INCIDENT 2026-09-02 13:28:21 trigger: mem_avail=11.7% load=109.99/10cpu swapout=3196/s php_procs=116 php_rss=11978MB mysql_conn=102 ================================================================== load: 109.99 47.58 19.19 119/925 3069540 ncpu:10 mem_avail: 1616MB/13777MB (11.7%) swap_used:2177MB swapout:3196/s blocked(D):2 running:122 iowait:2.3% steal:0.0% php: 116 procs / 11978MB heaviest user: otterfencing (96 procs, 10706MB) apache: 161 procs tcp_estab: 396 --- RSS by user (all processes) --- USER PROCS RSS_MB otterfencing 97 10817 nobody 160 1658 mysql 1 880 madalice 4 631 evolution 21 630 root 246 411 netdata 7 164 mailman 20 42 dovenull 6 16 zabbix 1 14 candyfabcom 1 13 wp-toolkit 3 11 cpanellogin 1 9 aaa 5 8 dovecot 3 7 cpanelconnecttrack 1 3 polkitd 1 2 dbus 1 2 mailnull 1 1 kurri 1 1 --- php workers by user --- USER PROCS RSS_MB otterfencing 97 10829 nobody 160 1659 mysql 1 880 madalice 4 631 evolution 20 611 root 246 411 netdata 7 164 mailman 20 42 dovenull 6 16 zabbix 1 14 candyfabcom 1 13 wp-toolkit 3 11 cpanellogin 1 9 aaa 5 8 dovecot 3 7 cpanelconnecttrack 1 3 polkitd 1 2 dbus 1 2 mailnull 1 1 kurri 1 1 --- php workers by user --- USER PROCS RSS_MB otterfencing 97 10853 madalice 4 632 evolution 14 608 root 1 3 --- vm tuning / memory pressure --- otterfencing 97 10865 madalice 4 632 evolution 14 611 root 1 3 vm.swappiness 30 --- vm tuning / memory pressure --- vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.swappiness 30 vm.overcommit_memory 0 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6343 MB Active(file): 1043 MB Inactive(file): 317 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 195 MB CommitLimit: 10984 MB Committed_AS: 27311 MB --- backup / dump / scan processes (page-cache evictors) --- vm.overcommit_ratio 50 Cached: 6347 MB Active(file): 1043 MB Inactive(file): 317 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 195 MB CommitLimit: 10984 MB Committed_AS: 27318 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 1-11:05:53 1252 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 1-11:05:53 1252 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3067388 1 mysql 907024 29.2 Ssl 01:34 /usr/sbin/mariadbd 3068132 3929444 madalice 248244 5.7 S 01:13 php-fpm: pool madalice_com_au 3068831 3929444 madalice 217752 9.0 R 00:42 php-fpm: pool madalice_com_au 3069062 3048964 otterfencing 175160 8.1 R 00:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069074 3066560 otterfencing 173668 7.8 R 00:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069269 3066710 otterfencing 171956 10.7 R 00:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069160 3066999 otterfencing 169920 9.0 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069111 3066714 otterfencing 168064 10.7 S 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069085 3066848 otterfencing 165476 7.7 S 00:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069089 3050923 otterfencing 165416 7.7 S 00:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069135 3066827 otterfencing 165276 9.5 R 00:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069262 3066258 otterfencing 160708 9.0 R 00:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069077 3051647 otterfencing 160580 8.1 S 00:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069158 3067101 otterfencing 160528 8.0 S 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069210 3066652 otterfencing 155920 8.5 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069272 3066822 otterfencing 155684 14.7 R 00:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069401 3066802 otterfencing 155488 20.6 R 00:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069226 3066705 otterfencing 154892 10.2 R 00:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069208 3066474 otterfencing 154180 9.3 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069211 3066539 otterfencing 153792 9.5 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069114 3066808 otterfencing 153452 6.5 R 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069071 3066825 otterfencing 153272 7.4 R 00:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069215 3067033 otterfencing 152824 8.3 S 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069093 3066703 otterfencing 152592 8.0 R 00:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069101 3066544 otterfencing 151912 8.5 R 00:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069096 3066110 otterfencing 149884 8.4 R 00:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069131 3051813 otterfencing 149120 8.4 R 00:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069122 3066624 otterfencing 149044 9.7 R 00:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 508924 1 netdata 147896 2.0 Ssl 5-11:08:42 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3069119 3066658 otterfencing 147624 8.3 R 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069253 3066549 otterfencing 145120 7.4 S 00:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069118 3066288 otterfencing 143464 5.9 R 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069124 3066800 otterfencing 143352 8.7 R 00:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069229 3066558 otterfencing 142264 9.2 R 00:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069109 3066715 otterfencing 141280 6.8 R 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069251 3051635 otterfencing 140656 7.6 R 00:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069398 3929444 madalice 140652 7.0 R 00:10 php-fpm: pool madalice_com_au 3069261 3050681 otterfencing 140436 8.7 R 00:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069282 3051682 otterfencing 137448 9.4 S 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069254 3049586 otterfencing 131684 9.1 S 00:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069289 3067102 otterfencing 131464 10.6 S 00:16 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069288 3066655 otterfencing 129924 10.0 R 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069133 3067090 otterfencing 129504 6.6 R 00:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069209 3066801 otterfencing 128864 8.5 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069198 3066816 otterfencing 128860 7.3 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069123 3051817 otterfencing 125716 7.2 R 00:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069394 3067247 otterfencing 125136 13.2 R 00:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069256 3066814 otterfencing 121636 6.8 R 00:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069213 3066244 otterfencing 120420 6.8 S 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069217 3066804 otterfencing 120196 8.4 S 00:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069400 3066819 otterfencing 120116 11.3 R 00:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069383 3066641 otterfencing 114992 10.2 R 00:11 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069322 3066657 otterfencing 113632 12.0 R 00:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069270 3066554 otterfencing 112624 7.1 R 00:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069287 3066555 otterfencing 112620 8.0 R 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069120 3067479 otterfencing 112564 7.3 R 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069231 3047648 otterfencing 110984 7.5 R 00:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069278 3066432 otterfencing 110576 7.1 R 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069395 3066707 otterfencing 108020 11.0 R 00:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069396 3066799 otterfencing 106876 12.0 R 00:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- 3069610 D - ps -eo pid,ppid,user:20,rss,pcpu,stat,etime,args --sort=-rss --- mariadb processlist (non-sleeping) --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3067388 1 mysql 907024 29.3 Ssl 01:34 /usr/sbin/mariadbd 3068132 3929444 madalice 248244 5.7 R 01:13 php-fpm: pool madalice_com_au 3068831 3929444 madalice 219864 9.1 R 00:42 php-fpm: pool madalice_com_au 3069062 3048964 otterfencing 175760 8.1 S 00:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069269 3066710 otterfencing 174704 10.8 R 00:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069074 3066560 otterfencing 173668 7.8 R 00:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069160 3066999 otterfencing 169920 9.0 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069085 3066848 otterfencing 168092 7.8 R 00:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069111 3066714 otterfencing 168064 10.7 R 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069135 3066827 otterfencing 165648 9.6 R 00:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069089 3050923 otterfencing 165416 7.7 R 00:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069262 3066258 otterfencing 161320 9.1 R 00:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069077 3051647 otterfencing 160580 8.2 R 00:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069158 3067101 otterfencing 160528 8.0 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069210 3066652 otterfencing 157096 8.6 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069401 3066802 otterfencing 155956 20.7 R 00:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069272 3066822 otterfencing 155684 14.7 R 00:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069114 3066808 otterfencing 155424 6.6 R 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069208 3066474 otterfencing 155116 9.4 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069226 3066705 otterfencing 154892 10.2 R 00:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069211 3066539 otterfencing 153792 9.5 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069071 3066825 otterfencing 153368 7.5 R 00:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069215 3067033 otterfencing 153280 8.3 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069093 3066703 otterfencing 152592 8.0 R 00:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069101 3066544 otterfencing 151912 8.5 R 00:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069096 3066110 otterfencing 149884 8.4 R 00:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069131 3051813 otterfencing 149120 8.4 R 00:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069122 3066624 otterfencing 149044 9.7 R 00:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 508924 1 netdata 147832 2.0 Ssl 5-11:08:42 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3069119 3066658 otterfencing 147624 8.3 R 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069253 3066549 otterfencing 145120 7.4 R 00:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069118 3066288 otterfencing 143464 5.9 R 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069124 3066800 otterfencing 143352 8.7 R 00:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069229 3066558 otterfencing 142264 9.2 R 00:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069398 3929444 madalice 142216 7.0 R 00:10 php-fpm: pool madalice_com_au 3069109 3066715 otterfencing 141280 6.8 R 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069251 3051635 otterfencing 140656 7.6 R 00:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069261 3050681 otterfencing 140436 8.7 R 00:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069282 3051682 otterfencing 137448 9.4 R 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069289 3067102 otterfencing 133052 10.7 R 00:16 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069254 3049586 otterfencing 132916 9.1 R 00:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069288 3066655 otterfencing 129924 10.0 R 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069209 3066801 otterfencing 129804 8.6 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069133 3067090 otterfencing 129504 6.6 R 00:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069198 3066816 otterfencing 128860 7.3 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069123 3051817 otterfencing 125716 7.2 R 00:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069394 3067247 otterfencing 125136 13.2 R 00:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069256 3066814 otterfencing 121636 6.8 R 00:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069213 3066244 otterfencing 121360 6.9 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069217 3066804 otterfencing 120196 8.4 R 00:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069400 3066819 otterfencing 120116 11.3 R 00:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069383 3066641 otterfencing 115288 10.3 R 00:11 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069287 3066555 otterfencing 113644 8.1 R 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069322 3066657 otterfencing 113632 12.0 R 00:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069270 3066554 otterfencing 112624 7.1 R 00:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069120 3067479 otterfencing 112564 7.3 R 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069278 3066432 otterfencing 111232 7.2 R 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069231 3047648 otterfencing 110984 7.5 R 00:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069396 3066799 otterfencing 108064 12.3 R 00:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069395 3066707 otterfencing 108020 11.0 R 00:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- +------+--------------+-----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +------+--------------+-----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4014 | lecsafec_evo | lecsafec_icatv2 | Prepare | 22 | Checking table | results | | 6106 | root | 108-1481181613 | Execute | 1 | Sending data | SELECT bomraw FROM jobInventory WHERE referenceId = ? | | 6178 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +------+--------------+-----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- mariadb processlist (non-sleeping) --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- +------+----------------------+-----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +------+----------------------+-----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4014 | lecsafec_evo | lecsafec_icatv2 | Prepare | 22 | Checking table | results | | 6106 | root | 108-1481181613 | Execute | 1 | Sending data | SELECT bomraw FROM jobInventory WHERE referenceId = ? | | 6182 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 6180 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | +------+----------------------+-----------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min VHOST LOG REQ/3min otterfencing/otterfencing.com.au-ssl_log 519 evolution/my.evolutionerp.com.au-ssl_log 297 evolution/portal.evolutionerp.com.au-ssl_log 130 evolution/app.evolutionerp.com.au-ssl_log 73 aaa/aaadownunder.com.au-ssl_log 39 madalice/madalice.com.au-ssl_log 5 evolution/evolutionerp.com.au-ssl_log 1 otterfencing/otterfencing.com.au-ssl_log 519 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- evolution/my.evolutionerp.com.au-ssl_log 297 evolution/portal.evolutionerp.com.au-ssl_log 130 evolution/app.evolutionerp.com.au-ssl_log 73 aaa/aaadownunder.com.au-ssl_log 39 madalice/madalice.com.au-ssl_log 5 evolution/evolutionerp.com.au-ssl_log 1 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 540 35.221.22.116 287 203.54.180.238 73 40.115.94.245 41 165.225.233.87 33 103.104.165.99 30 150.228.151.47 27 103.104.164.114 24 1.144.107.82 11 182.239.240.254 10 101.182.108.127 6 147.161.213.78 5 180.181.236.49 2 147.161.215.96 2 114.119.159.70 1 66.249.68.64 --- top request paths across all vhosts (last 3 min) --- 540 35.221.22.116 287 203.54.180.238 73 40.115.94.245 41 165.225.233.87 33 103.104.165.99 30 150.228.151.47 27 103.104.164.114 24 1.144.107.82 11 182.239.240.254 10 101.182.108.127 6 147.161.213.78 5 180.181.236.49 2 147.161.215.96 2 114.119.159.70 1 66.249.68.64 --- top request paths across all vhosts (last 3 min) --- 157 POST /functions.php 51 GET /index.php 41 GET /factory_session_checker.php 37 GET /api/getItem/LWPB2001KG 29 GET /app/ajax.php 26 POST /app/ajax/selectFilter.php 23 GET /heartbeat.php 23 GET /factory_session_processed_qty.php 22 GET /factory_session_joiner.php 12 GET /api/getItem/LWHG2001KG 10 POST /plugins/csvexporter/plugin.php 8 POST /quoteditsave.php 7 POST /portal/register 6 POST /plugins/pipe/pipetopostsave.php 6 POST /app/ajax/selectFilterSingle.php 5 POST /purchaseaddsave.php 4 POST /plugins/shopify/plugin.php 3 GET / 2 POST /testTagUploadsave.php 2 POST /itemModify.php --- busiest 3 vhosts: top paths + last 10 requests --- == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 1 GET /www.zst 1 GET /www.zip 1 GET /www.tgz 1 GET /www.tar.xz 1 GET /www.tar.gz 1 GET /www.sql.gz 1 GET /www.sql.bz2 1 GET /www.sql 1 GET /web.zip 1 GET /web.tgz 1 GET /web.tar.xz 1 GET /web.tar.gz -- last 10 requests -- 35.221.22.116 - - [02/Sep/2026:13:27:59 +1000] "GET /settings.7z HTTP/1.1" 404 56731 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:28:04 +1000] "GET /secrets.7z HTTP/1.1" 404 56728 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:28:02 +1000] "GET /conf.sql.gz HTTP/1.1" 404 56731 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:27:59 +1000] "GET /settings.tar.bz2 HTTP/1.1" 404 56741 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:28:03 +1000] "GET /secrets.tar HTTP/1.1" 404 56731 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:27:53 +1000] "GET /configs.tar.bz2 HTTP/1.1" 404 56738 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:27:59 +1000] "GET /settings.gz HTTP/1.1" 404 56731 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:28:02 +1000] "GET /secrets.tar.gz HTTP/1.1" 404 56737 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:27:55 +1000] "GET /configs.sql.bz2 HTTP/1.1" 404 56739 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:27:55 +1000] "GET /configs.gz HTTP/1.1" 404 56729 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 157 POST /functions.php 38 GET /index.php 29 GET /app/ajax.php 26 POST /app/ajax/selectFilter.php 10 POST /plugins/csvexporter/plugin.php 8 POST /quoteditsave.php 6 POST /plugins/pipe/pipetopostsave.php 6 POST /app/ajax/selectFilterSingle.php 5 POST /purchaseaddsave.php 4 POST /plugins/shopify/plugin.php 2 POST /testTagUploadsave.php 2 POST /itemModify.php -- last 10 requests -- 157 POST /functions.php 51 GET /index.php 41 GET /factory_session_checker.php 37 GET /api/getItem/LWPB2001KG 29 GET /app/ajax.php 26 POST /app/ajax/selectFilter.php 23 GET /heartbeat.php 23 GET /factory_session_processed_qty.php 22 GET /factory_session_joiner.php 12 GET /api/getItem/LWHG2001KG 10 POST /plugins/csvexporter/plugin.php 8 POST /quoteditsave.php 7 POST /portal/register 6 POST /plugins/pipe/pipetopostsave.php 6 POST /app/ajax/selectFilterSingle.php 5 POST /purchaseaddsave.php 4 POST /plugins/shopify/plugin.php 3 GET / 2 POST /testTagUploadsave.php 2 POST /itemModify.php --- busiest 3 vhosts: top paths + last 10 requests --- == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 1 GET /www.zst 1 GET /www.zip 1 GET /www.tgz 1 GET /www.tar.xz 1 GET /www.tar.gz 1 GET /www.sql.gz 1 GET /www.sql.bz2 1 GET /www.sql 1 GET /web.zip 1 GET /web.tgz 1 GET /web.tar.xz 1 GET /web.tar.gz -- last 10 requests -- 203.54.180.238 - - [02/Sep/2026:13:28:18 +1000] "GET /index.php?page=plugins HTTP/1.1" 200 6216 "https://my.evolutionerp.com.au/index.php?page=invcatedit&id=13&tab=collectionew-tab" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [02/Sep/2026:13:28:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29539&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [02/Sep/2026:13:28:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=mfshoporderdetail&id=43835" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 103.104.165.99 - - [02/Sep/2026:13:28:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 51 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=2667&tab=clienteditgeneral" "Mozilla/5.0 (Windows NT 103.104.165.99 - - [02/Sep/2026:13:28:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 51 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=2673&tab=clienteditgeneral" "Mozilla/5.0 (Windows NT 203.54.180.238 - - [02/Sep/2026:13:28:18 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 103.104.165.99 - - [02/Sep/2026:13:28:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 51 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=2661&tab=clienteditgeneral" "Mozilla/5.0 (Windows NT 203.54.180.238 - - [02/Sep/2026:13:28:00 +1000] "GET /index.php?page=opportunities HTTP/1.1" 200 157247 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, lik 203.54.180.238 - - [02/Sep/2026:13:28:20 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invedit&id=6666&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 203.54.180.238 - - [02/Sep/2026:13:28:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=mfshoporderdetail&id=43960" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 35.221.22.116 - - [02/Sep/2026:13:27:59 +1000] "GET /settings.7z HTTP/1.1" 404 56731 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:28:04 +1000] "GET /secrets.7z HTTP/1.1" 404 56728 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:28:02 +1000] "GET /conf.sql.gz HTTP/1.1" 404 56731 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:27:59 +1000] "GET /settings.tar.bz2 HTTP/1.1" 404 56741 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:28:03 +1000] "GET /secrets.tar HTTP/1.1" 404 56731 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:27:53 +1000] "GET /configs.tar.bz2 HTTP/1.1" 404 56738 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:27:59 +1000] "GET /settings.gz HTTP/1.1" 404 56731 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:28:02 +1000] "GET /secrets.tar.gz HTTP/1.1" 404 56737 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:27:55 +1000] "GET /configs.sql.bz2 HTTP/1.1" 404 56739 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:27:55 +1000] "GET /configs.gz HTTP/1.1" 404 56729 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 41 GET /factory_session_checker.php 23 GET /heartbeat.php 23 GET /factory_session_processed_qty.php 22 GET /factory_session_joiner.php 13 GET /index.php 7 POST /portal/register 1 POST /factory_functions.php -- last 10 requests -- 157 POST /functions.php 38 GET /index.php 29 GET /app/ajax.php 26 POST /app/ajax/selectFilter.php 10 POST /plugins/csvexporter/plugin.php 8 POST /quoteditsave.php 6 POST /plugins/pipe/pipetopostsave.php 6 POST /app/ajax/selectFilterSingle.php 5 POST /purchaseaddsave.php 4 POST /plugins/shopify/plugin.php 2 POST /testTagUploadsave.php 2 POST /itemModify.php -- last 10 requests -- 203.54.180.238 - - [02/Sep/2026:13:28:18 +1000] "GET /index.php?page=plugins HTTP/1.1" 200 6216 "https://my.evolutionerp.com.au/index.php?page=invcatedit&id=13&tab=collectionew-tab" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [02/Sep/2026:13:28:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29539&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 203.54.180.238 - - [02/Sep/2026:13:28:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=mfshoporderdetail&id=43835" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 103.104.165.99 - - [02/Sep/2026:13:28:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 51 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=2667&tab=clienteditgeneral" "Mozilla/5.0 (Windows NT 103.104.165.99 - - [02/Sep/2026:13:28:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 51 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=2673&tab=clienteditgeneral" "Mozilla/5.0 (Windows NT 203.54.180.238 - - [02/Sep/2026:13:28:18 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 234 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 103.104.165.99 - - [02/Sep/2026:13:28:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 51 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=2661&tab=clienteditgeneral" "Mozilla/5.0 (Windows NT 203.54.180.238 - - [02/Sep/2026:13:28:00 +1000] "GET /index.php?page=opportunities HTTP/1.1" 200 157247 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, lik 203.54.180.238 - - [02/Sep/2026:13:28:20 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invedit&id=6666&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 203.54.180.238 - - [02/Sep/2026:13:28:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=mfshoporderdetail&id=43960" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 203.54.180.238 - - [02/Sep/2026:13:28:05 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [02/Sep/2026:13:28:08 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:13:28:07 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:13:28:10 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 124 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [02/Sep/2026:13:28:13 +1000] "GET /factory_session_joiner.php?id=35053 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [02/Sep/2026:13:28:14 +1000] "GET /factory_session_joiner.php?id=35057 HTTP/1.1" 200 79 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [02/Sep/2026:13:28:14 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:13:28:15 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:13:28:16 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [02/Sep/2026:13:28:08 +1000] "GET /index.php?page=factory_proc_queue&process=9 HTTP/1.1" 200 24218 "https://portal.evolutionerp.com.au/index.php?page=processes" "Mozilla/5.0 (Linux; Android 10; K) Appl --- last 30 samples (run-up to this incident) --- 41 GET /factory_session_checker.php 23 GET /heartbeat.php 23 GET /factory_session_processed_qty.php 22 GET /factory_session_joiner.php 13 GET /index.php 7 POST /portal/register 1 POST /factory_functions.php -- last 10 requests -- 2026-09-02 13:25:21 L1=0.96 run=5 blk=0 avail=7996 (58.0%) swpO=0 conn=2 myRSS=3194 php=6 phpRSS=338 ap=47 tcp=54 topuser=madalice 2026-09-02 13:25:30 L1=0.88 run=5 blk=0 avail=8146 (59.1%) swpO=0 conn=1 myRSS=3194 php=3 phpRSS=120 ap=42 tcp=48 topuser=madalice 2026-09-02 13:25:31 L1=0.88 run=3 blk=0 avail=8137 (59.1%) swpO=0 conn=2 myRSS=3194 php=5 phpRSS=161 ap=41 tcp=56 topuser=madalice 2026-09-02 13:25:40 L1=0.75 run=2 blk=0 avail=8147 (59.1%) swpO=0 conn=1 myRSS=3194 php=4 phpRSS=185 ap=38 tcp=46 topuser=madalice 2026-09-02 13:25:41 L1=0.75 run=1 blk=0 avail=8170 (59.3%) swpO=0 conn=2 myRSS=3194 php=4 phpRSS=160 ap=38 tcp=50 topuser=madalice 2026-09-02 13:25:50 L1=1.01 run=2 blk=0 avail=8091 (58.7%) swpO=0 conn=1 myRSS=3194 php=4 phpRSS=229 ap=41 tcp=51 topuser=madalice 2026-09-02 13:25:51 L1=1.01 run=5 blk=0 avail=8004 (58.1%) swpO=0 conn=2 myRSS=3194 php=5 phpRSS=339 ap=41 tcp=50 topuser=evolution 2026-09-02 13:26:00 L1=1.01 run=1 blk=0 avail=8149 (59.2%) swpO=0 conn=1 myRSS=3194 php=3 phpRSS=187 ap=41 tcp=64 topuser=madalice 2026-09-02 13:26:01 L1=1.01 run=4 blk=0 avail=7948 (57.7%) swpO=0 conn=2 myRSS=3194 php=7 phpRSS=450 ap=45 tcp=67 topuser=evolution 2026-09-02 13:26:10 L1=5.00 run=74 blk=0 avail=4339 (31.5%) swpO=2130 conn=51 myRSS=3126 php=65 phpRSS=5617 ap=82 tcp=278 topuser=otterfencing 2026-09-02 13:26:11 L1=5.00 run=101 blk=0 avail=3516 (25.5%) swpO=3503 conn=60 myRSS=3082 php=79 phpRSS=6581 ap=128 tcp=313 topuser=otterfencing 2026-09-02 13:26:46 L1=81.11 run=14 blk=43 avail=3003 (21.8%) swpO=10897 conn=- myRSS=0 php=114 phpRSS=8398 ap=147 tcp=362 topuser=otterfencing 2026-09-02 13:26:46 L1=81.11 run=7 blk=12 avail=3061 (22.2%) swpO=17358 conn=- myRSS=0 php=113 phpRSS=8426 ap=148 tcp=359 topuser=otterfencing 2026-09-02 13:26:56 L1=81.11 run=141 blk=1 avail=3411 (24.8%) swpO=332 conn=111 myRSS=353 php=134 phpRSS=10566 ap=154 tcp=373 topuser=otterfencing 2026-09-02 13:26:56 L1=81.11 run=146 blk=2 avail=3404 (24.7%) swpO=0 conn=111 myRSS=354 php=135 phpRSS=10581 ap=155 tcp=377 topuser=otterfencing 2026-09-02 13:27:07 L1=91.73 run=42 blk=27 avail=601 (4.4%) swpO=9815 conn=- myRSS=470 php=138 phpRSS=13704 ap=160 tcp=395 topuser=otterfencing 2026-09-02 13:27:07 L1=91.73 run=45 blk=32 avail=574 (4.2%) swpO=14489 conn=- myRSS=474 php=126 phpRSS=13237 ap=163 tcp=394 topuser=otterfencing 2026-09-02 13:27:18 L1=102.09 run=128 blk=3 avail=1032 (7.5%) swpO=13654 conn=99 myRSS=537 php=126 phpRSS=13091 ap=175 tcp=416 topuser=otterfencing 2026-09-02 13:27:18 L1=102.09 run=123 blk=1 avail=1077 (7.8%) swpO=8980 conn=98 myRSS=538 php=123 phpRSS=13140 ap=175 tcp=420 topuser=otterfencing 2026-09-02 13:27:28 L1=105.55 run=100 blk=4 avail=3730 (27.1%) swpO=9 conn=79 myRSS=564 php=104 phpRSS=9827 ap=157 tcp=423 topuser=otterfencing 2026-09-02 13:27:38 L1=106.63 run=111 blk=0 avail=2848 (20.7%) swpO=4 conn=94 myRSS=604 php=106 phpRSS=10506 ap=156 tcp=425 topuser=otterfencing 2026-09-02 13:27:39 L1=106.74 run=108 blk=0 avail=3003 (21.8%) swpO=0 conn=96 myRSS=604 php=108 phpRSS=10602 ap=156 tcp=423 topuser=otterfencing 2026-09-02 13:27:48 L1=106.35 run=105 blk=0 avail=1858 (13.5%) swpO=0 conn=96 myRSS=618 php=113 phpRSS=11797 ap=155 tcp=409 topuser=otterfencing 2026-09-02 13:27:50 L1=106.35 run=121 blk=0 avail=1280 (9.3%) swpO=0 conn=87 myRSS=619 php=111 phpRSS=12126 ap=156 tcp=411 topuser=otterfencing 2026-09-02 13:28:00 L1=104.50 run=96 blk=1 avail=3495 (25.4%) swpO=0 conn=77 myRSS=661 php=104 phpRSS=9569 ap=154 tcp=398 topuser=otterfencing 2026-09-02 13:28:00 L1=104.50 run=103 blk=0 avail=3616 (26.3%) swpO=0 conn=80 myRSS=661 php=105 phpRSS=9531 ap=154 tcp=398 topuser=otterfencing 2026-09-02 13:28:10 L1=104.44 run=103 blk=0 avail=2655 (19.3%) swpO=0 conn=88 myRSS=820 php=105 phpRSS=10510 ap=153 tcp=396 topuser=otterfencing 2026-09-02 13:28:10 L1=104.44 run=103 blk=0 avail=2623 (19.0%) swpO=0 conn=89 myRSS=820 php=105 phpRSS=10503 ap=153 tcp=396 topuser=otterfencing 2026-09-02 13:28:21 L1=109.99 run=122 blk=2 avail=1616 (11.7%) swpO=3196 conn=102 myRSS=875 php=116 phpRSS=11978 ap=161 tcp=396 topuser=otterfencing 2026-09-02 13:28:21 L1=109.99 run=123 blk=2 avail=1579 (11.5%) swpO=3196 conn=102 myRSS=874 php=116 phpRSS=11927 ap=163 tcp=396 topuser=otterfencing 203.54.180.238 - - [02/Sep/2026:13:28:05 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [02/Sep/2026:13:28:08 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:13:28:07 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:13:28:10 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 124 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [02/Sep/2026:13:28:13 +1000] "GET /factory_session_joiner.php?id=35053 HTTP/1.1" 200 77 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [02/Sep/2026:13:28:14 +1000] "GET /factory_session_joiner.php?id=35057 HTTP/1.1" 200 79 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [02/Sep/2026:13:28:14 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:13:28:15 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:13:28:16 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [02/Sep/2026:13:28:08 +1000] "GET /index.php?page=factory_proc_queue&process=9 HTTP/1.1" 200 24218 "https://portal.evolutionerp.com.au/index.php?page=processes" "Mozilla/5.0 (Linux; Android 10; K) Appl --- last 30 samples (run-up to this incident) --- 2026-09-02 13:25:21 L1=0.96 run=5 blk=0 avail=7996 (58.0%) swpO=0 conn=2 myRSS=3194 php=6 phpRSS=338 ap=47 tcp=54 topuser=madalice 2026-09-02 13:25:30 L1=0.88 run=5 blk=0 avail=8146 (59.1%) swpO=0 conn=1 myRSS=3194 php=3 phpRSS=120 ap=42 tcp=48 topuser=madalice 2026-09-02 13:25:31 L1=0.88 run=3 blk=0 avail=8137 (59.1%) swpO=0 conn=2 myRSS=3194 php=5 phpRSS=161 ap=41 tcp=56 topuser=madalice 2026-09-02 13:25:40 L1=0.75 run=2 blk=0 avail=8147 (59.1%) swpO=0 conn=1 myRSS=3194 php=4 phpRSS=185 ap=38 tcp=46 topuser=madalice 2026-09-02 13:25:41 L1=0.75 run=1 blk=0 avail=8170 (59.3%) swpO=0 conn=2 myRSS=3194 php=4 phpRSS=160 ap=38 tcp=50 topuser=madalice 2026-09-02 13:25:50 L1=1.01 run=2 blk=0 avail=8091 (58.7%) swpO=0 conn=1 myRSS=3194 php=4 phpRSS=229 ap=41 tcp=51 topuser=madalice 2026-09-02 13:25:51 L1=1.01 run=5 blk=0 avail=8004 (58.1%) swpO=0 conn=2 myRSS=3194 php=5 phpRSS=339 ap=41 tcp=50 topuser=evolution 2026-09-02 13:26:00 L1=1.01 run=1 blk=0 avail=8149 (59.2%) swpO=0 conn=1 myRSS=3194 php=3 phpRSS=187 ap=41 tcp=64 topuser=madalice 2026-09-02 13:26:01 L1=1.01 run=4 blk=0 avail=7948 (57.7%) swpO=0 conn=2 myRSS=3194 php=7 phpRSS=450 ap=45 tcp=67 topuser=evolution 2026-09-02 13:26:10 L1=5.00 run=74 blk=0 avail=4339 (31.5%) swpO=2130 conn=51 myRSS=3126 php=65 phpRSS=5617 ap=82 tcp=278 topuser=otterfencing 2026-09-02 13:26:11 L1=5.00 run=101 blk=0 avail=3516 (25.5%) swpO=3503 conn=60 myRSS=3082 php=79 phpRSS=6581 ap=128 tcp=313 topuser=otterfencing 2026-09-02 13:26:46 L1=81.11 run=14 blk=43 avail=3003 (21.8%) swpO=10897 conn=- myRSS=0 php=114 phpRSS=8398 ap=147 tcp=362 topuser=otterfencing 2026-09-02 13:26:46 L1=81.11 run=7 blk=12 avail=3061 (22.2%) swpO=17358 conn=- myRSS=0 php=113 phpRSS=8426 ap=148 tcp=359 topuser=otterfencing 2026-09-02 13:26:56 L1=81.11 run=141 blk=1 avail=3411 (24.8%) swpO=332 conn=111 myRSS=353 php=134 phpRSS=10566 ap=154 tcp=373 topuser=otterfencing 2026-09-02 13:26:56 L1=81.11 run=146 blk=2 avail=3404 (24.7%) swpO=0 conn=111 myRSS=354 php=135 phpRSS=10581 ap=155 tcp=377 topuser=otterfencing 2026-09-02 13:27:07 L1=91.73 run=42 blk=27 avail=601 (4.4%) swpO=9815 conn=- myRSS=470 php=138 phpRSS=13704 ap=160 tcp=395 topuser=otterfencing 2026-09-02 13:27:07 L1=91.73 run=45 blk=32 avail=574 (4.2%) swpO=14489 conn=- myRSS=474 php=126 phpRSS=13237 ap=163 tcp=394 topuser=otterfencing 2026-09-02 13:27:18 L1=102.09 run=128 blk=3 avail=1032 (7.5%) swpO=13654 conn=99 myRSS=537 php=126 phpRSS=13091 ap=175 tcp=416 topuser=otterfencing 2026-09-02 13:27:18 L1=102.09 run=123 blk=1 avail=1077 (7.8%) swpO=8980 conn=98 myRSS=538 php=123 phpRSS=13140 ap=175 tcp=420 topuser=otterfencing 2026-09-02 13:27:28 L1=105.55 run=100 blk=4 avail=3730 (27.1%) swpO=9 conn=79 myRSS=564 php=104 phpRSS=9827 ap=157 tcp=423 topuser=otterfencing 2026-09-02 13:27:38 L1=106.63 run=111 blk=0 avail=2848 (20.7%) swpO=4 conn=94 myRSS=604 php=106 phpRSS=10506 ap=156 tcp=425 topuser=otterfencing 2026-09-02 13:27:39 L1=106.74 run=108 blk=0 avail=3003 (21.8%) swpO=0 conn=96 myRSS=604 php=108 phpRSS=10602 ap=156 tcp=423 topuser=otterfencing 2026-09-02 13:27:48 L1=106.35 run=105 blk=0 avail=1858 (13.5%) swpO=0 conn=96 myRSS=618 php=113 phpRSS=11797 ap=155 tcp=409 topuser=otterfencing 2026-09-02 13:27:50 L1=106.35 run=121 blk=0 avail=1280 (9.3%) swpO=0 conn=87 myRSS=619 php=111 phpRSS=12126 ap=156 tcp=411 topuser=otterfencing 2026-09-02 13:28:00 L1=104.50 run=96 blk=1 avail=3495 (25.4%) swpO=0 conn=77 myRSS=661 php=104 phpRSS=9569 ap=154 tcp=398 topuser=otterfencing 2026-09-02 13:28:00 L1=104.50 run=103 blk=0 avail=3616 (26.3%) swpO=0 conn=80 myRSS=661 php=105 phpRSS=9531 ap=154 tcp=398 topuser=otterfencing 2026-09-02 13:28:10 L1=104.44 run=103 blk=0 avail=2655 (19.3%) swpO=0 conn=88 myRSS=820 php=105 phpRSS=10510 ap=153 tcp=396 topuser=otterfencing 2026-09-02 13:28:10 L1=104.44 run=103 blk=0 avail=2623 (19.0%) swpO=0 conn=89 myRSS=820 php=105 phpRSS=10503 ap=153 tcp=396 topuser=otterfencing 2026-09-02 13:28:21 L1=109.99 run=122 blk=2 avail=1616 (11.7%) swpO=3196 conn=102 myRSS=875 php=116 phpRSS=11978 ap=161 tcp=396 topuser=otterfencing 2026-09-02 13:28:21 L1=109.99 run=123 blk=2 avail=1579 (11.5%) swpO=3196 conn=102 myRSS=874 php=116 phpRSS=11927 ap=163 tcp=396 topuser=otterfencing