INCIDENT 2026-08-28 08:05:13 trigger: php_rss=1506MB ================================================================== load: 3.73 2.33 2.17 4/665 1758221 ncpu:10 mem_avail: 8045MB/13777MB (58.4%) swap_used:637MB swapout:0/s blocked(D):0 running:3 iowait:0.1% steal:0.0% php: 15 procs / 1506MB heaviest user: madalice (7 procs, 1085MB) apache: 68 procs tcp_estab: 64 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 1780 root 261 1172 nobody 67 1104 madalice 7 1085 mailman 20 411 evolution 10 279 netdata 7 210 infinium 1 122 wp-toolkit 3 113 cpanellogin 1 96 dovenull 6 63 mailnull 4 60 kurri 4 54 named 1 39 dovecot 3 26 zabbix 1 24 lowrange 2 24 polkitd 1 23 rpc 1 5 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 7 1085 evolution 6 268 infinium 1 122 root 1 30 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5318 MB Active(file): 4466 MB Inactive(file): 1193 MB Dirty: 159 MB Writeback: 0 MB SReclaimable: 618 MB CommitLimit: 10984 MB Committed_AS: 9251 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 05:46:32 12064 /usr/bin/imunify-agent-proxy 1727322 root 05:12 1284 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 1744352 root 00:12 1444 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 1822872 7.4 Ssl 05:46:01 /usr/sbin/mariadbd 529388 527476 root 177724 0.0 S 05:40:54 spamd child 508924 1 netdata 177652 1.9 Ssl 05:45:30 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 529389 527476 root 161488 0.0 S 05:40:54 spamd child 1743952 510022 madalice 159076 18.5 S 00:43 php-fpm: pool madalice_com_au 1749509 510022 madalice 159020 36.8 S 00:07 php-fpm: pool madalice_com_au 1748411 510022 madalice 158664 31.5 S 00:08 php-fpm: pool madalice_com_au 1748406 510022 madalice 158632 32.5 S 00:08 php-fpm: pool madalice_com_au 1748407 510022 madalice 158600 32.5 S 00:08 php-fpm: pool madalice_com_au 1748891 510022 madalice 158548 31.2 S 00:08 php-fpm: pool madalice_com_au 1748405 510022 madalice 158524 31.1 S 00:08 php-fpm: pool madalice_com_au 527476 1 root 133400 0.0 Ss 05:42:33 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1755936 1755665 infinium 125692 54.5 R 00:02 /opt/cpanel/ea-php84/root/usr/bin/php-cgi 973642 1353308 cpanellogin 98792 0.0 S 03:42:40 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 1755235 1744224 evolution 73556 14.5 S 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509236 509098 root 71232 0.0 Sl 05:45:27 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 938582 1 wp-toolkit 66580 0.0 Ss 03:53:04 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1353308 1 root 41204 0.0 Ss 37-05:23:53 cpsrvd (SSL) - waiting for connections 938585 1 wp-toolkit 41164 0.0 Ss 03:53:04 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1757480 1743756 evolution 41000 2.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1758190 1755677 evolution 40448 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 508634 1 named 40048 0.0 Ssl 05:45:35 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 4180059 4180015 evolution 40020 0.0 Ss 08:05:12 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 1757986 1755675 evolution 39904 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1757946 1743767 evolution 39792 2.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509098 1 root 36112 0.0 Ss 05:45:28 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion 1469 1 root 35792 0.1 Ss 59-21:55:22 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 509266 1 root 31180 0.0 Ss 05:45:27 /usr/lib/systemd/systemd-journald 510022 1 root 31160 0.0 Ss 05:45:23 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 526869 1 root 30304 0.0 Ss 05:42:56 lfd - sleeping 481558 1 root 29816 0.1 Ssl 05:47:54 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 938444 1 root 25768 0.0 Ss 03:53:07 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 483898 1 zabbix 25584 0.2 Ssl 05:46:44 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 508591 1 polkitd 23708 0.0 Ssl 05:45:35 /usr/lib/polkit-1/polkitd --no-debug 1463 1 root 23320 0.0 Ss 59-21:55:22 tailwatchd 1741535 506832 nobody 22564 0.0 S 04:29 /usr/sbin/httpd -k start 1742145 506832 nobody 22328 0.0 S 03:25 /usr/sbin/httpd -k start 508863 508814 mailman 22188 0.0 S 05:45:33 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 508851 508814 mailman 22172 0.0 S 05:45:33 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 508857 508814 mailman 22172 0.0 S 05:45:33 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 508856 508814 mailman 22096 0.0 S 05:45:33 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508855 508814 mailman 22064 0.0 S 05:45:33 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 508864 508814 mailman 22020 0.0 S 05:45:33 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s 508867 508814 mailman 22004 0.0 S 05:45:33 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s 508858 508814 mailman 21984 0.0 S 05:45:33 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s 508861 508814 mailman 21984 0.0 S 05:45:33 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s 508860 508814 mailman 21912 0.0 S 05:45:33 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 508865 508814 mailman 21912 0.0 S 05:45:33 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 508850 508814 mailman 21900 0.0 S 05:45:33 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:0:2 -s 508854 508814 mailman 21888 0.0 S 05:45:33 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 508852 508814 mailman 21884 0.0 S 05:45:33 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s 508866 508814 mailman 21780 0.0 S 05:45:33 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 508853 508814 mailman 21752 0.0 S 05:45:33 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 508849 508814 mailman 21716 0.0 S 05:45:33 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=ArchRunner:0:1 -s 508859 508814 mailman 21716 0.0 S 05:45:33 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 508862 508814 mailman 21716 0.0 S 05:45:33 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s 1743204 506832 nobody 21528 0.0 S 01:56 /usr/sbin/httpd -k start 1743061 506832 nobody 21400 0.0 S 02:03 /usr/sbin/httpd -k start 1744028 506832 nobody 20952 0.1 S 00:37 /usr/sbin/httpd -k start 1743747 506832 nobody 20828 0.1 S 01:02 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 470919 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 470918 | root | 85-1559715131 | Execute | 0 | Sending data | SELECT SUM(mfbom.cost * mfbom.qty) AS cost FROM mfbom, inventory WHERE mfbom.mfsoid = '43162' AND mfbom.itemid = inventory.id AND inventory.uom NOT IN ('p/hr','p/h','p/day','p/hou','p/hour','hour | +--------+------+---------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 312 evolution/evolutionerp.com.au-ssl_log 119 evolution/portal.evolutionerp.com.au-ssl_log 63 tubesupplies/tubesupplies.com.au-ssl_log 16 aaa/aaadownunder.com.au-ssl_log 15 madalice/madalice.com.au-ssl_log 10 speedlin/speedlinefencing.com.au-ssl_log 10 infinium/infinium.net.au-ssl_log 6 corpkicks/corporatekicks.com.au-ssl_log 1 speedlin/speedlinefencing.com.au 1 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 214 203.54.180.238 116 35.229.55.35 86 14.1.95.251 47 103.104.165.99 9 114.116.181.153 8 147.161.213.71 8 143.244.57.121 8 118.127.40.55 8 1.145.102.184 8 103.104.164.114 7 175.36.227.212 3 3.84.14.142 3 20.104.81.161 2 91.92.243.249 2 91.92.243.243 --- top request paths across all vhosts (last 3 min) --- 110 POST /functions.php 57 GET /app/ajax.php 53 GET /heartbeat.php 24 GET /index.php 20 POST /plugins/csvexporter/plugin.php 16 GET / 15 POST /app/ajax/selectFilter.php 10 POST /clienteditsave.php 9 POST /app/ajax/selectFilterSingle.php 8 POST /jobeditsave.php 8 POST /invaddsave.php 8 POST /app/ajax.php 7 POST /quoteditsave.php 7 POST /mfreqsave.php 7 POST //functions.php 6 POST /wp-login.php 6 GET /wp-admin/admin-ajax.php 5 POST /wp-cron.php 5 POST /logsave.php 4 POST /itemModify.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 110 POST /functions.php 57 GET /app/ajax.php 22 GET /index.php 20 POST /plugins/csvexporter/plugin.php 15 POST /app/ajax/selectFilter.php 10 POST /clienteditsave.php 9 POST /app/ajax/selectFilterSingle.php 8 POST /jobeditsave.php 8 POST /invaddsave.php 8 POST /app/ajax.php 7 POST /quoteditsave.php 7 POST /mfreqsave.php -- last 10 requests -- 103.104.165.99 - - [28/Aug/2026:08:05:03 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 22 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 203.54.180.238 - - [28/Aug/2026:08:05:03 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78865§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK 175.36.227.212 - - [28/Aug/2026:08:05:04 +1000] "POST //functions.php?call=heartbeat HTTP/1.1" 200 282 "https://my.evolutionerp.com.au//index.php?page=jobedit&id=28921&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64 103.104.165.99 - - [28/Aug/2026:08:05:04 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 22 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 14.1.95.251 - - [28/Aug/2026:08:05:05 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=mfreqedit&id=53" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 1.145.102.184 - - [28/Aug/2026:08:05:06 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=PIC HTTP/1.1" 200 23475 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36963§ionid=0" "Mozilla/5. 1.145.102.184 - - [28/Aug/2026:08:05:06 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=PIC HTTP/1.1" 200 23475 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36963§ionid=0" "Mozilla/5. 1.145.102.184 - - [28/Aug/2026:08:05:07 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=PICK HTTP/1.1" 200 23312 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36963§ionid=0" "Mozilla/5 103.104.165.99 - - [28/Aug/2026:08:05:07 +1000] "POST /jobeditsave.php?call=filter HTTP/1.1" 200 11576 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 203.54.180.238 - - [28/Aug/2026:08:05:08 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 283 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29431" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 10 GET / 2 POST /wp-cron.php 2 GET /@fs/proc/self/environ 1 GET /wp-json/wp/v2/users/me 1 GET /web/.env 1 GET /@vite/env 1 GET /v2/.env 1 GET /v1/.env 1 GET /uploads../.env 1 GET /src/.env 1 GET /server/.env 1 GET /public/.env -- last 10 requests -- 35.229.55.35 - - [28/Aug/2026:08:05:01 +1000] "GET /backend/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (compatible; meta-externalagent/1.1; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" 35.229.55.35 - - [28/Aug/2026:08:05:01 +1000] "GET /core/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:133.10) Gecko/20100101 Firefox/133.10; compatible; GrokBot/1.0; +https://x.ai/grokbot" 35.229.55.35 - - [28/Aug/2026:08:05:01 +1000] "GET /web/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 35.229.55.35 - - [28/Aug/2026:08:05:01 +1000] "GET /frontend/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +https://www.anthropic.com/claude-user)" 35.229.55.35 - - [28/Aug/2026:08:05:01 +1000] "GET /src/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.2; +https://openai.com/gptbot) 35.229.55.35 - - [28/Aug/2026:08:05:01 +1000] "GET /server/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.1023.173 Mobile Safari/537. 35.229.55.35 - - [28/Aug/2026:08:05:00 +1000] "GET /.env.old HTTP/1.1" 404 123948 "-" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.2267.187 Safari/537.36; compatible; Byt 35.229.55.35 - - [28/Aug/2026:08:05:00 +1000] "GET /.env.bak HTTP/1.1" 404 123944 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Twitterbot/1.0) Chrome/118.0.1077.7 35.229.55.35 - - [28/Aug/2026:08:05:01 +1000] "GET /.env.swp HTTP/1.1" 404 123944 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:150.12) Gecko/20100101 Firefox/150.12; compatible; meta-externalagent/1.1; +https:// 35.229.55.35 - - [28/Aug/2026:08:05:06 +1000] "GET /public/.env HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.4558.131 Safari/537.36; compatible; Grok == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 53 GET /heartbeat.php 2 POST /portal/register 2 POST /factory_functions.php 2 GET /index.php 2 GET /factory_session_checker.php 1 GET /factory_session_processed_qty.php 1 GET /factory_session_joiner.php -- last 10 requests -- 203.54.180.238 - - [28/Aug/2026:08:04:45 +1000] "GET /heartbeat.php?sentAt=1787868285&bytes=106,144,180,125&_=1787867825101 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=5 203.54.180.238 - - [28/Aug/2026:08:04:48 +1000] "GET /heartbeat.php?sentAt=1787868284&bytes=106,144,180,124&_=1787865012238 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [28/Aug/2026:08:04:50 +1000] "GET /heartbeat.php?sentAt=1787868290&bytes=106,144,180,130&_=1787810682126 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [28/Aug/2026:08:04:52 +1000] "GET /heartbeat.php?sentAt=1787868292&bytes=106,144,180,132&_=1787835392683 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [28/Aug/2026:08:04:55 +1000] "GET /heartbeat.php?sentAt=1787868295&bytes=106,144,180,135&_=1787867825102 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=5 203.54.180.238 - - [28/Aug/2026:08:04:56 +1000] "GET /heartbeat.php?sentAt=1787868294&bytes=106,144,180,134&_=1787865012239 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [28/Aug/2026:08:05:00 +1000] "GET /heartbeat.php?sentAt=1787868300&bytes=106,144,180,140&_=1787810682127 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [28/Aug/2026:08:05:03 +1000] "GET /heartbeat.php?sentAt=1787868302&bytes=106,144,180,142&_=1787835392684 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [28/Aug/2026:08:05:05 +1000] "GET /heartbeat.php?sentAt=1787868305&bytes=106,144,180,145&_=1787867825103 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=5 203.54.180.238 - - [28/Aug/2026:08:05:06 +1000] "GET /heartbeat.php?sentAt=1787868304&bytes=106,144,180,144&_=1787865012240 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 --- last 30 samples (run-up to this incident) --- 2026-08-28 08:02:43 L1=2.27 run=1 blk=0 avail=9477 (68.8%) swpO=0 conn=1 myRSS=1748 php=2 phpRSS=69 ap=33 tcp=35 topuser=evolution 2026-08-28 08:02:52 L1=1.92 run=1 blk=0 avail=9518 (69.1%) swpO=0 conn=2 myRSS=1748 php=2 phpRSS=69 ap=27 tcp=32 topuser=evolution 2026-08-28 08:02:54 L1=1.92 run=3 blk=0 avail=9205 (66.8%) swpO=0 conn=1 myRSS=1748 php=4 phpRSS=450 ap=25 tcp=33 topuser=madalice 2026-08-28 08:03:02 L1=1.93 run=4 blk=0 avail=9227 (67.0%) swpO=0 conn=2 myRSS=1748 php=6 phpRSS=441 ap=28 tcp=41 topuser=madalice 2026-08-28 08:03:04 L1=1.93 run=2 blk=0 avail=8994 (65.3%) swpO=0 conn=1 myRSS=1748 php=6 phpRSS=640 ap=32 tcp=46 topuser=corpkicks 2026-08-28 08:03:12 L1=1.88 run=5 blk=0 avail=9062 (65.8%) swpO=0 conn=2 myRSS=1748 php=9 phpRSS=628 ap=35 tcp=45 topuser=evolution 2026-08-28 08:03:14 L1=1.88 run=2 blk=0 avail=9205 (66.8%) swpO=1 conn=1 myRSS=1748 php=9 phpRSS=436 ap=38 tcp=55 topuser=evolution 2026-08-28 08:03:22 L1=1.82 run=4 blk=0 avail=9209 (66.8%) swpO=1 conn=2 myRSS=1748 php=5 phpRSS=219 ap=62 tcp=48 topuser=evolution 2026-08-28 08:03:24 L1=1.82 run=1 blk=0 avail=9287 (67.4%) swpO=0 conn=1 myRSS=1748 php=2 phpRSS=69 ap=60 tcp=47 topuser=evolution 2026-08-28 08:03:32 L1=1.92 run=1 blk=0 avail=9236 (67.0%) swpO=0 conn=1 myRSS=1748 php=3 phpRSS=202 ap=51 tcp=46 topuser=madalice 2026-08-28 08:03:34 L1=1.92 run=3 blk=0 avail=9221 (66.9%) swpO=0 conn=1 myRSS=1748 php=4 phpRSS=264 ap=50 tcp=48 topuser=madalice 2026-08-28 08:03:42 L1=1.70 run=3 blk=0 avail=9232 (67.0%) swpO=0 conn=1 myRSS=1749 php=6 phpRSS=374 ap=41 tcp=35 topuser=evolution 2026-08-28 08:03:44 L1=1.70 run=4 blk=0 avail=9074 (65.9%) swpO=0 conn=3 myRSS=1749 php=5 phpRSS=474 ap=40 tcp=38 topuser=olympic 2026-08-28 08:03:52 L1=1.51 run=1 blk=0 avail=9363 (68.0%) swpO=0 conn=1 myRSS=1749 php=3 phpRSS=225 ap=31 tcp=29 topuser=madalice 2026-08-28 08:03:54 L1=1.51 run=6 blk=0 avail=9337 (67.8%) swpO=0 conn=3 myRSS=1749 php=4 phpRSS=229 ap=30 tcp=31 topuser=madalice 2026-08-28 08:04:02 L1=1.43 run=4 blk=0 avail=9234 (67.0%) swpO=0 conn=1 myRSS=1749 php=5 phpRSS=419 ap=27 tcp=41 topuser=madalice 2026-08-28 08:04:04 L1=1.43 run=1 blk=0 avail=9229 (67.0%) swpO=0 conn=3 myRSS=1749 php=4 phpRSS=358 ap=27 tcp=48 topuser=madalice 2026-08-28 08:04:12 L1=1.29 run=6 blk=0 avail=9012 (65.4%) swpO=0 conn=1 myRSS=1749 php=7 phpRSS=477 ap=58 tcp=71 topuser=madalice 2026-08-28 08:04:14 L1=1.29 run=1 blk=0 avail=9044 (65.6%) swpO=0 conn=3 myRSS=1749 php=4 phpRSS=358 ap=58 tcp=59 topuser=madalice 2026-08-28 08:04:22 L1=1.17 run=2 blk=0 avail=9094 (66.0%) swpO=0 conn=1 myRSS=1749 php=5 phpRSS=398 ap=49 tcp=39 topuser=madalice 2026-08-28 08:04:24 L1=1.17 run=1 blk=0 avail=9249 (67.1%) swpO=0 conn=3 myRSS=1749 php=3 phpRSS=202 ap=48 tcp=39 topuser=madalice 2026-08-28 08:04:32 L1=1.14 run=1 blk=0 avail=9272 (67.3%) swpO=0 conn=2 myRSS=1749 php=4 phpRSS=242 ap=42 tcp=49 topuser=madalice 2026-08-28 08:04:34 L1=1.14 run=12 blk=0 avail=8907 (64.6%) swpO=1 conn=3 myRSS=1755 php=9 phpRSS=778 ap=41 tcp=81 topuser=evolution 2026-08-28 08:04:43 L1=1.34 run=1 blk=0 avail=9254 (67.2%) swpO=1 conn=2 myRSS=1755 php=4 phpRSS=263 ap=41 tcp=38 topuser=madalice 2026-08-28 08:04:44 L1=1.34 run=1 blk=0 avail=9276 (67.3%) swpO=0 conn=1 myRSS=1755 php=3 phpRSS=222 ap=40 tcp=42 topuser=madalice 2026-08-28 08:04:53 L1=2.90 run=3 blk=0 avail=9093 (66.0%) swpO=0 conn=2 myRSS=1779 php=6 phpRSS=458 ap=41 tcp=35 topuser=evolution 2026-08-28 08:04:54 L1=2.90 run=5 blk=0 avail=8769 (63.7%) swpO=0 conn=1 myRSS=1779 php=7 phpRSS=811 ap=40 tcp=51 topuser=evolution 2026-08-28 08:05:03 L1=3.33 run=3 blk=0 avail=9185 (66.7%) swpO=0 conn=2 myRSS=1779 php=4 phpRSS=289 ap=40 tcp=64 topuser=madalice 2026-08-28 08:05:04 L1=3.33 run=4 blk=0 avail=8991 (65.3%) swpO=0 conn=1 myRSS=1779 php=4 phpRSS=505 ap=40 tcp=41 topuser=madalice 2026-08-28 08:05:13 L1=3.73 run=3 blk=0 avail=8045 (58.4%) swpO=0 conn=4 myRSS=1780 php=15 phpRSS=1506 ap=68 tcp=64 topuser=madalice