Linux – mod_ntlm for RHEL 5.3

pgpgin      -  Number of kilobytes the system has paged in from disk per second.
pgpgout     -  Number of kilobytes the system has paged out to disk per second.
pswpin      -  Number of kilobytes the system has swapped in from disk per second.
pswpout     -  Number of kilobytes the system has swapped out to disk per second.

I am 87% sure, that each page that increased pswpin counter should also increase pgpgin. You say it isn't . Hmmm.

This may be too simplistic thing to check (sorry!) but... Are you 200% sure, that the metric you observe is pswpin, not pgpgin? The later would translate to: process is reading some files.

EDIT: This might be ESX-related. My wild guess that it is a side effect of either balooning or transparent page sharing (TPS). Are you able to analyze via esxtop on the ESX? Here is another esxtop guide.

EDIT: Your nmon stats seem broken. First of all, there are more column names than actual metrics (i.e. you don't have data for last column pgscan_direct_dma). There are a lot -1 or 0 values on metrics that should be there on a busy system, not only pgpgin is missing. Pgsteal and pgrotated are there, but sometimes negative, which is not possible.

So, look at /proc/vmstat, what's going on there? And use other tools to confirm nmon stats.

Try Match in sshd_config:

Match User user1,user2,user3,user4
    PasswordAuthentication no

Or by group:

Match Group users
    PasswordAuthentication no

Or, as mentioned in the comment, by negation:

Match User !root
    PasswordAuthentication no

Note that match is effective "until either another Match line or the end of the file." (the indentation isn't significant)