INCIDENT 2026-08-24 15:24:07 trigger: php_rss=2420MB mysql_conn=17 ================================================================== load: 2.12 1.82 2.21 28/722 4182526 ncpu:10 mem_avail: 4241MB/11729MB (36.2%) swap_used:3621MB swapout:1030/s blocked(D):2 running:28 iowait:0.2% steal:0.0% php: 23 procs / 2420MB heaviest user: evolution (23 procs, 2420MB) apache: 97 procs tcp_estab: 81 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3109 evolution 28 2492 nobody 96 1257 root 237 818 netdata 8 256 mailman 20 92 cpanellogin 1 64 mailnull 7 53 dovenull 6 26 wp-toolkit 6 18 zabbix 1 14 lowrange 1 12 named 1 10 kurri 1 10 aaa 1 10 dovecot 3 7 nscd 1 6 cpanelconnecttrack 1 3 dbus 1 2 polkitd 1 1 --- php workers by user --- USER PROCS RSS_MB evolution 21 2483 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3720 MB Active(file): 2880 MB Inactive(file): 861 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 381 MB CommitLimit: 9960 MB Committed_AS: 10197 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3032611 root 14:12:51 2452 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 3183816 10.1 Ssl 9-07:33:34 /usr/sbin/mariadbd 1220 1 netdata 205592 2.5 Ssl 56-05:14:16 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 4182446 4182438 evolution 184956 50.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4182445 4182428 evolution 178352 45.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4182449 4182432 evolution 178328 45.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4182442 4180266 evolution 178240 44.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4182443 4165505 evolution 176492 43.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4182448 4182439 evolution 176492 45.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4182454 4182436 evolution 171636 43.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4182456 4182425 evolution 169148 41.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3080744 3075441 root 158796 0.0 S 12:51:31 spamd child 4182444 4182429 evolution 158476 41.5 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4182447 4182435 evolution 158248 42.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3879330 3075441 root 154608 0.0 S 01:25:18 spamd child 4182490 4181557 evolution 153592 79.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4182455 4182433 evolution 150436 37.5 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4182451 4182431 evolution 145532 34.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4182452 4182430 evolution 145504 35.0 R 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4182489 4182464 evolution 135284 62.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4182453 4182434 evolution 123328 26.0 S 00:02 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2575382 1 root 99272 0.0 Ss 9-07:33:37 /usr/lib/systemd/systemd-journald 3075441 1 root 90484 0.0 Ss 13:01:10 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4182508 4181459 evolution 83404 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4182507 4182123 evolution 67648 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3418681 1353308 cpanellogin 65464 0.0 S 05:25:16 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 2223 1201 root 63372 0.0 Sl 56-05:14:15 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4182494 4181217 evolution 40876 6.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 40212 0.1 Ss 56-05:14:15 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4182544 4181456 evolution 37812 0.0 R 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 31432 0.1 Sl 56-05:14:11 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1463 1 root 23292 0.0 Ss 56-05:14:15 tailwatchd 1353308 1 root 21308 0.0 Ss 33-12:42:46 cpsrvd (SSL) - waiting for connections 3074682 1 root 20828 0.0 Ss 13:01:44 lfd - sleeping 4180266 1276780 nobody 20136 0.0 S 02:48 /usr/sbin/httpd -k start 4165505 1276780 nobody 19660 0.0 S 04:29 /usr/sbin/httpd -k start 4180020 1276780 nobody 19260 0.0 S 03:08 /usr/sbin/httpd -k start 4182086 1276780 nobody 19188 0.0 S 00:26 /usr/sbin/httpd -k start 4179990 1276780 nobody 19144 0.0 S 03:09 /usr/sbin/httpd -k start 4180024 1276780 nobody 19044 0.0 S 03:08 /usr/sbin/httpd -k start 4181169 1276780 nobody 18900 0.0 S 01:41 /usr/sbin/httpd -k start 4165478 1276780 nobody 18876 0.0 S 04:31 /usr/sbin/httpd -k start 4182126 1276780 nobody 18828 0.0 S 00:21 /usr/sbin/httpd -k start 4181460 1276780 nobody 18640 0.0 S 01:12 /usr/sbin/httpd -k start 4181459 1276780 nobody 18088 0.1 S 01:12 /usr/sbin/httpd -k start 185104 2431 netdata 18048 2.1 Sl 11-18:50:34 /usr/libexec/netdata/plugins.d/apps.plugin 1 4181184 1276780 nobody 17944 0.0 S 01:39 /usr/sbin/httpd -k start 4181456 1276780 nobody 17704 0.0 S 01:13 /usr/sbin/httpd -k start 4182076 1276780 nobody 17252 0.0 S 00:27 /usr/sbin/httpd -k start 4181557 1276780 nobody 17200 0.0 S 01:07 /usr/sbin/httpd -k start 4181569 1276780 nobody 17132 0.0 S 01:06 /usr/sbin/httpd -k start 4181183 1276780 nobody 17128 0.0 S 01:39 /usr/sbin/httpd -k start 4181708 1276780 nobody 17104 0.1 S 01:04 /usr/sbin/httpd -k start 4181714 1276780 nobody 17096 0.0 S 01:03 /usr/sbin/httpd -k start 4165490 1276780 nobody 16976 0.1 S 04:30 /usr/sbin/httpd -k start 4181530 1276780 nobody 16968 0.0 S 01:08 /usr/sbin/httpd -k start 4182117 1276780 nobody 16876 0.0 S 00:22 /usr/sbin/httpd -k start 4182123 1276780 nobody 16760 0.1 S 00:21 /usr/sbin/httpd -k start 4182249 1276780 nobody 16744 0.0 S 00:13 /usr/sbin/httpd -k start 4182116 1276780 nobody 16724 0.0 S 00:22 /usr/sbin/httpd -k start 4182109 1276780 nobody 16716 0.1 S 00:23 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 4182555 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4182562 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi --- mariadb processlist (non-sleeping) --- +----------+--------------------+--------------------+---------+------+----------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+--------------------+--------------------+---------+------+----------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 27642015 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 27641983 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Statistics | SELECT QpCIPREUS_posts.ID FROM QpCIPREUS_posts WHERE 1=1 AND QpCIPREUS_posts.post_type = 'post' AND ((QpCIPREUS_posts.post_status = 'publish')) ORDER BY QpCIPREUS_posts.post_date DESC LIMIT 0, 5 | +----------+--------------------+--------------------+---------+------+----------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 357 evolution/evolutionerp.com.au-ssl_log 50 alison/alisonarts.com.au-ssl_log 47 evolution/portal.evolutionerp.com.au-ssl_log 18 tubesupplies/tubesupplies.com.au-ssl_log 12 alison/alisonarts.com.au 11 evolution/evolutionerp.com.au 5 infinium/infinium.net.au-ssl_log 2 corpkicks/corporatekicks.com.au-ssl_log 1 customc/customcentral.com.au-ssl_log 1 madalice/madalice.com.au-ssl_log 1 (total vhosts taking traffic: 11) --- top client IPs across all vhosts (last 3 min) --- 258 203.54.180.238 61 103.104.165.99 51 85.204.70.104 30 150.228.163.253 26 109.105.209.17 16 109.105.209.20 16 109.105.209.18 12 68.155.147.185 10 109.105.209.19 10 103.104.164.114 6 182.239.240.254 5 216.244.66.240 4 180.181.236.49 3 165.225.233.109 3 118.127.40.55 --- top request paths across all vhosts (last 3 min) --- 163 POST /functions.php 59 GET /app/ajax.php 21 GET /index.php 18 POST /plugins/csvexporter/plugin.php 18 GET /heartbeat.php 14 POST /quoteditsave.php 11 POST /app/ajax/selectFilterSingle.php 10 POST /clienteditsave.php 10 POST /app/ajax.php 9 POST /inveditsave.php 9 POST //functions.php 8 POST /app/ajax/selectFilter.php 7 GET / 6 POST /wp-login.php 5 GET /plugins/fensa/fensa-ajax.php 4 POST /print.php 4 POST /itemModify.php 3 POST /wp-cron.php 3 POST /plugins/fencecosting/plugin.php 3 POST /invoiceaddsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 163 POST /functions.php 59 GET /app/ajax.php 21 GET /index.php 18 POST /plugins/csvexporter/plugin.php 14 POST /quoteditsave.php 11 POST /app/ajax/selectFilterSingle.php 10 POST /clienteditsave.php 10 POST /app/ajax.php 9 POST /inveditsave.php 9 POST //functions.php 8 POST /app/ajax/selectFilter.php 5 GET /plugins/fensa/fensa-ajax.php -- last 10 requests -- 203.54.180.238 - - [24/Aug/2026:15:24:02 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=15124631679 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 203.54.180.238 - - [24/Aug/2026:15:24:02 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Djobedit%26id%3D29481&call=getUserSetting&caller=ajaxSubmitLocal&seq=18694917200 HTTP/1.1" 200 112 "https://my. 203.54.180.238 - - [24/Aug/2026:15:24:02 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobedit%26id%3D29481&call=getUserSetting&caller=ajaxSubmitLocal&seq=14937178384 HTTP/1.1" 200 160 "https://my.evolutionerp.com.a 203.54.180.238 - - [24/Aug/2026:15:24:03 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 2339 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29481&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [24/Aug/2026:15:24:03 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 24581 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29481&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Wi 203.54.180.238 - - [24/Aug/2026:15:24:04 +1000] "POST /quoteditsave.php?itemid=141531&call=getSupplier&baseprice=143.75 HTTP/1.1" 200 158 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78703" "Mozilla/5. 203.54.180.238 - - [24/Aug/2026:15:24:05 +1000] "POST /itemModify.php?call=getInvMFMeta&modifyid=141531 HTTP/1.1" 200 49 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78703" "Mozilla/5.0 (Windows NT 10. 203.54.180.238 - - [24/Aug/2026:15:24:05 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29481&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 203.54.180.238 - - [24/Aug/2026:15:24:05 +1000] "POST /quoteditsave.php?call=checkForBOMAlternates&id=141531 HTTP/1.1" 200 39 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78703" "Mozilla/5.0 (Windows N 203.54.180.238 - - [24/Aug/2026:15:24:05 +1000] "POST /itemModify.php?call=getBOM HTTP/1.1" 200 22 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78703" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 5 GET / 1 POST /wp-cron.php 1 GET /wp-json 1 GET /wp-content/plugins/wp-video-lightbox/readme.txt 1 GET /wp-content/plugins/wp-user-avatar/readme.txt 1 GET /wp-content/plugins/wp-time-capsule/readme.txt 1 GET /wp-content/plugins/wp-super-cache/readme.txt 1 GET /wp-content/plugins/wps-hide-login/readme.txt 1 GET /wp-content/plugins/wpschoolpress/readme.txt 1 GET /wp-content/plugins/wp-optimize/readme.txt 1 GET /wp-content/plugins/wpforms-lite/readme.txt 1 GET /wp-content/plugins/wp-file-manager/readme.txt -- last 10 requests -- 109.105.209.20 - - [24/Aug/2026:15:24:06 +1000] "GET /wp-content/plugins/wps-hide-login/readme.txt HTTP/1.1" 404 119806 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" 109.105.209.17 - - [24/Aug/2026:15:24:06 +1000] "GET /wp-content/plugins/coming-soon/readme.txt HTTP/1.1" 404 119803 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" 109.105.209.18 - - [24/Aug/2026:15:24:06 +1000] "GET /wp-content/plugins/svg-support/readme.txt HTTP/1.1" 404 119803 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" 109.105.209.20 - - [24/Aug/2026:15:24:06 +1000] "GET /wp-content/plugins/redux-framework/readme.txt HTTP/1.1" 404 119807 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" 109.105.209.18 - - [24/Aug/2026:15:24:06 +1000] "GET /wp-content/plugins/w3-total-cache/readme.txt HTTP/1.1" 404 119806 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" 109.105.209.19 - - [24/Aug/2026:15:24:06 +1000] "GET /wp-content/plugins/smart-slider-3/readme.txt HTTP/1.1" 404 119806 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" 109.105.209.18 - - [24/Aug/2026:15:24:06 +1000] "GET /wp-content/plugins/wp-optimize/readme.txt HTTP/1.1" 404 119803 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" 109.105.209.17 - - [24/Aug/2026:15:24:06 +1000] "GET /wp-content/plugins/wp-file-manager/readme.txt HTTP/1.1" 404 119807 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" 109.105.209.19 - - [24/Aug/2026:15:24:07 +1000] "GET /wp-content/plugins/sg-security/readme.txt HTTP/1.1" 404 119803 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" 109.105.209.18 - - [24/Aug/2026:15:24:06 +1000] "GET /wp-content/plugins/duplicator/readme.txt HTTP/1.1" 404 119802 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" == alison/alisonarts.com.au-ssl_log == -- top paths -- 2 GET / 1 GET /wp-login.php 1 GET /wp-includes/random_compat/ 1 GET /wp-includes/pomo/ 1 GET /wp-includes/PHPMailer/ 1 GET /wp-includes/php-compat/ 1 GET /wp-includes/js/ 1 GET /wp-includes/html-api/ 1 GET /wp-includes/block-supports/ 1 GET /wp-includes/block-patterns/ 1 GET /wp-includes/assets/ 1 GET /wp-content/themes/twentytwenty/ -- last 10 requests -- 216.244.66.240 - - [24/Aug/2026:15:23:20 +1000] "GET /fine-art-custom-painted-miners-hard-hat/?envira-tag=art HTTP/1.1" 200 75972 "-" "Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot; help@moz.c 85.204.70.104 - - [24/Aug/2026:15:23:22 +1000] "GET /wp-includes/block-patterns/ HTTP/1.1" 404 49417 "-" "-" 85.204.70.104 - - [24/Aug/2026:15:23:25 +1000] "GET /wp-includes/block-supports/ HTTP/1.1" 404 49417 "-" "-" 85.204.70.104 - - [24/Aug/2026:15:23:28 +1000] "GET /wp-includes/html-api/ HTTP/1.1" 404 49417 "-" "-" 85.204.70.104 - - [24/Aug/2026:15:23:31 +1000] "GET /wp-includes/js/ HTTP/1.1" 404 49417 "-" "-" 216.244.66.240 - - [24/Aug/2026:15:23:32 +1000] "GET /sam_1200/?share=pinterest HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot; help@moz.com)" 85.204.70.104 - - [24/Aug/2026:15:23:33 +1000] "GET /wp-includes/php-compat/ HTTP/1.1" 404 49417 "-" "-" 85.204.70.104 - - [24/Aug/2026:15:23:36 +1000] "GET /wp-includes/PHPMailer/ HTTP/1.1" 404 49417 "-" "-" 85.204.70.104 - - [24/Aug/2026:15:23:39 +1000] "GET /wp-includes/pomo/ HTTP/1.1" 404 49417 "-" "-" 85.204.70.104 - - [24/Aug/2026:15:23:42 +1000] "GET /wp-includes/random_compat/ HTTP/1.1" 404 49417 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-24 15:21:39 L1=1.34 run=2 blk=0 avail=5949 (50.7%) swpO=0 conn=1 myRSS=3137 php=2 phpRSS=146 ap=54 tcp=47 topuser=alison 2026-08-24 15:21:46 L1=1.48 run=6 blk=0 avail=5840 (49.8%) swpO=0 conn=3 myRSS=3137 php=3 phpRSS=330 ap=47 tcp=47 topuser=madalice 2026-08-24 15:21:50 L1=1.52 run=3 blk=0 avail=5999 (51.2%) swpO=0 conn=1 myRSS=3137 php=3 phpRSS=192 ap=44 tcp=43 topuser=evolution 2026-08-24 15:21:56 L1=1.40 run=5 blk=0 avail=6003 (51.2%) swpO=0 conn=3 myRSS=3137 php=1 phpRSS=160 ap=37 tcp=37 topuser=madalice 2026-08-24 15:22:00 L1=1.28 run=2 blk=1 avail=6108 (52.1%) swpO=0 conn=1 myRSS=3137 php=3 phpRSS=146 ap=35 tcp=36 topuser=alison 2026-08-24 15:22:07 L1=1.26 run=1 blk=0 avail=6153 (52.5%) swpO=0 conn=3 myRSS=3137 php=0 phpRSS=0 ap=34 tcp=40 topuser=- 2026-08-24 15:22:10 L1=1.16 run=2 blk=0 avail=6182 (52.7%) swpO=2 conn=1 myRSS=3137 php=1 phpRSS=39 ap=34 tcp=40 topuser=evolution 2026-08-24 15:22:17 L1=1.15 run=2 blk=0 avail=6049 (51.6%) swpO=2 conn=3 myRSS=3137 php=2 phpRSS=194 ap=31 tcp=54 topuser=alison 2026-08-24 15:22:20 L1=1.05 run=1 blk=0 avail=6192 (52.8%) swpO=0 conn=2 myRSS=3137 php=1 phpRSS=39 ap=31 tcp=36 topuser=evolution 2026-08-24 15:22:27 L1=1.05 run=3 blk=0 avail=6195 (52.8%) swpO=0 conn=3 myRSS=3137 php=1 phpRSS=65 ap=26 tcp=41 topuser=evolution 2026-08-24 15:22:30 L1=1.05 run=3 blk=0 avail=6143 (52.4%) swpO=0 conn=2 myRSS=3137 php=1 phpRSS=39 ap=33 tcp=42 topuser=evolution 2026-08-24 15:22:37 L1=1.04 run=3 blk=0 avail=6092 (51.9%) swpO=0 conn=3 myRSS=3137 php=0 phpRSS=0 ap=37 tcp=38 topuser=- 2026-08-24 15:22:40 L1=1.36 run=4 blk=0 avail=6163 (52.5%) swpO=0 conn=2 myRSS=3137 php=1 phpRSS=39 ap=35 tcp=39 topuser=evolution 2026-08-24 15:22:47 L1=1.33 run=3 blk=0 avail=6001 (51.2%) swpO=0 conn=3 myRSS=3137 php=2 phpRSS=287 ap=28 tcp=33 topuser=evolution 2026-08-24 15:22:50 L1=1.38 run=3 blk=0 avail=5961 (50.8%) swpO=0 conn=2 myRSS=3137 php=3 phpRSS=262 ap=25 tcp=41 topuser=alison 2026-08-24 15:22:57 L1=1.59 run=3 blk=0 avail=6089 (51.9%) swpO=0 conn=3 myRSS=3137 php=2 phpRSS=179 ap=28 tcp=42 topuser=alison 2026-08-24 15:23:00 L1=1.55 run=7 blk=0 avail=6029 (51.4%) swpO=0 conn=2 myRSS=3137 php=4 phpRSS=228 ap=28 tcp=42 topuser=evolution 2026-08-24 15:23:07 L1=1.50 run=3 blk=0 avail=6127 (52.2%) swpO=0 conn=3 myRSS=3137 php=1 phpRSS=40 ap=38 tcp=36 topuser=alison 2026-08-24 15:23:10 L1=1.46 run=4 blk=0 avail=5660 (48.3%) swpO=0 conn=2 myRSS=3137 php=5 phpRSS=636 ap=36 tcp=40 topuser=corpkicks 2026-08-24 15:23:17 L1=1.50 run=1 blk=0 avail=6204 (52.9%) swpO=0 conn=3 myRSS=3137 php=0 phpRSS=0 ap=31 tcp=33 topuser=- 2026-08-24 15:23:20 L1=1.38 run=4 blk=0 avail=6213 (53.0%) swpO=0 conn=1 myRSS=3137 php=1 phpRSS=40 ap=29 tcp=36 topuser=alison 2026-08-24 15:23:27 L1=1.27 run=2 blk=0 avail=6191 (52.8%) swpO=1 conn=3 myRSS=3137 php=1 phpRSS=81 ap=27 tcp=37 topuser=evolution 2026-08-24 15:23:30 L1=1.17 run=4 blk=0 avail=6110 (52.1%) swpO=1 conn=1 myRSS=3137 php=1 phpRSS=134 ap=27 tcp=37 topuser=evolution 2026-08-24 15:23:37 L1=1.24 run=5 blk=0 avail=5929 (50.5%) swpO=0 conn=3 myRSS=3137 php=4 phpRSS=424 ap=28 tcp=35 topuser=evolution 2026-08-24 15:23:40 L1=1.22 run=3 blk=0 avail=6123 (52.2%) swpO=0 conn=1 myRSS=3137 php=1 phpRSS=131 ap=28 tcp=37 topuser=evolution 2026-08-24 15:23:47 L1=1.20 run=7 blk=0 avail=6062 (51.7%) swpO=0 conn=4 myRSS=3137 php=3 phpRSS=200 ap=38 tcp=45 topuser=evolution 2026-08-24 15:23:50 L1=1.75 run=7 blk=0 avail=5902 (50.3%) swpO=0 conn=1 myRSS=3137 php=4 phpRSS=363 ap=37 tcp=47 topuser=evolution 2026-08-24 15:23:57 L1=1.77 run=4 blk=0 avail=5997 (51.1%) swpO=0 conn=4 myRSS=3137 php=2 phpRSS=121 ap=38 tcp=42 topuser=evolution 2026-08-24 15:24:00 L1=1.87 run=8 blk=0 avail=5814 (49.6%) swpO=0 conn=1 myRSS=3137 php=6 phpRSS=557 ap=35 tcp=45 topuser=evolution 2026-08-24 15:24:07 L1=2.12 run=28 blk=2 avail=4241 (36.2%) swpO=1030 conn=17 myRSS=3111 php=23 phpRSS=2420 ap=97 tcp=81 topuser=evolution