INCIDENT 2026-09-08 08:20:40 trigger: php_procs=25 ================================================================== load: 2.78 2.38 2.39 5/662 3096332 ncpu:10 mem_avail: 10108MB/13777MB (73.4%) swap_used:1900MB swapout:39/s blocked(D):1 running:10 iowait:9.4% steal:0.0% php: 25 procs / 822MB heaviest user: evolution (24 procs, 819MB) apache: 46 procs tcp_estab: 51 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1304 nobody 45 775 evolution 29 769 root 252 639 netdata 8 231 cpanellogin 1 84 kurri 4 46 mailman 20 36 mailnull 3 23 dovenull 6 22 lowrange 2 17 wp-toolkit 3 12 zabbix 1 11 candyfabcom 1 11 vinesit 1 9 dovecot 3 9 named 1 5 nscd 1 4 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB evolution 20 728 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 9508 MB Active(file): 4766 MB Inactive(file): 4958 MB Dirty: 3 MB Writeback: 0 MB SReclaimable: 356 MB CommitLimit: 10984 MB Committed_AS: 8465 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3081015 root 01:10 58748 /opt/imunify360/venv/bin/python3 -m imav.run 3926885 root 7-05:58:15 5316 /usr/bin/imunify-agent-proxy 4109079 root 3-03:35:53 4 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 3-03:35:53 73228 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 1335412 11.3 Ssl 03:35:12 /usr/sbin/mariadbd 166870 1 netdata 183956 2.8 Ssl 2-05:58:21 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1911708 1859745 root 156608 0.0 S 05:43:30 spamd child 2684593 1353308 cpanellogin 86168 0.0 S 01:54:40 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 4109105 4109079 root 73228 1.1 Sl 3-03:35:53 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2328754 1 root 66060 0.0 Ss 03:35:22 /usr/lib/systemd/systemd-journald 3078666 3072590 evolution 65980 0.0 S 03:16 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3096280 3082933 evolution 60100 10.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3081015 1 root 58748 2.8 Ssl 01:10 /opt/imunify360/venv/bin/python3 -m imav.run 3096288 3088561 evolution 57724 9.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3096294 3079686 evolution 40592 2.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509236 509098 root 38920 0.0 Sl 11-06:01:01 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3078791 3060331 evolution 38592 0.0 S 03:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3079870 3078043 evolution 38580 0.0 S 01:56 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3079620 3061600 evolution 38576 0.0 S 02:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3078740 3078522 evolution 38480 0.0 S 03:11 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3096301 3078058 evolution 36892 0.0 S 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3079713 3079696 evolution 36816 0.0 S 02:08 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3079472 3078758 evolution 36804 0.0 S 02:25 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3096302 3078523 evolution 36800 0.0 S 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3078673 3061474 evolution 36788 0.0 S 03:15 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3096290 3080540 evolution 36748 3.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3096107 3078900 evolution 36740 0.1 S 00:18 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3080607 3079915 evolution 36692 0.0 S 01:20 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3079746 3077380 evolution 36604 0.0 S 02:05 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3096295 3096138 evolution 36300 3.0 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1353308 1 root 34196 0.0 Ss 48-05:39:27 cpsrvd (SSL) - waiting for connections 167562 166914 netdata 33136 0.1 Sl 2-05:58:16 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1859745 1 root 26888 0.0 Ss 05:57:52 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3072590 506832 nobody 21664 0.0 S 05:31 /usr/sbin/httpd -k start 3078301 506832 nobody 21516 0.1 S 03:57 /usr/sbin/httpd -k start 3061600 506832 nobody 21280 0.0 S 06:56 /usr/sbin/httpd -k start 3078516 506832 nobody 20896 0.0 S 03:33 /usr/sbin/httpd -k start 3078307 506832 nobody 20692 0.0 S 03:56 /usr/sbin/httpd -k start 3062331 506832 nobody 20608 0.0 S 05:51 /usr/sbin/httpd -k start 3078523 506832 nobody 20516 0.1 S 03:32 /usr/sbin/httpd -k start 3080540 506832 nobody 20348 0.0 S 01:26 /usr/sbin/httpd -k start 3061984 506832 nobody 20172 0.0 S 06:26 /usr/sbin/httpd -k start 3079985 506832 nobody 20120 0.1 S 01:49 /usr/sbin/httpd -k start 3079916 506832 nobody 20020 0.0 S 01:51 /usr/sbin/httpd -k start 3078058 506832 nobody 19944 0.0 S 04:26 /usr/sbin/httpd -k start 3079778 506832 nobody 19796 0.0 S 02:01 /usr/sbin/httpd -k start 3078517 506832 nobody 19608 0.0 S 03:33 /usr/sbin/httpd -k start 3079686 506832 nobody 19412 0.0 S 02:10 /usr/sbin/httpd -k start 3078900 506832 nobody 19188 0.1 S 02:58 /usr/sbin/httpd -k start 3077380 506832 nobody 19176 0.0 S 05:14 /usr/sbin/httpd -k start 3079904 506832 nobody 19064 0.0 S 01:52 /usr/sbin/httpd -k start 3078043 506832 nobody 18908 0.0 S 04:28 /usr/sbin/httpd -k start 3085757 506832 nobody 18728 0.0 S 00:35 /usr/sbin/httpd -k start 3079988 506832 nobody 18604 0.1 S 01:49 /usr/sbin/httpd -k start 3094486 506832 nobody 18556 0.1 S 00:29 /usr/sbin/httpd -k start 3079915 506832 nobody 18468 0.0 S 01:51 /usr/sbin/httpd -k start 3081283 506832 nobody 18336 0.1 S 00:49 /usr/sbin/httpd -k start 3079986 506832 nobody 18232 0.0 S 01:49 /usr/sbin/httpd -k start 3061474 506832 nobody 18096 0.0 S 07:08 /usr/sbin/httpd -k start 3078522 506832 nobody 18032 0.0 S 03:32 /usr/sbin/httpd -k start 3079626 506832 nobody 17404 0.0 S 02:11 /usr/sbin/httpd -k start 3078758 506832 nobody 17236 0.0 S 03:08 /usr/sbin/httpd -k start 3080550 506832 nobody 17112 0.0 S 01:25 /usr/sbin/httpd -k start 3082933 506832 nobody 16980 0.1 S 00:37 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 551830 | root | 108-1481181613 | Execute | 0 | Sending data | SELECT DISTINCT subtype FROM uploads WHERE status = 1 AND type = 'User Upload' AND subtype <> '' ORDER BY subtype | | 551829 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 551817 | root | 108-1481181613 | Execute | 0 | Sending data | select quotes.*, IF(jobInventory.qty_orig = '0', SUM(jobInventory.qty*jobInventory.price), SUM(jobInventory.qty_orig*jobInventory.price)) as jobvalue FROM quotes,jobInventory WHERE jobInventory.quoteid=quotes.id AND quotes.jobid= ? AND jobInventory.status='1' AND | +--------+------+----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 629 cosgrovecreative/cosgrovecreative.com.au-ssl_log 167 coscom/coscom.com.au-ssl_log 124 customc/customcentral.com.au-ssl_log 89 evolution/portal.evolutionerp.com.au-ssl_log 89 bigdeals/bigdeals.com.au-ssl_log 18 madalice/madalice.com.au-ssl_log 6 aaa/aaadownunder.com.au-ssl_log 5 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 430 203.54.180.238 380 34.131.110.118 105 103.104.165.99 74 103.104.164.114 45 182.239.240.254 41 116.91.221.245 18 34.166.131.150 18 180.181.236.49 3 203.166.236.147 2 165.225.233.89 2 114.119.131.88 2 101.166.96.210 1 52.167.144.221 1 2a02:598:64:8a00::302:541 1 207.46.13.102 --- top request paths across all vhosts (last 3 min) --- 193 POST /functions.php 153 GET /app/ajax.php 78 GET /heartbeat.php 73 GET /index.php 44 POST /plugins/csvexporter/plugin.php 27 POST /quoteditsave.php 23 POST /app/ajax/selectFilterSingle.php 21 POST /app/ajax.php 19 POST /clienteditsave.php 14 POST /app/ajax/selectFilter.php 11 POST /purchaseaddsave.php 11 POST /jobeditsave.php 9 POST /plugins/fencecosting/plugin.php 9 POST /logsave.php 6 POST /php-cgi/php-cgi 6 POST /cgi/php-cgi 6 POST /cgi/php 6 POST /cgi-bin/php8.exe 6 POST /cgi-bin/php8 6 POST /cgi-bin/php5 --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 193 POST /functions.php 153 GET /app/ajax.php 68 GET /index.php 44 POST /plugins/csvexporter/plugin.php 27 POST /quoteditsave.php 23 POST /app/ajax/selectFilterSingle.php 21 POST /app/ajax.php 19 POST /clienteditsave.php 14 POST /app/ajax/selectFilter.php 11 POST /purchaseaddsave.php 11 POST /jobeditsave.php 9 POST /plugins/fencecosting/plugin.php -- last 10 requests -- 203.54.180.238 - - [08/Sep/2026:08:20:37 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=&cursel=&curseltext=&fromMS=1&&nolimit=LIMIT%2050&include=&supplierid=19832&contactid=19832&tid=%25%25&returnobj=item 203.54.180.238 - - [08/Sep/2026:08:20:40 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29405&tab=purchasetab" "Mozilla/5.0 (Windows NT 10.0; Win64 203.54.180.238 - - [08/Sep/2026:08:20:39 +1000] "POST /clienteditsave.php?clientid=15433&call=getCategoryDiscounts HTTP/1.1" 200 618 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29405&tab=purchasetab" "Mozil 203.54.180.238 - - [08/Sep/2026:08:20:37 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=18777183565 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 203.54.180.238 - - [08/Sep/2026:08:20:38 +1000] "POST /logsave.php?call=getHistory&id=29405&module=job HTTP/1.1" 200 1558 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29405&tab=purchasetab" "Mozilla/5.0 (Win 203.54.180.238 - - [08/Sep/2026:08:20:39 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29405&tab=purchasetab" "Mozilla/5.0 (Windows NT 10.0; 203.54.180.238 - - [08/Sep/2026:08:20:40 +1000] "GET /app/ajax.php?cn=&furi=true&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=17463710051 HTTP/1.1" 200 201 "https://my.evolutionerp.com.au/index.php?page=jobedit&id 203.54.180.238 - - [08/Sep/2026:08:20:40 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Djobedit%26id%3D29405%26tab%3Dpurchasetab&call=getUserSetting&caller=ajaxSubmitLocal&seq=19777449244 HTTP/1.1" 203.54.180.238 - - [08/Sep/2026:08:20:40 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=16034389540 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 203.54.180.238 - - [08/Sep/2026:08:20:40 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=10534478005 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 1 GET /www/phpinfo.php 1 GET /worker/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /vue/.env 1 GET /vite/.env 1 GET /vendor/.env 1 GET /v3/.env 1 GET /user-panel/.env 1 GET /uploads/.env 1 GET /uat/phpinfo.php 1 GET /uat/.env -- last 10 requests -- 34.131.110.118 - - [08/Sep/2026:08:18:37 +1000] "GET /staging/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:37 +1000] "GET /beta/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:37 +1000] "GET /uat/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:38 +1000] "GET /qa/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:38 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:38 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:38 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:38 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:39 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:39 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == coscom/coscom.com.au-ssl_log == -- top paths -- 1 GET /worker/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /vue/.env 1 GET /vite/.env 1 GET /uat/phpinfo.php 1 GET /uat/.env 1 GET /travis/.env 1 GET /transactional/.env 1 GET /tmp/phpinfo.php 1 GET /tmp/.env 1 GET /test/phpinfo.php -- last 10 requests -- 34.131.110.118 - - [08/Sep/2026:08:18:26 +1000] "GET /webmail/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:27 +1000] "GET /smtp/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:27 +1000] "GET /phpinfo.php.bak HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:27 +1000] "GET /phpinfo.php.old HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:27 +1000] "GET /phpinfo.php~ HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:27 +1000] "GET /info.php.bak HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:28 +1000] "GET /phpinfo.php.save HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:28 +1000] "GET /staging/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:28 +1000] "GET /beta/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.131.110.118 - - [08/Sep/2026:08:18:28 +1000] "GET /uat/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-08 08:18:09 L1=1.58 run=3 blk=1 avail=10325(74.9%) swpO=0 conn=4 myRSS=1309 php=10 phpRSS=388 ap=37 tcp=43 topuser=evolution 2026-09-08 08:18:19 L1=1.57 run=1 blk=1 avail=10338(75.0%) swpO=0 conn=2 myRSS=1309 php=10 phpRSS=375 ap=36 tcp=42 topuser=evolution 2026-09-08 08:18:19 L1=1.57 run=2 blk=1 avail=10337(75.0%) swpO=0 conn=4 myRSS=1309 php=10 phpRSS=375 ap=36 tcp=42 topuser=evolution 2026-09-08 08:18:29 L1=1.48 run=2 blk=1 avail=10308(74.8%) swpO=0 conn=4 myRSS=1309 php=12 phpRSS=472 ap=35 tcp=52 topuser=evolution 2026-09-08 08:18:29 L1=1.48 run=5 blk=1 avail=10306(74.8%) swpO=0 conn=4 myRSS=1309 php=12 phpRSS=472 ap=35 tcp=53 topuser=evolution 2026-09-08 08:18:39 L1=1.72 run=10 blk=1 avail=10170(73.8%) swpO=0 conn=4 myRSS=1309 php=16 phpRSS=693 ap=40 tcp=54 topuser=evolution 2026-09-08 08:18:39 L1=1.72 run=7 blk=1 avail=10169(73.8%) swpO=0 conn=4 myRSS=1309 php=16 phpRSS=693 ap=40 tcp=54 topuser=evolution 2026-09-08 08:18:49 L1=1.83 run=4 blk=1 avail=10224(74.2%) swpO=1 conn=4 myRSS=1309 php=16 phpRSS=609 ap=42 tcp=59 topuser=evolution 2026-09-08 08:18:49 L1=1.83 run=4 blk=1 avail=10223(74.2%) swpO=1 conn=4 myRSS=1309 php=17 phpRSS=620 ap=42 tcp=59 topuser=evolution 2026-09-08 08:19:00 L1=1.86 run=6 blk=1 avail=10026(72.8%) swpO=0 conn=7 myRSS=1309 php=26 phpRSS=1036 ap=48 tcp=57 topuser=evolution 2026-09-08 08:19:00 L1=1.86 run=5 blk=1 avail=10026(72.8%) swpO=0 conn=6 myRSS=1309 php=26 phpRSS=1037 ap=48 tcp=57 topuser=evolution 2026-09-08 08:19:10 L1=2.33 run=3 blk=1 avail=10150(73.7%) swpO=0 conn=6 myRSS=1311 php=16 phpRSS=628 ap=48 tcp=52 topuser=evolution 2026-09-08 08:19:10 L1=2.46 run=3 blk=1 avail=10151(73.7%) swpO=0 conn=3 myRSS=1311 php=16 phpRSS=627 ap=48 tcp=55 topuser=evolution 2026-09-08 08:19:20 L1=2.58 run=1 blk=1 avail=10250(74.4%) swpO=0 conn=6 myRSS=1311 php=14 phpRSS=425 ap=53 tcp=40 topuser=evolution 2026-09-08 08:19:20 L1=2.46 run=1 blk=1 avail=10271(74.6%) swpO=0 conn=3 myRSS=1311 php=13 phpRSS=400 ap=52 tcp=39 topuser=evolution 2026-09-08 08:19:30 L1=2.42 run=4 blk=2 avail=10071(73.1%) swpO=0 conn=2 myRSS=1311 php=15 phpRSS=569 ap=49 tcp=45 topuser=evolution 2026-09-08 08:19:30 L1=2.39 run=3 blk=1 avail=10075(73.1%) swpO=0 conn=3 myRSS=1311 php=16 phpRSS=625 ap=49 tcp=46 topuser=evolution 2026-09-08 08:19:40 L1=2.43 run=6 blk=1 avail=9994 (72.5%) swpO=81 conn=2 myRSS=1308 php=21 phpRSS=806 ap=42 tcp=52 topuser=evolution 2026-09-08 08:19:40 L1=2.56 run=2 blk=1 avail=10015(72.7%) swpO=81 conn=3 myRSS=1308 php=18 phpRSS=699 ap=43 tcp=50 topuser=evolution 2026-09-08 08:19:50 L1=2.60 run=4 blk=1 avail=10036(72.8%) swpO=69 conn=2 myRSS=1305 php=17 phpRSS=708 ap=38 tcp=43 topuser=evolution 2026-09-08 08:19:50 L1=2.63 run=4 blk=1 avail=9968 (72.4%) swpO=69 conn=3 myRSS=1305 php=16 phpRSS=751 ap=38 tcp=47 topuser=evolution 2026-09-08 08:20:00 L1=2.50 run=2 blk=1 avail=10146(73.6%) swpO=0 conn=2 myRSS=1305 php=17 phpRSS=685 ap=36 tcp=41 topuser=evolution 2026-09-08 08:20:00 L1=2.46 run=2 blk=1 avail=10145(73.6%) swpO=0 conn=3 myRSS=1305 php=17 phpRSS=686 ap=36 tcp=42 topuser=evolution 2026-09-08 08:20:10 L1=2.66 run=4 blk=1 avail=10105(73.3%) swpO=0 conn=2 myRSS=1305 php=16 phpRSS=645 ap=44 tcp=43 topuser=evolution 2026-09-08 08:20:10 L1=2.69 run=4 blk=1 avail=10133(73.5%) swpO=0 conn=1 myRSS=1305 php=14 phpRSS=551 ap=44 tcp=44 topuser=evolution 2026-09-08 08:20:20 L1=2.71 run=1 blk=1 avail=10156(73.7%) swpO=0 conn=2 myRSS=1305 php=15 phpRSS=571 ap=43 tcp=41 topuser=evolution 2026-09-08 08:20:21 L1=2.66 run=2 blk=1 avail=10163(73.8%) swpO=0 conn=1 myRSS=1305 php=15 phpRSS=565 ap=43 tcp=41 topuser=evolution 2026-09-08 08:20:30 L1=2.64 run=1 blk=1 avail=10083(73.2%) swpO=0 conn=4 myRSS=1305 php=17 phpRSS=663 ap=44 tcp=49 topuser=evolution 2026-09-08 08:20:31 L1=2.64 run=4 blk=1 avail=10063(73.0%) swpO=0 conn=1 myRSS=1305 php=17 phpRSS=679 ap=44 tcp=50 topuser=evolution 2026-09-08 08:20:40 L1=2.78 run=10 blk=1 avail=10108(73.4%) swpO=39 conn=4 myRSS=1304 php=25 phpRSS=822 ap=46 tcp=51 topuser=evolution