INCIDENT 2026-08-18 15:28:41 trigger: php_procs=29 ================================================================== load: 5.05 4.79 3.73 2/721 1673384 ncpu:10 mem_avail: 6279MB/11729MB (53.5%) swap_used:2695MB swapout:0/s blocked(D):0 running:5 iowait:0.0% steal:0.0% php: 29 procs / 1292MB heaviest user: evolution (29 procs, 1292MB) apache: 64 procs tcp_estab: 50 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2260 evolution 33 1306 nobody 63 965 root 244 761 netdata 8 263 cpanellogin 1 107 kurri 6 69 dovenull 6 26 aaa 2 23 wp-toolkit 6 18 mailnull 2 15 zabbix 1 14 alison 1 13 vinesit 1 12 mailman 20 12 nscd 1 7 dovecot 3 7 named 1 5 dbus 1 2 cpanelconnecttrack 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 29 1292 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5613 MB Active(file): 4767 MB Inactive(file): 1002 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 344 MB CommitLimit: 9960 MB Committed_AS: 11715 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 955450 root 14:17:25 1120 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2315008 10.2 Ssl 3-07:38:04 /usr/sbin/mariadbd 1220 1 netdata 202628 2.5 Ssl 50-05:18:46 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1000361 998750 root 153296 0.0 S 13:03:52 spamd child 1638383 1353308 cpanellogin 110268 0.0 S 37:32 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 2575382 1 root 93324 0.0 Ss 3-07:38:07 /usr/lib/systemd/systemd-journald 998750 1 root 90188 0.0 Ss 13:05:57 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1578009 998750 root 87856 0.0 S 01:46:13 spamd child 1673324 1671154 evolution 69392 8.0 S 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1658731 1658711 evolution 59092 0.7 S 14:33 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1658820 1658284 evolution 59088 0.7 S 14:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1660119 1660117 evolution 57796 0.6 S 13:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1661971 1661923 evolution 56032 0.6 S 11:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1662694 1662154 evolution 55628 0.5 S 10:35 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1666918 1666256 evolution 54048 0.5 S 06:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1671829 1353308 root 46276 0.2 S 01:16 whostmgrd - serving 1.144.107.82 1669958 1669681 evolution 43228 0.0 S 03:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669957 1669680 evolution 43184 0.0 S 03:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663347 1663338 evolution 43156 0.0 S 09:59 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663808 1663363 evolution 43084 0.0 S 09:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663804 1663711 evolution 43072 0.0 S 09:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663661 1663314 evolution 43012 0.0 S 09:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663613 1658938 evolution 42996 0.0 S 09:35 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663197 1662151 evolution 42984 0.0 S 10:06 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663383 1663357 evolution 42956 0.0 S 09:57 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669525 1669080 evolution 42916 0.0 S 03:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669524 1669082 evolution 42808 0.0 S 03:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669526 1669065 evolution 42756 0.0 S 03:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 42352 0.1 Sl 50-05:18:41 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1353308 1 root 42104 0.0 Ss 27-12:47:16 cpsrvd (SSL) - waiting for connections 2223 1201 root 40396 0.0 Sl 50-05:18:45 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1673347 1673157 evolution 40044 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1673348 1672742 evolution 39852 2.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1664109 1663969 evolution 39712 0.0 S 08:45 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663166 1661359 evolution 39700 0.0 S 10:11 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663645 1663336 evolution 39700 0.0 S 09:32 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663658 1661021 evolution 39672 0.0 S 09:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665393 1663680 evolution 39612 0.0 S 07:49 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665409 1664796 evolution 39592 0.0 S 07:47 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1671875 1353308 root 39244 0.0 S 01:13 whostmgrd - serving 1.144.107.82 1663678 1662119 evolution 39196 0.0 S 09:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1673344 1673119 evolution 39012 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 27136 0.1 Ss 50-05:18:45 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1668037 1276780 nobody 20356 0.0 S 04:48 /usr/sbin/httpd -k start 1669654 1276780 nobody 20180 0.0 S 03:06 /usr/sbin/httpd -k start 998083 1 root 19828 0.0 Ss 13:06:30 lfd - sleeping 1661021 1276780 nobody 19236 0.0 S 12:25 /usr/sbin/httpd -k start 1670675 1276780 nobody 19200 0.0 S 02:16 /usr/sbin/httpd -k start 1669932 1276780 nobody 18972 0.0 S 03:03 /usr/sbin/httpd -k start 1671797 1276780 nobody 18928 0.0 S 01:18 /usr/sbin/httpd -k start 1658938 1276780 nobody 18884 0.0 S 14:20 /usr/sbin/httpd -k start 1672188 1276780 nobody 18872 0.1 S 01:01 /usr/sbin/httpd -k start 1671807 1276780 nobody 18636 0.0 S 01:17 /usr/sbin/httpd -k start 1672176 1276780 nobody 18500 0.0 S 01:02 /usr/sbin/httpd -k start 1672190 1276780 nobody 18496 0.0 S 01:01 /usr/sbin/httpd -k start 1672193 1276780 nobody 18436 0.0 S 01:01 /usr/sbin/httpd -k start 1672192 1276780 nobody 18300 0.0 S 01:01 /usr/sbin/httpd -k start 1672178 1276780 nobody 18216 0.0 S 01:02 /usr/sbin/httpd -k start 1663680 1276780 nobody 18116 0.0 S 09:26 /usr/sbin/httpd -k start 1672723 1276780 nobody 18048 0.0 S 00:35 /usr/sbin/httpd -k start 1669934 1276780 nobody 17936 0.0 S 03:03 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9365239 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 9365235 | root | 85-1525752154 | Execute | 0 | Sending data | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9365211 | root | 85-1525752154 | Execute | 0 | Sending data | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9365210 | root | 85-1525752154 | Execute | 0 | Sending data | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9365209 | root | 85-1525752154 | Execute | 0 | Sending data | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9365207 | root | 85-1525752154 | Execute | 0 | Sending data | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | +---------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+---------------+------+------------------------------+------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+---------------+------+------------------------------+------------------------------------------+ | 9365245 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9365244 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9365242 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9365234 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | +---------+---------------+------+------------------------------+------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 470 nrg/nrgservices.net.au-ssl_log 121 evolution/portal.evolutionerp.com.au-ssl_log 47 infinium/infinium.net.au-ssl_log 42 vinesit/vinesit.com.au-ssl_log 42 candyfabcom/candyfab.com.au-ssl_log 30 cosgrovecreative/cosgrovecreative.com.au-ssl_log 13 corpkicks/corporatekicks.com.au-ssl_log 8 madalice/madalice.com.au-ssl_log 8 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 203 203.54.180.238 161 20.42.19.40 100 103.104.164.114 80 103.104.165.99 42 182.239.240.254 40 20.29.77.16 30 74.248.133.44 27 1.144.107.82 16 147.161.213.78 14 203.214.146.60 13 20.151.109.219 13 180.181.236.49 7 116.91.221.198 4 118.127.40.55 4 115.128.106.35 --- top request paths across all vhosts (last 3 min) --- 195 POST /functions.php 69 GET /app/ajax.php 45 GET /index.php 45 GET /heartbeat.php 25 POST /app/ajax/selectFilter.php 19 POST /quoteditsave.php 19 POST /purchaseaddsave.php 18 POST /plugins/csvexporter/plugin.php 14 POST /inveditsave.php 13 POST /app/ajax.php 12 POST /app/ajax/selectFilterSingle.php 9 POST /clienteditsave.php 7 POST //functions.php 6 GET /aa.php 5 GET /wp-content/plugins/hellopress/wp_filemanager.php 5 GET /av.php 4 POST /wp-admin/admin-ajax.php 4 POST /jobeditsave.php 4 POST /itemModify.php 4 GET /wp-file.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 195 POST /functions.php 69 GET /app/ajax.php 43 GET /index.php 25 POST /app/ajax/selectFilter.php 19 POST /quoteditsave.php 19 POST /purchaseaddsave.php 18 POST /plugins/csvexporter/plugin.php 14 POST /inveditsave.php 13 POST /app/ajax.php 12 POST /app/ajax/selectFilterSingle.php 9 POST /clienteditsave.php 7 POST //functions.php -- last 10 requests -- 203.54.180.238 - - [18/Aug/2026:15:28:38 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 604 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 203.54.180.238 - - [18/Aug/2026:15:28:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 285 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=28957&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; 147.161.213.78 - - [18/Aug/2026:15:28:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=siteedit&siteid=3028" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 147.161.213.78 - - [18/Aug/2026:15:28:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=siteedit&siteid=4198" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 147.161.213.78 - - [18/Aug/2026:15:28:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=siteedit&siteid=4031" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 147.161.213.78 - - [18/Aug/2026:15:28:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=siteedit&siteid=4422" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 147.161.213.78 - - [18/Aug/2026:15:28:40 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=siteedit&siteid=4346" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 147.161.213.78 - - [18/Aug/2026:15:28:40 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=siteedit&siteid=4802" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 147.161.213.78 - - [18/Aug/2026:15:28:40 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=siteedit&siteid=4192" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 203.54.180.238 - - [18/Aug/2026:15:28:41 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=purchaseadd" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 == nrg/nrgservices.net.au-ssl_log == -- top paths -- 3 GET /ioxi-o.php 3 GET /adminfuns.php 2 GET /wp-content/themes/admin.php 2 GET /wk/index.php 2 GET /lite.php 2 GET /inputs.php 2 GET /index/function.php 2 GET /goods.php 2 GET /dropdown.php 2 GET /buy.php 2 GET /as.php 2 GET /akc.php -- last 10 requests -- 20.42.19.40 - - [18/Aug/2026:15:26:51 +1000] "GET /akc.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:26:52 +1000] "GET /buy.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:26:52 +1000] "GET /cong.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:26:53 +1000] "GET /db.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:26:53 +1000] "GET /dropdown.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:26:53 +1000] "GET /file.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:26:54 +1000] "GET /goods.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:26:54 +1000] "GET /hplfuns.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:26:55 +1000] "GET /htaccess.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:26:55 +1000] "GET /index/function.php HTTP/1.1" 404 5749 "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 45 GET /heartbeat.php 1 POST /factory_functions.php 1 GET /index.php -- last 10 requests -- 203.54.180.238 - - [18/Aug/2026:15:27:58 +1000] "GET /heartbeat.php?sentAt=1787030876&bytes=106,131,237,92&_=1787030704899 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [18/Aug/2026:15:28:03 +1000] "GET /heartbeat.php?sentAt=1787030883&bytes=106,131,237,99&_=1787029289218 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [18/Aug/2026:15:28:05 +1000] "GET /heartbeat.php?sentAt=1787030885&bytes=106,131,237,101&_=1787027050447 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [18/Aug/2026:15:28:08 +1000] "GET /heartbeat.php?sentAt=1787030886&bytes=106,131,237,102&_=1787030704900 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [18/Aug/2026:15:28:13 +1000] "GET /heartbeat.php?sentAt=1787030893&bytes=106,131,237,109&_=1787029289219 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [18/Aug/2026:15:28:15 +1000] "GET /heartbeat.php?sentAt=1787030895&bytes=106,131,237,111&_=1787027050448 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [18/Aug/2026:15:28:18 +1000] "GET /heartbeat.php?sentAt=1787030896&bytes=106,131,237,112&_=1787030704901 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [18/Aug/2026:15:28:22 +1000] "GET /heartbeat.php?sentAt=1787030903&bytes=106,131,237,119&_=1787029289220 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [18/Aug/2026:15:28:25 +1000] "GET /heartbeat.php?sentAt=1787030905&bytes=106,131,237,121&_=1787027050449 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [18/Aug/2026:15:28:28 +1000] "GET /heartbeat.php?sentAt=1787030906&bytes=106,131,237,122&_=1787030704902 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 --- last 30 samples (run-up to this incident) --- 2026-08-18 15:26:11 L1=5.61 run=14 blk=0 avail=6240 (53.2%) swpO=2 conn=10 myRSS=2177 php=28 phpRSS=1458 ap=57 tcp=40 topuser=evolution 2026-08-18 15:26:19 L1=5.24 run=4 blk=0 avail=6522 (55.6%) swpO=2 conn=7 myRSS=2177 php=25 phpRSS=1108 ap=54 tcp=34 topuser=evolution 2026-08-18 15:26:21 L1=4.98 run=3 blk=0 avail=6550 (55.8%) swpO=0 conn=7 myRSS=2177 php=25 phpRSS=1108 ap=52 tcp=32 topuser=evolution 2026-08-18 15:26:29 L1=4.82 run=3 blk=0 avail=6455 (55.0%) swpO=0 conn=9 myRSS=2177 php=26 phpRSS=1142 ap=63 tcp=41 topuser=evolution 2026-08-18 15:26:31 L1=5.24 run=5 blk=0 avail=6359 (54.2%) swpO=0 conn=9 myRSS=2181 php=27 phpRSS=1272 ap=62 tcp=40 topuser=evolution 2026-08-18 15:26:40 L1=5.46 run=4 blk=1 avail=6093 (52.0%) swpO=0 conn=10 myRSS=2183 php=28 phpRSS=1561 ap=62 tcp=57 topuser=evolution 2026-08-18 15:26:42 L1=5.66 run=4 blk=0 avail=6147 (52.4%) swpO=0 conn=9 myRSS=2201 php=27 phpRSS=1417 ap=68 tcp=56 topuser=evolution 2026-08-18 15:26:50 L1=6.24 run=9 blk=0 avail=5944 (50.7%) swpO=27 conn=11 myRSS=2252 php=34 phpRSS=1725 ap=73 tcp=56 topuser=evolution 2026-08-18 15:26:52 L1=6.24 run=7 blk=0 avail=6186 (52.7%) swpO=27 conn=9 myRSS=2252 php=31 phpRSS=1387 ap=72 tcp=51 topuser=evolution 2026-08-18 15:27:00 L1=6.52 run=8 blk=0 avail=6115 (52.1%) swpO=0 conn=10 myRSS=2256 php=28 phpRSS=1387 ap=71 tcp=54 topuser=evolution 2026-08-18 15:27:02 L1=6.52 run=3 blk=0 avail=6242 (53.2%) swpO=0 conn=8 myRSS=2259 php=26 phpRSS=1199 ap=71 tcp=52 topuser=evolution 2026-08-18 15:27:10 L1=5.91 run=4 blk=0 avail=6371 (54.3%) swpO=0 conn=7 myRSS=2259 php=25 phpRSS=1108 ap=64 tcp=36 topuser=evolution 2026-08-18 15:27:12 L1=5.91 run=4 blk=0 avail=6382 (54.4%) swpO=0 conn=7 myRSS=2259 php=25 phpRSS=1108 ap=63 tcp=33 topuser=evolution 2026-08-18 15:27:20 L1=5.32 run=2 blk=0 avail=6424 (54.8%) swpO=0 conn=6 myRSS=2259 php=25 phpRSS=1108 ap=55 tcp=40 topuser=evolution 2026-08-18 15:27:22 L1=5.32 run=5 blk=0 avail=6280 (53.5%) swpO=0 conn=10 myRSS=2259 php=28 phpRSS=1343 ap=54 tcp=44 topuser=evolution 2026-08-18 15:27:30 L1=5.56 run=4 blk=0 avail=6372 (54.3%) swpO=0 conn=7 myRSS=2259 php=25 phpRSS=1108 ap=59 tcp=49 topuser=evolution 2026-08-18 15:27:32 L1=5.56 run=3 blk=0 avail=6380 (54.4%) swpO=0 conn=7 myRSS=2259 php=25 phpRSS=1108 ap=58 tcp=46 topuser=evolution 2026-08-18 15:27:41 L1=5.32 run=10 blk=0 avail=6296 (53.7%) swpO=0 conn=7 myRSS=2260 php=26 phpRSS=1168 ap=69 tcp=56 topuser=evolution 2026-08-18 15:27:42 L1=5.32 run=4 blk=0 avail=6317 (53.9%) swpO=0 conn=7 myRSS=2260 php=25 phpRSS=1108 ap=69 tcp=49 topuser=evolution 2026-08-18 15:27:51 L1=4.88 run=5 blk=0 avail=6267 (53.4%) swpO=0 conn=8 myRSS=2260 php=26 phpRSS=1234 ap=62 tcp=37 topuser=evolution 2026-08-18 15:27:52 L1=4.88 run=9 blk=0 avail=6110 (52.1%) swpO=0 conn=7 myRSS=2260 php=27 phpRSS=1420 ap=61 tcp=40 topuser=evolution 2026-08-18 15:28:01 L1=5.23 run=4 blk=0 avail=6393 (54.5%) swpO=0 conn=7 myRSS=2260 php=25 phpRSS=1108 ap=55 tcp=40 topuser=evolution 2026-08-18 15:28:02 L1=5.23 run=2 blk=0 avail=6400 (54.6%) swpO=0 conn=7 myRSS=2260 php=25 phpRSS=1108 ap=55 tcp=40 topuser=evolution 2026-08-18 15:28:11 L1=5.50 run=4 blk=0 avail=6356 (54.2%) swpO=0 conn=6 myRSS=2260 php=26 phpRSS=1173 ap=55 tcp=45 topuser=evolution 2026-08-18 15:28:12 L1=5.50 run=12 blk=0 avail=6217 (53.0%) swpO=0 conn=9 myRSS=2260 php=28 phpRSS=1389 ap=55 tcp=41 topuser=evolution 2026-08-18 15:28:21 L1=5.56 run=3 blk=0 avail=6381 (54.4%) swpO=0 conn=7 myRSS=2260 php=25 phpRSS=1108 ap=55 tcp=50 topuser=evolution 2026-08-18 15:28:22 L1=5.56 run=15 blk=0 avail=6305 (53.8%) swpO=0 conn=8 myRSS=2260 php=27 phpRSS=1247 ap=55 tcp=53 topuser=evolution 2026-08-18 15:28:31 L1=5.60 run=2 blk=0 avail=6365 (54.3%) swpO=0 conn=7 myRSS=2260 php=25 phpRSS=1108 ap=59 tcp=40 topuser=evolution 2026-08-18 15:28:32 L1=5.60 run=2 blk=0 avail=6371 (54.3%) swpO=0 conn=7 myRSS=2260 php=25 phpRSS=1108 ap=58 tcp=43 topuser=evolution 2026-08-18 15:28:41 L1=5.05 run=5 blk=0 avail=6279 (53.5%) swpO=0 conn=7 myRSS=2260 php=29 phpRSS=1292 ap=64 tcp=50 topuser=evolution