INCIDENT 2026-08-18 15:36:48 trigger: php_procs=30 ================================================================== load: 5.53 4.93 4.24 6/718 1682230 ncpu:10 mem_avail: 6137MB/11729MB (52.3%) swap_used:2719MB swapout:0/s blocked(D):0 running:7 iowait:0.0% steal:0.0% php: 30 procs / 1494MB heaviest user: evolution (28 procs, 1224MB) apache: 63 procs tcp_estab: 38 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2246 evolution 33 1247 nobody 62 941 root 237 757 netdata 8 262 madalice 1 167 speedlin 1 111 cpanellogin 1 107 kurri 8 93 aaa 4 48 dovenull 6 26 wp-toolkit 6 18 zabbix 1 14 alison 1 13 mailman 20 12 candyfabcom 1 12 nscd 1 7 mailnull 1 7 dovecot 3 7 named 1 6 --- php workers by user --- USER PROCS RSS_MB evolution 28 1224 madalice 1 169 speedlin 1 114 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5531 MB Active(file): 4548 MB Inactive(file): 999 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 343 MB CommitLimit: 9960 MB Committed_AS: 11795 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 955450 root 14:25:31 1080 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2300100 10.6 Ssl 3-07:46:10 /usr/sbin/mariadbd 1220 1 netdata 203348 2.5 Ssl 50-05:26:52 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1682195 1679347 madalice 179736 154 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1000361 998750 root 153328 0.0 S 13:11:58 spamd child 1682197 1681763 speedlin 118592 88.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1638383 1353308 cpanellogin 110356 0.0 S 45:38 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 2575382 1 root 95092 0.0 Ss 3-07:46:13 /usr/lib/systemd/systemd-journald 998750 1 root 90152 0.0 Ss 13:14:03 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1578009 998750 root 87776 0.0 S 01:54:19 spamd child 1658731 1658711 evolution 59092 0.6 S 22:39 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1658820 1658284 evolution 59088 0.6 S 22:32 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1660119 1660117 evolution 57796 0.5 S 21:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1661971 1661923 evolution 56068 0.5 S 19:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1662694 1662154 evolution 55792 0.5 S 18:41 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1666918 1666256 evolution 54048 0.5 S 14:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1681466 1353308 root 45844 0.1 S 00:53 whostmgrd - serving 1.144.107.82 1669958 1669681 evolution 43228 0.0 S 11:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669957 1669680 evolution 43184 0.0 S 11:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663347 1663338 evolution 43156 0.0 S 18:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663808 1663363 evolution 43084 0.0 S 17:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663804 1663711 evolution 43072 0.0 S 17:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663661 1663314 evolution 43012 0.0 S 17:35 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663613 1658938 evolution 42996 0.0 S 17:41 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663197 1662151 evolution 42984 0.0 S 18:12 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663383 1663357 evolution 42956 0.0 S 18:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669525 1669080 evolution 42916 0.0 S 11:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669524 1669082 evolution 42808 0.0 S 11:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669526 1669065 evolution 42756 0.0 S 11:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 42212 0.0 Ss 27-12:55:22 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 41064 0.1 Sl 50-05:26:47 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2223 1201 root 40372 0.0 Sl 50-05:26:51 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1664109 1663969 evolution 39712 0.0 S 16:51 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663166 1661359 evolution 39700 0.0 S 18:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663645 1663336 evolution 39700 0.0 S 17:38 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1681817 1681474 evolution 39700 0.0 S 00:36 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663658 1661021 evolution 39672 0.0 S 17:35 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1681816 1681475 evolution 39660 0.0 S 00:36 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1681565 1680067 evolution 39620 0.0 S 00:49 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665393 1663680 evolution 39612 0.0 S 15:55 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665409 1664796 evolution 39592 0.0 S 15:53 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663678 1662119 evolution 39196 0.0 S 17:33 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1681491 1353308 root 37860 0.0 S 00:51 whostmgrd - serving 1.144.107.82 1469 1 root 26060 0.1 Ss 50-05:26:51 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1466 1 root 25756 0.0 Ss 50-05:26:51 dnsadmin - server mode 1679362 1276780 nobody 21288 0.0 S 02:53 /usr/sbin/httpd -k start 1679000 1276780 nobody 20412 0.0 S 03:10 /usr/sbin/httpd -k start 998083 1 root 19868 0.0 Ss 13:14:36 lfd - sleeping 1679347 1276780 nobody 19712 0.0 S 02:54 /usr/sbin/httpd -k start 1661021 1276780 nobody 19236 0.0 S 20:31 /usr/sbin/httpd -k start 1658938 1276780 nobody 18884 0.0 S 22:26 /usr/sbin/httpd -k start 1680040 1276780 nobody 18740 0.0 S 02:08 /usr/sbin/httpd -k start 1681477 1276780 nobody 18540 0.0 S 00:52 /usr/sbin/httpd -k start 1681761 1276780 nobody 18320 0.1 S 00:39 /usr/sbin/httpd -k start 1663680 1276780 nobody 18116 0.0 S 17:32 /usr/sbin/httpd -k start 1662151 1276780 nobody 17908 0.0 S 19:06 /usr/sbin/httpd -k start 1669080 1276780 nobody 17820 0.0 S 11:53 /usr/sbin/httpd -k start 1680067 1276780 nobody 17764 0.0 S 02:04 /usr/sbin/httpd -k start 1679009 1276780 nobody 17440 0.0 S 03:09 /usr/sbin/httpd -k start 1681461 1276780 nobody 17420 0.0 S 00:53 /usr/sbin/httpd -k start 1681713 1276780 nobody 17292 0.0 S 00:40 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9502624 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 9502623 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9502622 | root | 85-1525752154 | Execute | 0 | Sending data | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9502621 | root | 85-1525752154 | Execute | 0 | Sending data | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9502620 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9502619 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9502618 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9502623 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9502620 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9502619 | 85-1525752154 | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadd | | 9502618 | 85-1525752154 | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadd | +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 379 vinesit/vinesit.com.au-ssl_log 114 lowrange/lowrange.com.au-ssl_log 107 madalice/madalice.com.au-ssl_log 50 evolution/portal.evolutionerp.com.au-ssl_log 48 speedlin/speedlinefencing.com.au-ssl_log 25 whiz/whizengineering.com.au 18 customc/customcentral.com.au-ssl_log 11 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 149 203.54.180.238 108 20.52.168.85 106 20.97.182.130 59 103.104.164.114 52 101.166.96.210 47 180.181.236.49 38 20.104.100.201 30 103.104.165.99 19 203.214.146.60 18 144.217.135.171 17 20.38.3.247 17 116.91.221.198 16 147.161.213.78 15 101.182.108.127 10 20.24.67.246 --- top request paths across all vhosts (last 3 min) --- 168 POST /functions.php 50 GET /app/ajax.php 44 GET /heartbeat.php 33 POST /quoteditsave.php 33 POST /app/ajax.php 33 GET /index.php 15 POST /app/ajax/selectFilter.php 13 POST /plugins/csvexporter/plugin.php 13 GET / 10 POST /app/ajax/selectFilterSingle.php 5 POST //functions.php 4 POST /plugins/fencecosting/plugin.php 4 POST /itemModify.php 4 GET /wp-content/plugins/hellopress/wp_filemanager.php 4 GET /this_is_a_new_hello_world.php 4 GET /store/custom-monogram-shoes/ 3 POST /timesheets.php 3 GET /wp-content/index.php 3 GET /wk/index.php 3 GET /robots.txt --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 168 POST /functions.php 50 GET /app/ajax.php 33 POST /quoteditsave.php 33 POST /app/ajax.php 30 GET /index.php 15 POST /app/ajax/selectFilter.php 13 POST /plugins/csvexporter/plugin.php 10 POST /app/ajax/selectFilterSingle.php 5 POST //functions.php 4 POST /plugins/fencecosting/plugin.php 4 POST /itemModify.php 3 POST /timesheets.php -- last 10 requests -- 52.167.144.230 - - [18/Aug/2026:15:36:42 +1000] "GET /index.php?page=activities&keyword=%E6%94%B6%E7%8B%80%E6%94%B6%E6%93%9A%E5%A4%9A%E4%B9%85%E9%80%9A%E7%9F%A5%E9%A0%98%E5%8F%96 HTTP/1.1" 200 5324 "-" "Mozilla/5.0 Apple 180.181.236.49 - - [18/Aug/2026:15:36:43 +1000] "POST /app/ajax.php HTTP/1.1" 200 124 "https://my.evolutionerp.com.au/index.php?page=timesheetHistory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 101.166.96.210 - - [18/Aug/2026:15:36:44 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36772§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 180.181.236.49 - - [18/Aug/2026:15:36:44 +1000] "POST /app/ajax.php HTTP/1.1" 200 6676 "https://my.evolutionerp.com.au/index.php?page=timesheetHistory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML 180.181.236.49 - - [18/Aug/2026:15:36:45 +1000] "GET /index.php?page=timesheetHistory HTTP/1.1" 200 67217 "https://my.evolutionerp.com.au/index.php?page=timesheetHistory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 180.181.236.49 - - [18/Aug/2026:15:36:45 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3DtimesheetHistory%23&call=getUserSetting&caller=ajaxSubmitLocal&seq=17003543726 HTTP/1.1" 200 99 "https://my.evolutionerp.com.au/ 180.181.236.49 - - [18/Aug/2026:15:36:45 +1000] "POST /app/ajax.php?call=ts&tsact=tsUpdateTimesheetNominalRates HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=timesheetHistory" "Mozilla/5.0 (Windows NT 1 180.181.236.49 - - [18/Aug/2026:15:36:45 +1000] "POST /timesheets.php?call=getTimesheets HTTP/1.1" 200 3548 "https://my.evolutionerp.com.au/index.php?page=timesheetHistory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 203.214.146.60 - - [18/Aug/2026:15:36:46 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2282§ionid=447" "Mozilla/5.0 (Windows NT 10.0; Win 180.181.236.49 - - [18/Aug/2026:15:36:46 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=timesheetHistory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi == vinesit/vinesit.com.au-ssl_log == -- top paths -- 2 GET /wp-content/themes/seotheme/db.php 1 POST /wp-plain.php 1 POST /ALFA_DATA/alfacgiapi/perl.alfa 1 GET /x.php 1 GET /xmlrpc.php0 1 GET /wp_wol.php 1 GET /wp-includes/wp-class.php 1 GET /wp-includes/rest-api/fields/ 1 GET /wp-includes/js/codemirror/about.php 1 GET /wp-includes/interactivity-api/index.php 1 GET /wp-includes/ID3/ 1 GET /wp-includes/css/dist/widgets/ -- last 10 requests -- 20.52.168.85 - - [18/Aug/2026:15:34:43 +1000] "GET /manager.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.168.85 - - [18/Aug/2026:15:34:43 +1000] "GET /csv.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.168.85 - - [18/Aug/2026:15:34:44 +1000] "GET /404.php123123 HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.168.85 - - [18/Aug/2026:15:34:44 +1000] "GET /log.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.25.139.174 - - [18/Aug/2026:15:36:07 +1000] "POST /wp-plain.php HTTP/1.1" 403 13 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/ 20.25.139.174 - - [18/Aug/2026:15:36:07 +1000] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" 403 17006 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like G 20.25.139.174 - - [18/Aug/2026:15:36:07 +1000] "GET / HTTP/1.1" 403 17006 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Sa 20.25.139.174 - - [18/Aug/2026:15:36:07 +1000] "POST /ALFA_DATA/alfacgiapi/perl.alfa HTTP/1.1" 403 17006 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko 20.25.139.174 - - [18/Aug/2026:15:36:08 +1000] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" 403 17006 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like G 20.25.139.174 - - [18/Aug/2026:15:36:08 +1000] "GET /wp-content/plugins/apikey/apikey.php?test=hello HTTP/1.1" 403 17006 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Ge == lowrange/lowrange.com.au-ssl_log == -- top paths -- 2 GET /wp-content/themes/admin.php 2 GET /wk/index.php 2 GET /lite.php 2 GET /ioxi-o.php 2 GET /inputs.php 2 GET /edit.php 2 GET /as.php 2 GET /admin.php 2 GET /adminfuns.php 2 GET /about.php 1 GET /x.php 1 GET /xmr.php -- last 10 requests -- 20.97.182.130 - - [18/Aug/2026:15:36:02 +1000] "GET /upload.php HTTP/1.1" 401 36 "-" "-" 20.97.182.130 - - [18/Aug/2026:15:36:02 +1000] "GET /wk/index.php HTTP/1.1" 401 36 "-" "-" 20.97.182.130 - - [18/Aug/2026:15:36:02 +1000] "GET /wp-act.php HTTP/1.1" 401 36 "-" "-" 20.97.182.130 - - [18/Aug/2026:15:36:03 +1000] "GET /wp-admin/css/bolt.php HTTP/1.1" 401 36 "-" "-" 20.97.182.130 - - [18/Aug/2026:15:36:03 +1000] "GET /wp-admin/js/ HTTP/1.1" 401 36 "-" "-" 20.97.182.130 - - [18/Aug/2026:15:36:04 +1000] "GET /wp-admin/js/widgets/ HTTP/1.1" 401 36 "-" "-" 20.97.182.130 - - [18/Aug/2026:15:36:05 +1000] "GET /wp-admin/maint/ HTTP/1.1" 401 36 "-" "-" 20.97.182.130 - - [18/Aug/2026:15:36:05 +1000] "GET /wp-admin/ HTTP/1.1" 401 36 "-" "-" 20.97.182.130 - - [18/Aug/2026:15:36:05 +1000] "GET /wp-content/themes/ HTTP/1.1" 401 36 "-" "-" 20.97.182.130 - - [18/Aug/2026:15:36:06 +1000] "GET /wp-content/themes/admin.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-18 15:34:26 L1=4.62 run=4 blk=0 avail=6398 (54.6%) swpO=0 conn=7 myRSS=2245 php=25 phpRSS=1108 ap=61 tcp=53 topuser=evolution 2026-08-18 15:34:26 L1=4.62 run=11 blk=0 avail=6398 (54.5%) swpO=0 conn=7 myRSS=2245 php=25 phpRSS=1108 ap=61 tcp=53 topuser=evolution 2026-08-18 15:34:36 L1=4.28 run=3 blk=0 avail=6427 (54.8%) swpO=0 conn=8 myRSS=2245 php=25 phpRSS=1108 ap=56 tcp=35 topuser=evolution 2026-08-18 15:34:36 L1=4.28 run=3 blk=0 avail=6428 (54.8%) swpO=0 conn=7 myRSS=2245 php=25 phpRSS=1108 ap=56 tcp=35 topuser=evolution 2026-08-18 15:34:46 L1=3.86 run=3 blk=0 avail=6379 (54.4%) swpO=0 conn=7 myRSS=2245 php=26 phpRSS=1173 ap=57 tcp=45 topuser=evolution 2026-08-18 15:34:46 L1=3.86 run=5 blk=0 avail=6385 (54.4%) swpO=0 conn=7 myRSS=2245 php=26 phpRSS=1166 ap=57 tcp=45 topuser=evolution 2026-08-18 15:34:56 L1=3.81 run=11 blk=0 avail=6228 (53.1%) swpO=2 conn=8 myRSS=2245 php=26 phpRSS=1366 ap=54 tcp=42 topuser=evolution 2026-08-18 15:34:57 L1=3.81 run=2 blk=0 avail=6445 (55.0%) swpO=2 conn=7 myRSS=2245 php=25 phpRSS=1108 ap=54 tcp=42 topuser=evolution 2026-08-18 15:35:06 L1=4.23 run=5 blk=0 avail=6184 (52.7%) swpO=1 conn=9 myRSS=2245 php=27 phpRSS=1446 ap=52 tcp=44 topuser=evolution 2026-08-18 15:35:07 L1=4.23 run=10 blk=0 avail=6129 (52.3%) swpO=1 conn=10 myRSS=2245 php=28 phpRSS=1529 ap=52 tcp=44 topuser=evolution 2026-08-18 15:35:16 L1=3.96 run=6 blk=0 avail=6409 (54.6%) swpO=0 conn=8 myRSS=2245 php=26 phpRSS=1190 ap=50 tcp=40 topuser=evolution 2026-08-18 15:35:17 L1=3.96 run=9 blk=0 avail=6383 (54.4%) swpO=0 conn=8 myRSS=2245 php=26 phpRSS=1217 ap=50 tcp=39 topuser=evolution 2026-08-18 15:35:27 L1=3.74 run=5 blk=0 avail=6294 (53.7%) swpO=0 conn=8 myRSS=2245 php=26 phpRSS=1257 ap=56 tcp=43 topuser=evolution 2026-08-18 15:35:27 L1=3.74 run=5 blk=0 avail=6256 (53.3%) swpO=0 conn=10 myRSS=2245 php=26 phpRSS=1287 ap=56 tcp=43 topuser=evolution 2026-08-18 15:35:37 L1=3.47 run=4 blk=0 avail=6281 (53.6%) swpO=0 conn=8 myRSS=2245 php=26 phpRSS=1276 ap=53 tcp=48 topuser=evolution 2026-08-18 15:35:37 L1=3.47 run=4 blk=0 avail=6238 (53.2%) swpO=0 conn=8 myRSS=2245 php=26 phpRSS=1303 ap=53 tcp=54 topuser=evolution 2026-08-18 15:35:47 L1=3.94 run=3 blk=0 avail=6416 (54.7%) swpO=0 conn=7 myRSS=2245 php=25 phpRSS=1108 ap=57 tcp=41 topuser=evolution 2026-08-18 15:35:47 L1=3.94 run=5 blk=0 avail=6405 (54.6%) swpO=0 conn=8 myRSS=2245 php=26 phpRSS=1150 ap=57 tcp=43 topuser=evolution 2026-08-18 15:35:57 L1=4.20 run=7 blk=0 avail=6078 (51.8%) swpO=0 conn=8 myRSS=2245 php=27 phpRSS=1449 ap=60 tcp=52 topuser=evolution 2026-08-18 15:35:57 L1=4.20 run=15 blk=0 avail=6105 (52.1%) swpO=0 conn=8 myRSS=2245 php=27 phpRSS=1223 ap=60 tcp=52 topuser=evolution 2026-08-18 15:36:07 L1=4.09 run=8 blk=0 avail=6354 (54.2%) swpO=0 conn=7 myRSS=2246 php=30 phpRSS=1277 ap=59 tcp=51 topuser=evolution 2026-08-18 15:36:07 L1=4.09 run=9 blk=0 avail=6345 (54.1%) swpO=0 conn=7 myRSS=2246 php=30 phpRSS=1330 ap=63 tcp=51 topuser=evolution 2026-08-18 15:36:17 L1=4.15 run=4 blk=0 avail=6184 (52.7%) swpO=1 conn=9 myRSS=2246 php=30 phpRSS=1432 ap=64 tcp=42 topuser=evolution 2026-08-18 15:36:17 L1=4.15 run=7 blk=0 avail=6174 (52.6%) swpO=1 conn=9 myRSS=2246 php=30 phpRSS=1437 ap=64 tcp=42 topuser=evolution 2026-08-18 15:36:27 L1=5.37 run=10 blk=0 avail=6148 (52.4%) swpO=1 conn=12 myRSS=2246 php=32 phpRSS=1551 ap=60 tcp=44 topuser=evolution 2026-08-18 15:36:28 L1=5.37 run=6 blk=0 avail=6128 (52.3%) swpO=1 conn=11 myRSS=2246 php=32 phpRSS=1561 ap=60 tcp=43 topuser=evolution 2026-08-18 15:36:38 L1=5.70 run=7 blk=0 avail=6235 (53.2%) swpO=0 conn=10 myRSS=2246 php=31 phpRSS=1460 ap=57 tcp=41 topuser=evolution 2026-08-18 15:36:38 L1=5.70 run=5 blk=0 avail=6225 (53.1%) swpO=0 conn=10 myRSS=2246 php=30 phpRSS=1432 ap=57 tcp=41 topuser=evolution 2026-08-18 15:36:48 L1=5.53 run=7 blk=0 avail=6137 (52.3%) swpO=0 conn=10 myRSS=2246 php=30 phpRSS=1494 ap=63 tcp=38 topuser=evolution 2026-08-18 15:36:48 L1=5.53 run=15 blk=0 avail=6121 (52.2%) swpO=0 conn=10 myRSS=2246 php=30 phpRSS=1511 ap=63 tcp=39 topuser=evolution