INCIDENT 2026-08-21 20:53:18 trigger: php_rss=2401MB mysql_conn=25 ================================================================== load: 0.54 0.59 0.58 35/703 1125092 ncpu:10 mem_avail: 4518MB/11729MB (38.5%) swap_used:3111MB swapout:93/s blocked(D):0 running:32 iowait:0.3% steal:0.0% php: 24 procs / 2401MB heaviest user: evolution (24 procs, 2401MB) apache: 76 procs tcp_estab: 97 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2876 evolution 32 2602 nobody 75 1180 root 241 1004 netdata 8 251 mailman 20 94 cpanellogin 1 28 dovenull 6 26 wp-toolkit 6 17 zabbix 1 15 named 1 10 kurri 1 10 nscd 1 7 dovecot 3 7 mailnull 1 5 cpanelconnecttrack 1 3 dbus 1 2 polkitd 1 1 rpc 1 0 chrony 1 0 --- php workers by user --- USER PROCS RSS_MB evolution 24 2579 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3909 MB Active(file): 3291 MB Inactive(file): 669 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 425 MB CommitLimit: 9960 MB Committed_AS: 9848 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 267385 root 19:42:01 2520 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2946760 11.5 Ssl 6-13:02:42 /usr/sbin/mariadbd 2575382 1 root 199916 0.0 Ss 6-13:02:45 /usr/lib/systemd/systemd-journald 1220 1 netdata 197420 2.5 Ssl 53-10:43:24 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 319521 311538 root 182064 0.0 S 18:15:33 spamd child 1125004 1124877 evolution 171036 83.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125003 1124874 evolution 166564 78.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125010 1124882 evolution 155780 73.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125009 1124859 evolution 153496 70.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 853881 311538 root 136664 0.0 S 07:02:28 spamd child 1125008 1124880 evolution 128040 51.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125007 1124878 evolution 124076 46.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125015 1124863 evolution 121856 46.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125030 1124876 evolution 121536 46.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125005 1124881 evolution 117936 43.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125013 1124865 evolution 117864 43.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125024 1124794 evolution 113348 43.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125022 1124855 evolution 113252 42.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125023 1118807 evolution 111020 41.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125017 1124864 evolution 108888 40.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125011 1124861 evolution 101732 36.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125002 1124875 evolution 101484 35.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125027 1124872 evolution 100356 35.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125006 1124879 evolution 99044 33.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 311538 1 root 94496 0.0 Ss 18:30:32 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1125016 1124764 evolution 94480 32.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125012 1124858 evolution 93924 29.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125014 1124862 evolution 72036 18.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125031 1124883 evolution 71884 19.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1125029 1124762 evolution 42716 4.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2223 1201 root 42596 0.0 Sl 53-10:43:23 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1125001 1124873 evolution 42312 5.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1353308 1 root 41624 0.0 Ss 30-18:11:54 cpsrvd (SSL) - waiting for connections 1125088 1353308 root 37364 0.0 R 00:00 webmaild - serving 127.0.0.1 4922 2431 netdata 35532 0.1 Sl 53-10:43:19 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 30592 0.1 Ss 53-10:43:23 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1124216 1353308 cpanellogin 28744 0.6 R 01:06 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en cpanel_locale docroot /usr/local/cpanel/base 1121827 1276780 nobody 22152 0.0 S 06:10 /usr/sbin/httpd -k start 1119151 1276780 nobody 22112 0.0 S 11:19 /usr/sbin/httpd -k start 1120090 1276780 nobody 21928 0.0 S 09:24 /usr/sbin/httpd -k start 1121996 1276780 nobody 20928 0.0 S 05:43 /usr/sbin/httpd -k start 1118807 1276780 nobody 20900 0.0 S 12:10 /usr/sbin/httpd -k start 310731 1 root 20868 0.0 Ss 18:31:04 lfd - sleeping 1123494 1276780 nobody 20860 0.0 S 02:50 /usr/sbin/httpd -k start 1124867 1276780 nobody 20204 1.2 S 00:04 /usr/sbin/httpd -k start 1123513 1276780 nobody 19396 0.0 S 02:48 /usr/sbin/httpd -k start 1123499 1276780 nobody 19352 0.0 S 02:49 /usr/sbin/httpd -k start 1124866 1276780 nobody 19300 0.7 S 00:04 /usr/sbin/httpd -k start 1123501 1276780 nobody 19048 0.0 S 02:49 /usr/sbin/httpd -k start 1123429 1276780 nobody 19020 0.0 S 02:57 /usr/sbin/httpd -k start 1463 1 root 18880 0.0 Ss 53-10:43:23 tailwatchd 1124822 1276780 nobody 18448 0.4 S 00:05 /usr/sbin/httpd -k start 1124745 1276780 nobody 18372 0.1 S 00:08 /usr/sbin/httpd -k start 1124868 1276780 nobody 18332 0.7 S 00:04 /usr/sbin/httpd -k start 1123495 1276780 nobody 17960 0.0 S 02:50 /usr/sbin/httpd -k start 185104 2431 netdata 17748 2.1 Sl 9-00:19:42 /usr/libexec/netdata/plugins.d/apps.plugin 1 1124764 1276780 nobody 16784 0.1 S 00:07 /usr/sbin/httpd -k start 1124762 1276780 nobody 16524 0.1 S 00:07 /usr/sbin/httpd -k start 1124810 1276780 nobody 16476 0.0 S 00:05 /usr/sbin/httpd -k start 1124746 1276780 nobody 16420 0.1 S 00:08 /usr/sbin/httpd -k start 1124863 1276780 nobody 16384 0.0 S 00:04 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+--------------------+--------------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+--------------------+--------------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 22965351 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 1 | Sending data | SELECT option_name, option_value FROM QpCIPREUS_options WHERE autoload IN ( 'yes', 'on', 'auto-on', 'auto' ) | | 22965377 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 22965374 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'perflab_server_timing_settings' LIMIT 1 | | 22965373 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'megamenu_locations' LIMIT 1 | | 22965372 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT autoload FROM QpCIPREUS_options WHERE option_name = 'astra-sites-last-export-checksums-latest' | | 22965371 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Sending data | SELECT option_name, option_value FROM QpCIPREUS_options WHERE autoload IN ( 'yes', 'on', 'auto-on', 'auto' ) | | 22965370 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'limit_login_active_app' LIMIT 1 | | 22965369 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'limit_login_active_app' LIMIT 1 | | 22965368 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'jetpack_sync_non_blocking' LIMIT 1 | | 22965367 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'perflab_server_timing_settings' LIMIT 1 | | 22965365 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_name, option_value FROM QpCIPREUS_options WHERE option_name IN ('jetpack_boost_status_lcp','jetpack_boost_status_image-guide','jetpack_boost_status_page-cache','jetpack_boost_status_speculation-rules','jetpack_boost_status_minify-common','jetpack_boost_status_cache-preload') | | 22965366 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'gzipcompression' LIMIT 1 | | 22965364 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'astra_sites_batch_process_started' LIMIT 1 | | 22965363 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'megamenu_locations' LIMIT 1 | | 22965362 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'astra_sites_usage_optin' LIMIT 1 | | 22965361 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'jetpack_excluded_extensions' LIMIT 1 | | 22965358 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'et_core_api_spam_options' LIMIT 1 | | 22965360 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'preload_cache_counter' LIMIT 1 | | 22965359 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'zip_ai_settings' LIMIT 1 | | 22965357 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'autoptimize_ccss_additional' LIMIT 1 | | 22965356 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | UPDATE `QpCIPREUS_options` SET `option_value` = 'a:2:{s:6:\"expire\";i:1789901598;s:4:\"data\";a:3:{s:5:\"paths\";a:2:{s:12:\"divi-dynamic\";s:56:\"/wp-content/et-cache/notfound/et-divi-dynamic-tb-236.css\";s:10:\"divi-style\";s:39:\"/wp-content/themes/divi-child/style.css\";}s:5:\"mtime\";i:1787307 | | 22965355 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'googlesitekit_dashboard_sharing' LIMIT 1 | | 22965354 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'reader_chat' LIMIT 1 | | 22965352 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'autoptimize_ccss_rtimelimit' LIMIT 1 | | 22965353 | evolution_wp_dhuho | evolution_wp_nv3qp | Query | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'jetpack_boost_ds_render_blocking_js_excludes' LIMIT 1 | +----------+--------------------+--------------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +----------+--------------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +----------+--------------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 22965374 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'perflab_server_timing_settings' LIMIT 1 | | 22965373 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'megamenu_locations' LIMIT 1 | | 22965372 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT autoload FROM QpCIPREUS_options WHERE option_name = 'astra-sites-last-export-checksums-latest' | | 22965370 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'limit_login_active_app' LIMIT 1 | | 22965369 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'limit_login_active_app' LIMIT 1 | | 22965368 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'jetpack_sync_non_blocking' LIMIT 1 | | 22965367 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'perflab_server_timing_settings' LIMIT 1 | | 22965365 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_name, option_value FROM QpCIPREUS_options WHERE option_name IN ('jetpack_boost_status_lcp','jetpack_boost_status_image-guide','jetpack_boost_status_page-cache','jetpack_boost_status_spec | | 22965366 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'gzipcompression' LIMIT 1 | | 22965364 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'astra_sites_batch_process_started' LIMIT 1 | | 22965363 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'megamenu_locations' LIMIT 1 | | 22965362 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'astra_sites_usage_optin' LIMIT 1 | | 22965361 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'jetpack_excluded_extensions' LIMIT 1 | | 22965358 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'et_core_api_spam_options' LIMIT 1 | | 22965360 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'preload_cache_counter' LIMIT 1 | | 22965359 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'zip_ai_settings' LIMIT 1 | | 22965357 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'autoptimize_ccss_additional' LIMIT 1 | | 22965356 | evolution_wp_nv3qp | 0 | Waiting for table level lock | UPDATE `QpCIPREUS_options` SET `option_value` = 'a:2:{s:6:\"expire\";i:1789901598;s:4:\"data\";a:3:{s:5:\"paths\";a:2:{s:12:\"divi-dynamic\";s:56:\"/wp-content/et-cache/notfound/et-divi-dynamic-tb-236 | | 22965355 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'googlesitekit_dashboard_sharing' LIMIT 1 | | 22965354 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'reader_chat' LIMIT 1 | | 22965352 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'autoptimize_ccss_rtimelimit' LIMIT 1 | | 22965353 | evolution_wp_nv3qp | 0 | Waiting for table level lock | SELECT option_value FROM QpCIPREUS_options WHERE option_name = 'jetpack_boost_ds_render_blocking_js_excludes' LIMIT 1 | +----------+--------------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/apps.evolutionerp.com.au-ssl_log 120 evolution/evolutionerp.com.au-ssl_log 94 evolution/support.evolutionerp.com.au-ssl_log 88 evolution/portal.evolutionerp.com.au-ssl_log 17 vinesit/vinesit.com.au-ssl_log 9 madalice/madalice.com.au-ssl_log 4 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 301 35.243.213.218 17 203.54.180.238 8 103.168.66.101 2 118.127.40.55 1 114.119.159.70 1 114.119.146.16 1 114.119.143.14 1 114.119.137.101 --- top request paths across all vhosts (last 3 min) --- 17 GET /heartbeat.php 12 GET / 3 POST /v1/graphql 3 POST /graphql 3 POST /api/graphql 3 GET /web.config 3 GET /values.yaml 3 GET /.streamlit/secrets.toml 3 GET /staging/.env 3 GET /src/.env 3 GET /settings.py 3 GET /server/.env 3 GET /sendgrid.env 3 GET /rclone.conf 3 GET /.pypirc 3 GET /production/.env 3 GET /metrics 3 GET /instance/config.py 3 GET /info 3 GET /_health --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/apps.evolutionerp.com.au-ssl_log == -- top paths -- 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /z9x8c7v6b5-debug-trigger-apps.evolutionerp.com.au 1 GET /wp-json 1 GET /web.config 1 GET /values.yaml 1 GET /v1/graphql 1 GET /trace.axd 1 GET /test.php 1 GET /terraform.tfstate 1 GET /telescope/requests -- last 10 requests -- 35.243.213.218 - - [21/Aug/2026:20:53:17 +1000] "GET /config/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:17 +1000] "GET /secrets.yml HTTP/1.1" 404 - "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:18 +1000] "GET /Dockerfile HTTP/1.1" 404 - "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:18 +1000] "GET /.github/.env HTTP/1.1" 404 - "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:18 +1000] "GET /.npmrc HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:18 +1000] "GET /.s3cfg HTTP/1.1" 404 - "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:18 +1000] "GET /.boto HTTP/1.1" 404 - "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:18 +1000] "GET /.svn/entries HTTP/1.1" 404 - "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:18 +1000] "GET /.htpasswd HTTP/1.1" 403 13 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:18 +1000] "GET /terraform.tfstate HTTP/1.1" 404 - "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 8 GET / 2 GET /.aws/credentials 2 GET /.aws/config 1 POST /wp-cron.php 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /z9x8c7v6b5-debug-trigger-webmail.evolutionerp.com.au 1 GET /web.config 1 GET /values.yaml 1 GET /v1/graphql 1 GET /test.php -- last 10 requests -- 35.243.213.218 - - [21/Aug/2026:20:53:17 +1000] "GET /info.php HTTP/1.1" 401 12592 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:17 +1000] "GET /test.php HTTP/1.1" 404 3496 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:17 +1000] "GET /i.php HTTP/1.1" 401 12601 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:17 +1000] "GET /_profiler/latest HTTP/1.1" 401 12592 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:17 +1000] "GET /_profiler/open HTTP/1.1" 401 12592 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:17 +1000] "GET /app_dev.php HTTP/1.1" 401 12591 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:17 +1000] "GET /app_dev.php/_profiler HTTP/1.1" 404 3496 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:18 +1000] "GET /_ignition/health-check HTTP/1.1" 401 12601 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:18 +1000] "GET /telescope/requests HTTP/1.1" 404 3496 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:18 +1000] "GET /_debugbar/open HTTP/1.1" 404 3496 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" == evolution/support.evolutionerp.com.au-ssl_log == -- top paths -- 1 POST /v1/graphql 1 POST /graphql 1 POST /api/graphql 1 GET /.zshrc 1 GET /z9x8c7v6b5-debug-trigger-support.evolutionerp.com.au 1 GET /wp-json 1 GET /wp-config.php.old 1 GET /wp-config.php.bak 1 GET /web/.env 1 GET /web.config 1 GET /values.yaml 1 GET /.streamlit/secrets.toml -- last 10 requests -- 35.243.213.218 - - [21/Aug/2026:20:53:17 +1000] "GET /debug/vars HTTP/1.1" 404 - "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:17 +1000] "GET /metrics HTTP/1.1" 404 - "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:17 +1000] "GET /config.yaml HTTP/1.1" 404 - "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:17 +1000] "GET /info HTTP/1.1" 404 - "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:17 +1000] "GET /dashboard HTTP/1.1" 404 - "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:17 +1000] "GET /config.toml HTTP/1.1" 404 - "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:17 +1000] "GET /config/runtime.exs HTTP/1.1" 404 - "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:17 +1000] "GET /_health HTTP/1.1" 404 - "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:17 +1000] "GET /config/prod.exs HTTP/1.1" 404 - "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" 35.243.213.218 - - [21/Aug/2026:20:53:18 +1000] "GET /values.yaml HTTP/1.1" 404 - "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)" --- last 30 samples (run-up to this incident) --- 2026-08-21 20:50:54 L1=0.65 run=1 blk=0 avail=6544 (55.8%) swpO=0 conn=1 myRSS=2879 php=0 phpRSS=0 ap=19 tcp=22 topuser=- 2026-08-21 20:50:57 L1=0.65 run=2 blk=0 avail=6552 (55.9%) swpO=0 conn=3 myRSS=2879 php=1 phpRSS=36 ap=17 tcp=19 topuser=vinesit 2026-08-21 20:51:04 L1=0.70 run=2 blk=0 avail=6553 (55.9%) swpO=0 conn=1 myRSS=2879 php=1 phpRSS=54 ap=15 tcp=19 topuser=alison 2026-08-21 20:51:07 L1=0.70 run=3 blk=0 avail=6471 (55.2%) swpO=0 conn=3 myRSS=2879 php=2 phpRSS=159 ap=15 tcp=21 topuser=madalice 2026-08-21 20:51:14 L1=0.82 run=1 blk=0 avail=6565 (56.0%) swpO=0 conn=1 myRSS=2879 php=0 phpRSS=0 ap=15 tcp=19 topuser=- 2026-08-21 20:51:17 L1=0.82 run=2 blk=0 avail=6558 (55.9%) swpO=0 conn=2 myRSS=2879 php=1 phpRSS=40 ap=15 tcp=20 topuser=evolution 2026-08-21 20:51:24 L1=0.69 run=1 blk=0 avail=6562 (55.9%) swpO=0 conn=1 myRSS=2879 php=0 phpRSS=0 ap=15 tcp=21 topuser=- 2026-08-21 20:51:27 L1=0.69 run=2 blk=0 avail=6456 (55.0%) swpO=0 conn=2 myRSS=2879 php=2 phpRSS=167 ap=15 tcp=21 topuser=speedlin 2026-08-21 20:51:34 L1=0.73 run=1 blk=0 avail=6567 (56.0%) swpO=0 conn=1 myRSS=2879 php=0 phpRSS=0 ap=15 tcp=21 topuser=- 2026-08-21 20:51:37 L1=0.73 run=1 blk=0 avail=6564 (56.0%) swpO=0 conn=2 myRSS=2879 php=1 phpRSS=40 ap=15 tcp=18 topuser=evolution 2026-08-21 20:51:44 L1=0.77 run=1 blk=0 avail=6573 (56.0%) swpO=0 conn=1 myRSS=2879 php=0 phpRSS=0 ap=14 tcp=21 topuser=- 2026-08-21 20:51:47 L1=0.77 run=1 blk=0 avail=6563 (56.0%) swpO=0 conn=2 myRSS=2879 php=1 phpRSS=39 ap=14 tcp=22 topuser=evolution 2026-08-21 20:51:54 L1=0.74 run=1 blk=0 avail=6578 (56.1%) swpO=0 conn=1 myRSS=2879 php=0 phpRSS=0 ap=14 tcp=18 topuser=- 2026-08-21 20:51:57 L1=0.74 run=1 blk=0 avail=6643 (56.6%) swpO=0 conn=2 myRSS=2879 php=1 phpRSS=40 ap=14 tcp=18 topuser=evolution 2026-08-21 20:52:04 L1=0.62 run=1 blk=0 avail=6655 (56.7%) swpO=0 conn=1 myRSS=2879 php=0 phpRSS=0 ap=14 tcp=20 topuser=- 2026-08-21 20:52:07 L1=0.62 run=1 blk=0 avail=6642 (56.6%) swpO=0 conn=2 myRSS=2879 php=1 phpRSS=40 ap=14 tcp=18 topuser=evolution 2026-08-21 20:52:14 L1=0.61 run=3 blk=0 avail=6407 (54.6%) swpO=0 conn=1 myRSS=2879 php=2 phpRSS=278 ap=14 tcp=19 topuser=madalice 2026-08-21 20:52:17 L1=0.61 run=1 blk=0 avail=6606 (56.3%) swpO=0 conn=2 myRSS=2879 php=1 phpRSS=40 ap=14 tcp=18 topuser=evolution 2026-08-21 20:52:25 L1=0.51 run=3 blk=0 avail=6556 (55.9%) swpO=0 conn=1 myRSS=2879 php=1 phpRSS=97 ap=14 tcp=16 topuser=madalice 2026-08-21 20:52:27 L1=0.51 run=3 blk=0 avail=6611 (56.4%) swpO=0 conn=2 myRSS=2879 php=1 phpRSS=40 ap=14 tcp=16 topuser=evolution 2026-08-21 20:52:35 L1=0.51 run=2 blk=0 avail=6565 (56.0%) swpO=0 conn=1 myRSS=2879 php=1 phpRSS=88 ap=14 tcp=16 topuser=olympic 2026-08-21 20:52:37 L1=0.51 run=1 blk=0 avail=6623 (56.5%) swpO=1 conn=2 myRSS=2879 php=1 phpRSS=39 ap=14 tcp=17 topuser=evolution 2026-08-21 20:52:45 L1=0.43 run=1 blk=0 avail=6630 (56.5%) swpO=1 conn=1 myRSS=2879 php=0 phpRSS=0 ap=14 tcp=15 topuser=- 2026-08-21 20:52:47 L1=0.43 run=1 blk=0 avail=6618 (56.4%) swpO=0 conn=2 myRSS=2879 php=1 phpRSS=40 ap=14 tcp=15 topuser=evolution 2026-08-21 20:52:55 L1=0.37 run=1 blk=0 avail=6633 (56.5%) swpO=0 conn=1 myRSS=2879 php=0 phpRSS=0 ap=14 tcp=15 topuser=- 2026-08-21 20:52:58 L1=0.37 run=3 blk=0 avail=6614 (56.4%) swpO=0 conn=2 myRSS=2879 php=2 phpRSS=82 ap=14 tcp=15 topuser=evolution 2026-08-21 20:53:05 L1=0.46 run=1 blk=0 avail=6617 (56.4%) swpO=0 conn=1 myRSS=2879 php=0 phpRSS=0 ap=14 tcp=16 topuser=- 2026-08-21 20:53:08 L1=0.46 run=2 blk=0 avail=6566 (56.0%) swpO=0 conn=2 myRSS=2879 php=2 phpRSS=128 ap=14 tcp=15 topuser=corpkicks 2026-08-21 20:53:15 L1=0.54 run=5 blk=0 avail=5965 (50.9%) swpO=0 conn=1 myRSS=2879 php=3 phpRSS=335 ap=77 tcp=61 topuser=corpkicks 2026-08-21 20:53:18 L1=0.54 run=32 blk=0 avail=4518 (38.5%) swpO=93 conn=25 myRSS=2896 php=24 phpRSS=2401 ap=76 tcp=97 topuser=evolution