INCIDENT 2026-08-18 15:30:43 trigger: php_procs=33 php_rss=1655MB ================================================================== load: 5.93 5.05 3.94 11/738 1675804 ncpu:10 mem_avail: 6021MB/11729MB (51.3%) swap_used:2714MB swapout:0/s blocked(D):0 running:5 iowait:0.1% steal:0.0% php: 33 procs / 1655MB heaviest user: evolution (32 procs, 1439MB) apache: 72 procs tcp_estab: 64 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2249 evolution 37 1491 nobody 71 1089 root 245 657 netdata 8 261 corpkicks 1 228 cpanellogin 1 107 kurri 6 69 dovenull 6 26 aaa 2 23 mailnull 3 19 wp-toolkit 6 18 zabbix 1 15 alison 1 13 mailman 20 12 kamcool 1 10 nscd 1 7 dovecot 3 7 named 1 5 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 34 1461 corpkicks 1 229 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5385 MB Active(file): 4499 MB Inactive(file): 1026 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 344 MB CommitLimit: 9960 MB Committed_AS: 12408 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 955450 root 14:19:27 1088 /usr/bin/imunify-agent-proxy 1674991 root 00:42 1332 /bin/sh -c bash -c "sleep $((RANDOM % 60))" ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2303104 10.3 Ssl 3-07:40:06 /usr/sbin/mariadbd 1675723 1674474 corpkicks 246172 136 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1220 1 netdata 202408 2.5 Ssl 50-05:20:48 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1000361 998750 root 153328 0.0 S 13:05:54 spamd child 1638383 1353308 cpanellogin 110312 0.0 S 39:34 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 2575382 1 root 93584 0.0 Ss 3-07:40:09 /usr/lib/systemd/systemd-journald 998750 1 root 90152 0.0 Ss 13:07:59 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1578009 998750 root 87792 0.0 S 01:48:15 spamd child 1675706 1673341 evolution 71560 7.3 S 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1675738 1675648 evolution 68296 18.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1658731 1658711 evolution 59092 0.6 S 16:35 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1658820 1658284 evolution 59088 0.6 S 16:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1660119 1660117 evolution 57796 0.6 S 15:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1661971 1661923 evolution 56032 0.5 S 13:15 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1662694 1662154 evolution 55628 0.5 S 12:37 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1666918 1666256 evolution 54048 0.5 S 08:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669958 1669681 evolution 43228 0.0 S 05:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669957 1669680 evolution 43184 0.0 S 05:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663347 1663338 evolution 43156 0.0 S 12:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663808 1663363 evolution 43084 0.0 S 11:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663804 1663711 evolution 43072 0.0 S 11:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663661 1663314 evolution 43012 0.0 S 11:31 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663613 1658938 evolution 42996 0.0 S 11:37 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663197 1662151 evolution 42984 0.0 S 12:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663383 1663357 evolution 42956 0.0 S 11:59 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669525 1669080 evolution 42916 0.0 S 05:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669524 1669082 evolution 42808 0.0 S 05:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669526 1669065 evolution 42756 0.0 S 05:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 42104 0.0 Ss 27-12:49:18 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 41196 0.1 Sl 50-05:20:43 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2223 1201 root 40388 0.0 Sl 50-05:20:47 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1675747 1674864 evolution 40028 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1675746 1675636 evolution 40012 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1664109 1663969 evolution 39712 0.0 S 10:47 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663166 1661359 evolution 39700 0.0 S 12:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663645 1663336 evolution 39700 0.0 S 11:34 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663658 1661021 evolution 39672 0.0 S 11:31 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1675739 1675700 evolution 39636 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665393 1663680 evolution 39612 0.0 S 09:51 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665409 1664796 evolution 39592 0.0 S 09:49 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1675810 1673119 evolution 39444 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1675812 1675356 evolution 39412 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1675795 1675695 evolution 39336 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1675745 1671807 evolution 39232 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663678 1662119 evolution 39196 0.0 S 11:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 26244 0.1 Ss 50-05:20:47 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 998083 1 root 19840 0.0 Ss 13:08:32 lfd - sleeping 1670675 1276780 nobody 19636 0.1 S 04:18 /usr/sbin/httpd -k start 1671807 1276780 nobody 19520 0.0 S 03:19 /usr/sbin/httpd -k start 1672742 1276780 nobody 19316 0.0 S 02:33 /usr/sbin/httpd -k start 1661021 1276780 nobody 19236 0.0 S 14:27 /usr/sbin/httpd -k start 1658938 1276780 nobody 18884 0.0 S 16:22 /usr/sbin/httpd -k start 1674025 1276780 nobody 18756 0.1 S 01:34 /usr/sbin/httpd -k start 1674013 1276780 nobody 18652 0.1 S 01:35 /usr/sbin/httpd -k start 1672723 1276780 nobody 18540 0.0 S 02:37 /usr/sbin/httpd -k start 1673353 1276780 nobody 18332 0.0 S 02:02 /usr/sbin/httpd -k start 1672150 1276780 nobody 18192 0.0 S 03:06 /usr/sbin/httpd -k start 1663680 1276780 nobody 18116 0.0 S 11:28 /usr/sbin/httpd -k start 1673341 1276780 nobody 18076 0.0 S 02:03 /usr/sbin/httpd -k start 1669066 1276780 nobody 18056 0.0 S 05:50 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9413804 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 9413792 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9413790 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9413789 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9413765 | root | 85-1525752154 | Execute | 0 | Sending data | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9413763 | root | 85-1525752154 | Execute | 0 | Sending data | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9413762 | root | 85-1525752154 | Execute | 0 | Sending data | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9413832 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9413830 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9413829 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9413828 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9413826 | 85-1525752154 | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadd | +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 624 infinium/infinium.net.au-ssl_log 129 olytis/tis.com.au-ssl_log 104 evolution/portal.evolutionerp.com.au-ssl_log 53 cosgrovecreative/cosgrovecreative.com.au-ssl_log 32 madalice/madalice.com.au-ssl_log 10 corpkicks/corporatekicks.com.au-ssl_log 1 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 322 203.54.180.238 132 103.104.164.114 129 20.42.19.40 88 172.161.79.158 80 182.239.240.254 43 103.104.165.99 41 180.181.236.49 32 191.237.254.161 23 116.91.221.198 16 172.202.39.151 16 147.161.213.78 5 203.214.146.60 4 115.128.106.35 4 101.182.108.127 3 68.67.112.66 --- top request paths across all vhosts (last 3 min) --- 200 POST /functions.php 140 GET /app/ajax.php 61 GET /index.php 43 POST /quoteditsave.php 38 GET /heartbeat.php 29 POST /clienteditsave.php 27 POST /app/ajax/selectFilterSingle.php 26 POST /plugins/csvexporter/plugin.php 25 POST /app/ajax.php 17 POST /jobeditsave.php 12 POST /app/ajax/selectFilter.php 10 POST /purchaseaddsave.php 8 POST /logsave.php 6 GET /admin.php 5 POST /invoiceaddsave.php 5 POST /dispatchsave.php 5 GET /adminfuns.php 4 POST /tasksave.php 4 POST //functions.php 4 GET /store/custom-monogram-shoes/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 200 POST /functions.php 140 GET /app/ajax.php 58 GET /index.php 43 POST /quoteditsave.php 29 POST /clienteditsave.php 27 POST /app/ajax/selectFilterSingle.php 26 POST /plugins/csvexporter/plugin.php 25 POST /app/ajax.php 17 POST /jobeditsave.php 12 POST /app/ajax/selectFilter.php 10 POST /purchaseaddsave.php 8 POST /logsave.php -- last 10 requests -- 203.54.180.238 - - [18/Aug/2026:15:30:37 +1000] "GET /index.php?page=jobedit&id=29284 HTTP/1.1" 200 193598 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 203.54.180.238 - - [18/Aug/2026:15:30:41 +1000] "GET /index.php?page=invoiceadd&invoiceid=37384 HTTP/1.1" 200 51585 "https://my.evolutionerp.com.au/index.php?page=clienthistory&clientid=20568" "Mozilla/5.0 (Windows NT 10 203.54.180.238 - - [18/Aug/2026:15:30:39 +1000] "POST /logsave.php?call=getHistory&id=29284&module=job HTTP/1.1" 200 1133 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29284" "Mozilla/5.0 (Windows NT 10.0; Wi 203.54.180.238 - - [18/Aug/2026:15:30:42 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=37384&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; 203.54.180.238 - - [18/Aug/2026:15:30:41 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29284" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 203.54.180.238 - - [18/Aug/2026:15:30:42 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29284" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 203.54.180.238 - - [18/Aug/2026:15:30:41 +1000] "POST /clienteditsave.php?clientid=19935&call=getCategoryDiscounts HTTP/1.1" 200 25 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29284" "Mozilla/5.0 (Windows N 203.54.180.238 - - [18/Aug/2026:15:30:43 +1000] "POST /clienteditsave.php?clientid=20568&call=getCategoryDiscounts HTTP/1.1" 200 585 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=37384&tab=maintab" 203.54.180.238 - - [18/Aug/2026:15:30:42 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 23376 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29284" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 203.54.180.238 - - [18/Aug/2026:15:30:43 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=14099318898 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index == infinium/infinium.net.au-ssl_log == -- top paths -- 3 GET /ioxi-o.php 3 GET /admin.php 3 GET /adminfuns.php 2 GET /wp-content/themes/admin.php 2 GET /wk/index.php 2 GET /lite.php 2 GET /inputs.php 2 GET /info.php 2 GET /index/function.php 2 GET /goods.php 2 GET /file.php 2 GET /edit.php -- last 10 requests -- 20.42.19.40 - - [18/Aug/2026:15:29:11 +1000] "GET /cong.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:29:12 +1000] "GET /db.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:29:12 +1000] "GET /dropdown.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:29:13 +1000] "GET /file.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:29:13 +1000] "GET /goods.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:29:14 +1000] "GET /hplfuns.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:29:14 +1000] "GET /htaccess.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:29:15 +1000] "GET /index/function.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:29:15 +1000] "GET /info.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:29:15 +1000] "GET /profile.php HTTP/1.1" 404 5749 "-" "-" == olytis/tis.com.au-ssl_log == -- top paths -- 2 GET /admin.php 2 GET /adminfuns.php 1 GET /wso112233.php 1 GET /wp-the.php 1 GET /wp-mail.php 1 GET /wp-logs.php 1 GET /wp-login.php 1 GET /wp-load.php 1 GET /wp-index.php 1 GET /wp-includes/Text/Diff/ 1 GET /wp-includes/Text/about.php 1 GET /wp-includes/Requests/library/ -- last 10 requests -- 172.202.39.151 - - [18/Aug/2026:15:30:37 +1000] "GET /about.php HTTP/1.1" 404 5750 "-" "-" 172.161.79.158 - - [18/Aug/2026:15:30:37 +1000] "GET /5173e.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.202.39.151 - - [18/Aug/2026:15:30:37 +1000] "GET /wp-admin/css/colors/index.php HTTP/1.1" 404 5750 "-" "-" 172.161.79.158 - - [18/Aug/2026:15:30:37 +1000] "GET /class_api.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.202.39.151 - - [18/Aug/2026:15:30:37 +1000] "GET /f35.php HTTP/1.1" 404 5750 "-" "-" 172.161.79.158 - - [18/Aug/2026:15:30:38 +1000] "GET /word.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [18/Aug/2026:15:30:38 +1000] "GET /wp-index.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.202.39.151 - - [18/Aug/2026:15:30:38 +1000] "GET /wp-includes/js/ HTTP/1.1" 404 5750 "-" "-" 172.161.79.158 - - [18/Aug/2026:15:30:38 +1000] "GET /bypass.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.202.39.151 - - [18/Aug/2026:15:30:38 +1000] "GET /inputs.php HTTP/1.1" 404 5750 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-18 15:28:21 L1=5.56 run=3 blk=0 avail=6381 (54.4%) swpO=0 conn=7 myRSS=2260 php=25 phpRSS=1108 ap=55 tcp=50 topuser=evolution 2026-08-18 15:28:22 L1=5.56 run=15 blk=0 avail=6305 (53.8%) swpO=0 conn=8 myRSS=2260 php=27 phpRSS=1247 ap=55 tcp=53 topuser=evolution 2026-08-18 15:28:31 L1=5.60 run=2 blk=0 avail=6365 (54.3%) swpO=0 conn=7 myRSS=2260 php=25 phpRSS=1108 ap=59 tcp=40 topuser=evolution 2026-08-18 15:28:32 L1=5.60 run=2 blk=0 avail=6371 (54.3%) swpO=0 conn=7 myRSS=2260 php=25 phpRSS=1108 ap=58 tcp=43 topuser=evolution 2026-08-18 15:28:41 L1=5.05 run=5 blk=0 avail=6279 (53.5%) swpO=0 conn=7 myRSS=2260 php=29 phpRSS=1292 ap=64 tcp=50 topuser=evolution 2026-08-18 15:28:42 L1=5.05 run=4 blk=0 avail=6277 (53.5%) swpO=0 conn=6 myRSS=2260 php=29 phpRSS=1293 ap=64 tcp=50 topuser=evolution 2026-08-18 15:28:52 L1=4.42 run=8 blk=0 avail=6405 (54.6%) swpO=0 conn=8 myRSS=2261 php=25 phpRSS=1108 ap=58 tcp=39 topuser=evolution 2026-08-18 15:28:53 L1=4.42 run=3 blk=0 avail=6391 (54.5%) swpO=0 conn=8 myRSS=2261 php=26 phpRSS=1148 ap=57 tcp=40 topuser=evolution 2026-08-18 15:29:02 L1=4.13 run=8 blk=0 avail=5965 (50.9%) swpO=0 conn=11 myRSS=2261 php=27 phpRSS=1608 ap=59 tcp=45 topuser=evolution 2026-08-18 15:29:03 L1=4.13 run=3 blk=0 avail=6164 (52.6%) swpO=0 conn=9 myRSS=2261 php=27 phpRSS=1408 ap=58 tcp=45 topuser=evolution 2026-08-18 15:29:12 L1=4.33 run=9 blk=0 avail=6263 (53.4%) swpO=249 conn=9 myRSS=2255 php=30 phpRSS=1370 ap=62 tcp=50 topuser=evolution 2026-08-18 15:29:13 L1=4.33 run=6 blk=0 avail=6217 (53.0%) swpO=249 conn=10 myRSS=2255 php=31 phpRSS=1443 ap=62 tcp=52 topuser=evolution 2026-08-18 15:29:22 L1=4.44 run=5 blk=0 avail=6299 (53.7%) swpO=0 conn=8 myRSS=2255 php=27 phpRSS=1216 ap=62 tcp=47 topuser=evolution 2026-08-18 15:29:23 L1=4.44 run=5 blk=0 avail=6331 (54.0%) swpO=0 conn=9 myRSS=2255 php=27 phpRSS=1213 ap=62 tcp=49 topuser=evolution 2026-08-18 15:29:32 L1=4.60 run=2 blk=0 avail=6424 (54.8%) swpO=0 conn=7 myRSS=2255 php=25 phpRSS=1108 ap=57 tcp=44 topuser=evolution 2026-08-18 15:29:33 L1=4.60 run=11 blk=0 avail=6392 (54.5%) swpO=0 conn=9 myRSS=2255 php=30 phpRSS=1277 ap=57 tcp=47 topuser=evolution 2026-08-18 15:29:42 L1=4.42 run=4 blk=0 avail=6323 (53.9%) swpO=0 conn=9 myRSS=2255 php=26 phpRSS=1149 ap=64 tcp=36 topuser=evolution 2026-08-18 15:29:43 L1=4.42 run=7 blk=0 avail=6311 (53.8%) swpO=0 conn=10 myRSS=2255 php=27 phpRSS=1189 ap=63 tcp=38 topuser=evolution 2026-08-18 15:29:53 L1=5.23 run=6 blk=0 avail=6358 (54.2%) swpO=0 conn=10 myRSS=2255 php=27 phpRSS=1197 ap=65 tcp=45 topuser=evolution 2026-08-18 15:29:53 L1=5.23 run=6 blk=0 avail=6355 (54.2%) swpO=0 conn=11 myRSS=2255 php=27 phpRSS=1197 ap=65 tcp=45 topuser=evolution 2026-08-18 15:30:03 L1=5.89 run=11 blk=0 avail=6276 (53.5%) swpO=0 conn=12 myRSS=2255 php=29 phpRSS=1336 ap=62 tcp=42 topuser=evolution 2026-08-18 15:30:03 L1=5.89 run=10 blk=0 avail=6274 (53.5%) swpO=0 conn=12 myRSS=2255 php=29 phpRSS=1336 ap=62 tcp=42 topuser=evolution 2026-08-18 15:30:13 L1=5.67 run=6 blk=0 avail=5997 (51.1%) swpO=0 conn=12 myRSS=2255 php=30 phpRSS=1694 ap=56 tcp=41 topuser=evolution 2026-08-18 15:30:13 L1=5.67 run=5 blk=0 avail=5989 (51.1%) swpO=0 conn=12 myRSS=2255 php=30 phpRSS=1708 ap=56 tcp=42 topuser=evolution 2026-08-18 15:30:23 L1=5.73 run=11 blk=0 avail=6219 (53.0%) swpO=247 conn=10 myRSS=2248 php=28 phpRSS=1431 ap=54 tcp=41 topuser=evolution 2026-08-18 15:30:23 L1=5.73 run=7 blk=0 avail=6216 (53.0%) swpO=247 conn=10 myRSS=2248 php=28 phpRSS=1435 ap=54 tcp=39 topuser=evolution 2026-08-18 15:30:33 L1=5.54 run=11 blk=0 avail=6319 (53.9%) swpO=0 conn=12 myRSS=2249 php=30 phpRSS=1366 ap=55 tcp=45 topuser=evolution 2026-08-18 15:30:33 L1=5.54 run=8 blk=0 avail=6316 (53.8%) swpO=0 conn=10 myRSS=2249 php=30 phpRSS=1371 ap=55 tcp=45 topuser=evolution 2026-08-18 15:30:43 L1=5.93 run=5 blk=0 avail=6021 (51.3%) swpO=0 conn=10 myRSS=2249 php=33 phpRSS=1655 ap=72 tcp=64 topuser=evolution 2026-08-18 15:30:43 L1=5.93 run=9 blk=0 avail=6015 (51.3%) swpO=0 conn=10 myRSS=2249 php=33 phpRSS=1660 ap=72 tcp=65 topuser=evolution