INCIDENT 2026-09-08 04:38:57 trigger: php_procs=30 php_rss=2629MB mysql_conn=22 ================================================================== load: 5.70 2.38 1.77 29/734 2327334 ncpu:10 mem_avail: 7286MB/13777MB (52.9%) swap_used:3122MB swapout:336/s blocked(D):1 running:31 iowait:1.1% steal:0.0% php: 30 procs / 2629MB heaviest user: alison (24 procs, 2360MB) apache: 47 procs tcp_estab: 51 --- RSS by user (all processes) --- USER PROCS RSS_MB alison 25 2622 mysql 1 2130 root 254 1018 nobody 46 733 netdata 8 253 madalice 2 246 mailman 20 99 cpanellogin 1 74 dovenull 6 65 wp-toolkit 3 55 lowrange 3 42 mailnull 4 32 infinium 2 29 kurri 2 27 dovecot 3 26 evolution 11 16 vinesit 1 14 corpkicks 1 14 zabbix 1 12 named 1 10 --- php workers by user --- USER PROCS RSS_MB alison 25 2626 mysql 1 2130 root 252 1012 nobody 46 734 netdata 8 253 madalice 2 246 mailman 20 99 cpanellogin 1 74 dovenull 6 65 wp-toolkit 3 55 lowrange 3 42 mailnull 4 32 infinium 2 29 kurri 2 27 dovecot 3 26 evolution 11 16 vinesit 1 14 corpkicks 1 14 zabbix 1 12 named 1 10 --- php workers by user --- USER PROCS RSS_MB alison 25 2653 madalice 2 246 root 1 22 evolution 3 0 --- vm tuning / memory pressure --- alison 25 2658 madalice 2 246 root 1 22 evolution 3 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.swappiness 30 vm.vfs_cache_pressure 100 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_memory 0 vm.overcommit_ratio 50 vm.overcommit_ratio 50 Cached: 7086 MB Active(file): 3289 MB Inactive(file): 2763 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 670 MB CommitLimit: 10984 MB Committed_AS: 12604 MB --- backup / dump / scan processes (page-cache evictors) --- Cached: 7092 MB Active(file): 3289 MB Inactive(file): 2763 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 670 MB CommitLimit: 10984 MB Committed_AS: 12604 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 7-02:16:32 5024 /usr/bin/imunify-agent-proxy 4109079 root 2-23:54:10 1952 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-23:54:10 61992 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 7-02:16:32 5024 /usr/bin/imunify-agent-proxy 4109079 root 2-23:54:10 1952 /opt/ai-bolit/wrapper /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --mem 4109105 root 2-23:54:10 61992 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2048M --progress / --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 2181236 8.2 Ssl 2-09:02:27 /usr/sbin/mariadbd 166870 1 netdata 193120 2.6 Ssl 2-02:16:38 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1911708 1859745 root 177540 0.0 S 02:01:47 spamd child 1859745 1 root 163604 0.0 Ss 02:16:09 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2327251 2327095 alison 161896 47.0 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327233 2327228 alison 161772 33.0 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327248 2327158 alison 161368 49.6 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1911709 1859745 root 155500 0.0 S 02:01:47 spamd child 2327249 2325189 alison 154428 40.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327259 2325326 alison 153088 71.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327250 2327177 alison 147752 42.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327247 2327159 alison 144720 38.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327257 2326993 alison 141572 40.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327071 167896 madalice 141120 8.7 S 00:15 php-fpm: pool madalice_com_au 2327258 2326711 alison 135696 42.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327256 2327006 alison 133488 37.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327254 2327178 alison 128008 32.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327263 2327090 alison 123820 50.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327262 2325275 alison 112328 45.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327261 2325304 alison 111820 38.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327074 167896 madalice 111688 6.8 S 00:14 php-fpm: pool madalice_com_au 2327238 2326421 alison 111120 33.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327266 2327161 alison 110896 37.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327265 2327174 alison 100828 38.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327271 2327212 alison 80376 45.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1895702 1353308 cpanellogin 75968 0.0 S 02:04:55 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 2327288 2327227 alison 74196 34.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327269 2325264 alison 70404 30.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327328 2327222 alison 64836 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327273 2325316 alison 63992 20.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4109105 4109079 root 61992 1.2 Sl 2-23:54:10 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2327270 2327171 alison 59800 25.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327277 2327173 alison 58404 21.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 167871 1 root 49228 0.0 Ss 2-02:16:31 /usr/lib/systemd/systemd-journald 2327370 2327221 alison 44252 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509236 509098 root 43368 0.0 Sl 11-02:19:18 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 41544 0.1 Ss 70-18:29:13 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 40344 0.0 Ss 48-01:57:44 cpsrvd (SSL) - waiting for connections 167562 166914 netdata 34872 0.1 Sl 2-02:16:33 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2327405 167562 netdata 34872 0.0 R 00:00 /usr/libexec/netdata/plugins.d/go.d.plugin 1 166645 1 wp-toolkit 31220 0.0 Ss 2-02:16:42 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1859125 1 root 30632 0.0 Ss 02:16:42 lfd - sleeping 1463 1 root 23512 0.0 Ss 70-18:29:13 tailwatchd 167896 1 root 23188 0.0 Ss 2-02:16:30 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 2325060 506832 nobody 22164 0.0 S 03:31 /usr/sbin/httpd -k start 2325326 506832 nobody 21380 0.0 S 03:12 /usr/sbin/httpd -k start 2325275 506832 nobody 21064 0.0 S 03:14 /usr/sbin/httpd -k start 2325189 506832 nobody 21024 0.0 S 03:16 /usr/sbin/httpd -k start 2326711 506832 nobody 20912 0.0 S 00:53 /usr/sbin/httpd -k start 2326421 506832 nobody 20876 0.0 S 01:09 /usr/sbin/httpd -k start 2325280 506832 nobody 20260 0.0 S 03:14 /usr/sbin/httpd -k start 2327006 506832 nobody 20060 0.2 S 00:23 /usr/sbin/httpd -k start 2325316 506832 nobody 19980 0.0 S 03:12 /usr/sbin/httpd -k start 2325264 506832 nobody 19848 0.0 S 03:14 /usr/sbin/httpd -k start 2325304 506832 nobody 19752 0.0 S 03:13 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19404 0.0 Ss 2-02:16:31 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2327004 506832 nobody 19388 0.2 S 00:23 /usr/sbin/httpd -k start 2327160 506832 nobody 19224 0.2 S 00:10 /usr/sbin/httpd -k start 2327171 506832 nobody 19172 0.2 S 00:09 /usr/sbin/httpd -k start 2327161 506832 nobody 19152 0.2 S 00:10 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2987918 1 mysql 2181236 8.2 Ssl 2-09:02:27 /usr/sbin/mariadbd 166870 1 netdata 193120 2.6 Ssl 2-02:16:38 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1911708 1859745 root 177540 0.0 S 02:01:47 spamd child 1859745 1 root 163604 0.0 Ss 02:16:09 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2327233 2327228 alison 161772 33.0 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327248 2327158 alison 161632 50.0 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327249 2325189 alison 155748 41.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1911709 1859745 root 155500 0.0 S 02:01:47 spamd child 2327259 2325326 alison 153616 71.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327250 2327177 alison 147752 42.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327247 2327159 alison 145512 38.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327257 2326993 alison 144312 41.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327071 167896 madalice 141120 8.7 S 00:15 php-fpm: pool madalice_com_au 2327258 2326711 alison 135792 42.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327256 2327006 alison 134544 38.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327251 2327095 alison 132232 48.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327254 2327178 alison 130384 32.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327263 2327090 alison 125140 52.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327262 2325275 alison 114176 46.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327261 2325304 alison 113460 39.5 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327074 167896 madalice 111688 6.8 S 00:14 php-fpm: pool madalice_com_au 2327266 2327161 alison 111160 37.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327238 2326421 alison 111120 33.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327265 2327174 alison 100828 38.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327271 2327212 alison 83280 47.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1895702 1353308 cpanellogin 75968 0.0 S 02:04:55 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 2327288 2327227 alison 75252 35.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327269 2325264 alison 70404 30.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327328 2327222 alison 66420 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327273 2325316 alison 65032 22.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4109105 4109079 root 61992 1.2 Sl 2-23:54:10 /opt/rustbolit/rustbolit --smart --deobfuscate --avdb /var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.db --no-html --memory 2327270 2327171 alison 59976 26.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327277 2327173 alison 55076 22.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2327370 2327221 alison 51824 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 167871 1 root 49228 0.0 Ss 2-02:16:31 /usr/lib/systemd/systemd-journald 509236 509098 root 43368 0.0 Sl 11-02:19:18 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 41544 0.1 Ss 70-18:29:13 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 40344 0.0 Ss 48-01:57:44 cpsrvd (SSL) - waiting for connections 167562 166914 netdata 34872 0.1 Sl 2-02:16:33 /usr/libexec/netdata/plugins.d/go.d.plugin 1 166645 1 wp-toolkit 31220 0.0 Ss 2-02:16:42 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1859125 1 root 30632 0.0 Ss 02:16:42 lfd - sleeping 1463 1 root 23512 0.0 Ss 70-18:29:13 tailwatchd 167896 1 root 23188 0.0 Ss 2-02:16:30 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 2325060 506832 nobody 22164 0.0 S 03:31 /usr/sbin/httpd -k start 2325326 506832 nobody 21380 0.0 S 03:12 /usr/sbin/httpd -k start 2325275 506832 nobody 21064 0.0 S 03:14 /usr/sbin/httpd -k start 2325189 506832 nobody 21024 0.0 S 03:16 /usr/sbin/httpd -k start 2326711 506832 nobody 20912 0.0 S 00:53 /usr/sbin/httpd -k start 2326421 506832 nobody 20876 0.0 S 01:09 /usr/sbin/httpd -k start 2325280 506832 nobody 20260 0.0 S 03:14 /usr/sbin/httpd -k start 2327006 506832 nobody 20060 0.2 S 00:23 /usr/sbin/httpd -k start 2325316 506832 nobody 19980 0.0 S 03:12 /usr/sbin/httpd -k start 2325264 506832 nobody 19848 0.0 S 03:14 /usr/sbin/httpd -k start 2325304 506832 nobody 19752 0.0 S 03:13 /usr/sbin/httpd -k start 167845 1 wp-toolkit 19404 0.0 Ss 2-02:16:31 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2327004 506832 nobody 19388 0.2 S 00:23 /usr/sbin/httpd -k start 2327160 506832 nobody 19224 0.2 S 00:10 /usr/sbin/httpd -k start 2327171 506832 nobody 19172 0.2 S 00:09 /usr/sbin/httpd -k start 2327161 506832 nobody 19152 0.2 S 00:10 /usr/sbin/httpd -k start 2327158 506832 nobody 19148 0.2 S 00:10 /usr/sbin/httpd -k start --- mariadb processlist (non-sleeping) --- --- processes in D state (uninterruptible IO) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 5352318 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- mariadb processlist (non-sleeping) --- --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- +---------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 5352321 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 5352319 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | +---------+----------------------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min VHOST LOG REQ/3min alison/alisonarts.com.au-ssl_log 118 alison/alisonarts.com.au-ssl_log 118 evolution/app.evolutionerp.com.au-ssl_log 117 evolution/app.evolutionerp.com.au-ssl_log 117 evolution/my.evolutionerp.com.au-ssl_log 67 alison/alisonarts.com.au 42 evolution/portal.evolutionerp.com.au-ssl_log 42 madalice/madalice.com.au-ssl_log 11 tubesupplies/tubesupplies.com.au-ssl_log 1 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- evolution/my.evolutionerp.com.au-ssl_log 67 alison/alisonarts.com.au 42 evolution/portal.evolutionerp.com.au-ssl_log 42 madalice/madalice.com.au-ssl_log 11 tubesupplies/tubesupplies.com.au-ssl_log 1 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 142 213.209.159.133 117 40.115.94.245 64 103.104.165.99 35 213.209.159.84 29 203.54.180.238 13 101.184.64.117 4 114.119.143.14 2 40.77.167.12 2 17.166.150.234 2 140.245.116.147 1 54.236.1.242 1 52.167.144.222 1 43.165.126.130 1 146.70.178.116 1 136.243.146.219 --- top request paths across all vhosts (last 3 min) --- 142 213.209.159.133 117 40.115.94.245 64 103.104.165.99 35 213.209.159.84 29 203.54.180.238 13 101.184.64.117 4 114.119.143.14 2 40.77.167.12 2 17.166.150.234 2 140.245.116.147 1 54.236.1.242 1 52.167.144.222 1 43.165.126.130 1 146.70.178.116 1 136.243.146.219 --- top request paths across all vhosts (last 3 min) --- 59 GET /api/getItem/LWPG2001KG 38 GET / 29 GET /heartbeat.php 22 GET /app/ajax.php 14 GET /index.php 9 POST /plugins/csvexporter/plugin.php 9 POST /functions.php 6 POST /clienteditsave.php 6 GET /painted-engine-covers/ 5 POST /uploadsave.php 5 GET /painted-items/ 5 GET /painted-cases/ 4 GET /store/drippy-air-max-90-custom-shoes/ 3 POST /plugins/fencecosting/plugin.php 3 POST /logsave.php 3 GET /painted-motorcycles 3 GET /painted-hard-hats/ 3 GET /painted-boards/ 3 GET /custom-painted-spiderman-bonnet-liner/ 3 GET /custom-painted-light-covers/ --- busiest 3 vhosts: top paths + last 10 requests --- == alison/alisonarts.com.au-ssl_log == -- top paths -- 37 GET / 4 GET /painted-engine-covers/ 3 GET /painted-items/ 3 GET /painted-hard-hats/ 3 GET /painted-cases/ 3 GET /painted-boards/ 3 GET /custom-paint-and-airbrush-gallery/ 2 GET /simtars-30-years-custom-hard-hat/ 2 GET /painted-motorcycles/ 2 GET /painted-motorcycles 2 GET /full-brimmed-custom-hard-hat/ 2 GET /custom-painted-spiderman-bonnet-liner/ -- last 10 requests -- 213.209.159.133 - - [08/Sep/2026:04:38:54 +1000] "GET /hand-painted-gold-miners-hard-hat/ HTTP/1.1" 200 12836 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [08/Sep/2026:04:38:54 +1000] "GET /custom-painted-miners-hard-hat-helmet/ HTTP/1.1" 200 12594 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [08/Sep/2026:04:38:54 +1000] "GET /custom-hard-hat-jeebropilly/ HTTP/1.1" 200 13488 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [08/Sep/2026:04:38:54 +1000] "GET /custom-hand-painted-hard-hat-spinifex/ HTTP/1.1" 200 12867 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [08/Sep/2026:04:38:55 +1000] "GET /custom-airbrush-painted-miners-hard-hat-anglo/ HTTP/1.1" 200 12639 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [08/Sep/2026:04:38:54 +1000] "GET /custom-painted-futurama-hard-hat/ HTTP/1.1" 200 12984 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [08/Sep/2026:04:38:53 +1000] "GET /custom-painted-rocking-horse/ HTTP/1.1" 200 12942 "http://alisonarts.com.au/custom-painted-rocking-horse/" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.c 213.209.159.133 - - [08/Sep/2026:04:38:55 +1000] "GET /miners-hard-hat-custom-airbrush-painted-new-hope-group/ HTTP/1.1" 200 12696 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [08/Sep/2026:04:38:55 +1000] "GET /mine-rescue-custom-painted-miners-hard-hat-helmets/ HTTP/1.1" 200 12971 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [08/Sep/2026:04:38:55 +1000] "GET /custom-artwork-on-miners-hard-hat/ HTTP/1.1" 200 12875 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 59 GET /api/getItem/LWPG2001KG 3 GET /api/getItem/SHSG404016-DP25-24-DI-110 1 GET /api/getItem/SHSG909020-8 1 GET /api/getItem/SHSG898950-8 1 GET /api/getItem/SHSG898935-8 1 GET /api/getItem/SHSG898930-8 1 GET /api/getItem/SHSG898920-8 1 GET /api/getItem/SHSG757550-8 1 GET /api/getItem/SHSG757540-8 1 GET /api/getItem/SHSG757530-8 1 GET /api/getItem/SHSG757525-8 1 GET /api/getItem/SHSG757520-SP25-8 -- last 10 requests -- 59 GET /api/getItem/LWPG2001KG 38 GET / 29 GET /heartbeat.php 22 GET /app/ajax.php 14 GET /index.php 9 POST /plugins/csvexporter/plugin.php 9 POST /functions.php 6 POST /clienteditsave.php 6 GET /painted-engine-covers/ 5 POST /uploadsave.php 5 GET /painted-items/ 5 GET /painted-cases/ 4 GET /store/drippy-air-max-90-custom-shoes/ 3 POST /plugins/fencecosting/plugin.php 3 POST /logsave.php 3 GET /painted-motorcycles 3 GET /painted-hard-hats/ 3 GET /painted-boards/ 3 GET /custom-painted-spiderman-bonnet-liner/ 3 GET /custom-painted-light-covers/ --- busiest 3 vhosts: top paths + last 10 requests --- == alison/alisonarts.com.au-ssl_log == -- top paths -- 37 GET / 4 GET /painted-engine-covers/ 3 GET /painted-items/ 3 GET /painted-hard-hats/ 3 GET /painted-cases/ 3 GET /painted-boards/ 3 GET /custom-paint-and-airbrush-gallery/ 2 GET /simtars-30-years-custom-hard-hat/ 2 GET /painted-motorcycles/ 2 GET /painted-motorcycles 2 GET /full-brimmed-custom-hard-hat/ 2 GET /custom-painted-spiderman-bonnet-liner/ -- last 10 requests -- 40.115.94.245 - - [08/Sep/2026:04:38:06 +1000] "GET /api/getItem/CLFBNSTD50250KK HTTP/1.1" 200 1552 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [08/Sep/2026:04:38:06 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [08/Sep/2026:04:38:06 +1000] "GET /api/getItem/CLPBNSTD50315KK HTTP/1.1" 200 1541 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [08/Sep/2026:04:38:06 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [08/Sep/2026:04:38:06 +1000] "GET /api/getItem/CLPBNSTD45250KK HTTP/1.1" 200 1539 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [08/Sep/2026:04:38:07 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [08/Sep/2026:04:38:07 +1000] "GET /api/getItem/CLSGNSTD45250KK HTTP/1.1" 404 117 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [08/Sep/2026:04:38:07 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [08/Sep/2026:04:38:07 +1000] "GET /api/getItem/CLPBNSTD45315KK HTTP/1.1" 200 1538 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [08/Sep/2026:04:38:07 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 22 GET /app/ajax.php 12 GET /index.php 9 POST /plugins/csvexporter/plugin.php 9 POST /functions.php 6 POST /clienteditsave.php 3 POST /plugins/fencecosting/plugin.php 3 POST /logsave.php 2 POST /app/ajax/selectFilterSingle.php 1 POST /app/ajax.php -- last 10 requests -- 213.209.159.133 - - [08/Sep/2026:04:38:54 +1000] "GET /hand-painted-gold-miners-hard-hat/ HTTP/1.1" 200 12836 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [08/Sep/2026:04:38:54 +1000] "GET /custom-painted-miners-hard-hat-helmet/ HTTP/1.1" 200 12594 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [08/Sep/2026:04:38:54 +1000] "GET /custom-hard-hat-jeebropilly/ HTTP/1.1" 200 13488 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [08/Sep/2026:04:38:54 +1000] "GET /custom-hand-painted-hard-hat-spinifex/ HTTP/1.1" 200 12867 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [08/Sep/2026:04:38:55 +1000] "GET /custom-airbrush-painted-miners-hard-hat-anglo/ HTTP/1.1" 200 12639 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [08/Sep/2026:04:38:54 +1000] "GET /custom-painted-futurama-hard-hat/ HTTP/1.1" 200 12984 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [08/Sep/2026:04:38:53 +1000] "GET /custom-painted-rocking-horse/ HTTP/1.1" 200 12942 "http://alisonarts.com.au/custom-painted-rocking-horse/" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.c 213.209.159.133 - - [08/Sep/2026:04:38:55 +1000] "GET /miners-hard-hat-custom-airbrush-painted-new-hope-group/ HTTP/1.1" 200 12696 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [08/Sep/2026:04:38:55 +1000] "GET /mine-rescue-custom-painted-miners-hard-hat-helmets/ HTTP/1.1" 200 12971 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" 213.209.159.133 - - [08/Sep/2026:04:38:55 +1000] "GET /custom-artwork-on-miners-hard-hat/ HTTP/1.1" 200 12875 "-" "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 103.104.165.99 - - [08/Sep/2026:04:38:02 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12149" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 103.104.165.99 - - [08/Sep/2026:04:38:02 +1000] "POST /plugins/fencecosting/plugin.php HTTP/1.1" 200 3913 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12149" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 103.104.165.99 - - [08/Sep/2026:04:38:02 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 2855 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12149" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe 103.104.165.99 - - [08/Sep/2026:04:38:02 +1000] "POST /logsave.php?call=getHistory&id=12149&module=job HTTP/1.1" 200 443 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12149" "Mozilla/5.0 (Windows NT 10.0; Win 103.104.165.99 - - [08/Sep/2026:04:38:03 +1000] "GET /app/ajax.php?cn=&furi=true&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=10673523077 HTTP/1.1" 200 202 "https://my.evolutionerp.com.au/index.php?page=jobedit&id 103.104.165.99 - - [08/Sep/2026:04:38:03 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=15927581778 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 103.104.165.99 - - [08/Sep/2026:04:38:03 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=13596310757 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 103.104.165.99 - - [08/Sep/2026:04:38:03 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobedit%26id%3D12149&call=getUserSetting&caller=ajaxSubmitLocal&seq=15912876031 HTTP/1.1" 200 98 "https://my.evolutionerp.com.au 103.104.165.99 - - [08/Sep/2026:04:38:03 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Djobedit%26id%3D12149&call=getUserSetting&caller=ajaxSubmitLocal&seq=18045709636 HTTP/1.1" 200 112 "https://my. 103.104.165.99 - - [08/Sep/2026:04:38:03 +1000] "GET /app/ajax.php?cn=tsExportSettingstimesheet&furi=false&uri=%2F&call=getUserSetting&caller=ajaxSubmitLocal&seq=11775582659 HTTP/1.1" 200 103 "https://my.evolutionerp.com --- last 30 samples (run-up to this incident) --- 2026-09-08 04:36:36 L1=1.70 run=1 blk=1 avail=8625 (62.6%) swpO=0 conn=1 myRSS=2142 php=6 phpRSS=311 ap=100 tcp=34 topuser=madalice 2026-09-08 04:36:36 L1=1.70 run=2 blk=1 avail=8625 (62.6%) swpO=0 conn=3 myRSS=2142 php=6 phpRSS=311 ap=99 tcp=34 topuser=madalice 2026-09-08 04:36:46 L1=1.60 run=1 blk=1 avail=8691 (63.1%) swpO=0 conn=1 myRSS=2142 php=6 phpRSS=311 ap=89 tcp=31 topuser=madalice 2026-09-08 04:36:46 L1=1.60 run=2 blk=1 avail=8691 (63.1%) swpO=0 conn=3 myRSS=2142 php=6 phpRSS=311 ap=89 tcp=31 topuser=madalice 2026-09-08 04:36:56 L1=1.50 run=1 blk=1 avail=9015 (65.4%) swpO=0 conn=1 myRSS=2142 php=5 phpRSS=43 ap=79 tcp=28 topuser=root 2026-09-08 04:36:56 L1=1.50 run=3 blk=1 avail=9014 (65.4%) swpO=0 conn=3 myRSS=2142 php=5 phpRSS=57 ap=79 tcp=28 topuser=evolution 2026-09-08 04:37:06 L1=1.43 run=5 blk=1 avail=8818 (64.0%) swpO=0 conn=1 myRSS=2142 php=6 phpRSS=331 ap=69 tcp=25 topuser=madalice 2026-09-08 04:37:06 L1=1.43 run=4 blk=1 avail=8816 (64.0%) swpO=0 conn=2 myRSS=2142 php=6 phpRSS=332 ap=69 tcp=25 topuser=madalice 2026-09-08 04:37:16 L1=1.36 run=1 blk=1 avail=8913 (64.7%) swpO=0 conn=1 myRSS=2143 php=6 phpRSS=308 ap=59 tcp=27 topuser=madalice 2026-09-08 04:37:16 L1=1.36 run=3 blk=1 avail=8912 (64.7%) swpO=0 conn=2 myRSS=2143 php=6 phpRSS=308 ap=59 tcp=27 topuser=madalice 2026-09-08 04:37:26 L1=1.30 run=1 blk=1 avail=8983 (65.2%) swpO=0 conn=1 myRSS=2143 php=6 phpRSS=308 ap=49 tcp=32 topuser=madalice 2026-09-08 04:37:26 L1=1.30 run=2 blk=1 avail=8983 (65.2%) swpO=0 conn=2 myRSS=2143 php=6 phpRSS=308 ap=49 tcp=32 topuser=madalice 2026-09-08 04:37:36 L1=1.26 run=1 blk=1 avail=9303 (67.5%) swpO=0 conn=1 myRSS=2143 php=4 phpRSS=22 ap=39 tcp=31 topuser=root 2026-09-08 04:37:36 L1=1.26 run=2 blk=1 avail=9303 (67.5%) swpO=0 conn=2 myRSS=2143 php=4 phpRSS=22 ap=39 tcp=31 topuser=root 2026-09-08 04:37:46 L1=1.22 run=2 blk=1 avail=9250 (67.1%) swpO=0 conn=1 myRSS=2143 php=6 phpRSS=210 ap=29 tcp=27 topuser=madalice 2026-09-08 04:37:46 L1=1.22 run=3 blk=1 avail=9249 (67.1%) swpO=0 conn=2 myRSS=2143 php=6 phpRSS=210 ap=29 tcp=27 topuser=madalice 2026-09-08 04:37:56 L1=1.26 run=3 blk=1 avail=9301 (67.5%) swpO=0 conn=1 myRSS=2143 php=6 phpRSS=193 ap=24 tcp=33 topuser=madalice 2026-09-08 04:37:56 L1=1.26 run=3 blk=2 avail=9298 (67.5%) swpO=0 conn=2 myRSS=2143 php=6 phpRSS=193 ap=24 tcp=33 topuser=madalice 2026-09-08 04:38:06 L1=1.53 run=1 blk=1 avail=9132 (66.3%) swpO=0 conn=1 myRSS=2144 php=6 phpRSS=335 ap=26 tcp=36 topuser=madalice 2026-09-08 04:38:06 L1=1.53 run=4 blk=1 avail=9130 (66.3%) swpO=0 conn=1 myRSS=2144 php=6 phpRSS=335 ap=26 tcp=36 topuser=madalice 2026-09-08 04:38:16 L1=1.45 run=1 blk=1 avail=9153 (66.4%) swpO=0 conn=1 myRSS=2144 php=6 phpRSS=335 ap=22 tcp=28 topuser=madalice 2026-09-08 04:38:16 L1=1.45 run=2 blk=1 avail=9152 (66.4%) swpO=0 conn=1 myRSS=2144 php=6 phpRSS=335 ap=22 tcp=28 topuser=madalice 2026-09-08 04:38:26 L1=1.38 run=2 blk=1 avail=9318 (67.6%) swpO=0 conn=1 myRSS=2145 php=5 phpRSS=47 ap=18 tcp=28 topuser=alison 2026-09-08 04:38:26 L1=1.38 run=4 blk=1 avail=9439 (68.5%) swpO=0 conn=1 myRSS=2145 php=4 phpRSS=22 ap=18 tcp=28 topuser=root 2026-09-08 04:38:36 L1=2.52 run=1 blk=1 avail=9376 (68.1%) swpO=6 conn=1 myRSS=2145 php=4 phpRSS=22 ap=25 tcp=35 topuser=root 2026-09-08 04:38:36 L1=2.52 run=2 blk=1 avail=9375 (68.1%) swpO=6 conn=1 myRSS=2145 php=4 phpRSS=22 ap=25 tcp=35 topuser=root 2026-09-08 04:38:46 L1=2.44 run=17 blk=1 avail=8654 (62.8%) swpO=236 conn=1 myRSS=2139 php=18 phpRSS=1231 ap=21 tcp=94 topuser=alison 2026-09-08 04:38:46 L1=2.44 run=15 blk=1 avail=8683 (63.0%) swpO=236 conn=1 myRSS=2139 php=18 phpRSS=1236 ap=21 tcp=94 topuser=alison 2026-09-08 04:38:57 L1=5.70 run=31 blk=1 avail=7272 (52.8%) swpO=336 conn=22 myRSS=2130 php=30 phpRSS=2622 ap=47 tcp=51 topuser=alison 2026-09-08 04:38:57 L1=5.70 run=31 blk=1 avail=7286 (52.9%) swpO=336 conn=22 myRSS=2130 php=30 phpRSS=2629 ap=47 tcp=51 topuser=alison 59 GET /api/getItem/LWPG2001KG 3 GET /api/getItem/SHSG404016-DP25-24-DI-110 1 GET /api/getItem/SHSG909020-8 1 GET /api/getItem/SHSG898950-8 1 GET /api/getItem/SHSG898935-8 1 GET /api/getItem/SHSG898930-8 1 GET /api/getItem/SHSG898920-8 1 GET /api/getItem/SHSG757550-8 1 GET /api/getItem/SHSG757540-8 1 GET /api/getItem/SHSG757530-8 1 GET /api/getItem/SHSG757525-8 1 GET /api/getItem/SHSG757520-SP25-8 -- last 10 requests -- 40.115.94.245 - - [08/Sep/2026:04:38:06 +1000] "GET /api/getItem/CLFBNSTD50250KK HTTP/1.1" 200 1552 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [08/Sep/2026:04:38:06 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [08/Sep/2026:04:38:06 +1000] "GET /api/getItem/CLPBNSTD50315KK HTTP/1.1" 200 1541 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [08/Sep/2026:04:38:06 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [08/Sep/2026:04:38:06 +1000] "GET /api/getItem/CLPBNSTD45250KK HTTP/1.1" 200 1539 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [08/Sep/2026:04:38:07 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [08/Sep/2026:04:38:07 +1000] "GET /api/getItem/CLSGNSTD45250KK HTTP/1.1" 404 117 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [08/Sep/2026:04:38:07 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [08/Sep/2026:04:38:07 +1000] "GET /api/getItem/CLPBNSTD45315KK HTTP/1.1" 200 1538 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [08/Sep/2026:04:38:07 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 22 GET /app/ajax.php 12 GET /index.php 9 POST /plugins/csvexporter/plugin.php 9 POST /functions.php 6 POST /clienteditsave.php 3 POST /plugins/fencecosting/plugin.php 3 POST /logsave.php 2 POST /app/ajax/selectFilterSingle.php 1 POST /app/ajax.php -- last 10 requests -- 103.104.165.99 - - [08/Sep/2026:04:38:02 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12149" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 103.104.165.99 - - [08/Sep/2026:04:38:02 +1000] "POST /plugins/fencecosting/plugin.php HTTP/1.1" 200 3913 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12149" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 103.104.165.99 - - [08/Sep/2026:04:38:02 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 2855 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12149" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe 103.104.165.99 - - [08/Sep/2026:04:38:02 +1000] "POST /logsave.php?call=getHistory&id=12149&module=job HTTP/1.1" 200 443 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12149" "Mozilla/5.0 (Windows NT 10.0; Win 103.104.165.99 - - [08/Sep/2026:04:38:03 +1000] "GET /app/ajax.php?cn=&furi=true&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=10673523077 HTTP/1.1" 200 202 "https://my.evolutionerp.com.au/index.php?page=jobedit&id 103.104.165.99 - - [08/Sep/2026:04:38:03 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=15927581778 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 103.104.165.99 - - [08/Sep/2026:04:38:03 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=13596310757 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 103.104.165.99 - - [08/Sep/2026:04:38:03 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobedit%26id%3D12149&call=getUserSetting&caller=ajaxSubmitLocal&seq=15912876031 HTTP/1.1" 200 98 "https://my.evolutionerp.com.au 103.104.165.99 - - [08/Sep/2026:04:38:03 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Djobedit%26id%3D12149&call=getUserSetting&caller=ajaxSubmitLocal&seq=18045709636 HTTP/1.1" 200 112 "https://my. 103.104.165.99 - - [08/Sep/2026:04:38:03 +1000] "GET /app/ajax.php?cn=tsExportSettingstimesheet&furi=false&uri=%2F&call=getUserSetting&caller=ajaxSubmitLocal&seq=11775582659 HTTP/1.1" 200 103 "https://my.evolutionerp.com --- last 30 samples (run-up to this incident) --- 2026-09-08 04:36:36 L1=1.70 run=1 blk=1 avail=8625 (62.6%) swpO=0 conn=1 myRSS=2142 php=6 phpRSS=311 ap=100 tcp=34 topuser=madalice 2026-09-08 04:36:36 L1=1.70 run=2 blk=1 avail=8625 (62.6%) swpO=0 conn=3 myRSS=2142 php=6 phpRSS=311 ap=99 tcp=34 topuser=madalice 2026-09-08 04:36:46 L1=1.60 run=1 blk=1 avail=8691 (63.1%) swpO=0 conn=1 myRSS=2142 php=6 phpRSS=311 ap=89 tcp=31 topuser=madalice 2026-09-08 04:36:46 L1=1.60 run=2 blk=1 avail=8691 (63.1%) swpO=0 conn=3 myRSS=2142 php=6 phpRSS=311 ap=89 tcp=31 topuser=madalice 2026-09-08 04:36:56 L1=1.50 run=1 blk=1 avail=9015 (65.4%) swpO=0 conn=1 myRSS=2142 php=5 phpRSS=43 ap=79 tcp=28 topuser=root 2026-09-08 04:36:56 L1=1.50 run=3 blk=1 avail=9014 (65.4%) swpO=0 conn=3 myRSS=2142 php=5 phpRSS=57 ap=79 tcp=28 topuser=evolution 2026-09-08 04:37:06 L1=1.43 run=5 blk=1 avail=8818 (64.0%) swpO=0 conn=1 myRSS=2142 php=6 phpRSS=331 ap=69 tcp=25 topuser=madalice 2026-09-08 04:37:06 L1=1.43 run=4 blk=1 avail=8816 (64.0%) swpO=0 conn=2 myRSS=2142 php=6 phpRSS=332 ap=69 tcp=25 topuser=madalice 2026-09-08 04:37:16 L1=1.36 run=1 blk=1 avail=8913 (64.7%) swpO=0 conn=1 myRSS=2143 php=6 phpRSS=308 ap=59 tcp=27 topuser=madalice 2026-09-08 04:37:16 L1=1.36 run=3 blk=1 avail=8912 (64.7%) swpO=0 conn=2 myRSS=2143 php=6 phpRSS=308 ap=59 tcp=27 topuser=madalice 2026-09-08 04:37:26 L1=1.30 run=1 blk=1 avail=8983 (65.2%) swpO=0 conn=1 myRSS=2143 php=6 phpRSS=308 ap=49 tcp=32 topuser=madalice 2026-09-08 04:37:26 L1=1.30 run=2 blk=1 avail=8983 (65.2%) swpO=0 conn=2 myRSS=2143 php=6 phpRSS=308 ap=49 tcp=32 topuser=madalice 2026-09-08 04:37:36 L1=1.26 run=1 blk=1 avail=9303 (67.5%) swpO=0 conn=1 myRSS=2143 php=4 phpRSS=22 ap=39 tcp=31 topuser=root 2026-09-08 04:37:36 L1=1.26 run=2 blk=1 avail=9303 (67.5%) swpO=0 conn=2 myRSS=2143 php=4 phpRSS=22 ap=39 tcp=31 topuser=root 2026-09-08 04:37:46 L1=1.22 run=2 blk=1 avail=9250 (67.1%) swpO=0 conn=1 myRSS=2143 php=6 phpRSS=210 ap=29 tcp=27 topuser=madalice 2026-09-08 04:37:46 L1=1.22 run=3 blk=1 avail=9249 (67.1%) swpO=0 conn=2 myRSS=2143 php=6 phpRSS=210 ap=29 tcp=27 topuser=madalice 2026-09-08 04:37:56 L1=1.26 run=3 blk=1 avail=9301 (67.5%) swpO=0 conn=1 myRSS=2143 php=6 phpRSS=193 ap=24 tcp=33 topuser=madalice 2026-09-08 04:37:56 L1=1.26 run=3 blk=2 avail=9298 (67.5%) swpO=0 conn=2 myRSS=2143 php=6 phpRSS=193 ap=24 tcp=33 topuser=madalice 2026-09-08 04:38:06 L1=1.53 run=1 blk=1 avail=9132 (66.3%) swpO=0 conn=1 myRSS=2144 php=6 phpRSS=335 ap=26 tcp=36 topuser=madalice 2026-09-08 04:38:06 L1=1.53 run=4 blk=1 avail=9130 (66.3%) swpO=0 conn=1 myRSS=2144 php=6 phpRSS=335 ap=26 tcp=36 topuser=madalice 2026-09-08 04:38:16 L1=1.45 run=1 blk=1 avail=9153 (66.4%) swpO=0 conn=1 myRSS=2144 php=6 phpRSS=335 ap=22 tcp=28 topuser=madalice 2026-09-08 04:38:16 L1=1.45 run=2 blk=1 avail=9152 (66.4%) swpO=0 conn=1 myRSS=2144 php=6 phpRSS=335 ap=22 tcp=28 topuser=madalice 2026-09-08 04:38:26 L1=1.38 run=2 blk=1 avail=9318 (67.6%) swpO=0 conn=1 myRSS=2145 php=5 phpRSS=47 ap=18 tcp=28 topuser=alison 2026-09-08 04:38:26 L1=1.38 run=4 blk=1 avail=9439 (68.5%) swpO=0 conn=1 myRSS=2145 php=4 phpRSS=22 ap=18 tcp=28 topuser=root 2026-09-08 04:38:36 L1=2.52 run=1 blk=1 avail=9376 (68.1%) swpO=6 conn=1 myRSS=2145 php=4 phpRSS=22 ap=25 tcp=35 topuser=root 2026-09-08 04:38:36 L1=2.52 run=2 blk=1 avail=9375 (68.1%) swpO=6 conn=1 myRSS=2145 php=4 phpRSS=22 ap=25 tcp=35 topuser=root 2026-09-08 04:38:46 L1=2.44 run=17 blk=1 avail=8654 (62.8%) swpO=236 conn=1 myRSS=2139 php=18 phpRSS=1231 ap=21 tcp=94 topuser=alison 2026-09-08 04:38:46 L1=2.44 run=15 blk=1 avail=8683 (63.0%) swpO=236 conn=1 myRSS=2139 php=18 phpRSS=1236 ap=21 tcp=94 topuser=alison 2026-09-08 04:38:57 L1=5.70 run=31 blk=1 avail=7272 (52.8%) swpO=336 conn=22 myRSS=2130 php=30 phpRSS=2622 ap=47 tcp=51 topuser=alison 2026-09-08 04:38:57 L1=5.70 run=31 blk=1 avail=7286 (52.9%) swpO=336 conn=22 myRSS=2130 php=30 phpRSS=2629 ap=47 tcp=51 topuser=alison