INCIDENT 2026-09-02 13:30:25 trigger: mem_avail=5.6% load=124.63/10cpu blocked=24 swapout=3891/s php_procs=138 php_rss=13701MB mysql_conn=111 ================================================================== load: 124.63 74.87 32.83 130/949 3072830 ncpu:10 mem_avail: 772MB/13777MB (5.6%) swap_used:2869MB swapout:3891/s blocked(D):24 running:109 iowait:2.5% steal:0.0% php: 138 procs / 13701MB heaviest user: otterfencing (112 procs, 12404MB) apache: 154 procs tcp_estab: 410 --- RSS by user (all processes) --- USER PROCS RSS_MB otterfencing 109 12158 nobody 154 1420 evolution 29 768 mysql 1 609 madalice 4 481 kamcool 3 185 root 250 169 netdata 7 127 mailnull 6 42 mailman 20 28 aaa 6 18 dovenull 6 16 zabbix 1 12 wp-toolkit 3 8 dovecot 3 6 kurri 1 3 polkitd 1 2 named 1 2 dbus 1 2 cpanelconnecttrack 1 2 --- php workers by user --- USER PROCS RSS_MB otterfencing 109 12189 evolution 20 727 madalice 4 481 root 1 1 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 6342 MB Active(file): 442 MB Inactive(file): 273 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 176 MB CommitLimit: 10984 MB Committed_AS: 30001 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3071416 root 00:25 3308 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : 3926885 root 1-11:07:58 1468 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3067388 1 mysql 624432 29.8 Ssl 03:39 /usr/sbin/mariadbd 3071500 3066813 otterfencing 175140 8.3 R 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071273 3066539 otterfencing 175052 6.9 R 00:34 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071428 3066824 otterfencing 174808 7.5 R 00:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071362 3066703 otterfencing 166132 7.4 R 00:30 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071612 3049465 otterfencing 165936 11.6 Rl 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071251 3066555 otterfencing 165716 4.8 Sl 00:37 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071256 3067176 otterfencing 164000 6.0 R 00:36 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071247 3066804 otterfencing 163000 5.8 R 00:37 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071537 3067390 otterfencing 160812 8.1 R 00:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071246 3066543 otterfencing 160428 6.0 R 00:37 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071577 3066652 otterfencing 159392 10.2 R 00:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071684 3048349 otterfencing 159292 12.0 R 00:16 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071607 3066717 otterfencing 159272 9.9 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071375 3066612 otterfencing 157344 7.3 S 00:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071670 3051682 otterfencing 156660 12.5 R 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071501 3066803 otterfencing 156612 7.5 R 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071107 3067090 otterfencing 155804 3.8 R 00:49 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071320 3051647 otterfencing 154804 7.0 R 00:31 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071369 3066819 otterfencing 154704 6.2 R 00:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071383 3066826 otterfencing 153888 8.4 R 00:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071548 3050201 otterfencing 152504 9.9 R 00:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071392 3066848 otterfencing 149960 6.6 R 00:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071644 3066799 otterfencing 149644 10.7 R 00:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071252 3066825 otterfencing 147548 5.4 R 00:37 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071302 3067483 otterfencing 147440 5.3 R 00:33 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3068831 3929444 madalice 146936 5.2 S 02:47 php-fpm: pool madalice_com_au 3071645 3066476 otterfencing 146716 10.1 R 00:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069467 3929444 madalice 146220 5.0 S 02:06 php-fpm: pool madalice_com_au 3071396 3066542 otterfencing 145224 8.5 R 00:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071239 3066258 otterfencing 144980 4.6 R 00:38 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071545 3050646 otterfencing 141432 10.6 R 00:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071365 3051099 otterfencing 140932 7.7 R 00:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071487 3066642 otterfencing 140908 8.4 R 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071677 3066706 otterfencing 135856 9.2 R 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071368 3067033 otterfencing 135072 6.1 R 00:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071566 3066651 otterfencing 133308 8.6 R 00:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071673 3066808 otterfencing 131784 9.0 R 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071884 3066541 otterfencing 130952 11.9 R 00:11 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071606 3066560 otterfencing 130236 7.2 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3072247 3067029 otterfencing 128836 17.2 R 00:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071667 3067089 otterfencing 128180 10.7 R 00:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071303 3067391 otterfencing 127740 5.3 R 00:33 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071371 3066624 otterfencing 127664 5.3 R 00:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071459 3066827 otterfencing 127236 6.4 R 00:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071669 3066657 otterfencing 126316 7.4 R 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071381 3049586 otterfencing 126004 4.8 R 00:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071493 3066801 otterfencing 125732 5.9 R 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071314 3066442 otterfencing 125344 4.9 R 00:32 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071662 3067392 otterfencing 125196 7.7 R 00:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071310 3066538 otterfencing 124552 6.3 R 00:33 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071374 3066817 otterfencing 123816 5.8 R 00:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071542 3066475 otterfencing 123736 8.7 R 00:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071586 3066823 otterfencing 122684 5.3 R 00:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071306 3066806 otterfencing 122304 4.3 R 00:33 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071379 3067482 otterfencing 120948 4.9 R 00:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071874 3066653 otterfencing 120904 16.0 R 00:11 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071608 3067101 otterfencing 120528 6.6 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3071609 3067247 otterfencing 116276 5.9 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3069398 3929444 madalice 115392 4.3 S 02:15 php-fpm: pool madalice_com_au --- processes in D state (uninterruptible IO) --- 3071696 D - find /home/evolution/staging.evolutionerp.com.au -path ./companies -prune -o -type d -exec chmod 0755 {} ; 3072890 D - /usr/sbin/httpd -k start 3072908 D - /usr/sbin/httpd -k start --- mariadb processlist (non-sleeping) --- +-------+--------------+-----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +-------+--------------+-----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9394 | lecsafec_evo | lecsafec_icatv2 | Execute | 50 | Sending data | update assets,results set results.asset_id=assets.id WHERE assets.uploadid='39206' AND results.uploadid=assets.uploadid AND assets.assetkey=results.assetkey AND assets.jobid=results.jobid | | 12872 | root | 304-1779936994 | Execute | 3 | Sending data | SELECT purchases.id,purchases.createdate,purchases.date,purchases.status,purchaseitems.id as puritemid, purchaseitems.qty,purchaseitems.reqitemid,purchaseitems.status as status2 FROM purchaseitems,purchases WHERE purchaseitems.purchaseid=purchases.id AND purchaseitems.reqitemid='178' | | 12961 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 12953 | root | 108-1481181613 | Execute | 0 | Sending data | SELECT sectionId,sectionRef,'0' as oncost FROM quoteitems where quoteid='79030' and status='1' group by sectionId | | 12950 | root | 108-1481181613 | Execute | 0 | Creating sort index | SELECT * FROM uploads where (sourceid='1' and subtype='quotetype') OR (sourceid='0' and sourceid>'0' and subtype='opportunity') OR (jobid='78933' and jobid>'0' and subtype='quoteitem') OR (sourceid='78933' and subtype='quote' and sourceid > 0) order by name | | 12949 | root | 304-1779936994 | Execute | 0 | Sending data | SELECT *, `desc` as description, maxdiscount as discount, suggest_kit as suggestkit, (select count(child) from inventoryassem where parent = inventory.id and ((select status from inventory where inventoryassem.child = inventory.id) = 1)) as child_count, (SELECT name FROM categories WHERE id = invent | +-------+--------------+-----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min otterfencing/otterfencing.com.au-ssl_log 442 evolution/my.evolutionerp.com.au-ssl_log 289 evolution/portal.evolutionerp.com.au-ssl_log 102 evolution/app.evolutionerp.com.au-ssl_log 56 aaa/aaadownunder.com.au-ssl_log 8 madalice/madalice.com.au-ssl_log 6 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 442 35.221.22.116 227 203.54.180.238 56 40.115.94.245 53 103.104.165.99 45 103.104.164.114 30 150.228.151.47 17 101.182.108.127 12 1.144.107.82 9 182.239.240.254 6 165.225.233.87 3 180.181.236.49 3 147.161.213.78 3 101.166.96.210 2 147.161.215.96 1 66.249.68.66 --- top request paths across all vhosts (last 3 min) --- 155 POST /functions.php 33 GET /factory_session_checker.php 31 GET /app/ajax.php 30 GET /index.php 27 GET /heartbeat.php 24 GET /api/getItem/LWPB2001KG 18 POST /app/ajax/selectFilter.php 17 GET /factory_session_processed_qty.php 17 GET /factory_session_joiner.php 13 POST /plugins/csvexporter/plugin.php 10 POST /app/ajax.php 7 POST /quoteditsave.php 7 POST /plugins/shopify/plugin.php 6 POST /app/ajax/selectFilterSingle.php 6 GET / 5 POST /opportunityeditsave.php 3 POST /portal/register 3 POST /clienteditsave.php 3 GET /modalload.php 2 POST /itemModify.php --- busiest 3 vhosts: top paths + last 10 requests --- == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 1 GET /vue.tar.xz 1 GET /vue.rar 1 GET /vue.gz 1 GET /vue.bz2 1 GET /uat.zst 1 GET /uat.tgz 1 GET /uat.tar.gz 1 GET /uat.tar 1 GET /uat.sql.bz2 1 GET /uat.rar 1 GET /svelte.zst 1 GET /svelte.zip -- last 10 requests -- 35.221.22.116 - - [02/Sep/2026:13:30:04 +1000] "GET /laravel.tar HTTP/1.1" 404 56730 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:29:53 +1000] "GET /sandbox.tar.xz HTTP/1.1" 404 56737 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:30:05 +1000] "GET /vue.rar HTTP/1.1" 404 56723 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:29:55 +1000] "GET /sandbox.sql.bz2 HTTP/1.1" 404 56738 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:29:50 +1000] "GET /demo.zst HTTP/1.1" 404 56725 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:30:00 +1000] "GET /qa.tar.gz HTTP/1.1" 404 56727 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:30:10 +1000] "GET /svelte.zst HTTP/1.1" 404 56729 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:30:00 +1000] "GET /qa.tgz HTTP/1.1" 404 56721 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:29:37 +1000] "GET /prod.tar.bz2 HTTP/1.1" 404 56733 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:30:05 +1000] "GET /vue.tar.xz HTTP/1.1" 404 56729 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 155 POST /functions.php 31 GET /app/ajax.php 27 GET /index.php 18 POST /app/ajax/selectFilter.php 13 POST /plugins/csvexporter/plugin.php 10 POST /app/ajax.php 7 POST /quoteditsave.php 7 POST /plugins/shopify/plugin.php 6 POST /app/ajax/selectFilterSingle.php 5 POST /opportunityeditsave.php 4 GET / 3 POST /clienteditsave.php -- last 10 requests -- 203.54.180.238 - - [02/Sep/2026:13:30:24 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=mfshoporderdetail&id=43960" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 203.54.180.238 - - [02/Sep/2026:13:30:26 +1000] "POST /app/ajax.php?call=projectFlagForReview HTTP/1.1" 200 2269 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K 203.54.180.238 - - [02/Sep/2026:13:30:27 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 103.104.164.114 - - [02/Sep/2026:13:30:23 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=18.5 HTTP/1.1" 200 2053 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=1861" "Mozilla/5.0 (Windows 103.104.165.99 - - [02/Sep/2026:13:30:26 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=activities&date=09-09-2026&filtertype=1&branches=1" "Mozilla/5.0 (Wind 203.54.180.238 - - [02/Sep/2026:13:30:25 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 203.54.180.238 - - [02/Sep/2026:13:30:28 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152 103.104.165.99 - - [02/Sep/2026:13:30:27 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dactivities%26date%3D09-09-2026%26filtertype%3D1%26branches%3D1&call=getUserSetting&caller=ajaxSubmitLocal&seq=18293095268 HTTP/1 203.54.180.238 - - [02/Sep/2026:13:30:28 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 238 "https://my.evolutionerp.com.au/index.php?page=purchasereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:13:30:29 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 238 "https://my.evolutionerp.com.au/index.php?page=purchasereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 33 GET /factory_session_checker.php 27 GET /heartbeat.php 17 GET /factory_session_processed_qty.php 17 GET /factory_session_joiner.php 3 POST /portal/register 3 GET /index.php 2 POST /factory_functions.php -- last 10 requests -- 203.54.180.238 - - [02/Sep/2026:13:30:12 +1000] "GET /factory_session_checker.php HTTP/1.1" 500 20 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:13:30:13 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:13:30:14 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [02/Sep/2026:13:30:15 +1000] "GET /heartbeat.php?sentAt=1788319815&bytes=106,151,152,71&_=1788267566552 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [02/Sep/2026:13:30:20 +1000] "GET /factory_session_checker.php HTTP/1.1" 500 20 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:13:30:21 +1000] "GET /factory_session_joiner.php?id=35053 HTTP/1.1" 500 20 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [02/Sep/2026:13:30:20 +1000] "GET /heartbeat.php?sentAt=1788319790&bytes=106,151,152,46&_=1788317126788 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [02/Sep/2026:13:30:22 +1000] "GET /factory_session_joiner.php?id=35057 HTTP/1.1" 200 79 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [02/Sep/2026:13:30:22 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 124 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [02/Sep/2026:13:30:22 +1000] "GET /heartbeat.php?sentAt=1788319800&bytes=106,151,152,56&_=1788317126789 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-09-02 13:27:39 L1=106.74 run=108 blk=0 avail=3003 (21.8%) swpO=0 conn=96 myRSS=604 php=108 phpRSS=10602 ap=156 tcp=423 topuser=otterfencing 2026-09-02 13:27:48 L1=106.35 run=105 blk=0 avail=1858 (13.5%) swpO=0 conn=96 myRSS=618 php=113 phpRSS=11797 ap=155 tcp=409 topuser=otterfencing 2026-09-02 13:27:50 L1=106.35 run=121 blk=0 avail=1280 (9.3%) swpO=0 conn=87 myRSS=619 php=111 phpRSS=12126 ap=156 tcp=411 topuser=otterfencing 2026-09-02 13:28:00 L1=104.50 run=96 blk=1 avail=3495 (25.4%) swpO=0 conn=77 myRSS=661 php=104 phpRSS=9569 ap=154 tcp=398 topuser=otterfencing 2026-09-02 13:28:00 L1=104.50 run=103 blk=0 avail=3616 (26.3%) swpO=0 conn=80 myRSS=661 php=105 phpRSS=9531 ap=154 tcp=398 topuser=otterfencing 2026-09-02 13:28:10 L1=104.44 run=103 blk=0 avail=2655 (19.3%) swpO=0 conn=88 myRSS=820 php=105 phpRSS=10510 ap=153 tcp=396 topuser=otterfencing 2026-09-02 13:28:10 L1=104.44 run=103 blk=0 avail=2623 (19.0%) swpO=0 conn=89 myRSS=820 php=105 phpRSS=10503 ap=153 tcp=396 topuser=otterfencing 2026-09-02 13:28:21 L1=109.99 run=122 blk=2 avail=1616 (11.7%) swpO=3196 conn=102 myRSS=875 php=116 phpRSS=11978 ap=161 tcp=396 topuser=otterfencing 2026-09-02 13:28:21 L1=109.99 run=123 blk=2 avail=1579 (11.5%) swpO=3196 conn=102 myRSS=874 php=116 phpRSS=11927 ap=163 tcp=396 topuser=otterfencing 2026-09-02 13:28:37 L1=108.38 run=134 blk=5 avail=1885 (13.7%) swpO=1052 conn=98 myRSS=926 php=119 phpRSS=11878 ap=166 tcp=411 topuser=otterfencing 2026-09-02 13:28:38 L1=108.38 run=126 blk=8 avail=1957 (14.2%) swpO=990 conn=100 myRSS=926 php=117 phpRSS=11767 ap=167 tcp=412 topuser=otterfencing 2026-09-02 13:28:48 L1=111.27 run=123 blk=9 avail=837 (6.1%) swpO=5173 conn=109 myRSS=846 php=119 phpRSS=13077 ap=165 tcp=411 topuser=otterfencing 2026-09-02 13:28:48 L1=113.25 run=142 blk=10 avail=821 (6.0%) swpO=5690 conn=107 myRSS=846 php=123 phpRSS=13021 ap=163 tcp=403 topuser=otterfencing 2026-09-02 13:28:59 L1=117.12 run=107 blk=70 avail=352 (2.6%) swpO=35782 conn=110 myRSS=819 php=125 phpRSS=13487 ap=168 tcp=413 topuser=otterfencing 2026-09-02 13:28:59 L1=117.12 run=14 blk=114 avail=311 (2.3%) swpO=35808 conn=109 myRSS=819 php=124 phpRSS=13429 ap=168 tcp=414 topuser=otterfencing 2026-09-02 13:29:11 L1=126.88 run=143 blk=3 avail=545 (4.0%) swpO=12155 conn=102 myRSS=713 php=132 phpRSS=10227 ap=160 tcp=302 topuser=otterfencing 2026-09-02 13:29:11 L1=126.88 run=144 blk=21 avail=546 (4.0%) swpO=12140 conn=104 myRSS=713 php=131 phpRSS=10217 ap=160 tcp=302 topuser=otterfencing 2026-09-02 13:29:22 L1=127.31 run=133 blk=1 avail=1937 (14.1%) swpO=24 conn=111 myRSS=733 php=125 phpRSS=10915 ap=156 tcp=439 topuser=otterfencing 2026-09-02 13:29:22 L1=127.31 run=133 blk=2 avail=1942 (14.1%) swpO=14 conn=110 myRSS=733 php=127 phpRSS=11010 ap=156 tcp=440 topuser=otterfencing 2026-09-02 13:29:32 L1=126.80 run=74 blk=46 avail=1038 (7.5%) swpO=399 conn=109 myRSS=736 php=126 phpRSS=12682 ap=156 tcp=436 topuser=otterfencing 2026-09-02 13:29:43 L1=126.53 run=124 blk=0 avail=1313 (9.5%) swpO=3594 conn=104 myRSS=704 php=118 phpRSS=12449 ap=162 tcp=399 topuser=otterfencing 2026-09-02 13:29:45 L1=126.49 run=120 blk=6 avail=1722 (12.5%) swpO=1892 conn=109 myRSS=710 php=121 phpRSS=12205 ap=157 tcp=405 topuser=otterfencing 2026-09-02 13:29:53 L1=122.34 run=106 blk=0 avail=2271 (16.5%) swpO=0 conn=100 myRSS=719 php=115 phpRSS=11345 ap=157 tcp=397 topuser=otterfencing 2026-09-02 13:29:55 L1=122.34 run=115 blk=2 avail=1726 (12.5%) swpO=0 conn=99 myRSS=723 php=119 phpRSS=12056 ap=154 tcp=395 topuser=otterfencing 2026-09-02 13:30:04 L1=123.34 run=132 blk=3 avail=2983 (21.7%) swpO=1022 conn=93 myRSS=698 php=114 phpRSS=10714 ap=173 tcp=404 topuser=otterfencing 2026-09-02 13:30:06 L1=123.34 run=142 blk=0 avail=2447 (17.8%) swpO=1022 conn=96 myRSS=699 php=128 phpRSS=11792 ap=165 tcp=405 topuser=otterfencing 2026-09-02 13:30:14 L1=123.90 run=140 blk=4 avail=841 (6.1%) swpO=2244 conn=109 myRSS=654 php=134 phpRSS=13483 ap=163 tcp=397 topuser=otterfencing 2026-09-02 13:30:18 L1=123.90 run=118 blk=5 avail=674 (4.9%) swpO=4482 conn=109 myRSS=622 php=134 phpRSS=13498 ap=164 tcp=400 topuser=otterfencing 2026-09-02 13:30:25 L1=124.63 run=109 blk=24 avail=772 (5.6%) swpO=3891 conn=111 myRSS=611 php=138 phpRSS=13701 ap=154 tcp=410 topuser=otterfencing 2026-09-02 13:30:28 L1=124.63 run=128 blk=3 avail=795 (5.8%) swpO=2160 conn=106 myRSS=580 php=126 phpRSS=13424 ap=159 tcp=408 topuser=otterfencing