INCIDENT 2026-08-18 15:38:49 trigger: php_procs=31 php_rss=1677MB ================================================================== load: 7.28 5.71 4.61 8/731 1684697 ncpu:10 mem_avail: 5914MB/11729MB (50.4%) swap_used:2720MB swapout:2/s blocked(D):0 running:8 iowait:0.1% steal:0.0% php: 31 procs / 1677MB heaviest user: evolution (29 procs, 1386MB) apache: 77 procs tcp_estab: 47 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2244 evolution 33 1405 nobody 76 1163 root 236 695 netdata 8 261 customc 1 181 madalice 1 124 cpanellogin 1 107 kurri 6 70 aaa 3 37 dovenull 6 26 wp-toolkit 6 18 zabbix 1 15 mailnull 2 15 alison 1 13 vinesit 1 12 mailman 20 12 nscd 1 7 dovecot 3 7 named 1 6 --- php workers by user --- USER PROCS RSS_MB evolution 29 1394 customc 1 182 madalice 1 127 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5331 MB Active(file): 4520 MB Inactive(file): 915 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 345 MB CommitLimit: 9960 MB Committed_AS: 12005 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 955450 root 14:27:33 1080 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2298400 10.7 Ssl 3-07:48:12 /usr/sbin/mariadbd 1220 1 netdata 203092 2.5 Ssl 50-05:28:54 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1684662 1679359 evolution 178096 95.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1000361 998750 root 153328 0.0 S 13:14:00 spamd child 1684658 1679347 madalice 137436 116 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1638383 1353308 cpanellogin 110356 0.0 S 47:40 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 2575382 1 root 95472 0.0 Ss 3-07:48:15 /usr/lib/systemd/systemd-journald 998750 1 root 90152 0.0 Ss 13:16:05 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1578009 998750 root 87776 0.0 S 01:56:21 spamd child 1658731 1658711 evolution 59092 0.6 S 24:41 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1658820 1658284 evolution 59088 0.6 S 24:34 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1660119 1660117 evolution 57796 0.5 S 23:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1661971 1661923 evolution 56068 0.5 S 21:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1662694 1662154 evolution 55792 0.5 R 20:43 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1666918 1666256 evolution 54284 0.5 R 16:15 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669958 1669681 evolution 43228 0.0 S 13:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669957 1669680 evolution 43184 0.0 S 13:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663347 1663338 evolution 43156 0.0 S 20:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663808 1663363 evolution 43084 0.0 S 19:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663804 1663711 evolution 43072 0.0 S 19:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663661 1663314 evolution 43012 0.0 S 19:37 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663613 1658938 evolution 42996 0.0 S 19:43 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663197 1662151 evolution 42984 0.0 S 20:14 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663383 1663357 evolution 42956 0.0 S 20:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669525 1669080 evolution 42916 0.0 S 13:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669524 1669082 evolution 42808 0.0 S 13:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1669526 1669065 evolution 42756 0.0 S 13:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 42212 0.0 Ss 27-12:57:24 cpsrvd (SSL) - waiting for connections 2223 1201 root 40368 0.0 Sl 50-05:28:53 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 40216 0.1 Sl 50-05:28:49 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1664109 1663969 evolution 39712 0.0 S 18:53 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663166 1661359 evolution 39700 0.0 S 20:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663645 1663336 evolution 39700 0.0 S 19:40 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1681817 1681474 evolution 39700 0.0 S 02:38 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663658 1661021 evolution 39672 0.0 S 19:37 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1681816 1681475 evolution 39660 0.0 S 02:38 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1681565 1680067 evolution 39620 0.0 S 02:51 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665393 1663680 evolution 39612 0.0 S 17:57 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1665409 1664796 evolution 39592 0.0 S 17:55 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1663678 1662119 evolution 39196 0.0 S 19:35 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1684659 1353308 root 37864 0.0 S 00:01 whostmgrd - serving 1.144.107.82 1469 1 root 26016 0.1 Ss 50-05:28:53 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 998083 1 root 19872 0.0 Ss 13:16:38 lfd - sleeping 1679347 1276780 nobody 19812 0.2 S 04:56 /usr/sbin/httpd -k start 1683042 1276780 nobody 19788 0.1 S 01:10 /usr/sbin/httpd -k start 1681477 1276780 nobody 19504 0.0 S 02:54 /usr/sbin/httpd -k start 1681767 1276780 nobody 19432 0.0 S 02:41 /usr/sbin/httpd -k start 1661021 1276780 nobody 19236 0.0 S 22:33 /usr/sbin/httpd -k start 1679009 1276780 nobody 19228 0.0 S 05:11 /usr/sbin/httpd -k start 1658938 1276780 nobody 18884 0.0 S 24:28 /usr/sbin/httpd -k start 1683754 1276780 nobody 18876 0.0 S 00:52 /usr/sbin/httpd -k start 1683737 1276780 nobody 18768 0.2 S 00:53 /usr/sbin/httpd -k start 1679340 1276780 nobody 18632 0.0 S 04:57 /usr/sbin/httpd -k start 1681670 1276780 nobody 18448 0.0 S 02:43 /usr/sbin/httpd -k start 1683717 1276780 nobody 18184 0.1 S 00:55 /usr/sbin/httpd -k start 1663680 1276780 nobody 18116 0.0 S 19:34 /usr/sbin/httpd -k start 1681764 1276780 nobody 18044 0.0 S 02:41 /usr/sbin/httpd -k start 1683747 1276780 nobody 17984 0.1 S 00:52 /usr/sbin/httpd -k start 1662151 1276780 nobody 17908 0.0 S 21:08 /usr/sbin/httpd -k start 1682824 1276780 nobody 17848 0.5 S 01:26 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+----------------------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+----------------------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9543404 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 9543403 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9543402 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9543401 | root | 85-1525752154 | Execute | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9543400 | root | 85-1525752154 | Execute | 0 | Sending data | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9543398 | root | 85-1525752154 | Execute | 0 | Sending data | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadded)) AS cid FROM jobs WHERE id = ? | | 9543396 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+----------------------+---------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9543409 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9543408 | 85-1525752154 | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadd | | 9543407 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9543405 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9543404 | 85-1525752154 | 0 | Waiting for table level lock | UPDATE jobs SET jobcode = ? WHERE id = ? | | 9543402 | 85-1525752154 | 0 | Waiting for table level lock | SELECT id, dateadded, month(dateadded) AS mm, year(dateadded) AS yy, (SELECT min(id) FROM jobs x WHERE x.id < ? AND month(x.dateadded) = month(jobs.dateadded) AND year(x.dateadded) = year(jobs.dateadd | +---------+---------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 407 customc/customcentral.com.au-ssl_log 67 madalice/madalice.com.au-ssl_log 51 evolution/portal.evolutionerp.com.au-ssl_log 47 lowrange/lowrange.com.au-ssl_log 42 evolution/evolutionerp.com.au-ssl_log 39 customc/customcentral.com.au 25 whiz/whizengineering.com.au 19 speedlin/speedlinefencing.com.au 17 speedlin/speedlinefencing.com.au-ssl_log 17 vinesit/vinesit.com.au-ssl_log 17 bigdeals/bigdeals.com.au-ssl_log 16 aaa/aaadownunder.com.au-ssl_log 7 vinesit/vinesit.com.au 6 alison/alisonarts.com.au-ssl_log 2 (total vhosts taking traffic: 18) --- top client IPs across all vhosts (last 3 min) --- 175 203.54.180.238 80 20.104.100.201 80 180.181.236.49 73 103.104.164.114 52 20.24.67.246 40 20.97.182.130 38 172.161.79.158 34 20.226.56.190 34 101.166.96.210 20 144.217.135.171 18 101.182.108.127 17 20.25.139.174 16 147.161.213.78 16 139.28.219.70 14 203.214.146.60 --- top request paths across all vhosts (last 3 min) --- 162 POST /functions.php 59 GET /app/ajax.php 42 GET /heartbeat.php 34 POST /app/ajax/selectFilter.php 31 GET /index.php 28 POST /quoteditsave.php 23 POST /app/ajax.php 21 GET / 12 POST /itemModify.php 11 POST /plugins/csvexporter/plugin.php 10 POST /clienteditsave.php 9 POST /app/ajax/selectFilterSingle.php 6 POST /wp-cron.php 6 POST /jobeditsave.php 6 POST //functions.php 5 GET /store/custom-melbourne-storm-shoes-design2/ 5 GET /robots.txt 5 GET /aa.php 4 GET /plugins/fensa/fensa-ajax.php 4 GET /img.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 162 POST /functions.php 59 GET /app/ajax.php 34 POST /app/ajax/selectFilter.php 28 POST /quoteditsave.php 27 GET /index.php 23 POST /app/ajax.php 12 POST /itemModify.php 11 POST /plugins/csvexporter/plugin.php 10 POST /clienteditsave.php 9 POST /app/ajax/selectFilterSingle.php 6 POST /jobeditsave.php 6 POST //functions.php -- last 10 requests -- 180.181.236.49 - - [18/Aug/2026:15:38:43 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=6738" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 203.54.180.238 - - [18/Aug/2026:15:38:43 +1000] "POST /quoteditsave.php?call=loadConfigureModal&id=4198&code=FREIGHT&client=12257 HTTP/1.1" 200 1146 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78520&s 203.214.146.60 - - [18/Aug/2026:15:38:43 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2282§ionid=447" "Mozilla/5.0 (Windows NT 10.0; Wi 203.214.146.60 - - [18/Aug/2026:15:38:43 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=12351903208 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 203.214.146.60 - - [18/Aug/2026:15:38:43 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=18748870177 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 203.214.146.60 - - [18/Aug/2026:15:38:43 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dquotedit%26quoteid%3D2282%26sectionid%3D447&call=getUserSetting&caller=ajaxSubmitLocal&seq=15902393974 HTTP/1. 203.214.146.60 - - [18/Aug/2026:15:38:43 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotedit%26quoteid2282&call=getUserSetting&caller=ajaxSubmitLocal&seq=10176332026 HTTP/1.1" 200 99 "https://my.evolutionerp.com. 203.214.146.60 - - [18/Aug/2026:15:38:44 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotedit%26quoteid%3D2282%26sectionid%3D447&call=getUserSetting&caller=ajaxSubmitLocal&seq=19764099122 HTTP/1.1" 200 171 "https: 203.214.146.60 - - [18/Aug/2026:15:38:45 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2282§ionid=447" "Mozilla/5.0 (Windows NT 10.0; Win 180.181.236.49 - - [18/Aug/2026:15:38:44 +1000] "POST /jobeditsave.php HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=51203" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM == customc/customcentral.com.au-ssl_log == -- top paths -- 3 POST /wp-cron.php 2 GET /k.php 1 GET /wpxml.php 1 GET /wp-login.php 1 GET /wp-load.php 1 GET /wp-includes/Text/Diff/ 1 GET /wp-includes/ID3/index.php 1 GET /wp-includes/fonts/ 1 GET /wp-good.php 1 GET /wp-content/themes/about.php 1 GET /wp-admin/css/colors/midnight/ 1 GET /vendor/ -- last 10 requests -- 172.161.79.158 - - [18/Aug/2026:15:38:11 +1000] "GET /assets/images/doc.php HTTP/1.1" 404 15045 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [18/Aug/2026:15:38:12 +1000] "GET /wp-load.php HTTP/1.1" 200 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [18/Aug/2026:15:38:13 +1000] "GET /r.php HTTP/1.1" 404 15035 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [18/Aug/2026:15:38:15 +1000] "GET /vendor/ HTTP/1.1" 404 15037 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [18/Aug/2026:15:38:16 +1000] "GET /root.php HTTP/1.1" 404 15038 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [18/Aug/2026:15:38:18 +1000] "GET /a1.php HTTP/1.1" 404 15036 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [18/Aug/2026:15:38:19 +1000] "GET /install.php HTTP/1.1" 404 15036 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [18/Aug/2026:15:38:21 +1000] "GET /wp-includes/Text/Diff/ HTTP/1.1" 404 15042 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [18/Aug/2026:15:38:22 +1000] "GET /file2.php HTTP/1.1" 404 15038 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.161.79.158 - - [18/Aug/2026:15:38:24 +1000] "GET //classwithtostring.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == madalice/madalice.com.au-ssl_log == -- top paths -- 5 GET /store/custom-melbourne-storm-shoes-design2/ 2 GET /robots.txt 1 GET /zxz.php 1 GET /zero.php 1 GET /wpxml.php 1 GET /wp-includes/Text/Diff/Engine/file_cdd9.php 1 GET /wp-content/uploads/users.php 1 GET /wp-content/uploads/panel.php 1 GET /wp-content/uploads/file1.php 1 GET /wp-content/options.php 1 GET /wp-content/ms-files.php 1 GET /wp-content/min.php -- last 10 requests -- 20.104.100.201 - - [18/Aug/2026:15:37:41 +1000] "GET /wp-admin/css/ HTTP/1.1" 200 1470 "-" "-" 20.104.100.201 - - [18/Aug/2026:15:37:41 +1000] "GET /epinyins.php HTTP/1.1" 404 30562 "-" "-" 20.104.100.201 - - [18/Aug/2026:15:37:44 +1000] "GET /load.php HTTP/1.1" 404 30562 "-" "-" 20.104.100.201 - - [18/Aug/2026:15:37:47 +1000] "GET /wp-includes/Text/Diff/Engine/file_cdd9.php HTTP/1.1" 404 30583 "-" "-" 20.104.100.201 - - [18/Aug/2026:15:37:50 +1000] "GET /ty.php HTTP/1.1" 404 30560 "-" "-" 20.104.100.201 - - [18/Aug/2026:15:37:53 +1000] "GET /wp-content/uploads/panel.php HTTP/1.1" 403 12 "-" "-" 20.104.100.201 - - [18/Aug/2026:15:37:54 +1000] "GET /dot.php HTTP/1.1" 404 30560 "-" "-" 114.119.130.40 - - [18/Aug/2026:15:37:56 +1000] "GET /store/custom-melbourne-storm-shoes-design2/?verified=1&rating=1&wcpr_rating=3&wcpr_image=1 HTTP/1.1" 404 30587 "https://madalice.com.au/store/custom-melbourne-storm-s 20.104.100.201 - - [18/Aug/2026:15:37:57 +1000] "GET /005.php HTTP/1.1" 404 30560 "-" "-" 92.222.108.105 - - [18/Aug/2026:15:38:00 +1000] "GET /robots.txt HTTP/1.1" 304 - "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" --- last 30 samples (run-up to this incident) --- 2026-08-18 15:36:27 L1=5.37 run=10 blk=0 avail=6148 (52.4%) swpO=1 conn=12 myRSS=2246 php=32 phpRSS=1551 ap=60 tcp=44 topuser=evolution 2026-08-18 15:36:28 L1=5.37 run=6 blk=0 avail=6128 (52.3%) swpO=1 conn=11 myRSS=2246 php=32 phpRSS=1561 ap=60 tcp=43 topuser=evolution 2026-08-18 15:36:38 L1=5.70 run=7 blk=0 avail=6235 (53.2%) swpO=0 conn=10 myRSS=2246 php=31 phpRSS=1460 ap=57 tcp=41 topuser=evolution 2026-08-18 15:36:38 L1=5.70 run=5 blk=0 avail=6225 (53.1%) swpO=0 conn=10 myRSS=2246 php=30 phpRSS=1432 ap=57 tcp=41 topuser=evolution 2026-08-18 15:36:48 L1=5.53 run=7 blk=0 avail=6137 (52.3%) swpO=0 conn=10 myRSS=2246 php=30 phpRSS=1494 ap=63 tcp=38 topuser=evolution 2026-08-18 15:36:48 L1=5.53 run=15 blk=0 avail=6121 (52.2%) swpO=0 conn=10 myRSS=2246 php=30 phpRSS=1511 ap=63 tcp=39 topuser=evolution 2026-08-18 15:36:58 L1=5.36 run=8 blk=0 avail=6134 (52.3%) swpO=0 conn=11 myRSS=2246 php=31 phpRSS=1574 ap=58 tcp=35 topuser=evolution 2026-08-18 15:36:58 L1=5.36 run=9 blk=0 avail=6037 (51.5%) swpO=0 conn=12 myRSS=2246 php=32 phpRSS=1674 ap=58 tcp=38 topuser=evolution 2026-08-18 15:37:08 L1=5.52 run=13 blk=0 avail=6261 (53.4%) swpO=0 conn=12 myRSS=2246 php=32 phpRSS=1476 ap=55 tcp=41 topuser=evolution 2026-08-18 15:37:08 L1=5.52 run=6 blk=0 avail=6250 (53.3%) swpO=0 conn=11 myRSS=2246 php=31 phpRSS=1460 ap=55 tcp=40 topuser=evolution 2026-08-18 15:37:18 L1=5.95 run=4 blk=0 avail=6269 (53.5%) swpO=0 conn=10 myRSS=2247 php=30 phpRSS=1410 ap=54 tcp=40 topuser=evolution 2026-08-18 15:37:18 L1=5.95 run=5 blk=0 avail=6205 (52.9%) swpO=0 conn=11 myRSS=2247 php=31 phpRSS=1507 ap=54 tcp=40 topuser=evolution 2026-08-18 15:37:28 L1=5.94 run=3 blk=0 avail=6160 (52.5%) swpO=0 conn=10 myRSS=2247 php=30 phpRSS=1472 ap=61 tcp=39 topuser=evolution 2026-08-18 15:37:28 L1=5.94 run=5 blk=0 avail=6082 (51.9%) swpO=0 conn=11 myRSS=2247 php=31 phpRSS=1585 ap=61 tcp=37 topuser=evolution 2026-08-18 15:37:38 L1=5.72 run=10 blk=0 avail=6267 (53.4%) swpO=2 conn=10 myRSS=2247 php=31 phpRSS=1458 ap=55 tcp=45 topuser=evolution 2026-08-18 15:37:38 L1=5.72 run=6 blk=0 avail=6232 (53.1%) swpO=2 conn=9 myRSS=2247 php=30 phpRSS=1386 ap=57 tcp=45 topuser=evolution 2026-08-18 15:37:48 L1=5.63 run=5 blk=0 avail=6298 (53.7%) swpO=0 conn=10 myRSS=2247 php=31 phpRSS=1422 ap=58 tcp=41 topuser=evolution 2026-08-18 15:37:49 L1=5.63 run=16 blk=0 avail=6146 (52.4%) swpO=0 conn=11 myRSS=2247 php=34 phpRSS=1667 ap=58 tcp=40 topuser=evolution 2026-08-18 15:37:59 L1=6.31 run=8 blk=0 avail=6094 (52.0%) swpO=0 conn=10 myRSS=2247 php=30 phpRSS=1480 ap=73 tcp=49 topuser=evolution 2026-08-18 15:37:59 L1=6.31 run=7 blk=1 avail=6158 (52.5%) swpO=0 conn=10 myRSS=2247 php=31 phpRSS=1447 ap=73 tcp=45 topuser=evolution 2026-08-18 15:38:09 L1=7.24 run=7 blk=0 avail=6015 (51.3%) swpO=73 conn=11 myRSS=2244 php=33 phpRSS=1626 ap=73 tcp=62 topuser=evolution 2026-08-18 15:38:09 L1=7.24 run=9 blk=0 avail=5841 (49.8%) swpO=73 conn=12 myRSS=2244 php=34 phpRSS=1836 ap=73 tcp=67 topuser=evolution 2026-08-18 15:38:19 L1=7.13 run=15 blk=0 avail=6158 (52.5%) swpO=0 conn=9 myRSS=2244 php=30 phpRSS=1426 ap=68 tcp=41 topuser=evolution 2026-08-18 15:38:19 L1=7.13 run=10 blk=0 avail=6017 (51.3%) swpO=0 conn=10 myRSS=2244 php=31 phpRSS=1632 ap=68 tcp=40 topuser=evolution 2026-08-18 15:38:29 L1=7.02 run=16 blk=0 avail=6191 (52.8%) swpO=54 conn=9 myRSS=2242 php=30 phpRSS=1432 ap=63 tcp=41 topuser=evolution 2026-08-18 15:38:30 L1=7.02 run=6 blk=0 avail=6065 (51.7%) swpO=49 conn=10 myRSS=2242 php=32 phpRSS=1616 ap=63 tcp=41 topuser=evolution 2026-08-18 15:38:39 L1=7.49 run=9 blk=0 avail=5987 (51.0%) swpO=0 conn=10 myRSS=2243 php=33 phpRSS=1733 ap=66 tcp=59 topuser=evolution 2026-08-18 15:38:40 L1=7.49 run=6 blk=0 avail=6245 (53.2%) swpO=0 conn=8 myRSS=2243 php=30 phpRSS=1324 ap=67 tcp=60 topuser=evolution 2026-08-18 15:38:49 L1=7.28 run=8 blk=0 avail=5914 (50.4%) swpO=2 conn=11 myRSS=2244 php=31 phpRSS=1677 ap=77 tcp=47 topuser=evolution 2026-08-18 15:38:50 L1=7.28 run=10 blk=0 avail=6098 (52.0%) swpO=2 conn=9 myRSS=2244 php=30 phpRSS=1462 ap=76 tcp=47 topuser=evolution