INCIDENT 2026-09-02 13:33:38 trigger: mem_avail=10.2% load=128.31/10cpu php_procs=134 php_rss=12435MB mysql_conn=105 ================================================================== load: 128.31 101.37 51.33 130/942 3089369 ncpu:10 mem_avail: 1402MB/13777MB (10.2%) swap_used:3156MB swapout:0/s blocked(D):0 running:126 iowait:1.0% steal:0.0% php: 134 procs / 12435MB heaviest user: otterfencing (107 procs, 10980MB) apache: 155 procs tcp_estab: 392 --- RSS by user (all processes) --- USER PROCS RSS_MB otterfencing 107 10853 nobody 154 1396 evolution 28 779 mysql 1 698 madalice 4 526 root 246 405 corpkicks 1 164 netdata 7 157 aaa 7 46 mailnull 4 39 mailman 20 28 kurri 3 27 dovenull 6 18 zabbix 1 13 candyfabcom 1 11 dovecot 3 7 wp-toolkit 3 5 cpanelconnecttrack 1 2 dbus 1 1 rpc 1 0 --- php workers by user --- USER PROCS RSS_MB otterfencing 108 10899 evolution 22 781 madalice 4 526 corpkicks 1 165 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5641 MB Active(file): 592 MB Inactive(file): 343 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 190 MB CommitLimit: 10984 MB Committed_AS: 29647 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 1-11:11:11 1872 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3067388 1 mysql 722596 31.2 Ssl 06:52 /usr/sbin/mariadbd 3083875 3929444 madalice 180272 4.5 R 01:17 php-fpm: pool madalice_com_au 3089000 3066540 otterfencing 175088 9.0 R 00:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3077683 3929444 madalice 174248 5.8 R 02:24 php-fpm: pool madalice_com_au 3088928 3066851 corpkicks 170804 6.6 R 00:26 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3087527 3066643 otterfencing 168376 5.6 R 00:44 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088310 3066642 otterfencing 167728 7.5 R 00:36 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088258 3066560 otterfencing 165736 6.2 R 00:37 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088514 3066708 otterfencing 164272 5.6 R 00:34 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088912 3066718 otterfencing 162388 7.0 R 00:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088064 3066704 otterfencing 161764 5.6 R 00:38 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088979 3066552 otterfencing 160776 10.0 R 00:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088892 3066541 otterfencing 158004 7.0 R 00:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3087818 3066822 otterfencing 157832 5.2 R 00:41 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088896 3066957 otterfencing 155908 7.0 R 00:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3089184 3067030 otterfencing 155776 21.0 R 00:11 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088897 3066715 otterfencing 154704 7.9 R 00:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088921 3067248 otterfencing 153128 7.7 R 00:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3089054 3067483 otterfencing 152920 10.8 R 00:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3089049 3051817 otterfencing 152704 9.5 R 00:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3089131 3066706 otterfencing 152200 15.4 R 00:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088900 3051804 otterfencing 150296 5.4 R 00:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088902 3067089 otterfencing 149264 7.8 R 00:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3089126 3066810 otterfencing 147832 14.2 R 00:14 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088936 3066716 otterfencing 144896 6.8 R 00:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 706071 655564 root 143204 0.0 S 10:55:41 spamd child 508924 1 netdata 142632 2.0 Ssl 5-11:14:00 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3087492 3066713 otterfencing 142280 4.6 R 00:45 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2900038 655564 root 137756 0.0 S 51:37 spamd child 3089232 3066442 otterfencing 132928 13.7 R 00:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3089272 3066826 otterfencing 131540 16.5 R 00:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088966 3066655 otterfencing 131264 7.0 R 00:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088954 3066288 otterfencing 130852 7.4 R 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088967 3067088 otterfencing 129712 8.1 R 00:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3089012 3066719 otterfencing 129644 8.2 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088891 3066623 otterfencing 128872 4.5 R 00:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3089158 3066441 otterfencing 126704 11.1 R 00:12 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088539 3066258 otterfencing 126200 5.4 R 00:34 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3089086 3066257 otterfencing 125592 9.5 R 00:16 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088965 3051806 otterfencing 125240 6.3 R 00:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088901 3067029 otterfencing 124480 4.7 R 00:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3075406 3929444 madalice 123752 3.8 R 02:47 php-fpm: pool madalice_com_au 3089159 3066474 otterfencing 123192 12.1 R 00:12 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3089093 3051099 otterfencing 122028 9.8 R 00:15 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088949 3066543 otterfencing 121232 6.9 R 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088929 3066476 otterfencing 116112 6.2 R 00:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088984 3067482 otterfencing 115864 6.3 R 00:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3089052 3066658 otterfencing 113584 5.6 R 00:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088972 3066711 otterfencing 112080 5.9 R 00:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3089020 3051634 otterfencing 111716 6.6 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088893 3066110 otterfencing 111156 4.8 R 00:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3089269 3067102 otterfencing 110748 15.0 R 00:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088939 3066801 otterfencing 109092 4.9 R 00:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3089244 3066802 otterfencing 108144 14.5 R 00:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3089162 3066656 otterfencing 107860 11.9 R 00:12 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3088890 3050201 otterfencing 107716 5.4 R 00:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3089191 3066652 otterfencing 107100 12.2 R 00:11 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3089223 3051807 otterfencing 105332 11.7 R 00:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3089010 3066710 otterfencing 104992 6.3 R 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 3089050 3066803 otterfencing 103324 7.4 R 00:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +-------+--------------+-----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +-------+--------------+-----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9394 | lecsafec_evo | lecsafec_icatv2 | Execute | 243 | Sending data | update assets,results set results.asset_id=assets.id WHERE assets.uploadid='39206' AND results.uploadid=assets.uploadid AND assets.assetkey=results.assetkey AND assets.jobid=results.jobid | | 20446 | root | 85-1559715131 | Execute | 22 | Sending data | SELECT SQL_CALC_FOUND_ROWS purchases.*, DATE_FORMAT(FROM_UNIXTIME(purchases.emailed), '%d-%m-%Y') as emailDate, contacts.company,contacts.firstname,contacts.lastname send_status, date_sent from purchases LEFT JOIN contacts ON contacts.clientid=purchases.supplierid LEFT JOIN staff ON staff.i | | 21985 | root | 85-1559715131 | Execute | 1 | Sending data | SELECT * from staff where status='1' | | 21973 | root | 108-1481181613 | Execute | 1 | Sending data | SELECT jobs.id, jobs.pmId, jobs.clientid, jobs.company, jobs.status, jobs.suburb, jobs.new_flag, jobs.reference, jobs.cat, jobs.dateadded, jobs.price, jobs.nextaction, jobs.repId, contacts.code, contacts.company, contacts.lastname, contacts.firstname, contacts.trading_names, jobs.site, jobs | | 22021 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 22020 | root | 85-1559715131 | Execute | 0 | Sending data | SELECT id,name,defaultTemplate,printOptions FROM uploads WHERE category = ? AND subtype LIKE ? AND status = '1' AND (path LIKE '%.htm' OR path LIKE '%.html' OR path IN (?,?)) | +-------+--------------+-----------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min otterfencing/otterfencing.com.au-ssl_log 516 evolution/my.evolutionerp.com.au-ssl_log 290 evolution/portal.evolutionerp.com.au-ssl_log 110 evolution/app.evolutionerp.com.au-ssl_log 94 aaa/aaadownunder.com.au-ssl_log 15 bigdeals/bigdeals.com.au 10 evolution/evolutionerp.com.au 7 madalice/madalice.com.au-ssl_log 4 olympic/seb-mobile-auth.olympicfencing.com.au 1 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 598 35.221.22.116 268 203.54.180.238 94 40.115.94.245 70 103.104.165.99 47 101.182.108.127 27 182.239.240.254 26 103.104.164.114 13 1.144.107.82 8 195.178.110.48 7 20.48.250.41 5 180.181.236.49 4 165.225.233.87 3 147.161.213.78 2 43.138.68.113 2 147.161.215.96 --- top request paths across all vhosts (last 3 min) --- 170 POST /functions.php 52 GET /api/getItem/LWPB2001KG 44 GET /factory_session_checker.php 41 GET /app/ajax.php 38 GET /heartbeat.php 26 GET /index.php 21 GET /factory_session_joiner.php 20 GET /factory_session_processed_qty.php 18 POST /app/ajax.php 13 POST /plugins/csvexporter/plugin.php 9 POST /clienteditsave.php 8 POST /app/ajax/selectFilterSingle.php 6 GET /store/custom-af1-drippy-swoosh/ 5 GET /cgi-sys/suspendedpage.cgi 4 POST /app/ajax/selectFilter.php 3 POST /plugins/shopify/plugin.php 3 POST /plugins/fencecosting/plugin.php 3 POST /opportunityeditsave.php 3 POST /logsave.php 3 POST /api/session/reset_password --- busiest 3 vhosts: top paths + last 10 requests --- == otterfencing/otterfencing.com.au-ssl_log == -- top paths -- 1 GET /virtualenv.zst 1 GET /virtualenv.zip 1 GET /virtualenv.tgz 1 GET /virtualenv.tar.xz 1 GET /virtualenv.tar.gz 1 GET /virtualenv.tar.bz2 1 GET /virtualenv.tar 1 GET /virtualenv.sql.gz 1 GET /virtualenv.sql.bz2 1 GET /virtualenv.sql 1 GET /virtualenv.rar 1 GET /virtualenv.gz -- last 10 requests -- 35.221.22.116 - - [02/Sep/2026:13:33:52 +1000] "GET /sql202607.tar.gz HTTP/1.1" 404 56741 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:33:56 +1000] "GET /sql_2026-07.tar.gz HTTP/1.1" 404 56745 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:33:46 +1000] "GET /sql2026-09.tar.gz HTTP/1.1" 404 56743 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:33:52 +1000] "GET /sql_202607.zip HTTP/1.1" 404 56737 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:33:48 +1000] "GET /sql2026-09.sql HTTP/1.1" 404 56737 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:33:53 +1000] "GET /sql_202607.sql.gz HTTP/1.1" 404 56743 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:33:55 +1000] "GET /sql202607.sql HTTP/1.1" 404 56734 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:33:45 +1000] "GET /sql_2026-09.zip HTTP/1.1" 404 56736 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:33:56 +1000] "GET /sql2026-07.tar.gz HTTP/1.1" 404 56742 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" 35.221.22.116 - - [02/Sep/2026:13:33:52 +1000] "GET /sql202607.zip HTTP/1.1" 404 56735 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 170 POST /functions.php 41 GET /app/ajax.php 24 GET /index.php 18 POST /app/ajax.php 13 POST /plugins/csvexporter/plugin.php 9 POST /clienteditsave.php 8 POST /app/ajax/selectFilterSingle.php 4 POST /app/ajax/selectFilter.php 3 POST /plugins/shopify/plugin.php 3 POST /plugins/fencecosting/plugin.php 3 POST /opportunityeditsave.php 3 POST /logsave.php -- last 10 requests -- 203.54.180.238 - - [02/Sep/2026:13:33:55 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29461&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 103.104.165.99 - - [02/Sep/2026:13:33:55 +1000] "GET /index.php?page=clientedit&clientid=2778 HTTP/1.1" 500 1000 "https://my.evolutionerp.com.au/index.php?page=clientlist" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 103.104.165.99 - - [02/Sep/2026:13:32:45 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=report&file=invoicesFiltered" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 203.54.180.238 - - [02/Sep/2026:13:33:58 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=78863" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 103.104.165.99 - - [02/Sep/2026:13:33:56 +1000] "POST /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Djobedit%26id%3D5344 HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=5344" "Mozilla 103.104.165.99 - - [02/Sep/2026:13:33:54 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 2857 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=5344" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 182.239.240.254 - - [02/Sep/2026:13:33:55 +1000] "GET /index.php HTTP/1.1" 200 19049 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152 203.54.180.238 - - [02/Sep/2026:13:33:56 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 282 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=28921&tab=jobeditinv" "Mozilla/5.0 (Windows NT 10.0; Win64; 103.104.165.99 - - [02/Sep/2026:13:33:58 +1000] "GET /app/ajax.php?cn=&furi=true&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=11804305445 HTTP/1.1" 200 284 "https://my.evolutionerp.com.au/index.php?page=jobedit&id 103.104.165.99 - - [02/Sep/2026:13:33:54 +1000] "POST /plugins/fencecosting/plugin.php HTTP/1.1" 200 3913 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=5344" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 44 GET /factory_session_checker.php 38 GET /heartbeat.php 21 GET /factory_session_joiner.php 20 GET /factory_session_processed_qty.php 2 POST /portal/register 2 GET /index.php 1 POST /factory_functions.php -- last 10 requests -- 203.54.180.238 - - [02/Sep/2026:13:33:40 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:13:33:44 +1000] "POST /factory_functions.php?id=35053&ajax=1&call=session_resume HTTP/1.1" 500 20 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; 203.54.180.238 - - [02/Sep/2026:13:33:45 +1000] "GET /heartbeat.php?sentAt=1788320025&bytes=106,151,153,25&_=1788319784256 HTTP/1.1" 500 20 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=9" 203.54.180.238 - - [02/Sep/2026:13:33:45 +1000] "GET /heartbeat.php?sentAt=1788320025&bytes=106,151,153,25&_=1788267566573 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [02/Sep/2026:13:33:45 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:13:33:47 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:13:33:50 +1000] "GET /heartbeat.php?sentAt=1788320030&bytes=106,151,153,30&_=1788317126812 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [02/Sep/2026:13:33:51 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [02/Sep/2026:13:33:49 +1000] "GET /factory_session_joiner.php?id=35057 HTTP/1.1" 500 20 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [02/Sep/2026:13:33:56 +1000] "GET /factory_session_checker.php HTTP/1.1" 500 20 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 --- last 30 samples (run-up to this incident) --- 2026-09-02 13:31:10 L1=128.66 run=137 blk=3 avail=1330 (9.7%) swpO=1161 conn=108 myRSS=627 php=131 phpRSS=12912 ap=158 tcp=407 topuser=otterfencing 2026-09-02 13:31:20 L1=129.89 run=141 blk=3 avail=1047 (7.6%) swpO=2011 conn=108 myRSS=629 php=132 phpRSS=13130 ap=155 tcp=415 topuser=otterfencing 2026-09-02 13:31:21 L1=129.89 run=136 blk=0 avail=1622 (11.8%) swpO=1644 conn=107 myRSS=628 php=127 phpRSS=12549 ap=157 tcp=409 topuser=otterfencing 2026-09-02 13:31:30 L1=130.52 run=129 blk=2 avail=1103 (8.0%) swpO=861 conn=110 myRSS=615 php=135 phpRSS=13032 ap=155 tcp=415 topuser=otterfencing 2026-09-02 13:31:31 L1=130.52 run=132 blk=1 avail=1131 (8.2%) swpO=750 conn=108 myRSS=615 php=128 phpRSS=12979 ap=162 tcp=416 topuser=otterfencing 2026-09-02 13:31:42 L1=130.37 run=150 blk=4 avail=748 (5.4%) swpO=4415 conn=109 myRSS=586 php=134 phpRSS=13585 ap=163 tcp=413 topuser=otterfencing 2026-09-02 13:31:53 L1=132.23 run=86 blk=62 avail=820 (6.0%) swpO=29782 conn=102 myRSS=541 php=118 phpRSS=13023 ap=170 tcp=406 topuser=otterfencing 2026-09-02 13:31:51 L1=132.23 run=83 blk=51 avail=467 (3.4%) swpO=17385 conn=102 myRSS=541 php=126 phpRSS=13751 ap=167 tcp=404 topuser=otterfencing 2026-09-02 13:32:03 L1=131.81 run=118 blk=1 avail=3542 (25.7%) swpO=1811 conn=85 myRSS=544 php=116 phpRSS=10271 ap=158 tcp=419 topuser=otterfencing 2026-09-02 13:32:04 L1=131.81 run=124 blk=1 avail=3421 (24.8%) swpO=2245 conn=87 myRSS=544 php=115 phpRSS=10355 ap=160 tcp=423 topuser=otterfencing 2026-09-02 13:32:14 L1=130.45 run=122 blk=0 avail=2045 (14.8%) swpO=0 conn=101 myRSS=547 php=126 phpRSS=12019 ap=154 tcp=412 topuser=otterfencing 2026-09-02 13:32:14 L1=130.45 run=122 blk=1 avail=1921 (13.9%) swpO=0 conn=103 myRSS=547 php=126 phpRSS=12143 ap=153 tcp=412 topuser=otterfencing 2026-09-02 13:32:24 L1=129.72 run=120 blk=0 avail=1753 (12.7%) swpO=0 conn=105 myRSS=551 php=126 phpRSS=12104 ap=154 tcp=412 topuser=otterfencing 2026-09-02 13:32:25 L1=129.72 run=120 blk=0 avail=1777 (12.9%) swpO=0 conn=106 myRSS=551 php=124 phpRSS=12187 ap=155 tcp=413 topuser=otterfencing 2026-09-02 13:32:35 L1=129.64 run=131 blk=5 avail=1629 (11.8%) swpO=486 conn=103 myRSS=616 php=133 phpRSS=12864 ap=160 tcp=265 topuser=otterfencing 2026-09-02 13:32:35 L1=129.64 run=133 blk=0 avail=1607 (11.7%) swpO=535 conn=101 myRSS=618 php=133 phpRSS=12680 ap=158 tcp=364 topuser=otterfencing 2026-09-02 13:32:46 L1=130.23 run=131 blk=0 avail=1590 (11.5%) swpO=576 conn=103 myRSS=637 php=132 phpRSS=12603 ap=162 tcp=426 topuser=otterfencing 2026-09-02 13:32:56 L1=129.88 run=122 blk=0 avail=1857 (13.5%) swpO=114 conn=98 myRSS=683 php=131 phpRSS=12401 ap=159 tcp=418 topuser=otterfencing 2026-09-02 13:32:57 L1=129.88 run=121 blk=2 avail=1552 (11.3%) swpO=340 conn=96 myRSS=685 php=132 phpRSS=12523 ap=159 tcp=423 topuser=otterfencing 2026-09-02 13:33:07 L1=129.15 run=132 blk=0 avail=1417 (10.3%) swpO=450 conn=107 myRSS=713 php=140 phpRSS=12919 ap=157 tcp=415 topuser=otterfencing 2026-09-02 13:33:08 L1=129.15 run=137 blk=1 avail=1104 (8.0%) swpO=2493 conn=108 myRSS=700 php=140 phpRSS=13188 ap=155 tcp=411 topuser=otterfencing 2026-09-02 13:33:17 L1=129.99 run=133 blk=2 avail=2062 (15.0%) swpO=2260 conn=98 myRSS=726 php=130 phpRSS=11641 ap=156 tcp=408 topuser=otterfencing 2026-09-02 13:33:19 L1=129.27 run=129 blk=1 avail=1551 (11.3%) swpO=12 conn=101 myRSS=726 php=136 phpRSS=12400 ap=157 tcp=408 topuser=otterfencing 2026-09-02 13:33:28 L1=129.41 run=124 blk=2 avail=1071 (7.8%) swpO=2887 conn=106 myRSS=694 php=134 phpRSS=13032 ap=154 tcp=402 topuser=otterfencing 2026-09-02 13:33:29 L1=128.98 run=129 blk=1 avail=1480 (10.7%) swpO=3175 conn=99 myRSS=694 php=131 phpRSS=12179 ap=155 tcp=404 topuser=otterfencing 2026-09-02 13:33:38 L1=128.31 run=126 blk=0 avail=1402 (10.2%) swpO=0 conn=105 myRSS=698 php=134 phpRSS=12435 ap=155 tcp=392 topuser=otterfencing 2026-09-02 13:33:40 L1=128.31 run=131 blk=0 avail=1505 (10.9%) swpO=0 conn=106 myRSS=705 php=134 phpRSS=12539 ap=157 tcp=395 topuser=otterfencing 2026-09-02 13:33:51 L1=128.27 run=125 blk=4 avail=718 (5.2%) swpO=5530 conn=107 myRSS=665 php=135 phpRSS=13376 ap=162 tcp=385 topuser=otterfencing 2026-09-02 13:34:02 L1=128.04 run=55 blk=4 avail=142 (1.0%) swpO=21589 conn=106 myRSS=641 php=141 phpRSS=9419 ap=157 tcp=147 topuser=otterfencing 2026-09-02 13:35:04 L1=151.72 run=69 blk=2 avail=4616 (33.5%) swpO=457 conn=58 myRSS=610 php=75 phpRSS=7248 ap=159 tcp=156 topuser=otterfencing