INCIDENT 2026-08-29 12:01:49 trigger: php_procs=59 php_rss=4940MB mysql_conn=50 ================================================================== load: 4.22 2.04 1.61 60/762 3472615 ncpu:10 mem_avail: 4392MB/13777MB (31.9%) swap_used:1408MB swapout:1517/s blocked(D):1 running:41 iowait:0.3% steal:0.0% php: 59 procs / 4940MB heaviest user: infinium (56 procs, 4806MB) apache: 70 procs tcp_estab: 109 --- RSS by user (all processes) --- USER PROCS RSS_MB infinium 54 4814 mysql 1 2712 nobody 70 1142 root 261 1124 mailman 20 199 netdata 7 196 evolution 8 118 cpanellogin 1 97 dovenull 6 54 wp-toolkit 3 44 aaa 2 29 zabbix 1 22 dovecot 3 22 sshd 5 18 named 1 14 kurri 1 9 mailnull 1 8 polkitd 1 6 nscd 1 4 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB infinium 51 4683 evolution 2 105 root 1 27 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3077 MB Active(file): 3016 MB Inactive(file): 591 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 582 MB CommitLimit: 10984 MB Committed_AS: 12095 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-09:43:09 7532 /usr/bin/imunify-agent-proxy 3456721 root 01:48 1252 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2777780 9.9 Ssl 1-09:42:38 /usr/sbin/mariadbd 1502903 1451906 root 202008 0.0 S 09:25:27 spamd child 508924 1 netdata 175368 2.0 Ssl 1-09:42:07 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1502904 1451906 root 165264 0.0 S 09:25:27 spamd child 1451906 1 root 145248 0.0 Ss 09:38:42 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3472528 3472385 infinium 123628 19.0 S 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472561 3472362 infinium 123088 17.6 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472512 3471893 infinium 122792 18.3 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472537 3472307 infinium 121868 18.6 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472522 3472288 infinium 121724 19.6 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472558 3471890 infinium 121224 17.3 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472534 3472304 infinium 121200 17.6 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472527 3472388 infinium 120984 19.0 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472567 3472555 infinium 120236 25.0 R 00:02 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472566 3472366 infinium 118792 28.0 R 00:02 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472545 3472345 infinium 117652 16.6 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472562 3472361 infinium 117360 16.0 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472518 3471917 infinium 117004 16.3 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472524 3472370 infinium 115972 16.3 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472547 3472343 infinium 112016 16.6 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472539 3472338 infinium 111992 15.3 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472559 3471912 infinium 111524 16.6 S 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472563 3472363 infinium 111356 17.0 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472552 3472352 infinium 109604 14.6 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472546 3472349 infinium 109260 15.6 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472554 3472347 infinium 109224 15.0 S 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472532 3472302 infinium 108548 14.6 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472551 3472346 infinium 107404 15.0 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472549 3472344 infinium 105264 15.3 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472540 3472306 infinium 104936 15.3 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472577 3472364 infinium 102380 40.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472538 3472308 infinium 101840 14.0 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472544 3472341 infinium 101308 14.3 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 2971632 1353308 cpanellogin 100232 0.0 S 02:24:54 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 3472556 3472350 infinium 98528 14.6 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472535 3472305 infinium 97756 13.0 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472536 3472309 infinium 94180 13.0 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3456777 3456729 evolution 94164 1.8 Rs 01:48 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero_payment_cron.php 509266 1 root 94020 0.0 Ss 1-09:42:04 /usr/lib/systemd/systemd-journald 3472575 3472290 infinium 91516 33.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472541 3472342 infinium 89192 11.0 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472557 3472351 infinium 83688 10.0 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472571 3472569 infinium 76812 14.0 R 00:02 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472548 3472353 infinium 72036 18.0 R 00:03 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472574 3472348 infinium 71464 26.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472578 3471918 infinium 64840 19.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472576 3472339 infinium 63328 19.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 509236 509098 root 63132 0.0 Sl 1-09:42:04 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3472573 3472570 infinium 55300 7.5 R 00:02 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472192 1353308 infinium 55284 0.3 S 00:31 webmaild - serving 1.41.252.211 3472203 1353308 infinium 55136 0.4 S 00:31 webmaild - serving 1.41.252.211 3472620 3472389 infinium 54024 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472609 3472372 infinium 53796 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472579 3472382 infinium 51204 7.0 R 00:01 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472621 3472378 infinium 51204 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472624 3472368 infinium 48728 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472605 3472381 infinium 48680 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472610 3472291 infinium 46320 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 3472623 3471158 infinium 41104 0.0 R 00:00 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 1353308 1 root 40644 0.1 Ss 38-09:20:30 cpsrvd (SSL) - waiting for connections --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3968070 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 3968069 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | +---------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/app.evolutionerp.com.au-ssl_log 1075 infinium/infinium.net.au-ssl_log 100 coscom/coscom.com.au-ssl_log 63 vinesit/vinesit.com.au-ssl_log 58 aaa/aaadownunder.com.au-ssl_log 28 evolution/portal.evolutionerp.com.au-ssl_log 28 infinium/infinium.net.au 21 alison/alisonarts.com.au-ssl_log 3 aaa/aaadownunder.com.au 2 corpkicks/corporatekicks.com.au-ssl_log 2 madalice/madalice.com.au-ssl_log 2 (total vhosts taking traffic: 11) --- top client IPs across all vhosts (last 3 min) --- 1075 40.115.94.245 121 52.139.37.240 66 199.188.200.178 60 20.104.104.62 28 203.54.180.238 21 34.83.186.82 6 66.116.251.167 5 143.244.57.120 4 34.71.198.3 4 118.127.40.55 2 168.63.79.147 2 114.119.131.88 1 209.50.177.191 1 209.50.165.157 1 185.48.117.193 --- top request paths across all vhosts (last 3 min) --- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 71 GET /wp-login.php 34 POST /wp-login.php 28 GET /heartbeat.php 9 GET /api/getItem/NA 5 GET /wp-json/wp/v2/users/me 4 POST /wp-cron.php 4 GET /api/getItem/PWFBW3151KG 2 GET /zoz.php 2 GET /zoom1.php 2 GET /Zeiss.php 2 GET /xx.php 2 GET /xmlrpc.php 2 GET /xda.php 2 GET /ww3.php 2 GET /ww2.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 135 GET /api/getItem/LWPG2001KG 135 GET /api/getItem/LWPB2001KG 135 GET /api/getItem/LWHG2001KG 135 GET /api/getItem/LWFBW2001KG 135 GET /api/getItem/LWFB2001KG 9 GET /api/getItem/NA 4 GET /api/getItem/PWFBW3151KG 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 -- last 10 requests -- 40.115.94.245 - - [29/Aug/2026:12:01:15 +1000] "GET /api/getItem/RGW90 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:12:01:16 +1000] "GET /api/getItem/RGW100 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:12:01:16 +1000] "GET /api/getItem/RGW120 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:12:01:16 +1000] "GET /api/getItem/RGW160 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:12:01:16 +1000] "GET /api/getItem/RGW117T HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:12:01:16 +1000] "GET /api/getItem/RGW80 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:12:01:16 +1000] "GET /api/getItem/GP150x200x8 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:12:01:16 +1000] "GET /api/getItem/K125MSGB HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:12:01:16 +1000] "GET /api/getItem/253-40SP HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [29/Aug/2026:12:01:16 +1000] "GET /api/getItem/300558 HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" == infinium/infinium.net.au-ssl_log == -- top paths -- 84 GET /wp-login.php 39 POST /wp-login.php 5 GET /wp-json/wp/v2/users/me 3 POST /wp-cron.php 1 GET /zoz.php 1 GET /Zeiss.php 1 GET /xcre1.php 1 GET /x0x.php 1 GET /ww3.php 1 GET /ww2.php 1 GET /wsz.php 1 GET /wp-gzone.php -- last 10 requests -- 199.188.200.178 - - [29/Aug/2026:12:01:52 +1000] "GET /wp-login.php HTTP/1.1" 503 6560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 199.188.200.178 - - [29/Aug/2026:12:01:50 +1000] "POST /wp-login.php HTTP/1.1" 503 6746 "https://infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151. 199.188.200.178 - - [29/Aug/2026:12:01:52 +1000] "GET /wp-login.php HTTP/1.1" 503 6560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 199.188.200.178 - - [29/Aug/2026:12:01:52 +1000] "GET /wp-login.php HTTP/1.1" 503 6560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 199.188.200.178 - - [29/Aug/2026:12:01:52 +1000] "GET /wp-login.php HTTP/1.1" 503 6560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 199.188.200.178 - - [29/Aug/2026:12:01:52 +1000] "GET /wp-login.php HTTP/1.1" 503 6560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 199.188.200.178 - - [29/Aug/2026:12:01:50 +1000] "POST /wp-login.php HTTP/1.1" 503 6746 "https://infinium.net.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151. 199.188.200.178 - - [29/Aug/2026:12:01:52 +1000] "GET /wp-login.php HTTP/1.1" 503 6560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 199.188.200.178 - - [29/Aug/2026:12:01:52 +1000] "GET /wp-login.php HTTP/1.1" 503 6560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 199.188.200.178 - - [29/Aug/2026:12:01:52 +1000] "GET /wp-login.php HTTP/1.1" 503 6560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" == coscom/coscom.com.au-ssl_log == -- top paths -- 1 GET /zoom1.php 1 GET /xx.php 1 GET /xmlrpc.php 1 GET /xda.php 1 GET /ws81.php 1 GET /ws77.php 1 GET /ws37.php 1 GET /wp-the.php 1 GET /wp-signin.php 1 GET /wp-includes/PHPMailer/ 1 GET /wp-includes/ID3/index.php 1 GET /wp-includes/bk/ -- last 10 requests -- 52.139.37.240 - - [29/Aug/2026:11:59:28 +1000] "GET /ws81.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:11:59:28 +1000] "GET /a1.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:11:59:28 +1000] "GET /ca5.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:11:59:28 +1000] "GET /install.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:11:59:29 +1000] "GET /wp-admin/css/colors/modern/ HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:11:59:29 +1000] "GET /wp-signin.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:11:59:29 +1000] "GET /Ov-Simple1.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:11:59:29 +1000] "GET /ftde.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:11:59:29 +1000] "GET /hplfuns.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 52.139.37.240 - - [29/Aug/2026:11:59:30 +1000] "GET /log.php HTTP/1.1" 401 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-08-29 11:59:24 L1=0.93 run=2 blk=0 avail=8594 (62.4%) swpO=0 conn=3 myRSS=2756 php=4 phpRSS=125 ap=17 tcp=23 topuser=evolution 2026-08-29 11:59:28 L1=0.93 run=1 blk=0 avail=8618 (62.6%) swpO=0 conn=1 myRSS=2756 php=3 phpRSS=63 ap=17 tcp=24 topuser=root 2026-08-29 11:59:34 L1=0.94 run=3 blk=0 avail=8597 (62.4%) swpO=0 conn=3 myRSS=2756 php=6 phpRSS=199 ap=16 tcp=25 topuser=evolution 2026-08-29 11:59:38 L1=0.86 run=1 blk=0 avail=8633 (62.7%) swpO=0 conn=1 myRSS=2756 php=2 phpRSS=44 ap=16 tcp=26 topuser=root 2026-08-29 11:59:44 L1=0.79 run=2 blk=0 avail=8598 (62.4%) swpO=0 conn=3 myRSS=2756 php=5 phpRSS=163 ap=16 tcp=28 topuser=evolution 2026-08-29 11:59:48 L1=0.73 run=1 blk=0 avail=8633 (62.7%) swpO=0 conn=1 myRSS=2756 php=2 phpRSS=44 ap=16 tcp=27 topuser=root 2026-08-29 11:59:54 L1=0.75 run=1 blk=0 avail=8599 (62.4%) swpO=0 conn=3 myRSS=2756 php=4 phpRSS=125 ap=16 tcp=35 topuser=evolution 2026-08-29 11:59:58 L1=0.69 run=2 blk=0 avail=8591 (62.4%) swpO=0 conn=1 myRSS=2756 php=3 phpRSS=109 ap=16 tcp=31 topuser=alison 2026-08-29 12:00:04 L1=1.60 run=3 blk=0 avail=8509 (61.8%) swpO=0 conn=3 myRSS=2756 php=6 phpRSS=261 ap=15 tcp=26 topuser=evolution 2026-08-29 12:00:08 L1=1.63 run=4 blk=0 avail=8547 (62.0%) swpO=0 conn=1 myRSS=2756 php=5 phpRSS=220 ap=15 tcp=28 topuser=evolution 2026-08-29 12:00:14 L1=1.58 run=2 blk=0 avail=8527 (61.9%) swpO=0 conn=5 myRSS=2756 php=7 phpRSS=292 ap=15 tcp=29 topuser=evolution 2026-08-29 12:00:18 L1=1.53 run=4 blk=0 avail=8543 (62.0%) swpO=0 conn=1 myRSS=2756 php=4 phpRSS=185 ap=15 tcp=28 topuser=evolution 2026-08-29 12:00:24 L1=1.41 run=4 blk=0 avail=8335 (60.5%) swpO=0 conn=5 myRSS=2756 php=7 phpRSS=490 ap=15 tcp=33 topuser=evolution 2026-08-29 12:00:28 L1=1.46 run=1 blk=0 avail=8540 (62.0%) swpO=0 conn=2 myRSS=2756 php=3 phpRSS=127 ap=22 tcp=48 topuser=evolution 2026-08-29 12:00:34 L1=1.34 run=2 blk=0 avail=8382 (60.8%) swpO=0 conn=5 myRSS=2756 php=5 phpRSS=214 ap=43 tcp=39 topuser=evolution 2026-08-29 12:00:38 L1=1.23 run=2 blk=0 avail=8316 (60.4%) swpO=0 conn=2 myRSS=2756 php=5 phpRSS=302 ap=38 tcp=34 topuser=evolution 2026-08-29 12:00:44 L1=1.29 run=1 blk=0 avail=8334 (60.5%) swpO=0 conn=5 myRSS=2756 php=7 phpRSS=368 ap=33 tcp=30 topuser=evolution 2026-08-29 12:00:48 L1=1.35 run=2 blk=0 avail=8397 (60.9%) swpO=0 conn=2 myRSS=2756 php=5 phpRSS=294 ap=28 tcp=27 topuser=madalice 2026-08-29 12:00:54 L1=1.40 run=1 blk=0 avail=8406 (61.0%) swpO=0 conn=5 myRSS=2756 php=7 phpRSS=376 ap=23 tcp=27 topuser=evolution 2026-08-29 12:00:58 L1=1.53 run=2 blk=0 avail=8570 (62.2%) swpO=0 conn=2 myRSS=2756 php=4 phpRSS=151 ap=18 tcp=28 topuser=evolution 2026-08-29 12:01:04 L1=1.57 run=3 blk=0 avail=8443 (61.3%) swpO=0 conn=5 myRSS=2756 php=4 phpRSS=269 ap=20 tcp=44 topuser=madalice 2026-08-29 12:01:09 L1=1.52 run=3 blk=0 avail=8361 (60.7%) swpO=0 conn=2 myRSS=2756 php=4 phpRSS=269 ap=31 tcp=32 topuser=madalice 2026-08-29 12:01:14 L1=1.64 run=4 blk=0 avail=8376 (60.8%) swpO=0 conn=4 myRSS=2756 php=7 phpRSS=388 ap=26 tcp=30 topuser=evolution 2026-08-29 12:01:19 L1=1.59 run=2 blk=0 avail=8395 (60.9%) swpO=0 conn=2 myRSS=2756 php=4 phpRSS=269 ap=21 tcp=33 topuser=madalice 2026-08-29 12:01:24 L1=2.58 run=1 blk=0 avail=8375 (60.8%) swpO=0 conn=4 myRSS=2756 php=3 phpRSS=137 ap=35 tcp=86 topuser=evolution 2026-08-29 12:01:29 L1=2.70 run=3 blk=0 avail=7973 (57.9%) swpO=0 conn=4 myRSS=2756 php=4 phpRSS=278 ap=81 tcp=74 topuser=alison 2026-08-29 12:01:34 L1=2.56 run=2 blk=0 avail=8094 (58.7%) swpO=0 conn=4 myRSS=2756 php=5 phpRSS=217 ap=76 tcp=64 topuser=evolution 2026-08-29 12:01:39 L1=2.44 run=2 blk=0 avail=8144 (59.1%) swpO=0 conn=4 myRSS=2756 php=3 phpRSS=138 ap=71 tcp=66 topuser=evolution 2026-08-29 12:01:44 L1=2.32 run=3 blk=0 avail=8136 (59.1%) swpO=0 conn=4 myRSS=2756 php=6 phpRSS=268 ap=66 tcp=56 topuser=evolution 2026-08-29 12:01:49 L1=4.22 run=41 blk=1 avail=4392 (31.9%) swpO=1517 conn=50 myRSS=2712 php=59 phpRSS=4940 ap=70 tcp=109 topuser=infinium