INCIDENT 2026-08-18 15:39:50 trigger: php_procs=32 php_rss=1820MB ================================================================== load: 8.27 6.36 4.91 8/753 1686389 ncpu:10 mem_avail: 5683MB/11729MB (48.5%) swap_used:2735MB swapout:302/s blocked(D):0 running:10 iowait:0.2% steal:0.0% php: 32 procs / 1820MB heaviest user: evolution (29 procs, 1365MB) apache: 98 procs tcp_estab: 70 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2232 nobody 97 1486 evolution 33 1382 root 237 668 madalice 2 365 netdata 8 261 customc 1 107 cpanellogin 1 106 kurri 6 70 wp-toolkit 6 41 mailnull 5 38 aaa 3 37 dovenull 6 26 zabbix 1 15 alison 1 13 mailman 20 12 nscd 1 7 dovecot 3 7 named 1 6 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 29 1369 madalice 2 367 customc 1 110 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5288 MB Active(file): 4361 MB Inactive(file): 923 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 345 MB CommitLimit: 9960 MB Committed_AS: 12762 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 955450 root 14:28:34 1052 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2286292 10.7 Ssl 3-07:49:13 /usr/sbin/mariadbd 1220 1 netdata 203032 2.5 Ssl 50-05:29:55 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1686359 1684580 evolution 160196 75.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1000361 998750 root 153328 0.0 S 13:15:01 spamd child 1686360 1682824 customc 127972 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1686357 1686352 madalice 116612 91.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1638383 1353308 cpanellogin 109280 0.0 S 48:41 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 2575382 1 root 95736 0.0 Ss 3-07:49:16 /usr/lib/systemd/systemd-journald 998750 1 root 90152 0.0 Ss 13:17:06 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1578009 998750 root 87776 0.0 S 01:57:22 spamd child 1658731 1658711 evolution 59092 0.6 S 25:42 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1658820 1658284 evolution 59088 0.6 S 25:35 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1660119 1660117 evolution 57796 0.6 S 24:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1661971 1661923 evolution 56068 0.5 S 22:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1662694 1662154 evolution 55792 0.5 S 21:44 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1666918 1666256 evolution 54284 0.5 S 17:16 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669958 1669681 evolution 43228 0.0 S 14:11 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669957 1669680 evolution 43184 0.0 S 14:11 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663347 1663338 evolution 43156 0.0 S 21:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663808 1663363 evolution 43084 0.0 S 20:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663804 1663711 evolution 43072 0.0 S 20:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663661 1663314 evolution 43012 0.0 S 20:38 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663613 1658938 evolution 42996 0.0 S 20:44 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663197 1662151 evolution 42984 0.0 S 21:15 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663383 1663357 evolution 42956 0.0 S 21:06 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669525 1669080 evolution 42916 0.0 S 14:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669524 1669082 evolution 42808 0.0 S 14:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669526 1669065 evolution 42756 0.0 S 14:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 42208 0.0 Ss 27-12:58:25 cpsrvd (SSL) - waiting for connections 2223 1201 root 40348 0.0 Sl 50-05:29:54 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 39920 0.1 Sl 50-05:29:50 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1664109 1663969 evolution 39712 0.0 S 19:54 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663166 1661359 evolution 39700 0.0 S 21:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663645 1663336 evolution 39700 0.0 S 20:41 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1681817 1681474 evolution 39700 0.0 S 03:39 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663658 1661021 evolution 39672 0.0 S 20:38 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1681816 1681475 evolution 39660 0.0 S 03:39 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1681565 1680067 evolution 39620 0.0 S 03:52 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665393 1663680 evolution 39612 0.0 S 18:58 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665409 1664796 evolution 39592 0.0 S 18:56 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663678 1662119 evolution 39196 0.0 S 20:36 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1686337 1679347 madalice 28760 116 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1685669 1198 wp-toolkit 25876 0.0 S 00:40 sw-engine-fpm: pool wordpress-toolkit 1469 1 root 25708 0.1 Ss 50-05:29:54 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1681767 1276780 nobody 20492 0.0 S 03:42 /usr/sbin/httpd -k start 1683042 1276780 nobody 20360 0.1 S 02:11 /usr/sbin/httpd -k start 998083 1 root 19872 0.0 Ss 13:17:39 lfd - sleeping 1679347 1276780 nobody 19824 0.2 S 05:57 /usr/sbin/httpd -k start 1679340 1276780 nobody 19680 0.0 S 05:58 /usr/sbin/httpd -k start 1681477 1276780 nobody 19512 0.0 S 03:55 /usr/sbin/httpd -k start 1679009 1276780 nobody 19412 0.0 S 06:12 /usr/sbin/httpd -k start 1661021 1276780 nobody 19236 0.0 S 23:34 /usr/sbin/httpd -k start 1683754 1276780 nobody 19124 0.1 S 01:53 /usr/sbin/httpd -k start 1683725 1276780 nobody 19100 0.0 S 01:55 /usr/sbin/httpd -k start 1683737 1276780 nobody 19040 0.2 S 01:54 /usr/sbin/httpd -k start 1683753 1276780 nobody 18932 0.1 S 01:53 /usr/sbin/httpd -k start 1658938 1276780 nobody 18884 0.0 S 25:29 /usr/sbin/httpd -k start 1684521 1276780 nobody 18516 0.0 S 01:11 /usr/sbin/httpd -k start 1679359 1276780 nobody 18456 0.1 S 05:56 /usr/sbin/httpd -k start 1684579 1276780 nobody 18444 0.1 S 01:09 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9566393 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9566392 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 9566391 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9566390 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9566389 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9566388 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9566383 | root | 85-1525752154 | Execute | 0 | Sending data | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 463 customc/customcentral.com.au-ssl_log 98 infinium/infinium.net.au-ssl_log 89 madalice/madalice.com.au-ssl_log 66 evolution/portal.evolutionerp.com.au-ssl_log 56 aaa/aaadownunder.com.au 44 aaa/aaadownunder.com.au-ssl_log 44 evolution/evolutionerp.com.au 44 evolution/evolutionerp.com.au-ssl_log 39 bigdeals/bigdeals.com.au-ssl_log 16 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 216 203.54.180.238 137 20.104.100.201 95 172.161.79.158 90 103.104.164.114 89 20.42.19.40 83 180.181.236.49 68 20.7.73.61 34 101.166.96.210 28 203.214.146.60 18 101.182.108.127 16 139.28.219.70 14 147.161.213.78 14 103.104.165.99 10 182.239.240.254 10 116.91.221.198 --- top request paths across all vhosts (last 3 min) --- 178 POST /functions.php 78 GET /app/ajax.php 44 GET /heartbeat.php 37 GET /index.php 26 POST /app/ajax/selectFilter.php 25 POST /quoteditsave.php 16 POST /plugins/csvexporter/plugin.php 16 POST /clienteditsave.php 16 POST /app/ajax.php 13 POST /app/ajax/selectFilterSingle.php 12 POST /itemModify.php 11 POST /invoiceaddsave.php 9 POST /jobeditsave.php 7 GET /store/custom-melbourne-storm-shoes-design2/ 6 POST //functions.php 5 POST /wp-cron.php 5 GET /wp-content/plugins/hellopress/wp_filemanager.php 5 GET /wp-content/admin.php 5 GET /this_is_a_new_hello_world.php 5 GET /admin.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 178 POST /functions.php 78 GET /app/ajax.php 31 GET /index.php 26 POST /app/ajax/selectFilter.php 25 POST /quoteditsave.php 16 POST /plugins/csvexporter/plugin.php 16 POST /clienteditsave.php 16 POST /app/ajax.php 13 POST /app/ajax/selectFilterSingle.php 12 POST /itemModify.php 11 POST /invoiceaddsave.php 9 POST /jobeditsave.php -- last 10 requests -- 203.54.180.238 - - [18/Aug/2026:15:39:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Ch 103.104.164.114 - - [18/Aug/2026:15:39:37 +1000] "POST /invoiceaddsave.php?call=fetch HTTP/1.1" 200 2430 "https://my.evolutionerp.com.au/index.php?page=invoicereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5 180.181.236.49 - - [18/Aug/2026:15:39:38 +1000] "POST /app/ajax.php?tsact=1 HTTP/1.1" 200 2328 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=51186&tab=timesheettab" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 103.104.164.114 - - [18/Aug/2026:15:39:38 +1000] "POST /invoiceaddsave.php?call=fetch HTTP/1.1" 200 1912 "https://my.evolutionerp.com.au/index.php?page=invoicereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5 147.161.213.78 - - [18/Aug/2026:15:39:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=report&file=testTagRetest3" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 147.161.213.78 - - [18/Aug/2026:15:39:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=siteedit&siteid=2122" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 180.181.236.49 - - [18/Aug/2026:15:39:40 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 2883 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=51186&tab=timesheettab" "Mozilla/5.0 (Windows NT 10.0; Win6 116.91.221.198 - - [18/Aug/2026:15:39:42 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 233 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2284" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:15 203.54.180.238 - - [18/Aug/2026:15:39:42 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/ 103.104.164.114 - - [18/Aug/2026:15:39:43 +1000] "POST /invoiceaddsave.php?call=fetch HTTP/1.1" 200 1825 "https://my.evolutionerp.com.au/index.php?page=invoicereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5 == customc/customcentral.com.au-ssl_log == -- top paths -- 3 POST /wp-cron.php 1 GET /wso112233.php 1 GET /wp-trackback.php 1 GET /wp-the.php 1 GET /wp-mail.php 1 GET /wp-logs.php 1 GET /wp-login.php 1 GET /wp-load.php 1 GET /wp-index.php 1 GET /wp-includes/Text/Diff/ 1 GET /wp-includes/Text/about.php 1 GET /wp-includes/Requests/library/ -- last 10 requests -- 172.161.79.158 - - [18/Aug/2026:15:39:31 +1000] "GET /word.php HTTP/1.1" 404 15038 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [18/Aug/2026:15:39:32 +1000] "GET /wp-index.php HTTP/1.1" 404 15035 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [18/Aug/2026:15:39:34 +1000] "GET /bypass.php HTTP/1.1" 404 15040 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [18/Aug/2026:15:39:35 +1000] "GET /alfanew.php7 HTTP/1.1" 404 15042 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [18/Aug/2026:15:39:37 +1000] "GET /admin-header.php HTTP/1.1" 404 15039 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [18/Aug/2026:15:39:38 +1000] "GET /83064.php HTTP/1.1" 404 15041 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [18/Aug/2026:15:39:40 +1000] "GET /wp-trackback.php HTTP/1.1" 404 80 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [18/Aug/2026:15:39:41 +1000] "GET /dxc.php HTTP/1.1" 404 15041 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [18/Aug/2026:15:39:43 +1000] "GET /v4.php HTTP/1.1" 404 15036 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [18/Aug/2026:15:39:44 +1000] "GET /error.php HTTP/1.1" 404 15037 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == infinium/infinium.net.au-ssl_log == -- top paths -- 2 GET /edit.php 2 GET /as.php 2 GET /admin.php 2 GET /adminfuns.php 2 GET /about.php 1 GET /x.php 1 GET /xmr.php 1 GET /xfun.php 1 GET /wp.php 1 GET /wp-includes/class-wp-http-client.php 1 GET /w.php 1 GET /wp-content/themes/theme/about.php -- last 10 requests -- 20.42.19.40 - - [18/Aug/2026:15:39:12 +1000] "GET /xmr.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:39:13 +1000] "GET /about.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:39:14 +1000] "GET /admin.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:39:14 +1000] "GET /adminfuns.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:39:14 +1000] "GET /as.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:39:15 +1000] "GET /bolt.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:39:15 +1000] "GET /cgi-bin/ HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:39:16 +1000] "GET /class-t.api.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:39:16 +1000] "GET /edit.php HTTP/1.1" 404 5749 "-" "-" 20.42.19.40 - - [18/Aug/2026:15:39:16 +1000] "GET /ff1.php HTTP/1.1" 404 5749 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-18 15:37:28 L1=5.94 run=3 blk=0 avail=6160 (52.5%) swpO=0 conn=10 myRSS=2247 php=30 phpRSS=1472 ap=61 tcp=39 topuser=evolution 2026-08-18 15:37:28 L1=5.94 run=5 blk=0 avail=6082 (51.9%) swpO=0 conn=11 myRSS=2247 php=31 phpRSS=1585 ap=61 tcp=37 topuser=evolution 2026-08-18 15:37:38 L1=5.72 run=10 blk=0 avail=6267 (53.4%) swpO=2 conn=10 myRSS=2247 php=31 phpRSS=1458 ap=55 tcp=45 topuser=evolution 2026-08-18 15:37:38 L1=5.72 run=6 blk=0 avail=6232 (53.1%) swpO=2 conn=9 myRSS=2247 php=30 phpRSS=1386 ap=57 tcp=45 topuser=evolution 2026-08-18 15:37:48 L1=5.63 run=5 blk=0 avail=6298 (53.7%) swpO=0 conn=10 myRSS=2247 php=31 phpRSS=1422 ap=58 tcp=41 topuser=evolution 2026-08-18 15:37:49 L1=5.63 run=16 blk=0 avail=6146 (52.4%) swpO=0 conn=11 myRSS=2247 php=34 phpRSS=1667 ap=58 tcp=40 topuser=evolution 2026-08-18 15:37:59 L1=6.31 run=8 blk=0 avail=6094 (52.0%) swpO=0 conn=10 myRSS=2247 php=30 phpRSS=1480 ap=73 tcp=49 topuser=evolution 2026-08-18 15:37:59 L1=6.31 run=7 blk=1 avail=6158 (52.5%) swpO=0 conn=10 myRSS=2247 php=31 phpRSS=1447 ap=73 tcp=45 topuser=evolution 2026-08-18 15:38:09 L1=7.24 run=7 blk=0 avail=6015 (51.3%) swpO=73 conn=11 myRSS=2244 php=33 phpRSS=1626 ap=73 tcp=62 topuser=evolution 2026-08-18 15:38:09 L1=7.24 run=9 blk=0 avail=5841 (49.8%) swpO=73 conn=12 myRSS=2244 php=34 phpRSS=1836 ap=73 tcp=67 topuser=evolution 2026-08-18 15:38:19 L1=7.13 run=15 blk=0 avail=6158 (52.5%) swpO=0 conn=9 myRSS=2244 php=30 phpRSS=1426 ap=68 tcp=41 topuser=evolution 2026-08-18 15:38:19 L1=7.13 run=10 blk=0 avail=6017 (51.3%) swpO=0 conn=10 myRSS=2244 php=31 phpRSS=1632 ap=68 tcp=40 topuser=evolution 2026-08-18 15:38:29 L1=7.02 run=16 blk=0 avail=6191 (52.8%) swpO=54 conn=9 myRSS=2242 php=30 phpRSS=1432 ap=63 tcp=41 topuser=evolution 2026-08-18 15:38:30 L1=7.02 run=6 blk=0 avail=6065 (51.7%) swpO=49 conn=10 myRSS=2242 php=32 phpRSS=1616 ap=63 tcp=41 topuser=evolution 2026-08-18 15:38:39 L1=7.49 run=9 blk=0 avail=5987 (51.0%) swpO=0 conn=10 myRSS=2243 php=33 phpRSS=1733 ap=66 tcp=59 topuser=evolution 2026-08-18 15:38:40 L1=7.49 run=6 blk=0 avail=6245 (53.2%) swpO=0 conn=8 myRSS=2243 php=30 phpRSS=1324 ap=67 tcp=60 topuser=evolution 2026-08-18 15:38:49 L1=7.28 run=8 blk=0 avail=5914 (50.4%) swpO=2 conn=11 myRSS=2244 php=31 phpRSS=1677 ap=77 tcp=47 topuser=evolution 2026-08-18 15:38:50 L1=7.28 run=10 blk=0 avail=6098 (52.0%) swpO=2 conn=9 myRSS=2244 php=30 phpRSS=1462 ap=76 tcp=47 topuser=evolution 2026-08-18 15:39:00 L1=7.56 run=10 blk=0 avail=6145 (52.4%) swpO=0 conn=8 myRSS=2244 php=29 phpRSS=1304 ap=72 tcp=45 topuser=evolution 2026-08-18 15:39:00 L1=7.56 run=7 blk=0 avail=6207 (52.9%) swpO=0 conn=8 myRSS=2244 php=29 phpRSS=1352 ap=72 tcp=44 topuser=evolution 2026-08-18 15:39:10 L1=7.70 run=13 blk=0 avail=5650 (48.2%) swpO=95 conn=11 myRSS=2241 php=33 phpRSS=2044 ap=67 tcp=50 topuser=evolution 2026-08-18 15:39:10 L1=7.70 run=7 blk=0 avail=5801 (49.5%) swpO=95 conn=11 myRSS=2241 php=33 phpRSS=1889 ap=67 tcp=52 topuser=evolution 2026-08-18 15:39:20 L1=8.48 run=8 blk=0 avail=6285 (53.6%) swpO=0 conn=8 myRSS=2241 php=29 phpRSS=1295 ap=67 tcp=45 topuser=evolution 2026-08-18 15:39:20 L1=8.48 run=10 blk=0 avail=6191 (52.8%) swpO=0 conn=10 myRSS=2241 php=31 phpRSS=1404 ap=67 tcp=46 topuser=evolution 2026-08-18 15:39:30 L1=9.00 run=11 blk=0 avail=6108 (52.1%) swpO=0 conn=8 myRSS=2241 php=30 phpRSS=1521 ap=66 tcp=37 topuser=evolution 2026-08-18 15:39:30 L1=9.00 run=10 blk=0 avail=6234 (53.2%) swpO=0 conn=8 myRSS=2241 php=29 phpRSS=1364 ap=66 tcp=39 topuser=evolution 2026-08-18 15:39:40 L1=8.38 run=9 blk=0 avail=5789 (49.4%) swpO=0 conn=11 myRSS=2242 php=33 phpRSS=1859 ap=68 tcp=45 topuser=evolution 2026-08-18 15:39:41 L1=8.38 run=9 blk=0 avail=5737 (48.9%) swpO=0 conn=11 myRSS=2242 php=32 phpRSS=1885 ap=68 tcp=44 topuser=evolution 2026-08-18 15:39:50 L1=8.27 run=10 blk=0 avail=5683 (48.5%) swpO=302 conn=11 myRSS=2232 php=32 phpRSS=1820 ap=98 tcp=70 topuser=evolution 2026-08-18 15:39:51 L1=8.27 run=15 blk=0 avail=5807 (49.5%) swpO=302 conn=10 myRSS=2232 php=31 phpRSS=1645 ap=98 tcp=70 topuser=evolution