INCIDENT 2026-08-18 15:32:45 trigger: php_procs=25 ================================================================== load: 5.48 5.23 4.15 4/711 1678024 ncpu:10 mem_avail: 6365MB/11729MB (54.3%) swap_used:2721MB swapout:0/s blocked(D):0 running:12 iowait:0.0% steal:0.0% php: 25 procs / 1108MB heaviest user: evolution (25 procs, 1108MB) apache: 67 procs tcp_estab: 50 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2244 evolution 30 1155 nobody 66 999 root 233 673 netdata 8 262 cpanellogin 1 107 kurri 7 82 aaa 3 35 dovenull 6 26 wp-toolkit 6 18 mailnull 2 15 zabbix 1 14 alison 1 13 mailman 20 12 nscd 1 7 dovecot 3 7 named 1 6 dbus 1 2 cpanelconnecttrack 1 2 polkitd 1 1 --- php workers by user --- USER PROCS RSS_MB evolution 26 1148 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5334 MB Active(file): 4334 MB Inactive(file): 1175 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 343 MB CommitLimit: 9960 MB Committed_AS: 11189 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 955450 root 14:21:28 1080 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2298000 10.4 Ssl 3-07:42:07 /usr/sbin/mariadbd 1220 1 netdata 202720 2.5 Ssl 50-05:22:49 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1000361 998750 root 153328 0.0 S 13:07:55 spamd child 1638383 1353308 cpanellogin 110312 0.0 S 41:35 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 2575382 1 root 94168 0.0 Ss 3-07:42:10 /usr/lib/systemd/systemd-journald 998750 1 root 90152 0.0 Ss 13:10:00 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1578009 998750 root 87776 0.0 S 01:50:16 spamd child 1658731 1658711 evolution 59092 0.6 S 18:36 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1658820 1658284 evolution 59088 0.6 S 18:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1660119 1660117 evolution 57796 0.6 S 17:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1661971 1661923 evolution 56068 0.5 S 15:16 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1662694 1662154 evolution 55792 0.5 S 14:38 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1666918 1666256 evolution 54048 0.5 S 10:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669958 1669681 evolution 43228 0.0 S 07:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669957 1669680 evolution 43184 0.0 S 07:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663347 1663338 evolution 43156 0.0 S 14:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663808 1663363 evolution 43084 0.0 S 13:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663804 1663711 evolution 43072 0.0 S 13:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663661 1663314 evolution 43012 0.0 S 13:32 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663613 1658938 evolution 42996 0.0 S 13:38 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663197 1662151 evolution 42984 0.0 S 14:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663383 1663357 evolution 42956 0.0 S 14:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669525 1669080 evolution 42916 0.0 S 07:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669524 1669082 evolution 42808 0.0 S 07:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669526 1669065 evolution 42756 0.0 S 07:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 42212 0.0 Ss 27-12:51:19 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 41064 0.1 Sl 50-05:22:44 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1678015 1677974 evolution 40676 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 40372 0.0 Sl 50-05:22:48 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1664109 1663969 evolution 39712 0.0 S 12:48 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663166 1661359 evolution 39700 0.0 S 14:14 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663645 1663336 evolution 39700 0.0 S 13:35 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663658 1661021 evolution 39672 0.0 S 13:32 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665393 1663680 evolution 39612 0.0 S 11:52 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665409 1664796 evolution 39592 0.0 S 11:50 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663678 1662119 evolution 39196 0.0 S 13:30 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 26040 0.1 Ss 50-05:22:48 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1466 1 root 25756 0.0 Ss 50-05:22:48 dnsadmin - server mode 1674483 1276780 nobody 19860 0.0 S 03:06 /usr/sbin/httpd -k start 998083 1 root 19856 0.0 Ss 13:10:33 lfd - sleeping 1672742 1276780 nobody 19820 0.0 S 04:34 /usr/sbin/httpd -k start 1675837 1276780 nobody 19728 0.0 S 02:01 /usr/sbin/httpd -k start 1672150 1276780 nobody 19640 0.0 S 05:07 /usr/sbin/httpd -k start 1674013 1276780 nobody 19572 0.1 S 03:36 /usr/sbin/httpd -k start 1676738 1276780 nobody 19380 0.0 S 01:23 /usr/sbin/httpd -k start 1661021 1276780 nobody 19236 0.0 S 16:28 /usr/sbin/httpd -k start 1675604 1276780 nobody 19204 0.0 S 02:09 /usr/sbin/httpd -k start 1673331 1276780 nobody 19080 0.0 S 04:05 /usr/sbin/httpd -k start 1658938 1276780 nobody 18884 0.0 S 18:23 /usr/sbin/httpd -k start 1675669 1276780 nobody 18796 0.1 S 02:05 /usr/sbin/httpd -k start 1677423 1276780 nobody 18720 0.1 S 00:49 /usr/sbin/httpd -k start 1677581 1276780 nobody 18376 0.0 S 00:40 /usr/sbin/httpd -k start 1674864 1276780 nobody 18268 0.0 S 02:53 /usr/sbin/httpd -k start 1663680 1276780 nobody 18116 0.0 S 13:29 /usr/sbin/httpd -k start 1675695 1276780 nobody 18068 0.0 S 02:04 /usr/sbin/httpd -k start 1662151 1276780 nobody 17908 0.0 S 15:03 /usr/sbin/httpd -k start 1669080 1276780 nobody 17820 0.0 S 07:50 /usr/sbin/httpd -k start 1675356 1276780 nobody 17764 0.1 S 02:25 /usr/sbin/httpd -k start 1674474 1276780 nobody 17448 0.0 S 03:07 /usr/sbin/httpd -k start 1463 1 root 16932 0.0 Ss 50-05:22:48 tailwatchd --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9446507 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 9446506 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9446505 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9446504 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9446503 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9446502 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9446499 | root | 85-1525752154 | Execute | 0 | Sending data | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9446506 | 85-1525752154 | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadd | | 9446505 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9446504 | 85-1525752154 | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadd | | 9446503 | 85-1525752154 | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadd | | 9446502 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 597 olytis/tis.com.au-ssl_log 208 evolution/portal.evolutionerp.com.au-ssl_log 84 corpkicks/corporatekicks.com.au 37 corpkicks/corporatekicks.com.au-ssl_log 36 madalice/madalice.com.au-ssl_log 12 aaa/aaadownunder.com.au-ssl_log 4 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 378 203.54.180.238 118 180.181.236.49 108 172.161.79.158 100 172.202.39.151 80 182.239.240.254 65 40.80.82.167 29 103.104.164.114 26 103.104.165.99 17 116.91.221.198 16 147.161.213.78 4 203.214.146.60 4 192.168.0.2 4 18.226.74.241 4 118.127.40.55 4 115.128.106.35 --- top request paths across all vhosts (last 3 min) --- 177 POST /functions.php 111 GET /app/ajax.php 90 GET /index.php 42 GET /heartbeat.php 40 POST /clienteditsave.php 27 POST /app/ajax/selectFilter.php 27 GET //app/ajax.php 26 POST /app/ajax/selectFilterSingle.php 23 POST /plugins/csvexporter/plugin.php 22 POST /app/ajax.php 11 POST /invoiceaddsave.php 11 POST //functions.php 10 GET //index.php 8 POST /jobeditsave.php 6 POST //clienteditsave.php 6 POST //app/ajax.php 5 POST /quoteditsave.php 5 POST /mfreqsave.php 5 POST /logsave.php 4 POST /tasksave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 177 POST /functions.php 111 GET /app/ajax.php 48 GET /index.php 40 POST /clienteditsave.php 27 POST /app/ajax/selectFilter.php 27 GET //app/ajax.php 26 POST /app/ajax/selectFilterSingle.php 23 POST /plugins/csvexporter/plugin.php 22 POST /app/ajax.php 11 POST /invoiceaddsave.php 11 POST //functions.php 10 GET //index.php -- last 10 requests -- 203.54.180.238 - - [18/Aug/2026:15:32:41 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29284&tab=filestab" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 203.54.180.238 - - [18/Aug/2026:15:32:41 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=28996&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [18/Aug/2026:15:32:41 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78511§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 203.54.180.238 - - [18/Aug/2026:15:32:41 +1000] "GET /index.php?page=inventory HTTP/1.1" 200 40080 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/ 203.54.180.238 - - [18/Aug/2026:15:32:43 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 203.54.180.238 - - [18/Aug/2026:15:32:43 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinventory&call=getUserSetting&caller=ajaxSubmitLocal&seq=15660010914 HTTP/1.1" 200 91 "https://my.evolutionerp.com.au/index.php? 203.54.180.238 - - [18/Aug/2026:15:32:43 +1000] "POST /inveditsave.php?call=fetch_inventory HTTP/1.1" 200 13370 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe 180.181.236.49 - - [18/Aug/2026:15:32:43 +1000] "GET /index.php?page=invoiceadd&invoiceid=2054%2Findex.php%3Fpage%3Dinvoiceadd&invoiceid=2054&tab=maintab HTTP/1.1" 200 54060 "https://my.evolutionerp.com.au/index.php?page 180.181.236.49 - - [18/Aug/2026:15:32:44 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=11304185490 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 180.181.236.49 - - [18/Aug/2026:15:32:44 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=10546901597 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index == olytis/tis.com.au-ssl_log == -- top paths -- 2 GET /wp-mail.php 2 GET /wp-login.php 2 GET /wp-includes/pomo/ 2 GET /wp-includes/js/crop/ 2 GET /wp-includes/ID3/index.php 2 GET /wp-includes/html-api/ 2 GET /wp-good.php 2 GET /wp-content/uploads/ 2 GET /wp-content/upgrade/index.php 2 GET /wp-admin/network/index.php 2 GET /wp-admin/js/widgets/ 2 GET /wp-admin/css/colors/midnight/ -- last 10 requests -- 172.202.39.151 - - [18/Aug/2026:15:31:15 +1000] "GET /wp-includes/images/smilies/about.php HTTP/1.1" 404 5750 "-" "-" 172.202.39.151 - - [18/Aug/2026:15:31:16 +1000] "GET /wp-includes/js/crop/ HTTP/1.1" 404 5750 "-" "-" 172.202.39.151 - - [18/Aug/2026:15:31:16 +1000] "GET /wp-mail.php HTTP/1.1" 404 5750 "-" "-" 172.202.39.151 - - [18/Aug/2026:15:31:17 +1000] "GET /o.php HTTP/1.1" 404 5750 "-" "-" 172.202.39.151 - - [18/Aug/2026:15:31:17 +1000] "GET /bb.php HTTP/1.1" 404 5750 "-" "-" 172.202.39.151 - - [18/Aug/2026:15:31:18 +1000] "GET /wp-admin/maint/admin.php HTTP/1.1" 404 5750 "-" "-" 172.202.39.151 - - [18/Aug/2026:15:31:19 +1000] "GET /wp-admin/network/ HTTP/1.1" 404 5750 "-" "-" 172.202.39.151 - - [18/Aug/2026:15:31:19 +1000] "GET /wp-includes/IXR/index.php HTTP/1.1" 404 5750 "-" "-" 172.202.39.151 - - [18/Aug/2026:15:31:20 +1000] "GET /xmrlpc.php HTTP/1.1" 404 5750 "-" "-" 172.202.39.151 - - [18/Aug/2026:15:31:20 +1000] "GET /file.php HTTP/1.1" 404 5750 "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 42 GET /index.php 42 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [18/Aug/2026:15:32:05 +1000] "GET /index.php?page=inventory_picking_goods&pickid=37732&seq=11385415187475 HTTP/1.1" 200 11853 "https://www.portal.evolutionerp.com.au/index.php?page=inventory_picking" " 203.54.180.238 - - [18/Aug/2026:15:32:05 +1000] "GET /heartbeat.php?sentAt=1787031125&bytes=106,131,238,85&_=1787027050471 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [18/Aug/2026:15:32:07 +1000] "GET /index.php?page=inventory_picking HTTP/1.1" 200 9126 "https://www.portal.evolutionerp.com.au/index.php?page=inventory_picking_goods&pickid=37732&seq=11385415187475" "M 203.54.180.238 - - [18/Aug/2026:15:32:08 +1000] "GET /index.php?page=inventory_picking_goods&pickid=37622&seq=340575847545 HTTP/1.1" 200 12762 "https://www.portal.evolutionerp.com.au/index.php?page=inventory_picking" "Mo 203.54.180.238 - - [18/Aug/2026:15:32:08 +1000] "GET /heartbeat.php?sentAt=1787031126&bytes=106,131,238,86&_=1787030704924 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [18/Aug/2026:15:32:11 +1000] "GET /index.php?page=inventory_picking HTTP/1.1" 200 9125 "https://www.portal.evolutionerp.com.au/index.php?page=inventory_picking_goods&pickid=37622&seq=340575847545" "Moz 203.54.180.238 - - [18/Aug/2026:15:32:13 +1000] "GET /heartbeat.php?sentAt=1787031133&bytes=106,131,238,93&_=1787029289243 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [18/Aug/2026:15:32:15 +1000] "GET /heartbeat.php?sentAt=1787031135&bytes=106,131,238,95&_=1787027050472 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [18/Aug/2026:15:32:18 +1000] "GET /heartbeat.php?sentAt=1787031136&bytes=106,131,238,96&_=1787030704925 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [18/Aug/2026:15:32:22 +1000] "GET /index.php?page=inventory_picking_goods&pickid=37731&seq=9747563200215 HTTP/1.1" 200 14130 "https://www.portal.evolutionerp.com.au/index.php?page=inventory_picking" "M --- last 30 samples (run-up to this incident) --- 2026-08-18 15:30:23 L1=5.73 run=11 blk=0 avail=6219 (53.0%) swpO=247 conn=10 myRSS=2248 php=28 phpRSS=1431 ap=54 tcp=41 topuser=evolution 2026-08-18 15:30:23 L1=5.73 run=7 blk=0 avail=6216 (53.0%) swpO=247 conn=10 myRSS=2248 php=28 phpRSS=1435 ap=54 tcp=39 topuser=evolution 2026-08-18 15:30:33 L1=5.54 run=11 blk=0 avail=6319 (53.9%) swpO=0 conn=12 myRSS=2249 php=30 phpRSS=1366 ap=55 tcp=45 topuser=evolution 2026-08-18 15:30:33 L1=5.54 run=8 blk=0 avail=6316 (53.8%) swpO=0 conn=10 myRSS=2249 php=30 phpRSS=1371 ap=55 tcp=45 topuser=evolution 2026-08-18 15:30:43 L1=5.93 run=5 blk=0 avail=6021 (51.3%) swpO=0 conn=10 myRSS=2249 php=33 phpRSS=1655 ap=72 tcp=64 topuser=evolution 2026-08-18 15:30:43 L1=5.93 run=9 blk=0 avail=6015 (51.3%) swpO=0 conn=10 myRSS=2249 php=33 phpRSS=1660 ap=72 tcp=65 topuser=evolution 2026-08-18 15:30:54 L1=6.37 run=5 blk=0 avail=6210 (52.9%) swpO=0 conn=9 myRSS=2249 php=31 phpRSS=1366 ap=76 tcp=60 topuser=evolution 2026-08-18 15:30:54 L1=6.37 run=11 blk=0 avail=6205 (52.9%) swpO=0 conn=9 myRSS=2249 php=33 phpRSS=1424 ap=76 tcp=58 topuser=evolution 2026-08-18 15:31:04 L1=6.73 run=8 blk=0 avail=5865 (50.0%) swpO=210 conn=10 myRSS=2244 php=30 phpRSS=1761 ap=69 tcp=53 topuser=evolution 2026-08-18 15:31:04 L1=6.73 run=5 blk=0 avail=6001 (51.2%) swpO=210 conn=9 myRSS=2244 php=28 phpRSS=1570 ap=69 tcp=51 topuser=evolution 2026-08-18 15:31:14 L1=6.23 run=4 blk=0 avail=6263 (53.4%) swpO=0 conn=7 myRSS=2244 php=25 phpRSS=1108 ap=64 tcp=43 topuser=evolution 2026-08-18 15:31:14 L1=6.23 run=4 blk=0 avail=6394 (54.5%) swpO=0 conn=7 myRSS=2244 php=25 phpRSS=1108 ap=64 tcp=43 topuser=evolution 2026-08-18 15:31:24 L1=6.66 run=4 blk=0 avail=6367 (54.3%) swpO=0 conn=7 myRSS=2244 php=26 phpRSS=1138 ap=69 tcp=56 topuser=evolution 2026-08-18 15:31:24 L1=6.66 run=4 blk=0 avail=6235 (53.2%) swpO=0 conn=8 myRSS=2244 php=27 phpRSS=1298 ap=69 tcp=53 topuser=evolution 2026-08-18 15:31:34 L1=6.24 run=5 blk=0 avail=6382 (54.4%) swpO=0 conn=7 myRSS=2244 php=26 phpRSS=1137 ap=64 tcp=50 topuser=evolution 2026-08-18 15:31:34 L1=6.24 run=5 blk=0 avail=6365 (54.3%) swpO=0 conn=8 myRSS=2244 php=27 phpRSS=1190 ap=64 tcp=51 topuser=evolution 2026-08-18 15:31:44 L1=6.22 run=8 blk=1 avail=6375 (54.4%) swpO=0 conn=7 myRSS=2244 php=25 phpRSS=1108 ap=65 tcp=47 topuser=evolution 2026-08-18 15:31:44 L1=6.22 run=5 blk=0 avail=6375 (54.4%) swpO=0 conn=7 myRSS=2244 php=25 phpRSS=1108 ap=65 tcp=46 topuser=evolution 2026-08-18 15:31:54 L1=5.49 run=4 blk=0 avail=6374 (54.3%) swpO=0 conn=8 myRSS=2244 php=26 phpRSS=1174 ap=60 tcp=55 topuser=evolution 2026-08-18 15:31:55 L1=5.49 run=4 blk=0 avail=6374 (54.3%) swpO=0 conn=8 myRSS=2244 php=26 phpRSS=1174 ap=60 tcp=54 topuser=evolution 2026-08-18 15:32:05 L1=5.18 run=3 blk=0 avail=6339 (54.0%) swpO=0 conn=7 myRSS=2244 php=26 phpRSS=1147 ap=61 tcp=49 topuser=evolution 2026-08-18 15:32:05 L1=5.18 run=4 blk=0 avail=6339 (54.0%) swpO=0 conn=7 myRSS=2244 php=25 phpRSS=1108 ap=61 tcp=49 topuser=evolution 2026-08-18 15:32:15 L1=5.24 run=4 blk=0 avail=6321 (53.9%) swpO=0 conn=8 myRSS=2244 php=26 phpRSS=1167 ap=60 tcp=42 topuser=evolution 2026-08-18 15:32:15 L1=5.24 run=3 blk=0 avail=6310 (53.8%) swpO=0 conn=8 myRSS=2244 php=26 phpRSS=1178 ap=60 tcp=43 topuser=evolution 2026-08-18 15:32:25 L1=5.19 run=6 blk=0 avail=6371 (54.3%) swpO=0 conn=8 myRSS=2244 php=26 phpRSS=1174 ap=52 tcp=42 topuser=evolution 2026-08-18 15:32:25 L1=5.09 run=4 blk=0 avail=6371 (54.3%) swpO=0 conn=8 myRSS=2244 php=26 phpRSS=1174 ap=52 tcp=42 topuser=evolution 2026-08-18 15:32:35 L1=5.13 run=6 blk=0 avail=6397 (54.5%) swpO=1 conn=8 myRSS=2244 php=29 phpRSS=1285 ap=55 tcp=50 topuser=evolution 2026-08-18 15:32:35 L1=5.13 run=5 blk=0 avail=6395 (54.5%) swpO=1 conn=9 myRSS=2244 php=28 phpRSS=1252 ap=55 tcp=50 topuser=evolution 2026-08-18 15:32:45 L1=5.48 run=12 blk=0 avail=6365 (54.3%) swpO=0 conn=7 myRSS=2244 php=25 phpRSS=1108 ap=67 tcp=50 topuser=evolution 2026-08-18 15:32:45 L1=5.48 run=8 blk=0 avail=6360 (54.2%) swpO=0 conn=8 myRSS=2244 php=26 phpRSS=1148 ap=67 tcp=49 topuser=evolution