INCIDENT 2026-09-06 14:18:02 trigger: php_rss=1622MB mysql_conn=18 ================================================================== load: 1.83 1.57 1.56 32/650 2612071 ncpu:10 mem_avail: 9185MB/13777MB (66.7%) swap_used:2243MB swapout:112/s blocked(D):1 running:22 iowait:3.5% steal:0.0% php: 21 procs / 1622MB heaviest user: alison (16 procs, 1466MB) apache: 29 procs tcp_estab: 42 --- RSS by user (all processes) --- USER PROCS RSS_MB alison 16 1640 mysql 1 1217 root 254 938 nobody 28 488 netdata 8 247 mailman 20 143 madalice 1 132 wp-toolkit 3 60 dovenull 6 53 mailnull 2 27 kurri 2 23 lowrange 1 21 dovecot 3 21 cpanellogin 1 18 named 1 16 aaa 1 14 polkitd 1 11 evolution 11 11 zabbix 1 9 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB alison 16 1652 mysql 1 1217 root 250 930 nobody 28 488 netdata 8 247 mailman 20 143 madalice 1 132 wp-toolkit 3 60 dovenull 6 53 mailnull 2 27 kurri 2 23 lowrange 1 21 dovecot 3 21 cpanellogin 1 18 named 1 16 aaa 1 14 polkitd 1 11 evolution 11 11 zabbix 1 9 nscd 1 4 --- php workers by user --- USER PROCS RSS_MB alison 16 1655 madalice 1 132 root 1 23 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 alison 16 1684 madalice 1 132 root 1 23 evolution 3 0 --- vm tuning / memory pressure --- vm.min_free_kbytes 67584 vm.swappiness 30 vm.vfs_cache_pressure 100 vm.overcommit_memory 0 vm.min_free_kbytes 67584 vm.overcommit_ratio 50 Cached: 9179 MB Active(file): 3857 MB Inactive(file): 4630 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 569 MB CommitLimit: 10984 MB Committed_AS: 10418 MB --- backup / dump / scan processes (page-cache evictors) --- vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 9158 MB Active(file): 3857 MB Inactive(file): 4596 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 569 MB CommitLimit: 10984 MB Committed_AS: 10360 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2545575 root 18:01 3168 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 5-11:55:37 5792 /usr/bin/imunify-agent-proxy 4109079 root 1-09:33:15 1720 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 1-09:33:15 48456 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 1247092 2.8 Ssl 18:41:32 /usr/sbin/mariadbd 166870 1 netdata 188064 2.6 Ssl 11:55:43 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 220206 168913 root 179524 0.0 S 11:39:45 spamd child 167871 1 root 177316 0.0 Ss 11:55:36 /usr/lib/systemd/systemd-journald 2611943 167896 madalice 135652 19.0 S 00:07 php-fpm: pool madalice_com_au 2611999 2578993 alison 132872 65.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2611996 2611763 alison 132480 71.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2612006 2611762 alison 120144 60.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2611997 2611758 alison 116764 56.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2611994 2611855 alison 111560 53.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2612001 2611767 alison 105552 49.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2612003 2611746 alison 104880 50.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2611993 2578996 alison 104848 49.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2611998 2611751 alison 102460 46.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2612000 2579117 alison 99264 39.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2611995 2595241 alison 98788 46.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2612007 2579000 alison 97452 45.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 168913 1 root 95316 0.0 Ss 11:54:33 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2611992 2611752 alison 93552 43.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2612005 2611514 alison 93404 45.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 220207 168913 root 75804 0.0 S 11:39:45 spamd child 4109105 4109079 root 48456 1.6 Sl 1-09:33:15 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1353308 1 root 42204 0.1 Ss 46-11:36:49 cpsrvd (SSL) - waiting for connections 1469 1 root 40512 0.1 Ss 69-04:08:18 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 167562 166914 netdata 37828 0.1 Sl 11:55:38 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 34460 0.0 Sl 9-11:58:23 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166645 1 wp-toolkit 32292 0.0 Ss 11:55:47 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1463 1 root 24440 0.0 Ss 69-04:08:18 tailwatchd 167896 1 root 23964 0.0 Ss 11:55:35 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 167845 1 wp-toolkit 23628 0.0 Ss 11:55:36 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2578993 506832 nobody 23452 0.0 S 08:34 /usr/sbin/httpd -k start 2595241 506832 nobody 22932 0.0 S 04:59 /usr/sbin/httpd -k start 2578996 506832 nobody 22800 0.0 S 08:34 /usr/sbin/httpd -k start 2579117 506832 nobody 22512 0.0 S 08:32 /usr/sbin/httpd -k start 2578530 167382 lowrange 22464 0.0 S 09:17 dovecot/imap 2579003 506832 nobody 21900 0.0 S 08:34 /usr/sbin/httpd -k start 2579000 506832 nobody 21376 0.0 S 08:34 /usr/sbin/httpd -k start 2611746 506832 nobody 20864 0.1 S 00:30 /usr/sbin/httpd -k start 2596145 506832 nobody 20816 0.0 S 03:09 /usr/sbin/httpd -k start 2611767 506832 nobody 20244 0.1 S 00:27 /usr/sbin/httpd -k start 2611514 506832 nobody 20212 0.0 S 00:58 /usr/sbin/httpd -k start 2611762 506832 nobody 20120 0.1 S 00:27 /usr/sbin/httpd -k start 2611751 506832 nobody 20096 0.1 S 00:29 /usr/sbin/httpd -k start 2611752 506832 nobody 20020 0.0 S 00:29 /usr/sbin/httpd -k start 2611763 506832 nobody 19984 0.0 S 00:27 /usr/sbin/httpd -k start 2611768 506832 nobody 19852 0.0 S 00:27 /usr/sbin/httpd -k start 2611855 506832 nobody 19836 0.0 S 00:13 /usr/sbin/httpd -k start 2611758 506832 nobody 19752 0.0 S 00:28 /usr/sbin/httpd -k start 2611273 506832 nobody 19396 0.0 S 01:21 /usr/sbin/httpd -k start 2611860 506832 nobody 19264 0.0 S 00:12 /usr/sbin/httpd -k start 2578528 1353308 cpanellogin 18976 0.0 S 09:17 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 2611765 506832 nobody 17588 0.0 S 00:27 /usr/sbin/httpd -k start 166809 1 named 17164 0.0 Ssl 11:55:45 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 167566 166914 netdata 17104 2.1 Sl 11:55:38 /usr/libexec/netdata/plugins.d/apps.plugin 1 2611861 506832 nobody 16660 0.0 S 00:12 /usr/sbin/httpd -k start 167814 1 root 16476 0.0 Ss 11:55:36 lfd - sleeping 166757 1 root 15844 0.0 Ss 11:55:46 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 508720 1 mailnull 15468 0.0 Ss 9-11:58:30 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 167017 1 root 15044 0.1 Ssl 11:55:42 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 2300726 167382 kurri 14876 0.0 S 01:32:54 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- PID USER ELAPSED RSS_KB COMMAND 2545575 root 18:01 3168 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 5-11:55:37 5792 /usr/bin/imunify-agent-proxy 4109079 root 1-09:33:15 1720 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 1-09:33:15 48456 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 516492 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 1247092 2.8 Ssl 18:41:32 /usr/sbin/mariadbd 166870 1 netdata 188064 2.6 Ssl 11:55:43 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 220206 168913 root 179524 0.0 S 11:39:45 spamd child 167871 1 root 177316 0.0 Ss 11:55:36 /usr/lib/systemd/systemd-journald 2611996 2611763 alison 137964 74.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2611943 167896 madalice 135652 19.0 S 00:07 php-fpm: pool madalice_com_au 2611999 2578993 alison 134456 66.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2612006 2611762 alison 123836 65.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2611997 2611758 alison 121968 59.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2611994 2611855 alison 115840 55.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2612001 2611767 alison 110996 52.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2612003 2611746 alison 105936 51.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2611993 2578996 alison 105904 50.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2612007 2579000 alison 105360 49.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2611998 2611751 alison 104308 47.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2611992 2611752 alison 102160 47.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2612000 2579117 alison 101112 40.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2611995 2595241 alison 100636 48.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2612005 2611514 alison 96040 46.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 168913 1 root 95316 0.0 Ss 11:54:33 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 220207 168913 root 75804 0.0 S 11:39:45 spamd child 4109105 4109079 root 48456 1.6 Sl 1-09:33:15 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 1353308 1 root 42204 0.1 Ss 46-11:36:49 cpsrvd (SSL) - waiting for connections 1469 1 root 40512 0.1 Ss 69-04:08:18 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 167562 166914 netdata 37828 0.1 Sl 11:55:38 /usr/libexec/netdata/plugins.d/go.d.plugin 1 509236 509098 root 34460 0.0 Sl 9-11:58:23 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 166645 1 wp-toolkit 32292 0.0 Ss 11:55:47 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1463 1 root 24440 0.0 Ss 69-04:08:18 tailwatchd 167896 1 root 23964 0.0 Ss 11:55:35 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 167845 1 wp-toolkit 23628 0.0 Ss 11:55:36 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2578993 506832 nobody 23452 0.0 S 08:34 /usr/sbin/httpd -k start 2595241 506832 nobody 22932 0.0 S 04:59 /usr/sbin/httpd -k start 2578996 506832 nobody 22800 0.0 S 08:34 /usr/sbin/httpd -k start 2579117 506832 nobody 22512 0.0 S 08:32 /usr/sbin/httpd -k start 2578530 167382 lowrange 22464 0.0 S 09:17 dovecot/imap 2579003 506832 nobody 21900 0.0 S 08:34 /usr/sbin/httpd -k start 2579000 506832 nobody 21376 0.0 S 08:34 /usr/sbin/httpd -k start 2611746 506832 nobody 20864 0.1 S 00:30 /usr/sbin/httpd -k start 2596145 506832 nobody 20816 0.0 S 03:09 /usr/sbin/httpd -k start 2611767 506832 nobody 20244 0.1 S 00:27 /usr/sbin/httpd -k start 2611514 506832 nobody 20212 0.0 S 00:58 /usr/sbin/httpd -k start 2611762 506832 nobody 20120 0.1 S 00:27 /usr/sbin/httpd -k start 2611751 506832 nobody 20096 0.1 S 00:29 /usr/sbin/httpd -k start 2611752 506832 nobody 20020 0.0 S 00:29 /usr/sbin/httpd -k start 2611763 506832 nobody 19984 0.0 S 00:27 /usr/sbin/httpd -k start 2611768 506832 nobody 19852 0.0 S 00:27 /usr/sbin/httpd -k start 2611855 506832 nobody 19836 0.0 S 00:13 /usr/sbin/httpd -k start 2611758 506832 nobody 19752 0.0 S 00:28 /usr/sbin/httpd -k start 2611273 506832 nobody 19396 0.0 S 01:21 /usr/sbin/httpd -k start 2611860 506832 nobody 19264 0.0 S 00:12 /usr/sbin/httpd -k start 2578528 1353308 cpanellogin 18976 0.0 S 09:17 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 2611765 506832 nobody 17588 0.0 S 00:27 /usr/sbin/httpd -k start 166809 1 named 17164 0.0 Ssl 11:55:45 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 167566 166914 netdata 17104 2.1 Rl 11:55:38 /usr/libexec/netdata/plugins.d/apps.plugin 1 2611861 506832 nobody 16660 0.0 S 00:12 /usr/sbin/httpd -k start 167814 1 root 16476 0.0 Ss 11:55:36 lfd - sleeping 166757 1 root 15844 0.0 Ss 11:55:46 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 508720 1 mailnull 15468 0.0 Ss 9-11:58:30 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 167017 1 root 15044 0.1 Ssl 11:55:42 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 2300726 167382 kurri 14876 0.0 S 01:32:54 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 516494 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min otter2/otterfencing.net.au-ssl_log 95 alison/alisonarts.com.au-ssl_log 65 evolution/app.evolutionerp.com.au-ssl_log 58 evolution/evolutionerp.com.au 44 VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 1 madalice/madalice.com.au-ssl_log 1 otter2/otterfencing.net.au-ssl_log 95 alison/alisonarts.com.au-ssl_log 65 evolution/app.evolutionerp.com.au-ssl_log 58 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- evolution/evolutionerp.com.au 44 evolution/my.evolutionerp.com.au-ssl_log 1 madalice/madalice.com.au-ssl_log 1 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 95 195.178.110.103 60 93.123.109.250 58 40.115.94.245 44 195.178.110.22 2 136.64.153.238 1 52.167.144.184 1 43.173.180.22 1 118.127.40.55 1 114.119.159.70 1 103.183.118.35 --- top request paths across all vhosts (last 3 min) --- 95 195.178.110.103 60 93.123.109.250 58 40.115.94.245 44 195.178.110.22 2 136.64.153.238 1 52.167.144.184 1 43.173.180.22 1 118.127.40.55 1 114.119.159.70 1 103.183.118.35 --- top request paths across all vhosts (last 3 min) --- 28 GET /api/getItem/LWFB2001KG 21 POST /wp/ 13 POST /wp/index.php 9 GET /wp/ 7 POST /wp/wp-json/Batch/v1 7 POST /wp/wp-json/batch/v1/ 7 POST /wp/wp-json/batch/v1 7 POST /wp//wp-json/batch/v1 7 POST /wp/wordpress/wp-json/batch/v1 7 POST /wp/blog/wp-json/batch/v1 2 GET /backup.zip 2 GET / 1 POST /wordpress/index.php 1 POST / 1 GET /xampp/phpinfo.php 1 GET /xampp/.env 1 GET /www.zip 1 GET /www.tar.gz 1 GET /www.sql 1 GET /wwwroot.zip --- busiest 3 vhosts: top paths + last 10 requests --- == otter2/otterfencing.net.au-ssl_log == -- top paths -- 21 POST /wp/ 13 POST /wp/index.php 9 GET /wp/ 7 POST /wp/wp-json/Batch/v1 7 POST /wp/wp-json/batch/v1/ 7 POST /wp/wp-json/batch/v1 7 POST /wp//wp-json/batch/v1 7 POST /wp/wordpress/wp-json/batch/v1 7 POST /wp/blog/wp-json/batch/v1 1 POST /wordpress/index.php 1 GET /wp/wp/v2/users 1 GET /wp/wp/v2/tags -- last 10 requests -- 195.178.110.103 - - [06/Sep/2026:14:17:25 +1000] "GET /wp/?rest_route=/wp/v2/tags HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.103 - - [06/Sep/2026:14:17:25 +1000] "GET /wp/wp/v2/posts/999998 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.103 - - [06/Sep/2026:14:17:25 +1000] "GET /wp/?rest_route=/wp/v2/posts/999998 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537. 195.178.110.103 - - [06/Sep/2026:14:17:25 +1000] "GET /wp/wp/v2/posts/99999 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.103 - - [06/Sep/2026:14:17:26 +1000] "GET /wp/?rest_route=/wp/v2/posts/99999 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 195.178.110.103 - - [06/Sep/2026:14:17:26 +1000] "GET /wp/wp/v2/posts/9999999 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.103 - - [06/Sep/2026:14:17:26 +1000] "GET /wp/?rest_route=/wp/v2/posts/9999999 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537 195.178.110.103 - - [06/Sep/2026:14:17:27 +1000] "GET /wp/wp/v2/users HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.103 - - [06/Sep/2026:14:17:27 +1000] "GET /wp/?rest_route=/wp/v2/users HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.103 - - [06/Sep/2026:14:17:27 +1000] "POST /wordpress/index.php?rest_route=/batch/v1 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safa == alison/alisonarts.com.au-ssl_log == -- top paths -- 2 GET / 1 POST / 1 GET /xampp/phpinfo.php 1 GET /xampp/.env 1 GET /www/.env 1 GET /wp-json/wp/v2/users/me 1 GET /wp-config.php.bak 1 GET /wp-config 1 GET /website/.env 1 GET /web/.env 1 GET /test.php 1 GET /site/.env -- last 10 requests -- 28 GET /api/getItem/LWFB2001KG 21 POST /wp/ 13 POST /wp/index.php 9 GET /wp/ 7 POST /wp/wp-json/Batch/v1 7 POST /wp/wp-json/batch/v1/ 7 POST /wp/wp-json/batch/v1 7 POST /wp//wp-json/batch/v1 7 POST /wp/wordpress/wp-json/batch/v1 7 POST /wp/blog/wp-json/batch/v1 2 GET /backup.zip 2 GET / 1 POST /wordpress/index.php 1 POST / 1 GET /xampp/phpinfo.php 1 GET /xampp/.env 1 GET /www.zip 1 GET /www.tar.gz 1 GET /www.sql 1 GET /wwwroot.zip --- busiest 3 vhosts: top paths + last 10 requests --- == otter2/otterfencing.net.au-ssl_log == -- top paths -- 93.123.109.250 - - [06/Sep/2026:14:17:53 +1000] "GET /server_info.php HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" 93.123.109.250 - - [06/Sep/2026:14:17:53 +1000] "GET /server-info HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" 93.123.109.250 - - [06/Sep/2026:14:17:53 +1000] "GET /test.php HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" 93.123.109.250 - - [06/Sep/2026:14:17:53 +1000] "GET /app_dev.php/_profiler/phpinfo HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" 93.123.109.250 - - [06/Sep/2026:14:17:55 +1000] "GET /settings.py HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" 93.123.109.250 - - [06/Sep/2026:14:17:55 +1000] "GET /config/aws.yml HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" 93.123.109.250 - - [06/Sep/2026:14:17:57 +1000] "GET /backend/config/default.yml HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" 93.123.109.250 - - [06/Sep/2026:14:17:57 +1000] "GET /?phpinfo=1 HTTP/1.1" 200 13725 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" 93.123.109.250 - - [06/Sep/2026:14:17:57 +1000] "GET /app.py HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" 93.123.109.250 - - [06/Sep/2026:14:17:57 +1000] "GET /application.properties HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 21 POST /wp/ 13 POST /wp/index.php 9 GET /wp/ 7 POST /wp/wp-json/Batch/v1 7 POST /wp/wp-json/batch/v1/ 7 POST /wp/wp-json/batch/v1 7 POST /wp//wp-json/batch/v1 7 POST /wp/wordpress/wp-json/batch/v1 7 POST /wp/blog/wp-json/batch/v1 1 POST /wordpress/index.php 1 GET /wp/wp/v2/users 1 GET /wp/wp/v2/tags -- last 10 requests -- 28 GET /api/getItem/LWFB2001KG 1 GET /api/getItem/SHSP200200608 1 GET /api/getItem/SHSP200200508 1 GET /api/getItem/SHSP150150608 1 GET /api/getItem/SHSP150150508 1 GET /api/getItem/SHSP125125608 1 GET /api/getItem/SHSP100100608 1 GET /api/getItem/SHSG125125508 1 GET /api/getItem/SHSG125125408 1 GET /api/getItem/SHSG100100508 1 GET /api/getItem/SHSG100100408 1 GET /api/getItem/SHSG100100308 -- last 10 requests -- 195.178.110.103 - - [06/Sep/2026:14:17:25 +1000] "GET /wp/?rest_route=/wp/v2/tags HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.103 - - [06/Sep/2026:14:17:25 +1000] "GET /wp/wp/v2/posts/999998 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.103 - - [06/Sep/2026:14:17:25 +1000] "GET /wp/?rest_route=/wp/v2/posts/999998 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537. 195.178.110.103 - - [06/Sep/2026:14:17:25 +1000] "GET /wp/wp/v2/posts/99999 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.103 - - [06/Sep/2026:14:17:26 +1000] "GET /wp/?rest_route=/wp/v2/posts/99999 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 195.178.110.103 - - [06/Sep/2026:14:17:26 +1000] "GET /wp/wp/v2/posts/9999999 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.103 - - [06/Sep/2026:14:17:26 +1000] "GET /wp/?rest_route=/wp/v2/posts/9999999 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537 195.178.110.103 - - [06/Sep/2026:14:17:27 +1000] "GET /wp/wp/v2/users HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.103 - - [06/Sep/2026:14:17:27 +1000] "GET /wp/?rest_route=/wp/v2/users HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 195.178.110.103 - - [06/Sep/2026:14:17:27 +1000] "POST /wordpress/index.php?rest_route=/batch/v1 HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safa 40.115.94.245 - - [06/Sep/2026:14:17:06 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:14:17:07 +1000] "GET /api/getItem/RHSG7525258 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:14:17:07 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:14:17:07 +1000] "GET /api/getItem/RHSG7550168 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:14:17:07 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:14:17:07 +1000] "GET /api/getItem/RHSG755020 HTTP/1.1" 200 1502 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:14:17:08 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:14:17:08 +1000] "GET /api/getItem/RHSG7550258 HTTP/1.1" 200 1340 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:14:17:08 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:14:17:08 +1000] "GET /api/getItem/RHSG7550308 HTTP/1.1" 200 1340 "-" "RestSharp/106.13.0.0" == alison/alisonarts.com.au-ssl_log == -- top paths -- --- last 30 samples (run-up to this incident) --- 2 GET / 1 POST / 1 GET /xampp/phpinfo.php 1 GET /xampp/.env 1 GET /www/.env 1 GET /wp-json/wp/v2/users/me 1 GET /wp-config.php.bak 1 GET /wp-config 1 GET /website/.env 1 GET /web/.env 1 GET /test.php 1 GET /site/.env -- last 10 requests -- 93.123.109.250 - - [06/Sep/2026:14:17:53 +1000] "GET /server_info.php HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" 93.123.109.250 - - [06/Sep/2026:14:17:53 +1000] "GET /server-info HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" 93.123.109.250 - - [06/Sep/2026:14:17:53 +1000] "GET /test.php HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" 93.123.109.250 - - [06/Sep/2026:14:17:53 +1000] "GET /app_dev.php/_profiler/phpinfo HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" 93.123.109.250 - - [06/Sep/2026:14:17:55 +1000] "GET /settings.py HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" 93.123.109.250 - - [06/Sep/2026:14:17:55 +1000] "GET /config/aws.yml HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" 93.123.109.250 - - [06/Sep/2026:14:17:57 +1000] "GET /backend/config/default.yml HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" 93.123.109.250 - - [06/Sep/2026:14:17:57 +1000] "GET /?phpinfo=1 HTTP/1.1" 200 13725 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" 93.123.109.250 - - [06/Sep/2026:14:17:57 +1000] "GET /app.py HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" 93.123.109.250 - - [06/Sep/2026:14:17:57 +1000] "GET /application.properties HTTP/1.1" 404 9226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 2026-09-06 14:15:41 L1=1.63 run=6 blk=1 avail=10176(73.9%) swpO=0 conn=2 myRSS=1220 php=5 phpRSS=266 ap=13 tcp=26 topuser=madalice 2026-09-06 14:15:41 L1=1.63 run=4 blk=1 avail=10175(73.9%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=267 ap=13 tcp=26 topuser=madalice 2026-09-06 14:15:51 L1=1.62 run=3 blk=1 avail=10259(74.5%) swpO=0 conn=2 myRSS=1220 php=6 phpRSS=205 ap=13 tcp=26 topuser=madalice 2026-09-06 14:15:51 L1=1.62 run=4 blk=1 avail=10259(74.5%) swpO=0 conn=1 myRSS=1220 php=6 phpRSS=212 ap=13 tcp=26 topuser=madalice 2026-09-06 14:16:01 L1=1.60 run=2 blk=1 avail=10244(74.4%) swpO=0 conn=2 myRSS=1220 php=5 phpRSS=178 ap=13 tcp=27 topuser=madalice 2026-09-06 14:16:01 L1=1.60 run=3 blk=1 avail=10244(74.4%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=178 ap=13 tcp=27 topuser=madalice 2026-09-06 14:16:12 L1=1.50 run=4 blk=1 avail=10152(73.7%) swpO=0 conn=1 myRSS=1220 php=6 phpRSS=301 ap=13 tcp=27 topuser=madalice 2026-09-06 14:16:12 L1=1.50 run=3 blk=1 avail=10152(73.7%) swpO=0 conn=2 myRSS=1220 php=6 phpRSS=301 ap=13 tcp=27 topuser=madalice 2026-09-06 14:16:22 L1=1.43 run=2 blk=1 avail=10249(74.4%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=178 ap=13 tcp=25 topuser=madalice 2026-09-06 14:16:22 L1=1.43 run=2 blk=1 avail=10249(74.4%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=178 ap=13 tcp=25 topuser=madalice 2026-09-06 14:16:32 L1=1.43 run=1 blk=1 avail=10254(74.4%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=178 ap=13 tcp=26 topuser=madalice 2026-09-06 14:16:32 L1=1.43 run=3 blk=1 avail=10254(74.4%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=178 ap=13 tcp=26 topuser=madalice 2026-09-06 14:16:42 L1=1.52 run=2 blk=1 avail=10247(74.4%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=178 ap=14 tcp=27 topuser=madalice 2026-09-06 14:16:42 L1=1.52 run=2 blk=1 avail=10247(74.4%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=178 ap=14 tcp=27 topuser=madalice 2026-09-06 14:16:52 L1=1.52 run=2 blk=1 avail=10243(74.3%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=179 ap=14 tcp=24 topuser=madalice 2026-09-06 14:16:52 L1=1.52 run=2 blk=1 avail=10243(74.3%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=179 ap=14 tcp=24 topuser=madalice 2026-09-06 14:17:02 L1=1.44 run=4 blk=1 avail=10229(74.2%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=179 ap=14 tcp=27 topuser=madalice 2026-09-06 14:17:02 L1=1.44 run=3 blk=1 avail=10229(74.2%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=179 ap=14 tcp=27 topuser=madalice 2026-09-06 14:17:12 L1=1.52 run=3 blk=1 avail=10213(74.1%) swpO=4 conn=1 myRSS=1220 php=5 phpRSS=179 ap=15 tcp=26 topuser=madalice 2026-09-06 14:17:12 L1=1.52 run=2 blk=1 avail=10214(74.1%) swpO=4 conn=1 myRSS=1220 php=5 phpRSS=179 ap=15 tcp=26 topuser=madalice 2026-09-06 14:17:22 L1=1.44 run=2 blk=1 avail=10225(74.2%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=179 ap=14 tcp=22 topuser=madalice 2026-09-06 14:17:22 L1=1.44 run=2 blk=1 avail=10225(74.2%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=179 ap=14 tcp=22 topuser=madalice 2026-09-06 14:17:32 L1=1.45 run=2 blk=1 avail=10201(74.0%) swpO=0 conn=2 myRSS=1220 php=6 phpRSS=233 ap=14 tcp=25 topuser=madalice 2026-09-06 14:17:32 L1=1.45 run=7 blk=1 avail=10199(74.0%) swpO=0 conn=1 myRSS=1220 php=6 phpRSS=235 ap=14 tcp=25 topuser=madalice 2026-09-06 14:17:42 L1=1.46 run=2 blk=1 avail=9936 (72.1%) swpO=0 conn=2 myRSS=1220 php=7 phpRSS=440 ap=27 tcp=40 topuser=evolution 2026-09-06 14:17:42 L1=1.46 run=3 blk=1 avail=9935 (72.1%) swpO=0 conn=1 myRSS=1220 php=7 phpRSS=443 ap=27 tcp=40 topuser=evolution 2026-09-06 14:17:52 L1=1.63 run=2 blk=1 avail=10037(72.9%) swpO=17 conn=2 myRSS=1220 php=7 phpRSS=343 ap=29 tcp=43 topuser=alison 2026-09-06 14:17:52 L1=1.63 run=4 blk=1 avail=10034(72.8%) swpO=17 conn=1 myRSS=1220 php=7 phpRSS=308 ap=29 tcp=43 topuser=alison 2026-09-06 14:18:02 L1=1.83 run=20 blk=1 avail=9201 (66.8%) swpO=112 conn=18 myRSS=1217 php=21 phpRSS=1610 ap=29 tcp=42 topuser=alison 2026-09-06 14:18:02 L1=1.83 run=22 blk=1 avail=9185 (66.7%) swpO=112 conn=18 myRSS=1217 php=21 phpRSS=1622 ap=29 tcp=42 topuser=alison 28 GET /api/getItem/LWFB2001KG 1 GET /api/getItem/SHSP200200608 1 GET /api/getItem/SHSP200200508 1 GET /api/getItem/SHSP150150608 1 GET /api/getItem/SHSP150150508 1 GET /api/getItem/SHSP125125608 1 GET /api/getItem/SHSP100100608 1 GET /api/getItem/SHSG125125508 1 GET /api/getItem/SHSG125125408 1 GET /api/getItem/SHSG100100508 1 GET /api/getItem/SHSG100100408 1 GET /api/getItem/SHSG100100308 -- last 10 requests -- 40.115.94.245 - - [06/Sep/2026:14:17:06 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:14:17:07 +1000] "GET /api/getItem/RHSG7525258 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:14:17:07 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:14:17:07 +1000] "GET /api/getItem/RHSG7550168 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:14:17:07 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:14:17:07 +1000] "GET /api/getItem/RHSG755020 HTTP/1.1" 200 1502 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:14:17:08 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:14:17:08 +1000] "GET /api/getItem/RHSG7550258 HTTP/1.1" 200 1340 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:14:17:08 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [06/Sep/2026:14:17:08 +1000] "GET /api/getItem/RHSG7550308 HTTP/1.1" 200 1340 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-06 14:15:41 L1=1.63 run=6 blk=1 avail=10176(73.9%) swpO=0 conn=2 myRSS=1220 php=5 phpRSS=266 ap=13 tcp=26 topuser=madalice 2026-09-06 14:15:41 L1=1.63 run=4 blk=1 avail=10175(73.9%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=267 ap=13 tcp=26 topuser=madalice 2026-09-06 14:15:51 L1=1.62 run=3 blk=1 avail=10259(74.5%) swpO=0 conn=2 myRSS=1220 php=6 phpRSS=205 ap=13 tcp=26 topuser=madalice 2026-09-06 14:15:51 L1=1.62 run=4 blk=1 avail=10259(74.5%) swpO=0 conn=1 myRSS=1220 php=6 phpRSS=212 ap=13 tcp=26 topuser=madalice 2026-09-06 14:16:01 L1=1.60 run=2 blk=1 avail=10244(74.4%) swpO=0 conn=2 myRSS=1220 php=5 phpRSS=178 ap=13 tcp=27 topuser=madalice 2026-09-06 14:16:01 L1=1.60 run=3 blk=1 avail=10244(74.4%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=178 ap=13 tcp=27 topuser=madalice 2026-09-06 14:16:12 L1=1.50 run=4 blk=1 avail=10152(73.7%) swpO=0 conn=1 myRSS=1220 php=6 phpRSS=301 ap=13 tcp=27 topuser=madalice 2026-09-06 14:16:12 L1=1.50 run=3 blk=1 avail=10152(73.7%) swpO=0 conn=2 myRSS=1220 php=6 phpRSS=301 ap=13 tcp=27 topuser=madalice 2026-09-06 14:16:22 L1=1.43 run=2 blk=1 avail=10249(74.4%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=178 ap=13 tcp=25 topuser=madalice 2026-09-06 14:16:22 L1=1.43 run=2 blk=1 avail=10249(74.4%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=178 ap=13 tcp=25 topuser=madalice 2026-09-06 14:16:32 L1=1.43 run=1 blk=1 avail=10254(74.4%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=178 ap=13 tcp=26 topuser=madalice 2026-09-06 14:16:32 L1=1.43 run=3 blk=1 avail=10254(74.4%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=178 ap=13 tcp=26 topuser=madalice 2026-09-06 14:16:42 L1=1.52 run=2 blk=1 avail=10247(74.4%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=178 ap=14 tcp=27 topuser=madalice 2026-09-06 14:16:42 L1=1.52 run=2 blk=1 avail=10247(74.4%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=178 ap=14 tcp=27 topuser=madalice 2026-09-06 14:16:52 L1=1.52 run=2 blk=1 avail=10243(74.3%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=179 ap=14 tcp=24 topuser=madalice 2026-09-06 14:16:52 L1=1.52 run=2 blk=1 avail=10243(74.3%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=179 ap=14 tcp=24 topuser=madalice 2026-09-06 14:17:02 L1=1.44 run=4 blk=1 avail=10229(74.2%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=179 ap=14 tcp=27 topuser=madalice 2026-09-06 14:17:02 L1=1.44 run=3 blk=1 avail=10229(74.2%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=179 ap=14 tcp=27 topuser=madalice 2026-09-06 14:17:12 L1=1.52 run=3 blk=1 avail=10213(74.1%) swpO=4 conn=1 myRSS=1220 php=5 phpRSS=179 ap=15 tcp=26 topuser=madalice 2026-09-06 14:17:12 L1=1.52 run=2 blk=1 avail=10214(74.1%) swpO=4 conn=1 myRSS=1220 php=5 phpRSS=179 ap=15 tcp=26 topuser=madalice 2026-09-06 14:17:22 L1=1.44 run=2 blk=1 avail=10225(74.2%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=179 ap=14 tcp=22 topuser=madalice 2026-09-06 14:17:22 L1=1.44 run=2 blk=1 avail=10225(74.2%) swpO=0 conn=1 myRSS=1220 php=5 phpRSS=179 ap=14 tcp=22 topuser=madalice 2026-09-06 14:17:32 L1=1.45 run=2 blk=1 avail=10201(74.0%) swpO=0 conn=2 myRSS=1220 php=6 phpRSS=233 ap=14 tcp=25 topuser=madalice 2026-09-06 14:17:32 L1=1.45 run=7 blk=1 avail=10199(74.0%) swpO=0 conn=1 myRSS=1220 php=6 phpRSS=235 ap=14 tcp=25 topuser=madalice 2026-09-06 14:17:42 L1=1.46 run=2 blk=1 avail=9936 (72.1%) swpO=0 conn=2 myRSS=1220 php=7 phpRSS=440 ap=27 tcp=40 topuser=evolution 2026-09-06 14:17:42 L1=1.46 run=3 blk=1 avail=9935 (72.1%) swpO=0 conn=1 myRSS=1220 php=7 phpRSS=443 ap=27 tcp=40 topuser=evolution 2026-09-06 14:17:52 L1=1.63 run=2 blk=1 avail=10037(72.9%) swpO=17 conn=2 myRSS=1220 php=7 phpRSS=343 ap=29 tcp=43 topuser=alison 2026-09-06 14:17:52 L1=1.63 run=4 blk=1 avail=10034(72.8%) swpO=17 conn=1 myRSS=1220 php=7 phpRSS=308 ap=29 tcp=43 topuser=alison 2026-09-06 14:18:02 L1=1.83 run=20 blk=1 avail=9201 (66.8%) swpO=112 conn=18 myRSS=1217 php=21 phpRSS=1610 ap=29 tcp=42 topuser=alison 2026-09-06 14:18:02 L1=1.83 run=22 blk=1 avail=9185 (66.7%) swpO=112 conn=18 myRSS=1217 php=21 phpRSS=1622 ap=29 tcp=42 topuser=alison