INCIDENT 2026-08-27 10:30:48 trigger: php_rss=1773MB mysql_conn=18 ================================================================== load: 3.90 2.90 2.47 22/771 1309153 ncpu:10 mem_avail: 5031MB/11729MB (42.9%) swap_used:2043MB swapout:1031/s blocked(D):0 running:29 iowait:0.1% steal:0.0% php: 21 procs / 1773MB heaviest user: evolution (10 procs, 742MB) apache: 120 procs tcp_estab: 132 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2677 nobody 119 1664 root 235 844 evolution 15 780 corpkicks 3 452 tubesupplies 5 418 netdata 8 251 customc 2 228 infinium 5 132 otterfencing 1 64 cpanellogin 1 62 mailman 20 52 dovenull 6 43 wp-toolkit 6 18 dovecot 3 16 alison 1 15 zabbix 1 13 lowrange 1 13 kurri 1 7 nscd 1 6 --- php workers by user --- USER PROCS RSS_MB evolution 8 750 tubesupplies 5 437 corpkicks 3 397 customc 3 237 otterfencing 1 67 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4711 MB Active(file): 3427 MB Inactive(file): 1150 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 363 MB CommitLimit: 9960 MB Committed_AS: 10915 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3565593 root 09:19:32 6192 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2739348 15.0 Ssl 2-06:59:32 /usr/sbin/mariadbd 1220 1 netdata 201932 2.5 Ssl 59-00:20:58 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1309066 1309014 evolution 182996 90.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1309065 1309013 evolution 171468 78.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3846466 3797563 root 170700 0.1 S 07:55:14 spamd child 1309076 1308993 corpkicks 167868 77.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3846467 3797563 root 160696 0.0 S 07:55:14 spamd child 1309061 1309011 evolution 145736 63.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1309064 1309012 evolution 145660 63.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1309112 1309027 customc 133632 60.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 3797563 1 root 128696 0.0 Ss 08:07:52 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1309073 1309017 customc 119416 54.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1309068 1309018 tubesupplies 115128 97.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1309069 1309023 tubesupplies 96548 73.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1309111 1309016 tubesupplies 96276 72.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1309070 1309024 tubesupplies 91992 73.0 S 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 91720 0.0 Ss 12-02:40:19 /usr/lib/systemd/systemd-journald 1309067 1309022 tubesupplies 87100 63.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1309118 1289827 otterfencing 78680 57.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1308977 1308463 evolution 72760 7.2 S 00:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2223 1201 root 64076 0.0 Sl 59-00:20:57 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1103418 1353308 cpanellogin 64020 0.0 S 54:25 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 1308913 1353308 infinium 54652 1.3 S 00:09 webmaild - serving 1.41.252.211 1309177 1292274 evolution 43120 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 41444 0.0 Ss 36-07:49:28 cpsrvd (SSL) - waiting for connections 1309184 1308981 evolution 40764 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1309055 1309020 evolution 40036 1.0 S 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1309054 1309019 evolution 39900 1.0 S 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1309000 1308992 evolution 39488 1.0 S 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 38940 0.1 Ss 59-00:20:57 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1124374 2938073 infinium 34516 0.0 S 47:53 php-fpm: pool user_infinium 4922 2431 netdata 34356 0.1 Sl 59-00:20:53 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3797007 1 root 25848 0.0 Ss 08:08:26 lfd - sleeping 1272893 1276780 nobody 22156 0.0 S 07:24 /usr/sbin/httpd -k start 1270293 1276780 nobody 21632 0.0 S 10:14 /usr/sbin/httpd -k start 1274114 1276780 nobody 21156 0.0 S 06:17 /usr/sbin/httpd -k start 1291205 1276780 nobody 20772 0.0 S 03:45 /usr/sbin/httpd -k start 1273961 1276780 nobody 20716 0.0 S 06:24 /usr/sbin/httpd -k start 1292418 1276780 nobody 20528 0.0 S 02:46 /usr/sbin/httpd -k start 1291172 1276780 nobody 20480 0.0 S 03:46 /usr/sbin/httpd -k start 1293462 1276780 nobody 20292 0.1 S 01:59 /usr/sbin/httpd -k start 1289827 1276780 nobody 20248 0.0 S 04:37 /usr/sbin/httpd -k start 1292392 1276780 nobody 20140 0.1 S 02:47 /usr/sbin/httpd -k start 1292719 1276780 nobody 20132 0.1 S 02:34 /usr/sbin/httpd -k start 1292274 1276780 nobody 20116 0.2 S 02:51 /usr/sbin/httpd -k start 1289346 1276780 nobody 20068 0.0 S 04:54 /usr/sbin/httpd -k start 1274137 1276780 nobody 19832 0.0 S 06:16 /usr/sbin/httpd -k start 1292030 1276780 nobody 19804 0.0 S 03:02 /usr/sbin/httpd -k start 1293069 1276780 nobody 19724 0.0 S 02:21 /usr/sbin/httpd -k start 1292351 1276780 nobody 19704 0.0 S 02:48 /usr/sbin/httpd -k start 185104 2431 netdata 19552 2.1 Rl 14-13:57:16 /usr/libexec/netdata/plugins.d/apps.plugin 1 1294270 1276780 nobody 19464 0.0 S 00:55 /usr/sbin/httpd -k start 1289801 1276780 nobody 19460 0.0 S 04:38 /usr/sbin/httpd -k start 1293789 1276780 nobody 19340 0.0 S 01:34 /usr/sbin/httpd -k start 1293112 1276780 nobody 19260 0.0 S 02:20 /usr/sbin/httpd -k start 1289826 1276780 nobody 19040 0.0 S 04:37 /usr/sbin/httpd -k start 1293798 1276780 nobody 19012 0.0 S 01:33 /usr/sbin/httpd -k start 1292333 1276780 nobody 18920 0.1 S 02:49 /usr/sbin/httpd -k start 1292420 1276780 nobody 18728 0.0 S 02:46 /usr/sbin/httpd -k start 1293113 1276780 nobody 18728 0.0 S 02:20 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 11014165 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 1258 evolution/portal.evolutionerp.com.au-ssl_log 211 olytis/tis.com.au-ssl_log 89 infinium/infinium.net.au-ssl_log 85 evolution/staging.evolutionerp.com.au-ssl_log 49 tubesupplies/tubesupplies.com.au-ssl_log 21 aaa/aaadownunder.com.au-ssl_log 20 evolution/evolutionerp.com.au-ssl_log 14 candyfabcom/candyfab.com.au-ssl_log 13 bigdeals/bigdeals.com.au-ssl_log 9 madalice/madalice.com.au-ssl_log 7 alison/alisonarts.com.au 4 corpkicks/corporatekicks.com.au-ssl_log 4 alison/alisonarts.com.au-ssl_log 3 vinesit/westpanel.vinesit.com.au-ssl_log 2 (total vhosts taking traffic: 18) --- top client IPs across all vhosts (last 3 min) --- 889 203.54.180.238 303 103.104.165.99 124 103.104.164.114 89 52.139.37.240 88 120.150.225.142 83 20.63.64.130 52 1.144.107.82 23 14.1.95.251 18 20.48.160.90 18 165.225.233.87 15 147.161.215.103 13 172.191.149.99 9 52.139.44.162 9 118.127.40.55 8 203.220.53.174 --- top request paths across all vhosts (last 3 min) --- 343 POST /functions.php 300 GET /app/ajax.php 102 GET /index.php 89 POST /clienteditsave.php 75 POST /app/ajax.php 68 GET /factory_session_checker.php 63 POST /plugins/csvexporter/plugin.php 58 POST /app/ajax/selectFilterSingle.php 51 GET /heartbeat.php 40 POST /logsave.php 36 POST /plugins/shopify/plugin.php 35 GET /factory_session_processed_qty.php 35 GET /factory_session_joiner.php 33 POST /quoteditsave.php 28 POST /app/ajax/selectFilter.php 23 POST //functions.php 22 GET /autodiscover/autodiscover.xml 19 POST /jobeditsave.php 18 POST /itemModify.php 15 GET //app/ajax.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 334 POST /functions.php 298 GET /app/ajax.php 92 GET /index.php 89 POST /clienteditsave.php 75 POST /app/ajax.php 63 POST /plugins/csvexporter/plugin.php 58 POST /app/ajax/selectFilterSingle.php 40 POST /logsave.php 33 POST /quoteditsave.php 28 POST /app/ajax/selectFilter.php 23 POST //functions.php 19 POST /jobeditsave.php -- last 10 requests -- 103.104.164.114 - - [27/Aug/2026:10:30:46 +1000] "GET /index.php?page=invoiceadd&invoiceid=4677 HTTP/1.1" 200 56551 "https://my.evolutionerp.com.au/index.php?page=dispatchedit&dispatchid=157" "Mozilla/5.0 (Windows NT 10. 203.54.180.238 - - [27/Aug/2026:10:30:47 +1000] "POST /itemModify.php?call=getBOM HTTP/1.1" 200 22 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78825§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win64; 103.104.164.114 - - [27/Aug/2026:10:30:47 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=14461465983 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/inde 103.104.164.114 - - [27/Aug/2026:10:30:47 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dinvoiceadd%26invoiceid%3D4677%26tab%3Dmaintab&call=getUserSetting&caller=ajaxSubmitLocal&seq=18373778460 HTTP 103.104.164.114 - - [27/Aug/2026:10:30:47 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=10458007798 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/ind 103.104.164.114 - - [27/Aug/2026:10:30:47 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvoiceadd%26invoiceid%3D4677%26tab%3Dmaintab&call=getUserSetting&caller=ajaxSubmitLocal&seq=15170743092 HTTP/1.1" 200 112 "htt 103.104.165.99 - - [27/Aug/2026:10:30:47 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36945§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 103.104.164.114 - - [27/Aug/2026:10:30:47 +1000] "POST /clienteditsave.php?clientid=16&call=getCategoryDiscounts HTTP/1.1" 200 25 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4677&tab=maintab" "Moz 203.54.180.238 - - [27/Aug/2026:10:30:48 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=27651" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 103.104.164.114 - - [27/Aug/2026:10:30:47 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4677&tab=maintab" "Mozilla/5.0 (Windows NT == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 68 GET /factory_session_checker.php 51 GET /heartbeat.php 35 GET /factory_session_processed_qty.php 35 GET /factory_session_joiner.php 8 GET /index.php 4 POST /portal/register 4 GET /uploadsave.php 2 POST /uploadsave.php 2 POST /inventory.php 1 GET /userlogin.php 1 GET /logoff.php -- last 10 requests -- 203.54.180.238 - - [27/Aug/2026:10:30:43 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [27/Aug/2026:10:30:42 +1000] "GET /heartbeat.php?sentAt=1787790642&bytes=106,143,133,50&_=1787785928898 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [27/Aug/2026:10:30:44 +1000] "POST /uploadsave.php HTTP/1.1" 200 24 "https://portal.evolutionerp.com.au/index.php?page=delivery_commit&id=33939" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 ( 203.54.180.238 - - [27/Aug/2026:10:30:46 +1000] "GET /uploadsave.php?call=get_uploads&sourceId=33939&subType=delivery_commit HTTP/1.1" 200 407 "https://portal.evolutionerp.com.au/index.php?page=delivery_commit&id=33939" 203.54.180.238 - - [27/Aug/2026:10:30:48 +1000] "GET /factory_session_joiner.php?id=34906 HTTP/1.1" 200 86 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [27/Aug/2026:10:30:48 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 124 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [27/Aug/2026:10:30:48 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [27/Aug/2026:10:30:48 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [27/Aug/2026:10:30:47 +1000] "POST /inventory.php HTTP/1.1" 302 20 "https://portal.evolutionerp.com.au/index.php?page=delivery_commit&id=33939" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (K 203.54.180.238 - - [27/Aug/2026:10:30:49 +1000] "GET /index.php?page=delivery_commit&id=33939 HTTP/1.1" 200 61720 "https://portal.evolutionerp.com.au/index.php?page=delivery_commit&id=33939" "Mozilla/5.0 (Linux; Android == olytis/tis.com.au-ssl_log == -- top paths -- 1 GET /zoom1.php 1 GET /xx.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws.php 1 GET /ws81.php 1 GET /ws77.php 1 GET /ws37.php 1 GET /wp-trackback.php 1 GET /wp-the.php 1 GET /wp-signin.php 1 GET /wp-includes/PHPMailer/ -- last 10 requests -- 52.139.37.240 - - [27/Aug/2026:10:28:26 +1000] "GET /ftde.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:10:28:26 +1000] "GET /hplfuns.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:10:28:26 +1000] "GET /log.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:10:28:26 +1000] "GET /txets.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:10:28:27 +1000] "GET /wp-admin.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:10:28:27 +1000] "GET /wp-admin/images/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:10:28:27 +1000] "GET /wp-admin/network/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:10:28:27 +1000] "GET /wp-config-sample.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:10:28:27 +1000] "GET /wp-content/packed.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [27/Aug/2026:10:28:28 +1000] "GET /wp-includes/IXR/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-27 10:28:26 L1=1.64 run=4 blk=0 avail=6010 (51.2%) swpO=0 conn=3 myRSS=2694 php=5 phpRSS=540 ap=54 tcp=65 topuser=corpkicks 2026-08-27 10:28:27 L1=2.63 run=5 blk=0 avail=6348 (54.1%) swpO=0 conn=2 myRSS=2694 php=2 phpRSS=107 ap=57 tcp=64 topuser=evolution 2026-08-27 10:28:36 L1=2.66 run=3 blk=0 avail=6295 (53.7%) swpO=1 conn=3 myRSS=2694 php=6 phpRSS=266 ap=58 tcp=47 topuser=evolution 2026-08-27 10:28:37 L1=2.77 run=5 blk=0 avail=6408 (54.6%) swpO=1 conn=2 myRSS=2694 php=1 phpRSS=42 ap=56 tcp=46 topuser=evolution 2026-08-27 10:28:46 L1=2.79 run=6 blk=0 avail=6316 (53.9%) swpO=0 conn=3 myRSS=2694 php=8 phpRSS=369 ap=49 tcp=54 topuser=evolution 2026-08-27 10:28:48 L1=3.12 run=7 blk=0 avail=6145 (52.4%) swpO=0 conn=5 myRSS=2694 php=11 phpRSS=608 ap=49 tcp=56 topuser=evolution 2026-08-27 10:28:56 L1=3.35 run=6 blk=0 avail=6274 (53.5%) swpO=0 conn=3 myRSS=2694 php=10 phpRSS=413 ap=55 tcp=54 topuser=evolution 2026-08-27 10:28:58 L1=3.33 run=3 blk=0 avail=6325 (53.9%) swpO=0 conn=5 myRSS=2694 php=7 phpRSS=306 ap=54 tcp=49 topuser=evolution 2026-08-27 10:29:06 L1=3.22 run=6 blk=0 avail=6268 (53.4%) swpO=0 conn=4 myRSS=2695 php=10 phpRSS=453 ap=53 tcp=52 topuser=evolution 2026-08-27 10:29:08 L1=3.44 run=4 blk=0 avail=6246 (53.3%) swpO=0 conn=5 myRSS=2695 php=12 phpRSS=539 ap=53 tcp=48 topuser=evolution 2026-08-27 10:29:16 L1=3.33 run=2 blk=0 avail=6264 (53.4%) swpO=0 conn=4 myRSS=2695 php=6 phpRSS=263 ap=65 tcp=54 topuser=evolution 2026-08-27 10:29:18 L1=3.06 run=2 blk=0 avail=6280 (53.5%) swpO=0 conn=5 myRSS=2695 php=6 phpRSS=260 ap=64 tcp=49 topuser=evolution 2026-08-27 10:29:26 L1=2.97 run=5 blk=0 avail=6321 (53.9%) swpO=0 conn=4 myRSS=2695 php=7 phpRSS=272 ap=56 tcp=53 topuser=evolution 2026-08-27 10:29:28 L1=2.82 run=2 blk=0 avail=6345 (54.1%) swpO=0 conn=5 myRSS=2695 php=6 phpRSS=259 ap=54 tcp=46 topuser=evolution 2026-08-27 10:29:36 L1=2.75 run=4 blk=0 avail=6389 (54.5%) swpO=0 conn=4 myRSS=2695 php=6 phpRSS=263 ap=46 tcp=41 topuser=evolution 2026-08-27 10:29:38 L1=2.77 run=2 blk=0 avail=6437 (54.9%) swpO=0 conn=5 myRSS=2695 php=6 phpRSS=259 ap=44 tcp=35 topuser=evolution 2026-08-27 10:29:46 L1=2.87 run=4 blk=0 avail=6435 (54.9%) swpO=0 conn=4 myRSS=2695 php=8 phpRSS=353 ap=39 tcp=45 topuser=evolution 2026-08-27 10:29:48 L1=3.28 run=8 blk=0 avail=6428 (54.8%) swpO=0 conn=3 myRSS=2695 php=11 phpRSS=438 ap=39 tcp=42 topuser=evolution 2026-08-27 10:29:56 L1=3.42 run=8 blk=0 avail=6474 (55.2%) swpO=0 conn=4 myRSS=2696 php=6 phpRSS=203 ap=40 tcp=49 topuser=evolution 2026-08-27 10:29:58 L1=3.55 run=2 blk=0 avail=6461 (55.1%) swpO=0 conn=3 myRSS=2696 php=5 phpRSS=202 ap=40 tcp=46 topuser=evolution 2026-08-27 10:30:06 L1=3.66 run=8 blk=0 avail=6364 (54.3%) swpO=0 conn=4 myRSS=2696 php=8 phpRSS=379 ap=41 tcp=44 topuser=evolution 2026-08-27 10:30:08 L1=3.93 run=7 blk=0 avail=6390 (54.5%) swpO=0 conn=3 myRSS=2696 php=8 phpRSS=325 ap=41 tcp=47 topuser=evolution 2026-08-27 10:30:16 L1=3.69 run=2 blk=0 avail=6338 (54.0%) swpO=0 conn=4 myRSS=2696 php=3 phpRSS=203 ap=50 tcp=57 topuser=evolution 2026-08-27 10:30:18 L1=3.40 run=5 blk=0 avail=6366 (54.3%) swpO=0 conn=3 myRSS=2696 php=3 phpRSS=180 ap=50 tcp=48 topuser=evolution 2026-08-27 10:30:26 L1=3.13 run=5 blk=0 avail=6437 (54.9%) swpO=0 conn=4 myRSS=2696 php=1 phpRSS=67 ap=48 tcp=52 topuser=evolution 2026-08-27 10:30:28 L1=2.96 run=3 blk=0 avail=6394 (54.5%) swpO=0 conn=3 myRSS=2696 php=2 phpRSS=134 ap=49 tcp=54 topuser=evolution 2026-08-27 10:30:37 L1=2.80 run=6 blk=0 avail=6338 (54.0%) swpO=0 conn=4 myRSS=2696 php=3 phpRSS=178 ap=58 tcp=45 topuser=evolution 2026-08-27 10:30:38 L1=2.82 run=6 blk=0 avail=5885 (50.2%) swpO=0 conn=3 myRSS=2696 php=7 phpRSS=729 ap=57 tcp=59 topuser=customc 2026-08-27 10:30:47 L1=2.67 run=26 blk=0 avail=5408 (46.1%) swpO=21 conn=4 myRSS=2696 php=11 phpRSS=1093 ap=88 tcp=118 topuser=corpkicks 2026-08-27 10:30:48 L1=3.90 run=29 blk=0 avail=5031 (42.9%) swpO=1031 conn=18 myRSS=2680 php=21 phpRSS=1773 ap=120 tcp=132 topuser=evolution