895 netdata 8 263 cpanellogin 1 107 kurri 5 57 dovenull 6 26 aaa 2 23 wp-toolkit 6 18 zabbix 1 15 alison 1 13 mailman 20 12 nscd 1 7 mailnull 1 7 dovecot 3 7 named 1 5 dbus 1 2 cpanelconnecttrack 1 2 polkitd 1 1 --- php workers by user --- USER PROCS RSS_MB evolution 26 1173 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5606 MB Active(file): 4763 MB Inactive(file): 1007 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 344 MB CommitLimit: 9960 MB Committed_AS: 11559 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 955450 root 14:16:24 1120 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2314696 10.2 Ssl 3-07:37:03 /usr/sbin/mariadbd 1220 1 netdata 202372 2.5 Ssl 50-05:17:45 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1000361 998750 root 153296 0.0 S 13:02:51 spamd child 1638383 1353308 cpanellogin 110268 0.0 S 36:31 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 2575382 1 root 93000 0.0 Ss 3-07:37:06 /usr/lib/systemd/systemd-journald 998750 1 root 90188 0.0 Ss 13:04:56 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1578009 998750 root 87856 0.0 S 01:45:12 spamd child 1658731 1658711 evolution 59092 0.7 S 13:32 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1658820 1658284 evolution 59088 0.7 S 13:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1660119 1660117 evolution 57796 0.6 S 12:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1661971 1661923 evolution 56032 0.6 S 10:12 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1662694 1662154 evolution 55628 0.5 S 09:34 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1666918 1666256 evolution 54048 0.5 S 05:06 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1671829 1353308 root 44680 0.9 S 00:15 whostmgrd - serving 1.144.107.82 1669958 1669681 evolution 43228 0.0 S 02:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669957 1669680 evolution 43184 0.0 S 02:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663347 1663338 evolution 43156 0.0 S 08:58 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663808 1663363 evolution 43084 0.0 S 08:16 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663804 1663711 evolution 43072 0.0 S 08:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663661 1663314 evolution 43012 0.0 S 08:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663613 1658938 evolution 42996 0.0 S 08:34 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663197 1662151 evolution 42984 0.0 S 09:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663383 1663357 evolution 42956 0.0 S 08:56 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669525 1669080 evolution 42916 0.0 S 02:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669524 1669082 evolution 42808 0.0 S 02:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669526 1669065 evolution 42756 0.0 S 02:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 42360 0.1 Sl 50-05:17:40 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1353308 1 root 42104 0.0 Ss 27-12:46:15 cpsrvd (SSL) - waiting for connections 2223 1201 root 40396 0.0 Sl 50-05:17:44 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1671828 1353308 root 39784 0.8 S 00:15 whostmgrd - serving 1.144.107.82 1664109 1663969 evolution 39712 0.0 S 07:44 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663166 1661359 evolution 39700 0.0 S 09:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663645 1663336 evolution 39700 0.0 S 08:31 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663658 1661021 evolution 39672 0.0 S 08:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665393 1663680 evolution 39612 0.0 S 06:48 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665409 1664796 evolution 39592 0.0 S 06:46 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1671875 1353308 root 39244 0.5 S 00:12 whostmgrd - serving 1.144.107.82 1663678 1662119 evolution 39196 0.0 S 08:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1671876 1353308 root 38776 0.6 S 00:12 whostmgrd - serving 1.144.107.82 1671877 1353308 root 38720 0.8 S 00:12 whostmgrd - serving 1.144.107.82 1469 1 root 27136 0.1 Ss 50-05:17:44 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1668037 1276780 nobody 20216 0.0 S 03:47 /usr/sbin/httpd -k start 998083 1 root 19828 0.0 Ss 13:05:29 lfd - sleeping 1661021 1276780 nobody 19236 0.0 S 11:24 /usr/sbin/httpd -k start 1670675 1276780 nobody 19076 0.0 S 01:15 /usr/sbin/httpd -k start 1658938 1276780 nobody 18884 0.0 S 13:19 /usr/sbin/httpd -k start 1669932 1276780 nobody 18748 0.0 S 02:02 /usr/sbin/httpd -k start 1669663 1276780 nobody 18672 0.0 S 02:04 /usr/sbin/httpd -k start 1668875 1276780 nobody 18624 0.0 S 02:59 /usr/sbin/httpd -k start 1669678 1276780 nobody 18436 0.0 S 02:03 /usr/sbin/httpd -k start 1663680 1276780 nobody 18116 0.0 S 08:25 /usr/sbin/httpd -k start 1669664 1276780 nobody 17952 0.0 S 02:04 /usr/sbin/httpd -k start 1662151 1276780 nobody 17908 0.0 S 09:59 /usr/sbin/httpd -k start 1669080 1276780 nobody 17788 0.0 S 02:46 /usr/sbin/httpd -k start 1669066 1276780 nobody 17456 0.0 S 02:47 /usr/sbin/httpd -k start 1671797 1276780 nobody 17352 0.1 S 00:17 /usr/sbin/httpd -k start 1463 1 root 17144 0.0 Ss 50-05:17:44 tailwatchd 1671807 1276780 nobody 17036 0.0 S 00:16 /usr/sbin/httpd -k start 1669654 1276780 nobody 17024 0.0 S 02:05 /usr/sbin/httpd -k start 1669934 1276780 nobody 17016 0.0 S 02:02 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9350102 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 9350101 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9350100 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9350099 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9350098 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9350097 | root | 85-1525752154 | Execute | 0 | Sending data | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9350096 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9350101 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9350100 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9350099 | 85-1525752154 | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadd | | 9350098 | 85-1525752154 | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadd | | 9350096 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 414 nrg/nrgservices.net.au-ssl_log 127 candyfabcom/candyfab.com.au-ssl_log 97 vinesit/vinesit.com.au-ssl_log 42 evolution/portal.evolutionerp.com.au-ssl_log 41 whiz/whizengineering.com.au-ssl_log 24 cosgrovecreative/cosgrovecreative.com.au-ssl_log 13 madalice/madalice.com.au-ssl_log 4 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 211 203.54.180.238 127 20.42.19.40 96 74.248.133.44 62 103.104.165.99 59 103.104.164.114 40 20.29.77.16 32 182.239.240.254 26 1.144.107.82 24 4.184.238.176 20 203.214.146.60 15 180.181.236.49 13 20.151.109.219 11 147.161.213.78 7 116.91.221.198 3 40.77.167.51 --- top request paths across all vhosts (last 3 min) --- 183 POST /functions.php 52 GET /app/ajax.php 38 GET /heartbeat.php 36 GET /index.php 27 POST /app/ajax/selectFilter.php 18 POST /plugins/csvexporter/plugin.php 11 POST /quoteditsave.php 11 POST /purchaseaddsave.php 10 POST /app/ajax/selectFilterSingle.php 10 POST /app/ajax.php 9 POST /clienteditsave.php 8 POST /inveditsave.php 7 POST //functions.php 5 GET /av.php 5 GET /aa.php 4 POST /itemModify.php 4 GET /wp-file.php 4 GET /wp-content/plugins/hellopress/wp_filemanager.php 4 GET /this_is_a_new_hello_world.php 4 GET /core.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 183 POST /functions.php 52 GET /app/ajax.php 34 GET /index.php 27 POST /app/ajax/selectFilter.php 18 POST /plugins/csvexporter/plugin.php 11 POST /quoteditsave.php 11 POST /purchaseaddsave.php 10 POST /app/ajax/selectFilterSingle.php 10 POST /app/ajax.php 9 POST /clienteditsave.php 8 POST /inveditsave.php 7 POST //functions.php -- last 10 requests -- 203.54.180.238 - - [18/Aug/2026:15:27:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 203.54.180.238 - - [18/Aug/2026:15:27:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 103.104.165.99 - - [18/Aug/2026:15:27:38 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=11042" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 103.104.165.99 - - [18/Aug/2026:15:27:38 +1000] "GET /index.php?page=purchasereg HTTP/1.1" 200 14401 "https://my.evolutionerp.com.au/index.php?page=invedithist&id=10531&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 103.104.165.99 - - [18/Aug/2026:15:27:39 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=purchasereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 103.104.165.99 - - [18/Aug/2026:15:27:39 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dpurchasereg&call=getUserSetting&caller=ajaxSubmitLocal&seq=16677076552 HTTP/1.1" 200 93 "https://my.evolutionerp.com.au/index.ph 147.161.213.78 - - [18/Aug/2026:15:27:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=siteedit&siteid=2122" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 147.161.213.78 - - [18/Aug/2026:15:27:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=report&file=testTagRetest3" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 103.104.165.99 - - [18/Aug/2026:15:27:39 +1000] "POST /purchaseaddsave.php?call=fetch HTTP/1.1" 200 4385 "https://my.evolutionerp.com.au/index.php?page=purchasereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 103.104.164.114 - - [18/Aug/2026:15:27:40 +1000] "GET /index.php?page=inventory HTTP/1.1" 200 25593 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=1670§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win64; == nrg/nrgservices.net.au-ssl_log == -- top paths -- 3 GET /ioxi-o.php 3 GET /admin.php 3 GET /adminfuns.php 2 GET /wp-content/themes/admin.php 2 GET /wk/index.php 2 GET /lite.php 2 GET /inputs.php 2 GET /index/function.php 2 GET /goods.php 2 GET /file.php 2 GET /edit.php 2 GET /dropdown.php -- last 10 requests -- 20.42.19.40 - - [18/Aug/2026:15:26:51 +1000] "GET /akc.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:26:52 +1000] "GET /buy.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:26:52 +1000] "GET /cong.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:26:53 +1000] "GET /db.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:26:53 +1000] "GET /dropdown.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:26:53 +1000] "GET /file.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:26:54 +1000] "GET /goods.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:26:54 +1000] "GET /hplfuns.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:26:55 +1000] "GET /htaccess.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:26:55 +1000] "GET /index/function.php HTTP/1.1" 404 5749 "-" "-" == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 1 GET /wso112233.php 1 GET /wp-trackback.php 1 GET /wp-the.php 1 GET /wp-mail.php 1 GET /wp-logs.php 1 GET /wp-login.php 1 GET /wp-load.php 1 GET /wp-index.php 1 GET /wp-includes/Text/Diff/ 1 GET /wp-includes/Text/about.php 1 GET /wp-includes/Requests/library/ 1 GET /wp-includes/pomo/ -- last 10 requests -- 74.248.133.44 - - [18/Aug/2026:15:26:07 +1000] "GET /wp-index.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [18/Aug/2026:15:26:07 +1000] "GET /bypass.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [18/Aug/2026:15:26:07 +1000] "GET /alfanew.php7 HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [18/Aug/2026:15:26:08 +1000] "GET /admin-header.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [18/Aug/2026:15:26:08 +1000] "GET /83064.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [18/Aug/2026:15:26:08 +1000] "GET /wp-trackback.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [18/Aug/2026:15:26:09 +1000] "GET /dxc.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [18/Aug/2026:15:26:09 +1000] "GET /v4.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [18/Aug/2026:15:26:09 +1000] "GET /error.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 74.248.133.44 - - [18/Aug/2026:15:26:09 +1000] "GET /disagrsod.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-18 15:25:11 L1=4.01 run=7 blk=0 avail=6502 (55.4%) swpO=2 conn=7 myRSS=2175 php=23 phpRSS=1046 ap=56 tcp=45 topuser=evolution 2026-08-18 15:25:18 L1=4.49 run=3 blk=0 avail=6618 (56.4%) swpO=0 conn=7 myRSS=2175 php=20 phpRSS=898 ap=51 tcp=37 topuser=evolution 2026-08-18 15:25:21 L1=4.85 run=8 blk=0 avail=6421 (54.7%) swpO=0 conn=7 myRSS=2175 php=21 phpRSS=1137 ap=48 tcp=38 topuser=evolution 2026-08-18 15:25:28 L1=4.78 run=4 blk=0 avail=6564 (56.0%) swpO=0 conn=8 myRSS=2175 php=24 phpRSS=1063 ap=51 tcp=34 topuser=evolution 2026-08-18 15:25:31 L1=4.48 run=2 blk=0 avail=6594 (56.2%) swpO=0 conn=7 myRSS=2175 php=23 phpRSS=1023 ap=48 tcp=28 topuser=evolution 2026-08-18 15:25:38 L1=4.60 run=5 blk=0 avail=6349 (54.1%) swpO=0 conn=10 myRSS=2175 php=26 phpRSS=1275 ap=61 tcp=48 topuser=evolution 2026-08-18 15:25:41 L1=4.79 run=4 blk=1 avail=6301 (53.7%) swpO=0 conn=8 myRSS=2177 php=30 phpRSS=1332 ap=76 tcp=44 topuser=evolution 2026-08-18 15:25:49 L1=4.65 run=10 blk=0 avail=6365 (54.3%) swpO=0 conn=8 myRSS=2177 php=26 phpRSS=1174 ap=69 tcp=48 topuser=evolution 2026-08-18 15:25:51 L1=4.92 run=9 blk=0 avail=6369 (54.3%) swpO=0 conn=8 myRSS=2177 php=27 phpRSS=1217 ap=67 tcp=50 topuser=evolution 2026-08-18 15:25:59 L1=5.00 run=5 blk=0 avail=6463 (55.1%) swpO=0 conn=8 myRSS=2177 php=25 phpRSS=1108 ap=62 tcp=35 topuser=evolution 2026-08-18 15:26:01 L1=5.32 run=5 blk=0 avail=6472 (55.2%) swpO=0 conn=7 myRSS=2177 php=26 phpRSS=1129 ap=60 tcp=43 topuser=evolution 2026-08-18 15:26:09 L1=5.14 run=9 blk=0 avail=6082 (51.9%) swpO=0 conn=10 myRSS=2177 php=28 phpRSS=1612 ap=58 tcp=35 topuser=evolution 2026-08-18 15:26:11 L1=5.61 run=14 blk=0 avail=6240 (53.2%) swpO=2 conn=10 myRSS=2177 php=28 phpRSS=1458 ap=57 tcp=40 topuser=evolution 2026-08-18 15:26:19 L1=5.24 run=4 blk=0 avail=6522 (55.6%) swpO=2 conn=7 myRSS=2177 php=25 phpRSS=1108 ap=54 tcp=34 topuser=evolution 2026-08-18 15:26:21 L1=4.98 run=3 blk=0 avail=6550 (55.8%) swpO=0 conn=7 myRSS=2177 php=25 phpRSS=1108 ap=52 tcp=32 topuser=evolution 2026-08-18 15:26:29 L1=4.82 run=3 blk=0 avail=6455 (55.0%) swpO=0 conn=9 myRSS=2177 php=26 phpRSS=1142 ap=63 tcp=41 topuser=evolution 2026-08-18 15:26:31 L1=5.24 run=5 blk=0 avail=6359 (54.2%) swpO=0 conn=9 myRSS=2181 php=27 phpRSS=1272 ap=62 tcp=40 topuser=evolution 2026-08-18 15:26:40 L1=5.46 run=4 blk=1 avail=6093 (52.0%) swpO=0 conn=10 myRSS=2183 php=28 phpRSS=1561 ap=62 tcp=57 topuser=evolution 2026-08-18 15:26:42 L1=5.66 run=4 blk=0 avail=6147 (52.4%) swpO=0 conn=9 myRSS=2201 php=27 phpRSS=1417 ap=68 tcp=56 topuser=evolution 2026-08-18 15:26:50 L1=6.24 run=9 blk=0 avail=5944 (50.7%) swpO=27 conn=11 myRSS=2252 php=34 phpRSS=1725 ap=73 tcp=56 topuser=evolution 2026-08-18 15:26:52 L1=6.24 run=7 blk=0 avail=6186 (52.7%) swpO=27 conn=9 myRSS=2252 php=31 phpRSS=1387 ap=72 tcp=51 topuser=evolution 2026-08-18 15:27:00 L1=6.52 run=8 blk=0 avail=6115 (52.1%) swpO=0 conn=10 myRSS=2256 php=28 phpRSS=1387 ap=71 tcp=54 topuser=evolution 2026-08-18 15:27:02 L1=6.52 run=3 blk=0 avail=6242 (53.2%) swpO=0 conn=8 myRSS=2259 php=26 phpRSS=1199 ap=71 tcp=52 topuser=evolution 2026-08-18 15:27:10 L1=5.91 run=4 blk=0 avail=6371 (54.3%) swpO=0 conn=7 myRSS=2259 php=25 phpRSS=1108 ap=64 tcp=36 topuser=evolution 2026-08-18 15:27:12 L1=5.91 run=4 blk=0 avail=6382 (54.4%) swpO=0 conn=7 myRSS=2259 php=25 phpRSS=1108 ap=63 tcp=33 topuser=evolution 2026-08-18 15:27:20 L1=5.32 run=2 blk=0 avail=6424 (54.8%) swpO=0 conn=6 myRSS=2259 php=25 phpRSS=1108 ap=55 tcp=40 topuser=evolution 2026-08-18 15:27:22 L1=5.32 run=5 blk=0 avail=6280 (53.5%) swpO=0 conn=10 myRSS=2259 php=28 phpRSS=1343 ap=54 tcp=44 topuser=evolution 2026-08-18 15:27:30 L1=5.56 run=4 blk=0 avail=6372 (54.3%) swpO=0 conn=7 myRSS=2259 php=25 phpRSS=1108 ap=59 tcp=49 topuser=evolution 2026-08-18 15:27:32 L1=5.56 run=3 blk=0 avail=6380 (54.4%) swpO=0 conn=7 myRSS=2259 php=25 phpRSS=1108 ap=58 tcp=46 topuser=evolution 2026-08-18 15:27:41 L1=5.32 run=10 blk=0 avail=6296 (53.7%) swpO=0 conn=7 myRSS=2260 php=26 phpRSS=1168 ap=69 tcp=56 topuser=evolution