INCIDENT 2026-08-21 07:32:52 trigger: php_rss=1725MB mysql_conn=21 ================================================================== load: 1.70 2.31 1.90 3/664 498289 ncpu:10 mem_avail: 5426MB/11729MB (46.3%) swap_used:2882MB swapout:72/s blocked(D):2 running:1 iowait:0.3% steal:0.0% php: 20 procs / 1725MB heaviest user: evolution (20 procs, 1725MB) apache: 36 procs tcp_estab: 55 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2649 evolution 28 1755 root 241 1016 nobody 35 604 netdata 8 266 mailman 20 98 cpanellogin 1 80 mailnull 4 26 dovenull 6 26 wp-toolkit 6 19 named 1 15 zabbix 1 14 kurri 1 10 kamcool 1 10 nscd 1 7 dovecot 3 7 cpanelconnecttrack 1 3 dbus 1 2 polkitd 1 1 rpc 1 0 --- php workers by user --- USER PROCS RSS_MB evolution 20 1725 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4795 MB Active(file): 4570 MB Inactive(file): 481 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 548 MB CommitLimit: 9960 MB Committed_AS: 8281 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 267385 root 06:21:35 8180 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2714680 11.1 Ssl 5-23:42:16 /usr/sbin/mariadbd 1220 1 netdata 214668 2.5 Ssl 52-21:22:58 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 319520 311538 root 203112 0.0 S 04:55:07 spamd child 311538 1 root 174536 0.0 Ss 05:10:06 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 319521 311538 root 166560 0.0 S 04:55:07 spamd child 2575382 1 root 130424 0.0 Ss 5-23:42:19 /usr/lib/systemd/systemd-journald 498251 498122 evolution 121540 43.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 498250 498123 evolution 121248 46.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 498245 497260 evolution 110672 39.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 498248 498027 evolution 101968 32.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 498244 492482 evolution 101296 35.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 498247 497237 evolution 100292 32.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 498240 498145 evolution 98108 31.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 498242 497895 evolution 95980 30.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 498258 495944 evolution 93856 28.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 498256 494757 evolution 93852 29.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 498241 497313 evolution 93388 29.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 498243 496160 evolution 92764 28.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 498255 498130 evolution 83260 22.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 498246 497067 evolution 83256 23.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 405736 1353308 cpanellogin 82664 0.0 S 02:20:42 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 498259 498141 evolution 74064 20.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 498252 497728 evolution 71996 17.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 498254 498140 evolution 71904 18.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 498253 497905 evolution 71700 17.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2223 1201 root 43108 0.0 Sl 52-21:22:57 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 498257 493410 evolution 42804 4.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 498249 498129 evolution 42668 5.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1353308 1 root 41760 0.0 Ss 30-04:51:28 cpsrvd (SSL) - waiting for connections 1469 1 root 38684 0.1 Ss 52-21:22:57 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 33756 0.1 Sl 52-21:22:53 /usr/libexec/netdata/plugins.d/go.d.plugin 1 310731 1 root 30316 0.0 Ss 05:10:38 lfd - sleeping 1463 1 root 25412 0.0 Ss 52-21:22:57 tailwatchd 492482 1276780 nobody 23140 0.1 S 06:29 /usr/sbin/httpd -k start 495944 1276780 nobody 22128 0.1 S 02:50 /usr/sbin/httpd -k start 497237 1276780 nobody 21288 0.0 S 01:23 /usr/sbin/httpd -k start 496160 1276780 nobody 21260 0.0 S 02:40 /usr/sbin/httpd -k start 493410 1276780 nobody 21232 0.0 S 05:17 /usr/sbin/httpd -k start 497074 1276780 nobody 20856 0.0 S 01:33 /usr/sbin/httpd -k start 492613 1276780 nobody 20608 0.0 S 06:21 /usr/sbin/httpd -k start 494757 1276780 nobody 19904 0.0 S 03:48 /usr/sbin/httpd -k start 496665 1276780 nobody 19324 0.0 S 02:09 /usr/sbin/httpd -k start 494777 1276780 nobody 19316 0.0 S 03:47 /usr/sbin/httpd -k start 498122 1276780 nobody 19092 0.0 S 00:12 /usr/sbin/httpd -k start 498123 1276780 nobody 18948 0.0 S 00:12 /usr/sbin/httpd -k start 493060 1276780 nobody 18816 0.0 S 05:45 /usr/sbin/httpd -k start 498139 1276780 nobody 18800 0.0 S 00:10 /usr/sbin/httpd -k start 497073 1276780 nobody 18716 0.0 S 01:33 /usr/sbin/httpd -k start 497312 1276780 nobody 18648 0.0 S 01:20 /usr/sbin/httpd -k start 497895 1276780 nobody 18460 0.0 S 00:34 /usr/sbin/httpd -k start 498132 1276780 nobody 18408 0.0 S 00:11 /usr/sbin/httpd -k start 497313 1276780 nobody 18208 0.0 S 01:20 /usr/sbin/httpd -k start 185104 2431 netdata 18144 2.1 Sl 8-10:59:16 /usr/libexec/netdata/plugins.d/apps.plugin 1 497260 1276780 nobody 17964 0.0 S 01:21 /usr/sbin/httpd -k start 497067 1276780 nobody 17500 0.0 S 01:34 /usr/sbin/httpd -k start 497905 1276780 nobody 17476 0.0 S 00:33 /usr/sbin/httpd -k start 498027 1276780 nobody 17400 0.0 S 00:22 /usr/sbin/httpd -k start 497728 1276780 nobody 17300 0.0 S 00:50 /usr/sbin/httpd -k start 498129 1276780 nobody 16892 0.0 S 00:11 /usr/sbin/httpd -k start 498130 1276780 nobody 16844 0.0 S 00:11 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+--------------------+--------------------+---------+------+------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+--------------------+--------------------+---------+------+------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 19680271 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 19680268 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'uninstall_plugins' LIMIT 1 | | 19680267 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'gzipcompression' LIMIT 1 | | 19680266 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'astra-sites-batch-is-complete' LIMIT 1 | | 19680264 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'gzipcompression' LIMIT 1 | | 19680265 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Sending data | SELECT option_name, option_value FROM QpCIPREUS_options WHERE autoload IN ( 'yes', 'on', 'auto-on', 'auto' ) | | 19680263 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Sending data | SELECT option_name, option_value FROM QpCIPREUS_options WHERE autoload IN ( 'yes', 'on', 'auto-on', 'auto' ) | | 19680262 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'perflab_server_timing_settings' LIMIT 1 | | 19680261 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | UPDATE `QpCIPREUS_options` SET `option_value` = '1787347972' WHERE `option_name` = '_transient_timeout_et_core_path' | | 19680260 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'perflab_server_timing_settings' LIMIT 1 | | 19680259 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'jetpack_sync_non_blocking' LIMIT 1 | | 19680258 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'ninja_forms_oauth_client_id' LIMIT 1 | | 19680257 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'megamenu_locations' LIMIT 1 | | 19680256 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'perflab_server_timing_settings' LIMIT 1 | | 19680255 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'autoptimize_imgopt_settings' LIMIT 1 | | 19680254 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'ninja_forms_allow_tracking' LIMIT 1 | | 19680253 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'jetpack_sync_error_idc' LIMIT 1 | | 19680252 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'autoptimize_ccss_rules' LIMIT 1 | | 19680251 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'jb_transient_premium_features' LIMIT 1 | | 19680250 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'astra_sites_batch_process_started' LIMIT 1 | | 19680249 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'gzipcompression' LIMIT 1 | +----------+--------------------+--------------------+---------+------+------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +----------+--------------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +----------+--------------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------+ | 19680268 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'uninstall_plugins' LIMIT 1 | | 19680267 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'gzipcompression' LIMIT 1 | | 19680266 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'astra-sites-batch-is-complete' LIMIT 1 | | 19680264 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'gzipcompression' LIMIT 1 | | 19680262 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'perflab_server_timing_settings' LIMIT 1 | | 19680261 | evolution_wp_nv3qp | 0 | Waiting for table level lock | UPDATE `QpCIPREUS_options` SET `option_value` = '1787347972' WHERE `option_name` = '_transient_timeout_et_core_path' | | 19680260 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'perflab_server_timing_settings' LIMIT 1 | | 19680259 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'jetpack_sync_non_blocking' LIMIT 1 | | 19680258 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'ninja_forms_oauth_client_id' LIMIT 1 | | 19680257 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'megamenu_locations' LIMIT 1 | | 19680256 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'perflab_server_timing_settings' LIMIT 1 | | 19680255 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'autoptimize_imgopt_settings' LIMIT 1 | | 19680254 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'ninja_forms_allow_tracking' LIMIT 1 | | 19680253 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'jetpack_sync_error_idc' LIMIT 1 | | 19680252 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'autoptimize_ccss_rules' LIMIT 1 | | 19680251 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'jb_transient_premium_features' LIMIT 1 | | 19680250 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'astra_sites_batch_process_started' LIMIT 1 | | 19680249 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'gzipcompression' LIMIT 1 | +----------+--------------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 507 evolution/portal.evolutionerp.com.au-ssl_log 258 evolution/wp.evolutionerp.com.au 192 madalice/madalice.com.au-ssl_log 97 evolution/evolutionerp.com.au 38 olympic/olympicfencing.com.au-ssl_log 36 evolution/evolutionerp.com.au-ssl_log 31 cosgrovecreative/cosgrovecreative.com.au-ssl_log 18 evolution/portal.evolutionerp.com.au 11 customc/customcentral.com.au-ssl_log 6 alison/alisonarts.com.au-ssl_log 3 (total vhosts taking traffic: 11) --- top client IPs across all vhosts (last 3 min) --- 361 203.54.180.238 192 82.102.18.220 106 104.209.144.33 88 172.161.79.158 87 180.181.236.49 62 202.153.211.134 53 4.232.94.69 53 103.104.164.114 48 52.173.121.69 47 103.104.165.99 34 68.155.154.236 28 101.166.96.210 18 82.102.18.222 17 165.225.233.109 8 182.239.240.254 --- top request paths across all vhosts (last 3 min) --- 152 POST /functions.php 73 GET /factory_session_checker.php 66 POST /app/ajax.php 56 GET /heartbeat.php 53 GET /app/ajax.php 49 GET /index.php 37 GET /factory_session_processed_qty.php 37 GET /factory_session_joiner.php 32 POST /plugins/csvexporter/plugin.php 12 GET / 11 POST /app/ajax/selectFilter.php 10 POST /reports/quoteByRepSave.php 10 POST /app/ajax/selectFilterSingle.php 8 POST /clienteditsave.php 8 GET //app/ajax.php 6 POST /portal/register 5 POST /mfreqsave.php 5 POST /login2save.php 5 POST /invaddsave.php 5 POST //functions.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 152 POST /functions.php 66 POST /app/ajax.php 53 GET /app/ajax.php 40 GET /index.php 32 POST /plugins/csvexporter/plugin.php 11 POST /app/ajax/selectFilter.php 10 POST /reports/quoteByRepSave.php 10 POST /app/ajax/selectFilterSingle.php 8 POST /clienteditsave.php 8 GET //app/ajax.php 8 GET / 5 POST /mfreqsave.php -- last 10 requests -- 180.181.236.49 - - [21/Aug/2026:07:32:38 +1000] "POST /app/ajax.php?call=ts&tsact=tsUpdateTimesheetNominalRates HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=timesheetHistory" "Mozilla/5.0 (Windows NT 1 203.54.180.238 - - [21/Aug/2026:07:32:38 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 51 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=9899&tab=clienteditgeneral" "Mozilla/5.0 (Windows NT 180.181.236.49 - - [21/Aug/2026:07:32:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=timesheetHistory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 103.104.165.99 - - [21/Aug/2026:07:32:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Ch 103.104.165.99 - - [21/Aug/2026:07:32:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 180.181.236.49 - - [21/Aug/2026:07:32:39 +1000] "POST /app/ajax/selectFilter.php?call=filterstaffandcontractors&filter=&cursel=&curseltext=&fromMS=1&&nolimit=LIMIT%201000&excludelabour=1&include=38&returnobj=ts_add_staff 203.54.180.238 - - [21/Aug/2026:07:32:39 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 121318 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=9899&tab=clienteditgeneral" "Mozilla/5.0 (Win 103.104.165.99 - - [21/Aug/2026:07:32:40 +1000] "GET /index.php?page=jobregister HTTP/1.1" 200 15155 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=711&tab=clienteditgeneral" "Mozilla/5.0 (Windows NT 203.54.180.238 - - [21/Aug/2026:07:32:41 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 103.104.165.99 - - [21/Aug/2026:07:32:40 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 73 GET /factory_session_checker.php 56 GET /heartbeat.php 37 GET /factory_session_processed_qty.php 37 GET /factory_session_joiner.php 9 GET /index.php 6 POST /portal/register 2 GET /wp-includes/Text/Diff/index.php 2 GET /uploadsave.php 1 POST /factory_functions.php 1 GET /wp-login.php 1 GET /wp-includes/widgets/class-wp-widget-head.php 1 GET /wp-includes/Text/about.php7 -- last 10 requests -- 203.54.180.238 - - [21/Aug/2026:07:32:46 +1000] "GET /heartbeat.php?sentAt=1787261566&bytes=106,135,114,126&_=1787230386166 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [21/Aug/2026:07:32:47 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [21/Aug/2026:07:32:46 +1000] "GET /heartbeat.php?sentAt=1787261567&bytes=106,135,114,127&_=1787203714306 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=9 203.54.180.238 - - [21/Aug/2026:07:32:48 +1000] "GET /factory_session_joiner.php?id=34776 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [21/Aug/2026:07:32:48 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 139 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [21/Aug/2026:07:32:48 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [21/Aug/2026:07:32:48 +1000] "GET /factory_session_joiner.php?id=34774 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [21/Aug/2026:07:32:48 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [21/Aug/2026:07:32:47 +1000] "GET /heartbeat.php?sentAt=1787261568&bytes=106,135,114,128&_=1787256895140 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [21/Aug/2026:07:32:49 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == evolution/wp.evolutionerp.com.au == -- top paths -- 1 GET /wp-includes/sodium_compat/namespaced//wp-includes/sodium_compat/ 1 GET /wp-includes/sodium_compat/namespaced/Core//wp-includes/sodium_compat/namespaced/ 1 GET /wp-includes/sodium_compat/namespaced/Core/HChaCha20.php 1 GET /wp-includes/sodium_compat/namespaced/Core/Ed25519.php 1 GET /wp-includes/sodium_compat/namespaced/Core/Curve25519//wp-includes/sodium_compat/namespaced/Core/ 1 GET /wp-includes/sodium_compat/namespaced/Core/Curve25519.php 1 GET /wp-includes/sodium_compat/namespaced/Core/Curve25519/H.php 1 GET /wp-includes/sodium_compat/namespaced/Core/Curve25519/Ge//wp-includes/sodium_compat/namespaced/Core/Curve25519/ 1 GET /wp-includes/sodium_compat/namespaced/Core/Curve25519/Ge/Precomp.php 1 GET /wp-includes/sodium_compat/namespaced/Core/Curve25519/Ge/P3.php 1 GET /wp-includes/sodium_compat/namespaced/Core/Curve25519/Ge/P2.php 1 GET /wp-includes/sodium_compat/namespaced/Core/Curve25519/Ge/P1p1.php -- last 10 requests -- 82.102.18.220 - - [21/Aug/2026:07:32:23 +1000] "GET /wp-includes/sodium_compat/namespaced/Core/Curve25519/Ge/ HTTP/1.1" 200 1669 "-" "-" 82.102.18.220 - - [21/Aug/2026:07:32:23 +1000] "GET /wp-includes/sodium_compat/namespaced/Core/Curve25519/Ge//wp-includes/sodium_compat/namespaced/Core/Curve25519/ HTTP/1.1" 500 188 "-" "-" 82.102.18.220 - - [21/Aug/2026:07:32:25 +1000] "GET /wp-includes/sodium_compat/namespaced/Core/Curve25519/Ge/Cached.php HTTP/1.1" 500 - "-" "-" 82.102.18.220 - - [21/Aug/2026:07:32:25 +1000] "GET /wp-includes/sodium_compat/namespaced/Core/Curve25519/Ge/P1p1.php HTTP/1.1" 500 - "-" "-" 82.102.18.220 - - [21/Aug/2026:07:32:26 +1000] "GET /wp-includes/sodium_compat/namespaced/Core/Curve25519/Ge/P2.php HTTP/1.1" 500 - "-" "-" 82.102.18.220 - - [21/Aug/2026:07:32:27 +1000] "GET /wp-includes/sodium_compat/namespaced/Core/Curve25519/Ge/P3.php HTTP/1.1" 500 - "-" "-" 82.102.18.220 - - [21/Aug/2026:07:32:27 +1000] "GET /wp-includes/sodium_compat/namespaced/Core/Curve25519/Ge/Precomp.php HTTP/1.1" 500 - "-" "-" 82.102.18.220 - - [21/Aug/2026:07:32:28 +1000] "GET /wp-includes/sodium_compat/namespaced/Core/Curve25519/H.php HTTP/1.1" 500 - "-" "-" 82.102.18.220 - - [21/Aug/2026:07:32:29 +1000] "GET /wp-includes/sodium_compat/namespaced/Core/Ed25519.php HTTP/1.1" 500 - "-" "-" 82.102.18.220 - - [21/Aug/2026:07:32:29 +1000] "GET /wp-includes/sodium_compat/namespaced/Core/HChaCha20.php HTTP/1.1" 500 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-21 07:30:31 L1=3.05 run=4 blk=0 avail=6408 (54.6%) swpO=0 conn=2 myRSS=2632 php=2 phpRSS=190 ap=45 tcp=43 topuser=evolution 2026-08-21 07:30:31 L1=3.05 run=3 blk=0 avail=6385 (54.4%) swpO=0 conn=3 myRSS=2632 php=2 phpRSS=212 ap=45 tcp=43 topuser=evolution 2026-08-21 07:30:41 L1=2.81 run=3 blk=0 avail=6492 (55.3%) swpO=0 conn=2 myRSS=2632 php=2 phpRSS=159 ap=39 tcp=42 topuser=olympic 2026-08-21 07:30:41 L1=2.81 run=6 blk=0 avail=6462 (55.1%) swpO=0 conn=3 myRSS=2632 php=2 phpRSS=166 ap=39 tcp=41 topuser=olympic 2026-08-21 07:30:51 L1=3.34 run=5 blk=0 avail=6328 (54.0%) swpO=0 conn=2 myRSS=2632 php=4 phpRSS=352 ap=42 tcp=44 topuser=evolution 2026-08-21 07:30:51 L1=3.34 run=4 blk=0 avail=6272 (53.5%) swpO=0 conn=3 myRSS=2632 php=2 phpRSS=199 ap=42 tcp=43 topuser=evolution 2026-08-21 07:31:01 L1=3.07 run=4 blk=0 avail=6397 (54.5%) swpO=0 conn=2 myRSS=2632 php=2 phpRSS=195 ap=36 tcp=42 topuser=corpkicks 2026-08-21 07:31:01 L1=3.07 run=3 blk=0 avail=6448 (55.0%) swpO=0 conn=3 myRSS=2632 php=1 phpRSS=182 ap=36 tcp=42 topuser=corpkicks 2026-08-21 07:31:11 L1=3.04 run=2 blk=0 avail=6496 (55.4%) swpO=0 conn=2 myRSS=2632 php=1 phpRSS=157 ap=35 tcp=35 topuser=evolution 2026-08-21 07:31:12 L1=3.04 run=2 blk=0 avail=6483 (55.3%) swpO=0 conn=3 myRSS=2632 php=2 phpRSS=199 ap=35 tcp=35 topuser=evolution 2026-08-21 07:31:21 L1=3.12 run=3 blk=0 avail=6272 (53.5%) swpO=0 conn=2 myRSS=2632 php=3 phpRSS=384 ap=40 tcp=39 topuser=customc 2026-08-21 07:31:22 L1=3.12 run=4 blk=0 avail=6477 (55.2%) swpO=0 conn=2 myRSS=2632 php=1 phpRSS=114 ap=40 tcp=35 topuser=evolution 2026-08-21 07:31:31 L1=2.95 run=4 blk=0 avail=6376 (54.4%) swpO=0 conn=2 myRSS=2632 php=2 phpRSS=269 ap=37 tcp=42 topuser=evolution 2026-08-21 07:31:32 L1=2.95 run=5 blk=0 avail=6487 (55.3%) swpO=0 conn=2 myRSS=2632 php=2 phpRSS=146 ap=37 tcp=43 topuser=olympic 2026-08-21 07:31:41 L1=2.81 run=2 blk=0 avail=6523 (55.6%) swpO=0 conn=1 myRSS=2638 php=1 phpRSS=32 ap=45 tcp=41 topuser=olympic 2026-08-21 07:31:42 L1=2.81 run=2 blk=0 avail=6496 (55.4%) swpO=0 conn=2 myRSS=2638 php=1 phpRSS=60 ap=45 tcp=41 topuser=olympic 2026-08-21 07:31:52 L1=2.61 run=2 blk=0 avail=6530 (55.7%) swpO=0 conn=1 myRSS=2638 php=1 phpRSS=85 ap=40 tcp=39 topuser=olympic 2026-08-21 07:31:52 L1=2.61 run=3 blk=0 avail=6485 (55.3%) swpO=0 conn=2 myRSS=2638 php=2 phpRSS=163 ap=39 tcp=39 topuser=olympic 2026-08-21 07:32:02 L1=2.44 run=3 blk=0 avail=6370 (54.3%) swpO=0 conn=1 myRSS=2638 php=2 phpRSS=326 ap=32 tcp=44 topuser=madalice 2026-08-21 07:32:02 L1=2.44 run=4 blk=0 avail=6327 (53.9%) swpO=0 conn=2 myRSS=2638 php=3 phpRSS=399 ap=33 tcp=44 topuser=madalice 2026-08-21 07:32:12 L1=2.45 run=3 blk=0 avail=6340 (54.1%) swpO=0 conn=1 myRSS=2638 php=2 phpRSS=349 ap=33 tcp=36 topuser=madalice 2026-08-21 07:32:12 L1=2.45 run=3 blk=0 avail=6307 (53.8%) swpO=0 conn=2 myRSS=2638 php=2 phpRSS=382 ap=33 tcp=34 topuser=madalice 2026-08-21 07:32:22 L1=2.22 run=1 blk=0 avail=6616 (56.4%) swpO=0 conn=1 myRSS=2638 php=0 phpRSS=0 ap=36 tcp=38 topuser=- 2026-08-21 07:32:22 L1=2.22 run=2 blk=1 avail=6616 (56.4%) swpO=0 conn=1 myRSS=2638 php=0 phpRSS=0 ap=36 tcp=38 topuser=- 2026-08-21 07:32:32 L1=1.95 run=3 blk=0 avail=6649 (56.7%) swpO=0 conn=1 myRSS=2638 php=1 phpRSS=31 ap=31 tcp=40 topuser=evolution 2026-08-21 07:32:32 L1=1.95 run=2 blk=0 avail=6598 (56.3%) swpO=0 conn=1 myRSS=2638 php=1 phpRSS=73 ap=31 tcp=40 topuser=evolution 2026-08-21 07:32:42 L1=1.73 run=4 blk=0 avail=6434 (54.9%) swpO=0 conn=3 myRSS=2638 php=2 phpRSS=222 ap=43 tcp=44 topuser=evolution 2026-08-21 07:32:42 L1=1.73 run=3 blk=0 avail=6518 (55.6%) swpO=0 conn=1 myRSS=2638 php=1 phpRSS=76 ap=43 tcp=43 topuser=alison 2026-08-21 07:32:52 L1=1.70 run=1 blk=2 avail=5426 (46.3%) swpO=72 conn=21 myRSS=2648 php=20 phpRSS=1725 ap=36 tcp=55 topuser=evolution 2026-08-21 07:32:52 L1=1.70 run=3 blk=2 avail=5423 (46.2%) swpO=75 conn=21 myRSS=2652 php=20 phpRSS=1736 ap=36 tcp=56 topuser=evolution