INCIDENT 2026-08-18 15:41:52 trigger: php_procs=30 ================================================================== load: 6.36 6.26 5.05 7/715 1689093 ncpu:10 mem_avail: 6241MB/11729MB (53.2%) swap_used:2735MB swapout:0/s blocked(D):0 running:5 iowait:0.1% steal:0.0% php: 30 procs / 1439MB heaviest user: evolution (29 procs, 1266MB) apache: 58 procs tcp_estab: 38 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2233 evolution 33 1306 nobody 57 860 root 241 751 netdata 8 263 madalice 1 179 cpanellogin 1 106 mailnull 4 65 kurri 5 58 aaa 3 37 dovenull 6 26 wp-toolkit 6 18 zabbix 1 15 alison 1 13 mailman 20 12 candyfabcom 1 12 nscd 1 7 dovecot 3 7 named 1 6 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 29 1296 madalice 1 181 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5271 MB Active(file): 4423 MB Inactive(file): 913 MB Dirty: 2 MB Writeback: 0 MB SReclaimable: 350 MB CommitLimit: 9960 MB Committed_AS: 11595 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 955450 root 14:30:36 1052 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2286612 10.8 Ssl 3-07:51:15 /usr/sbin/mariadbd 1220 1 netdata 205524 2.5 Ssl 50-05:31:57 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1689052 1686334 madalice 192424 85.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1000361 998750 root 153328 0.0 S 13:17:03 spamd child 1638383 1353308 cpanellogin 109280 0.0 S 50:43 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 2575382 1 root 96320 0.0 Ss 3-07:51:18 /usr/lib/systemd/systemd-journald 998750 1 root 90152 0.0 Ss 13:19:08 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1578009 998750 root 87776 0.0 S 01:59:24 spamd child 1689064 1687605 evolution 81784 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1658731 1658711 evolution 59092 0.6 S 27:44 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1658820 1658284 evolution 59088 0.6 S 27:37 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1660119 1660117 evolution 57796 0.6 S 26:31 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1661971 1661923 evolution 56068 0.6 S 24:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1662694 1662154 evolution 55792 0.6 S 23:46 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1666918 1666256 evolution 54284 0.6 R 19:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669958 1669681 evolution 43228 0.0 S 16:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669957 1669680 evolution 43184 0.0 S 16:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663347 1663338 evolution 43156 0.0 S 23:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663808 1663363 evolution 43084 0.0 S 22:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663804 1663711 evolution 43072 0.0 S 22:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663661 1663314 evolution 43012 0.0 S 22:40 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663613 1658938 evolution 42996 0.0 S 22:46 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663197 1662151 evolution 42984 0.0 S 23:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663383 1663357 evolution 42956 0.0 S 23:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669525 1669080 evolution 42916 0.0 S 16:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669524 1669082 evolution 42808 0.0 S 16:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669526 1669065 evolution 42756 0.0 S 16:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 42208 0.0 Ss 27-13:00:27 cpsrvd (SSL) - waiting for connections 2223 1201 root 40348 0.0 Sl 50-05:31:56 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 39920 0.1 Sl 50-05:31:52 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1664109 1663969 evolution 39712 0.0 S 21:56 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663166 1661359 evolution 39700 0.0 S 23:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663645 1663336 evolution 39700 0.0 S 22:43 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1681817 1681474 evolution 39700 0.0 S 05:41 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663658 1661021 evolution 39672 0.0 S 22:40 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1681816 1681475 evolution 39660 0.0 S 05:41 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1681565 1680067 evolution 39620 0.0 S 05:54 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665393 1663680 evolution 39612 0.0 S 21:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665409 1664796 evolution 39592 0.0 S 20:58 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1687018 1353308 root 39560 0.0 S 01:52 whostmgrd - serving 1.144.107.82 1663678 1662119 evolution 39196 0.0 S 22:38 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 25712 0.1 Ss 50-05:31:56 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1689056 1 root 24532 9.0 S 00:01 /usr/sbin/exim -Mc 1wwCa9-000000075Op-3pNq 1689059 1689056 mailnull 22752 1.0 S 00:01 /usr/sbin/exim -Mc 1wwCa9-000000075Op-3pNq 1689060 1689056 mailnull 22752 1.0 S 00:01 /usr/sbin/exim -Mc 1wwCa9-000000075Op-3pNq 998083 1 root 20252 0.0 Ss 13:19:41 lfd - sleeping 1661021 1276780 nobody 19236 0.0 S 25:36 /usr/sbin/httpd -k start 1686334 1276780 nobody 19044 0.1 S 02:05 /usr/sbin/httpd -k start 1658938 1276780 nobody 18884 0.0 S 27:31 /usr/sbin/httpd -k start 1684459 1276780 nobody 18788 0.0 S 03:15 /usr/sbin/httpd -k start 1681764 1276780 nobody 18692 0.0 S 05:44 /usr/sbin/httpd -k start 1688168 1276780 nobody 18176 0.0 S 00:46 /usr/sbin/httpd -k start 1663680 1276780 nobody 18116 0.0 S 22:37 /usr/sbin/httpd -k start 1662151 1276780 nobody 17908 0.0 S 24:11 /usr/sbin/httpd -k start 1669080 1276780 nobody 17820 0.0 S 16:58 /usr/sbin/httpd -k start 1680067 1276780 nobody 17764 0.0 S 07:09 /usr/sbin/httpd -k start 1686352 1276780 nobody 17688 0.0 S 02:04 /usr/sbin/httpd -k start 1688177 1276780 nobody 17640 0.0 S 00:45 /usr/sbin/httpd -k start 1688187 1276780 nobody 17616 0.0 S 00:43 /usr/sbin/httpd -k start 1686329 1276780 nobody 17476 0.0 S 02:05 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9627070 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 9627069 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9627068 | root | 85-1525752154 | Execute | 0 | Optimizing | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 394 aaa/aaadownunder.com.au-ssl_log 117 evolution/evolutionerp.com.au-ssl_log 89 aaa/aaadownunder.com.au 87 evolution/evolutionerp.com.au 82 madalice/madalice.com.au-ssl_log 59 evolution/portal.evolutionerp.com.au-ssl_log 48 infinium/infinium.net.au-ssl_log 38 customc/customcentral.com.au-ssl_log 33 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 214 20.104.100.201 195 20.7.73.61 164 203.54.180.238 155 103.104.164.114 38 20.42.19.40 32 172.161.79.158 25 203.214.146.60 24 116.91.221.198 17 180.181.236.49 15 101.182.108.127 14 103.104.165.99 11 147.161.213.78 7 120.21.209.101 5 118.127.40.55 4 1.144.107.82 --- top request paths across all vhosts (last 3 min) --- 175 POST /functions.php 66 GET /app/ajax.php 39 GET /index.php 39 GET /heartbeat.php 15 POST /app/ajax.php 14 POST /plugins/csvexporter/plugin.php 12 POST /clienteditsave.php 11 POST /jobeditsave.php 9 POST /app/ajax/selectFilterSingle.php 8 POST /quoteditsave.php 8 POST /invoiceaddsave.php 7 GET /wp-login.php 6 GET /yup.php 6 GET /store/custom-melbourne-storm-shoes-design2/ 5 POST /app/templates/ajax.php 5 POST /app/ajax/selectFilter.php 5 GET /gecko-new.php 5 GET /classwithtostring.php 5 GET /222.php 4 POST /wp-cron.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 175 POST /functions.php 66 GET /app/ajax.php 36 GET /index.php 15 POST /app/ajax.php 14 POST /plugins/csvexporter/plugin.php 12 POST /clienteditsave.php 11 POST /jobeditsave.php 9 POST /app/ajax/selectFilterSingle.php 8 POST /quoteditsave.php 8 POST /invoiceaddsave.php 5 POST /app/templates/ajax.php 5 POST /app/ajax/selectFilter.php -- last 10 requests -- 203.54.180.238 - - [18/Aug/2026:15:41:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 103.104.164.114 - - [18/Aug/2026:15:41:36 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4421&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 103.104.164.114 - - [18/Aug/2026:15:41:34 +1000] "POST /print.php HTTP/1.1" 200 98279 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4421&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 147.161.213.78 - - [18/Aug/2026:15:41:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=report&file=testTagRetest3" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 147.161.213.78 - - [18/Aug/2026:15:41:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=siteedit&siteid=2122" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 52.167.144.222 - - [18/Aug/2026:15:41:40 +1000] "GET /index.php?page=activities&keyword=ms+word+%E0%B9%81%E0%B8%9B%E0%B8%A5%E0%B8%87%E0%B8%95%E0%B8%B1%E0%B8%A7%E0%B9%80%E0%B8%A5%E0%B8%82+%E0%B9%80%E0%B8%9B%E0%B9%87%E0%B8 203.54.180.238 - - [18/Aug/2026:15:41:40 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=activities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/ 116.91.221.198 - - [18/Aug/2026:15:41:42 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2284" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:15 203.54.180.238 - - [18/Aug/2026:15:41:44 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=purchaseadd" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 203.54.180.238 - - [18/Aug/2026:15:41:44 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 4 GET /wp-login.php 1 POST /wp-cron.php 1 GET /zxz.php 1 GET /xmrlpc.php 1 GET /xmlrpc.php 1 GET /www.php 1 GET /wso.php 1 GET /wp-mail.php 1 GET /wp-includes/rest-api/ 1 GET /wp-includes/pomo/ 1 GET /wp-includes/js/tinymce/plugins/compat3x/css/ 1 GET /wp-includes/js/crop/ -- last 10 requests -- 20.7.73.61 - - [18/Aug/2026:15:40:33 +1000] "GET /wp-includes/images/smilies/about.php HTTP/1.1" 404 - "-" "-" 20.7.73.61 - - [18/Aug/2026:15:40:33 +1000] "GET /wp-includes/js/crop/ HTTP/1.1" 200 1402 "-" "-" 20.7.73.61 - - [18/Aug/2026:15:40:34 +1000] "GET /wp-mail.php HTTP/1.1" 403 2571 "-" "-" 20.7.73.61 - - [18/Aug/2026:15:40:35 +1000] "GET /o.php HTTP/1.1" 404 - "-" "-" 20.7.73.61 - - [18/Aug/2026:15:40:35 +1000] "GET /bb.php HTTP/1.1" 404 - "-" "-" 20.7.73.61 - - [18/Aug/2026:15:40:36 +1000] "GET /wp-admin/maint/admin.php HTTP/1.1" 404 - "-" "-" 20.7.73.61 - - [18/Aug/2026:15:40:36 +1000] "GET /wp-admin/network/ HTTP/1.1" 302 - "-" "-" 20.7.73.61 - - [18/Aug/2026:15:40:38 +1000] "GET /wp-login.php?redirect_to=https%3A%2F%2Faaadownunder.com.au%2Fwp-admin%2Fnetwork%2F&reauth=1 HTTP/1.1" 200 5792 "-" "-" 20.7.73.61 - - [18/Aug/2026:15:40:39 +1000] "GET /wp-includes/IXR/index.php HTTP/1.1" 404 - "-" "-" 20.7.73.61 - - [18/Aug/2026:15:40:39 +1000] "GET /xmrlpc.php HTTP/1.1" 404 - "-" "-" == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 2 POST /wp-cron.php 2 GET /yup.php 1 GET /z43agz.php 1 GET /yawa.php 1 GET /xyn.php 1 GET /xwpg.php 1 GET /ws77.php 1 GET /wpxml.php 1 GET /wp-the.php 1 GET /wp-temp.php 1 GET /wp-rrtx.php 1 GET /wp-login.php -- last 10 requests -- 20.104.100.201 - - [18/Aug/2026:15:41:29 +1000] "GET /wp-admin/js/ HTTP/1.1" 200 18718 "-" "-" 20.104.100.201 - - [18/Aug/2026:15:41:30 +1000] "GET /wp-good.php HTTP/1.1" 404 203868 "-" "-" 20.104.100.201 - - [18/Aug/2026:15:41:33 +1000] "GET /wmore1.php HTTP/1.1" 404 203867 "-" "-" 20.104.100.201 - - [18/Aug/2026:15:41:35 +1000] "GET /special.php HTTP/1.1" 404 203868 "-" "-" 20.104.100.201 - - [18/Aug/2026:15:41:37 +1000] "GET /wp-content/themes/index.php HTTP/1.1" 200 - "-" "-" 20.104.100.201 - - [18/Aug/2026:15:41:37 +1000] "GET /thoms.php HTTP/1.1" 404 203866 "-" "-" 118.127.40.55 - - [18/Aug/2026:15:41:41 +1000] "POST /wp-cron.php?doing_wp_cron=1787031701.1206519603729248046875 HTTP/1.1" 200 1 "-" "WordPress/7.0.4; https://evolutionerp.com.au" 20.104.100.201 - - [18/Aug/2026:15:41:39 +1000] "GET /wp-includes/Text/Diff/Engine/about.php HTTP/1.1" 404 200407 "-" "-" 20.104.100.201 - - [18/Aug/2026:15:41:42 +1000] "GET /root.php HTTP/1.1" 404 203865 "-" "-" 20.104.100.201 - - [18/Aug/2026:15:41:44 +1000] "GET /fpwch.php HTTP/1.1" 404 203866 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-18 15:39:30 L1=9.00 run=11 blk=0 avail=6108 (52.1%) swpO=0 conn=8 myRSS=2241 php=30 phpRSS=1521 ap=66 tcp=37 topuser=evolution 2026-08-18 15:39:30 L1=9.00 run=10 blk=0 avail=6234 (53.2%) swpO=0 conn=8 myRSS=2241 php=29 phpRSS=1364 ap=66 tcp=39 topuser=evolution 2026-08-18 15:39:40 L1=8.38 run=9 blk=0 avail=5789 (49.4%) swpO=0 conn=11 myRSS=2242 php=33 phpRSS=1859 ap=68 tcp=45 topuser=evolution 2026-08-18 15:39:41 L1=8.38 run=9 blk=0 avail=5737 (48.9%) swpO=0 conn=11 myRSS=2242 php=32 phpRSS=1885 ap=68 tcp=44 topuser=evolution 2026-08-18 15:39:50 L1=8.27 run=10 blk=0 avail=5683 (48.5%) swpO=302 conn=11 myRSS=2232 php=32 phpRSS=1820 ap=98 tcp=70 topuser=evolution 2026-08-18 15:39:51 L1=8.27 run=15 blk=0 avail=5807 (49.5%) swpO=302 conn=10 myRSS=2232 php=31 phpRSS=1645 ap=98 tcp=70 topuser=evolution 2026-08-18 15:40:01 L1=7.92 run=13 blk=0 avail=5874 (50.1%) swpO=0 conn=12 myRSS=2232 php=34 phpRSS=1735 ap=88 tcp=39 topuser=evolution 2026-08-18 15:40:01 L1=7.92 run=11 blk=0 avail=5993 (51.1%) swpO=0 conn=10 myRSS=2232 php=35 phpRSS=1629 ap=87 tcp=38 topuser=evolution 2026-08-18 15:40:11 L1=8.14 run=7 blk=0 avail=6096 (52.0%) swpO=0 conn=9 myRSS=2232 php=30 phpRSS=1445 ap=77 tcp=35 topuser=evolution 2026-08-18 15:40:11 L1=8.14 run=9 blk=0 avail=5980 (51.0%) swpO=0 conn=9 myRSS=2232 php=30 phpRSS=1585 ap=77 tcp=33 topuser=evolution 2026-08-18 15:40:21 L1=7.43 run=8 blk=0 avail=6090 (51.9%) swpO=0 conn=9 myRSS=2232 php=35 phpRSS=1697 ap=67 tcp=37 topuser=evolution 2026-08-18 15:40:22 L1=7.43 run=11 blk=0 avail=6360 (54.2%) swpO=0 conn=7 myRSS=2232 php=28 phpRSS=1225 ap=67 tcp=38 topuser=evolution 2026-08-18 15:40:31 L1=7.61 run=7 blk=0 avail=6265 (53.4%) swpO=0 conn=9 myRSS=2232 php=30 phpRSS=1428 ap=59 tcp=38 topuser=evolution 2026-08-18 15:40:32 L1=7.61 run=10 blk=0 avail=6316 (53.9%) swpO=0 conn=7 myRSS=2232 php=29 phpRSS=1345 ap=59 tcp=38 topuser=evolution 2026-08-18 15:40:41 L1=7.36 run=6 blk=0 avail=6136 (52.3%) swpO=0 conn=7 myRSS=2232 php=30 phpRSS=1492 ap=68 tcp=50 topuser=evolution 2026-08-18 15:40:42 L1=7.36 run=8 blk=0 avail=6208 (52.9%) swpO=0 conn=8 myRSS=2232 php=30 phpRSS=1426 ap=68 tcp=53 topuser=evolution 2026-08-18 15:40:51 L1=7.14 run=3 blk=0 avail=6203 (52.9%) swpO=0 conn=8 myRSS=2232 php=29 phpRSS=1415 ap=66 tcp=35 topuser=evolution 2026-08-18 15:40:52 L1=7.14 run=12 blk=0 avail=6089 (51.9%) swpO=0 conn=8 myRSS=2232 php=30 phpRSS=1557 ap=66 tcp=36 topuser=evolution 2026-08-18 15:41:02 L1=6.35 run=7 blk=0 avail=6353 (54.2%) swpO=0 conn=8 myRSS=2232 php=29 phpRSS=1317 ap=58 tcp=29 topuser=evolution 2026-08-18 15:41:02 L1=6.35 run=7 blk=0 avail=6345 (54.1%) swpO=0 conn=9 myRSS=2232 php=29 phpRSS=1326 ap=58 tcp=29 topuser=evolution 2026-08-18 15:41:12 L1=6.39 run=21 blk=0 avail=5895 (50.3%) swpO=0 conn=12 myRSS=2232 php=35 phpRSS=1859 ap=62 tcp=42 topuser=evolution 2026-08-18 15:41:12 L1=6.39 run=15 blk=0 avail=6000 (51.2%) swpO=0 conn=10 myRSS=2232 php=33 phpRSS=1751 ap=62 tcp=42 topuser=evolution 2026-08-18 15:41:22 L1=6.56 run=5 blk=0 avail=6332 (54.0%) swpO=0 conn=7 myRSS=2232 php=29 phpRSS=1290 ap=61 tcp=50 topuser=evolution 2026-08-18 15:41:22 L1=6.56 run=7 blk=0 avail=6317 (53.9%) swpO=0 conn=8 myRSS=2232 php=30 phpRSS=1249 ap=63 tcp=50 topuser=evolution 2026-08-18 15:41:32 L1=6.16 run=10 blk=0 avail=6216 (53.0%) swpO=0 conn=8 myRSS=2232 php=29 phpRSS=1428 ap=59 tcp=42 topuser=evolution 2026-08-18 15:41:32 L1=6.16 run=12 blk=0 avail=6206 (52.9%) swpO=0 conn=8 myRSS=2232 php=29 phpRSS=1438 ap=59 tcp=43 topuser=evolution 2026-08-18 15:41:42 L1=6.14 run=12 blk=0 avail=6307 (53.8%) swpO=0 conn=8 myRSS=2233 php=29 phpRSS=1308 ap=64 tcp=43 topuser=evolution 2026-08-18 15:41:42 L1=6.14 run=9 blk=0 avail=6269 (53.5%) swpO=0 conn=8 myRSS=2233 php=30 phpRSS=1376 ap=64 tcp=43 topuser=evolution 2026-08-18 15:41:52 L1=6.36 run=5 blk=0 avail=6241 (53.2%) swpO=0 conn=10 myRSS=2233 php=30 phpRSS=1439 ap=58 tcp=38 topuser=evolution 2026-08-18 15:41:52 L1=6.36 run=8 blk=0 avail=6196 (52.8%) swpO=0 conn=8 myRSS=2233 php=30 phpRSS=1486 ap=58 tcp=39 topuser=evolution