INCIDENT 2026-08-18 15:34:46 trigger: php_procs=26 ================================================================== load: 3.86 4.77 4.12 3/706 1680144 ncpu:10 mem_avail: 6379MB/11729MB (54.4%) swap_used:2719MB swapout:0/s blocked(D):0 running:3 iowait:0.0% steal:0.0% php: 26 procs / 1173MB heaviest user: evolution (26 procs, 1173MB) apache: 57 procs tcp_estab: 45 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2245 evolution 29 1122 nobody 56 873 root 236 716 netdata 8 261 cpanellogin 1 107 kurri 9 105 aaa 4 47 dovenull 6 26 wp-toolkit 6 18 zabbix 1 14 alison 1 13 mailman 20 12 nscd 1 7 mailnull 1 7 dovecot 3 7 named 1 6 dbus 1 2 cpanelconnecttrack 1 2 polkitd 1 1 --- php workers by user --- USER PROCS RSS_MB evolution 25 1108 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5335 MB Active(file): 4493 MB Inactive(file): 1020 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 343 MB CommitLimit: 9960 MB Committed_AS: 10882 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 955450 root 14:23:30 1080 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2299652 10.5 Ssl 3-07:44:09 /usr/sbin/mariadbd 1220 1 netdata 201784 2.5 Ssl 50-05:24:51 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1000361 998750 root 153328 0.0 S 13:09:57 spamd child 1638383 1353308 cpanellogin 110356 0.0 S 43:37 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 2575382 1 root 94492 0.0 Ss 3-07:44:12 /usr/lib/systemd/systemd-journald 998750 1 root 90152 0.0 Ss 13:12:02 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1578009 998750 root 87776 0.0 S 01:52:18 spamd child 1658731 1658711 evolution 59092 0.6 S 20:38 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1658820 1658284 evolution 59088 0.6 S 20:31 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1660119 1660117 evolution 57796 0.6 S 19:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1661971 1661923 evolution 56068 0.5 S 17:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1662694 1662154 evolution 55792 0.5 S 16:40 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1666918 1666256 evolution 54048 0.5 S 12:12 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669958 1669681 evolution 43228 0.0 S 09:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669957 1669680 evolution 43184 0.0 S 09:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663347 1663338 evolution 43156 0.0 S 16:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663808 1663363 evolution 43084 0.0 S 15:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663804 1663711 evolution 43072 0.0 S 15:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663661 1663314 evolution 43012 0.0 S 15:34 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663613 1658938 evolution 42996 0.0 S 15:40 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663197 1662151 evolution 42984 0.0 S 16:11 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663383 1663357 evolution 42956 0.0 S 16:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669525 1669080 evolution 42916 0.0 S 09:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669524 1669082 evolution 42808 0.0 S 09:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669526 1669065 evolution 42756 0.0 S 09:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 42212 0.0 Ss 27-12:53:21 cpsrvd (SSL) - waiting for connections 4922 2431 netdata 41064 0.1 Sl 50-05:24:46 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2223 1201 root 40372 0.0 Sl 50-05:24:50 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1664109 1663969 evolution 39712 0.0 S 14:50 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663166 1661359 evolution 39700 0.0 S 16:16 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663645 1663336 evolution 39700 0.0 S 15:37 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663658 1661021 evolution 39672 0.0 S 15:34 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665393 1663680 evolution 39612 0.0 S 13:54 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665409 1664796 evolution 39592 0.0 S 13:52 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663678 1662119 evolution 39196 0.0 S 15:32 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1680137 1353308 root 32216 0.0 S 00:00 webmaild - serving 167.94.146.62 1469 1 root 26048 0.1 Ss 50-05:24:50 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1466 1 root 25756 0.0 Ss 50-05:24:50 dnsadmin - server mode 1676748 1276780 nobody 21264 0.0 S 03:24 /usr/sbin/httpd -k start 1673331 1276780 nobody 20956 0.0 S 06:07 /usr/sbin/httpd -k start 1679362 1276780 nobody 20636 0.0 S 00:52 /usr/sbin/httpd -k start 1674483 1276780 nobody 20364 0.0 S 05:08 /usr/sbin/httpd -k start 1679000 1276780 nobody 19944 0.1 S 01:09 /usr/sbin/httpd -k start 1677951 1276780 nobody 19916 0.1 S 02:09 /usr/sbin/httpd -k start 998083 1 root 19860 0.0 Ss 13:12:35 lfd - sleeping 1679008 1276780 nobody 19292 0.1 S 01:08 /usr/sbin/httpd -k start 1661021 1276780 nobody 19236 0.0 S 18:30 /usr/sbin/httpd -k start 1677581 1276780 nobody 18932 0.0 S 02:42 /usr/sbin/httpd -k start 1658938 1276780 nobody 18884 0.0 S 20:25 /usr/sbin/httpd -k start 1679760 1276780 nobody 18860 0.1 S 00:28 /usr/sbin/httpd -k start 1679330 1276780 nobody 18644 0.0 S 00:55 /usr/sbin/httpd -k start 1677595 1276780 nobody 18268 0.1 S 02:41 /usr/sbin/httpd -k start 1663680 1276780 nobody 18116 0.0 S 15:31 /usr/sbin/httpd -k start 1662151 1276780 nobody 17908 0.0 S 17:05 /usr/sbin/httpd -k start 1679339 1276780 nobody 17864 0.0 S 00:54 /usr/sbin/httpd -k start 1679360 1276780 nobody 17864 0.0 S 00:52 /usr/sbin/httpd -k start 1669080 1276780 nobody 17820 0.0 S 09:52 /usr/sbin/httpd -k start 1679363 1276780 nobody 17656 0.0 S 00:52 /usr/sbin/httpd -k start 1680040 1276780 nobody 17216 0.1 S 00:07 /usr/sbin/httpd -k start 1463 1 root 16936 0.0 Ss 50-05:24:50 tailwatchd --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9479190 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 9479189 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9479188 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9479186 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9479187 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9479181 | root | 85-1525752154 | Execute | 0 | Sending data | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9479180 | root | 85-1525752154 | Execute | 0 | Sending data | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | +---------+------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9479189 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9479188 | 85-1525752154 | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadd | | 9479186 | 85-1525752154 | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadd | | 9479187 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 490 vinesit/vinesit.com.au-ssl_log 96 evolution/portal.evolutionerp.com.au-ssl_log 57 madalice/madalice.com.au-ssl_log 10 corpkicks/corporatekicks.com.au 4 tubesupplies/tubesupplies.com.au-ssl_log 1 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 259 203.54.180.238 96 20.52.168.85 69 101.166.96.210 47 103.104.165.99 35 180.181.236.49 29 182.239.240.254 24 116.91.221.198 21 103.104.164.114 18 116.91.223.246 16 203.214.146.60 16 147.161.213.78 4 192.168.0.2 4 115.128.106.35 4 101.182.108.127 2 40.77.167.28 --- top request paths across all vhosts (last 3 min) --- 181 POST /functions.php 92 GET /app/ajax.php 53 GET /index.php 44 GET /heartbeat.php 28 POST /quoteditsave.php 28 POST /plugins/csvexporter/plugin.php 18 POST /app/ajax/selectFilterSingle.php 17 POST /app/ajax.php 9 POST /clienteditsave.php 8 GET //app/ajax.php 7 POST /app/ajax/selectFilter.php 6 POST /plugins/fencecosting/plugin.php 6 POST /jobeditsave.php 6 POST /inveditsave.php 6 POST //functions.php 6 GET /store/custom-monogram-shoes/ 5 POST /mfreqsave.php 5 GET /plugins/fensa/fensa-ajax.php 3 POST /purchaseaddsave.php 3 POST //purchaseaddsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 181 POST /functions.php 92 GET /app/ajax.php 41 GET /index.php 28 POST /quoteditsave.php 28 POST /plugins/csvexporter/plugin.php 18 POST /app/ajax/selectFilterSingle.php 17 POST /app/ajax.php 9 POST /clienteditsave.php 8 GET //app/ajax.php 7 POST /app/ajax/selectFilter.php 6 POST /plugins/fencecosting/plugin.php 6 POST /jobeditsave.php -- last 10 requests -- 203.214.146.60 - - [18/Aug/2026:15:34:43 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=10251676562 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 203.214.146.60 - - [18/Aug/2026:15:34:43 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=13517305329 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 203.214.146.60 - - [18/Aug/2026:15:34:44 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dquotedit%26quoteid%3D2282%26sectionid%3D447&call=getUserSetting&caller=ajaxSubmitLocal&seq=19275386213 HTTP/1. 203.214.146.60 - - [18/Aug/2026:15:34:44 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotedit%26quoteid2282&call=getUserSetting&caller=ajaxSubmitLocal&seq=11384247156 HTTP/1.1" 200 99 "https://my.evolutionerp.com. 203.214.146.60 - - [18/Aug/2026:15:34:44 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotedit%26quoteid%3D2282%26sectionid%3D447&call=getUserSetting&caller=ajaxSubmitLocal&seq=19389919129 HTTP/1.1" 200 111 "https: 203.214.146.60 - - [18/Aug/2026:15:34:45 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2282§ionid=447" "Mozilla/5.0 (Windows NT 10.0; Win 101.166.96.210 - - [18/Aug/2026:15:34:45 +1000] "POST /quoteditsave.php?itemid=7572&call=plugins HTTP/1.1" 200 43 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36772§ionid=0" "Mozilla/5.0 (Windows N 101.166.96.210 - - [18/Aug/2026:15:34:45 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36772§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 101.166.96.210 - - [18/Aug/2026:15:34:45 +1000] "POST /itemModify.php?call=getInvMFMeta&modifyid=7572 HTTP/1.1" 200 49 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36772§ionid=0" "Mozilla/5.0 (Wind 101.166.96.210 - - [18/Aug/2026:15:34:45 +1000] "POST /quoteditsave.php?call=checkForBOMAlternates&id=7572 HTTP/1.1" 200 39 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36772§ionid=0" "Mozilla/5.0 == vinesit/vinesit.com.au-ssl_log == -- top paths -- 1 GET /x.php 1 GET /xmlrpc.php0 1 GET /wp_wol.php 1 GET /wp-includes/wp-class.php 1 GET /wp-includes/rest-api/fields/ 1 GET /wp-includes/js/codemirror/about.php 1 GET /wp-includes/interactivity-api/index.php 1 GET /wp-includes/ID3/ 1 GET /wp-includes/css/dist/widgets/ 1 GET /wp-includes/certificates/ 1 GET /wp-includes/blocks/about.php 1 GET /wp-includes/block-bindings/ -- last 10 requests -- 20.52.168.85 - - [18/Aug/2026:15:34:37 +1000] "GET /MYK4TJEfFvO.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.168.85 - - [18/Aug/2026:15:34:37 +1000] "GET /Casper.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.168.85 - - [18/Aug/2026:15:34:37 +1000] "GET /beence.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.168.85 - - [18/Aug/2026:15:34:38 +1000] "GET /configs.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.168.85 - - [18/Aug/2026:15:34:38 +1000] "GET /delpaths.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.168.85 - - [18/Aug/2026:15:34:38 +1000] "GET /NewFile.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.168.85 - - [18/Aug/2026:15:34:39 +1000] "GET /system.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.168.85 - - [18/Aug/2026:15:34:39 +1000] "GET /IDhrIlrLb.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.168.85 - - [18/Aug/2026:15:34:39 +1000] "GET /cJLGqzB.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 20.52.168.85 - - [18/Aug/2026:15:34:40 +1000] "GET /akc.php HTTP/1.1" 404 3417 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 44 GET /heartbeat.php 12 GET /index.php 1 PATCH /api/pickings.php -- last 10 requests -- 203.54.180.238 - - [18/Aug/2026:15:34:08 +1000] "GET /heartbeat.php?sentAt=1787031246&bytes=106,131,238,206&_=1787030704936 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [18/Aug/2026:15:34:12 +1000] "GET /index.php?page=inventory_picking_goods&pickid=37731&seq=9747563200215 HTTP/1.1" 200 14128 "https://www.portal.evolutionerp.com.au/index.php?page=inventory_picking" "M 203.54.180.238 - - [18/Aug/2026:15:34:13 +1000] "GET /heartbeat.php?sentAt=1787031253&bytes=106,131,238,213&_=1787029289255 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [18/Aug/2026:15:34:15 +1000] "GET /heartbeat.php?sentAt=1787031255&bytes=106,131,238,215&_=1787027050484 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [18/Aug/2026:15:34:16 +1000] "GET /index.php?page=inventory_picking_goods&pickid=37731&seq=9747563200215 HTTP/1.1" 200 14157 "https://www.portal.evolutionerp.com.au/index.php?page=inventory_picking" "M 203.54.180.238 - - [18/Aug/2026:15:34:18 +1000] "GET /index.php?page=inventory_picking_goods&pickid=37731&seq=9747563200215 HTTP/1.1" 200 14154 "https://www.portal.evolutionerp.com.au/index.php?page=inventory_picking_goo 203.54.180.238 - - [18/Aug/2026:15:34:18 +1000] "GET /heartbeat.php?sentAt=1787031256&bytes=106,131,238,216&_=1787030704937 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [18/Aug/2026:15:34:21 +1000] "PATCH /api/pickings.php HTTP/1.1" 200 53 "https://www.portal.evolutionerp.com.au/index.php?page=inventory_picking_goods&pickid=37731&seq=9747563200215" "Mozilla/5.0 (Windo 203.54.180.238 - - [18/Aug/2026:15:34:23 +1000] "GET /heartbeat.php?sentAt=1787031263&bytes=106,131,238,223&_=1787029289256 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [18/Aug/2026:15:34:25 +1000] "GET /heartbeat.php?sentAt=1787031265&bytes=106,131,238,225&_=1787027050485 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 --- last 30 samples (run-up to this incident) --- 2026-08-18 15:32:25 L1=5.19 run=6 blk=0 avail=6371 (54.3%) swpO=0 conn=8 myRSS=2244 php=26 phpRSS=1174 ap=52 tcp=42 topuser=evolution 2026-08-18 15:32:25 L1=5.09 run=4 blk=0 avail=6371 (54.3%) swpO=0 conn=8 myRSS=2244 php=26 phpRSS=1174 ap=52 tcp=42 topuser=evolution 2026-08-18 15:32:35 L1=5.13 run=6 blk=0 avail=6397 (54.5%) swpO=1 conn=8 myRSS=2244 php=29 phpRSS=1285 ap=55 tcp=50 topuser=evolution 2026-08-18 15:32:35 L1=5.13 run=5 blk=0 avail=6395 (54.5%) swpO=1 conn=9 myRSS=2244 php=28 phpRSS=1252 ap=55 tcp=50 topuser=evolution 2026-08-18 15:32:45 L1=5.48 run=12 blk=0 avail=6365 (54.3%) swpO=0 conn=7 myRSS=2244 php=25 phpRSS=1108 ap=67 tcp=50 topuser=evolution 2026-08-18 15:32:45 L1=5.48 run=8 blk=0 avail=6360 (54.2%) swpO=0 conn=8 myRSS=2244 php=26 phpRSS=1148 ap=67 tcp=49 topuser=evolution 2026-08-18 15:32:55 L1=5.33 run=3 blk=0 avail=6402 (54.6%) swpO=0 conn=8 myRSS=2244 php=26 phpRSS=1148 ap=60 tcp=45 topuser=evolution 2026-08-18 15:32:55 L1=5.33 run=4 blk=0 avail=6401 (54.6%) swpO=0 conn=8 myRSS=2244 php=26 phpRSS=1148 ap=60 tcp=45 topuser=evolution 2026-08-18 15:33:05 L1=5.13 run=6 blk=0 avail=5960 (50.8%) swpO=0 conn=11 myRSS=2244 php=32 phpRSS=1782 ap=56 tcp=51 topuser=evolution 2026-08-18 15:33:05 L1=5.13 run=13 blk=0 avail=5873 (50.1%) swpO=0 conn=10 myRSS=2244 php=33 phpRSS=1898 ap=56 tcp=50 topuser=evolution 2026-08-18 15:33:15 L1=4.89 run=7 blk=0 avail=6372 (54.3%) swpO=0 conn=9 myRSS=2244 php=27 phpRSS=1217 ap=58 tcp=34 topuser=evolution 2026-08-18 15:33:15 L1=4.89 run=6 blk=0 avail=6365 (54.3%) swpO=0 conn=9 myRSS=2244 php=27 phpRSS=1218 ap=58 tcp=34 topuser=evolution 2026-08-18 15:33:25 L1=4.43 run=6 blk=0 avail=6429 (54.8%) swpO=0 conn=8 myRSS=2244 php=26 phpRSS=1148 ap=55 tcp=42 topuser=evolution 2026-08-18 15:33:26 L1=4.43 run=8 blk=0 avail=6427 (54.8%) swpO=0 conn=8 myRSS=2244 php=26 phpRSS=1148 ap=55 tcp=42 topuser=evolution 2026-08-18 15:33:35 L1=5.02 run=4 blk=0 avail=6489 (55.3%) swpO=0 conn=8 myRSS=2244 php=26 phpRSS=1148 ap=47 tcp=40 topuser=evolution 2026-08-18 15:33:36 L1=5.02 run=3 blk=0 avail=6489 (55.3%) swpO=0 conn=8 myRSS=2244 php=26 phpRSS=1148 ap=47 tcp=41 topuser=evolution 2026-08-18 15:33:45 L1=4.62 run=3 blk=0 avail=6471 (55.2%) swpO=1 conn=8 myRSS=2244 php=26 phpRSS=1148 ap=53 tcp=34 topuser=evolution 2026-08-18 15:33:46 L1=4.62 run=6 blk=0 avail=6465 (55.1%) swpO=1 conn=8 myRSS=2244 php=26 phpRSS=1148 ap=53 tcp=34 topuser=evolution 2026-08-18 15:33:56 L1=4.45 run=2 blk=0 avail=6378 (54.4%) swpO=0 conn=8 myRSS=2244 php=26 phpRSS=1148 ap=64 tcp=52 topuser=evolution 2026-08-18 15:33:56 L1=4.45 run=6 blk=0 avail=6372 (54.3%) swpO=0 conn=8 myRSS=2244 php=26 phpRSS=1148 ap=64 tcp=52 topuser=evolution 2026-08-18 15:34:06 L1=4.64 run=6 blk=0 avail=6362 (54.2%) swpO=0 conn=9 myRSS=2244 php=28 phpRSS=1259 ap=59 tcp=43 topuser=evolution 2026-08-18 15:34:06 L1=4.64 run=6 blk=0 avail=6361 (54.2%) swpO=0 conn=8 myRSS=2244 php=28 phpRSS=1259 ap=59 tcp=43 topuser=evolution 2026-08-18 15:34:16 L1=4.82 run=6 blk=0 avail=6428 (54.8%) swpO=0 conn=7 myRSS=2244 php=25 phpRSS=1108 ap=57 tcp=49 topuser=evolution 2026-08-18 15:34:16 L1=4.82 run=3 blk=0 avail=6429 (54.8%) swpO=0 conn=7 myRSS=2244 php=25 phpRSS=1108 ap=57 tcp=49 topuser=evolution 2026-08-18 15:34:26 L1=4.62 run=4 blk=0 avail=6398 (54.6%) swpO=0 conn=7 myRSS=2245 php=25 phpRSS=1108 ap=61 tcp=53 topuser=evolution 2026-08-18 15:34:26 L1=4.62 run=11 blk=0 avail=6398 (54.5%) swpO=0 conn=7 myRSS=2245 php=25 phpRSS=1108 ap=61 tcp=53 topuser=evolution 2026-08-18 15:34:36 L1=4.28 run=3 blk=0 avail=6427 (54.8%) swpO=0 conn=8 myRSS=2245 php=25 phpRSS=1108 ap=56 tcp=35 topuser=evolution 2026-08-18 15:34:36 L1=4.28 run=3 blk=0 avail=6428 (54.8%) swpO=0 conn=7 myRSS=2245 php=25 phpRSS=1108 ap=56 tcp=35 topuser=evolution 2026-08-18 15:34:46 L1=3.86 run=3 blk=0 avail=6379 (54.4%) swpO=0 conn=7 myRSS=2245 php=26 phpRSS=1173 ap=57 tcp=45 topuser=evolution 2026-08-18 15:34:46 L1=3.86 run=5 blk=0 avail=6385 (54.4%) swpO=0 conn=7 myRSS=2245 php=26 phpRSS=1166 ap=57 tcp=45 topuser=evolution