INCIDENT 2026-09-10 09:01:30 trigger: php_procs=50 php_rss=1915MB ================================================================== load: 2.56 1.94 1.63 7/734 865524 ncpu:10 mem_avail: 7133MB/13777MB (51.8%) swap_used:1475MB swapout:0/s blocked(D):0 running:2 iowait:0.0% steal:0.0% php: 50 procs / 1915MB heaviest user: evolution (48 procs, 1780MB) apache: 82 procs tcp_estab: 102 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2893 evolution 52 1787 nobody 81 1471 root 253 1148 netdata 8 255 mailman 20 190 madalice 1 133 aaa 6 87 infinium 2 81 dovenull 6 67 wp-toolkit 3 62 cpanellogin 1 55 kurri 3 41 mailnull 3 30 dovecot 3 28 candyfabcom 2 27 polkitd 1 15 lowrange 1 14 zabbix 1 10 nscd 1 6 --- php workers by user --- USER PROCS RSS_MB evolution 49 1814 madalice 1 133 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5504 MB Active(file): 4593 MB Inactive(file): 1047 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 619 MB CommitLimit: 10984 MB Committed_AS: 9291 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 849368 root 01:30 3096 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 9-06:39:06 4068 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 2962812 13.3 Ssl 2-04:16:03 /usr/sbin/mariadbd 166870 1 netdata 199600 2.7 Ssl 4-06:39:12 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3701672 3652415 root 177540 0.0 S 06:26:18 spamd child 3701673 3652415 root 165148 0.0 S 06:26:18 spamd child 3652415 1 root 164284 0.0 Ss 06:36:39 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328754 1 root 154188 0.0 Ss 2-04:16:13 /usr/lib/systemd/systemd-journald 865456 167896 madalice 136572 41.3 S 00:03 php-fpm: pool madalice_com_au 509236 509098 root 67088 0.0 Sl 13-06:41:52 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 865491 865072 evolution 58640 4.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849022 847572 evolution 57980 0.0 S 01:48 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864647 864165 evolution 56576 0.1 S 00:56 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 625148 1353308 cpanellogin 56548 0.0 S 01:04:21 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 847868 1353308 infinium 56416 0.0 S 02:54 webmaild - serving 1.41.252.211 1353308 1 root 42528 0.0 Ss 50-06:20:18 cpsrvd (SSL) - waiting for connections 1469 1 root 41472 0.1 Ss 72-22:51:47 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 865494 1469 root 38940 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 864272 864210 evolution 38868 0.0 S 01:11 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 865046 865039 evolution 38648 0.1 S 00:27 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864689 848618 evolution 38632 0.0 S 00:52 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864954 864317 evolution 38628 0.0 S 00:30 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864368 830311 evolution 38620 0.0 S 01:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864814 864208 evolution 38620 0.0 S 00:41 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 855719 847540 evolution 38600 0.0 S 01:24 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 857147 848593 evolution 38600 0.0 S 01:24 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864214 864206 evolution 38600 0.0 S 01:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849395 848580 evolution 38596 0.0 S 01:30 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864739 864318 evolution 38596 0.0 S 00:48 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 865047 865041 evolution 38596 0.1 S 00:27 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864754 845467 evolution 38592 0.0 S 00:43 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864862 848596 evolution 38588 0.0 S 00:33 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849347 848579 evolution 38584 0.0 S 01:30 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864752 864316 evolution 38584 0.0 S 00:43 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864124 847091 evolution 38572 0.0 S 01:18 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864748 848060 evolution 38572 0.0 S 00:45 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864624 864164 evolution 38564 0.0 S 01:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864820 848499 evolution 38556 0.0 S 00:40 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864338 848459 evolution 38552 0.0 S 01:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864755 864254 evolution 38548 0.0 S 00:43 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 857180 846219 evolution 38540 0.0 S 01:24 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 855648 848607 evolution 38516 0.0 S 01:25 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849278 848595 evolution 38512 0.0 S 01:33 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 858008 848582 evolution 38512 0.0 S 01:23 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864623 864259 evolution 38508 0.0 S 01:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849152 846055 evolution 38492 0.0 S 01:41 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864273 864252 evolution 38488 0.0 S 01:11 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864661 864203 evolution 38488 0.0 S 00:53 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864741 848575 evolution 38488 0.0 S 00:48 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864899 848597 evolution 38488 0.0 S 00:32 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864271 864248 evolution 38412 0.0 S 01:11 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864747 864247 evolution 38412 0.0 S 00:45 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864372 848598 evolution 38408 0.0 S 01:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 865364 864159 evolution 38408 0.1 S 00:11 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864699 864257 evolution 38404 0.0 S 00:52 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849211 848498 evolution 38392 0.0 S 01:37 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864298 848614 evolution 37836 0.0 S 01:08 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 167562 166914 netdata 37468 0.1 Sl 4-06:39:07 /usr/libexec/netdata/plugins.d/go.d.plugin 1 864749 864258 evolution 36780 0.0 S 00:45 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864849 864304 evolution 36776 0.0 S 00:36 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864126 848616 evolution 36728 0.0 S 01:17 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864213 864205 evolution 36716 0.0 S 01:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 8996598 | claude | 108-1481181613 | Execute | 172 | Sending data | SELECT COUNT(*) AS n FROM `contacts` c WHERE DATEDIFF(CURDATE(), (SELECT MAX(NULLIF(j.`dateadded`, '0000-00-00')) FROM `jobs` j JOIN `customextrameta` m ON m.`metaname` LIKE CONCAT('shopify-%-job-', j.`id`, '-orderid') WHERE j.`clientid` = c.`clientid`)) <= 90 | | 9002845 | root | 108-1481181613 | Execute | 106 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9003585 | root | 108-1481181613 | Execute | 100 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9004214 | root | 108-1481181613 | Execute | 96 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9005097 | root | 108-1481181613 | Execute | 92 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9005726 | root | 108-1481181613 | Execute | 89 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9006750 | root | 108-1481181613 | Execute | 81 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9006858 | root | 108-1481181613 | Execute | 77 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9009077 | root | 108-1481181613 | Execute | 55 | Waiting for table level lock | SELECT *, IF(source = 'project', (SELECT jobcode FROM jobs WHERE jobs.id = sourceid), '') as jobcode FROM tasks WHERE id='11395' | | 9009257 | root | 108-1481181613 | Execute | 42 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9019135 | root | 108-1481181613 | Execute | 1 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.dateadded) as diff,contacts.company from jobs,contacts where jobs.clientid=contacts.clientid AND jobs.branch='3' AND jobs.status='1' AND new_flag='1' order by dateadded desc | | 9019151 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9002845 | 108-1481181613 | 106 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9003585 | 108-1481181613 | 100 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9004214 | 108-1481181613 | 96 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9005097 | 108-1481181613 | 92 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9005726 | 108-1481181613 | 89 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9006750 | 108-1481181613 | 81 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9006858 | 108-1481181613 | 77 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9009077 | 108-1481181613 | 55 | Waiting for table level lock | SELECT *, IF(source = 'project', (SELECT jobcode FROM jobs WHERE jobs.id = sourceid), '') as jobcode FROM tasks WHERE id='11395' | | 9009257 | 108-1481181613 | 42 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9019135 | 108-1481181613 | 1 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.dateadded) as diff,contacts.company from jobs,contacts where jobs.clientid=contacts.clientid AND jobs.branch='3' AND jobs.status='1' AND new_flag='1' orde | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 779 evolution/portal.evolutionerp.com.au-ssl_log 155 evolution/app.evolutionerp.com.au-ssl_log 114 evolution/pdev.evolutionerp.com.au-ssl_log 59 evolution/my.evolutionerp.com.au 47 evolution/pdev.evolutionerp.com.au 36 madalice/madalice.com.au-ssl_log 10 aaa/aaadownunder.com.au-ssl_log 2 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 227 45.148.10.125 207 203.54.180.238 158 180.181.236.49 156 103.104.165.99 152 182.239.240.254 114 40.115.94.245 74 150.228.151.88 46 120.150.225.142 24 1.145.125.62 9 103.104.164.114 8 1.144.107.82 5 203.54.162.106 2 165.225.233.89 2 147.161.213.71 2 124.170.183.15 --- top request paths across all vhosts (last 3 min) --- 141 POST /functions.php 136 GET /app/ajax.php 114 GET /api/getItem/LWFB2001KG 63 GET //app/ajax.php 56 GET /factory_session_checker.php 48 GET /index.php 42 GET /heartbeat.php 28 POST /clienteditsave.php 28 GET /factory_session_processed_qty.php 28 GET /factory_session_joiner.php 26 POST /app/ajax.php 21 POST /jobeditsave.php 21 POST //functions.php 21 POST /app/ajax/selectFilterSingle.php 19 POST /plugins/csvexporter/plugin.php 19 POST /app/ajax/selectFilter.php 16 HEAD /index.php 14 POST //clienteditsave.php 14 POST //app/ajax.php 13 POST /logsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 141 POST /functions.php 136 GET /app/ajax.php 63 GET //app/ajax.php 47 GET /index.php 28 POST /clienteditsave.php 26 POST /app/ajax.php 21 POST /jobeditsave.php 21 POST //functions.php 21 POST /app/ajax/selectFilterSingle.php 19 POST /plugins/csvexporter/plugin.php 19 POST /app/ajax/selectFilter.php 16 HEAD /index.php -- last 10 requests -- 180.181.236.49 - - [10/Sep/2026:09:01:27 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=10607987887 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 180.181.236.49 - - [10/Sep/2026:09:01:27 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Djobedit%26id%3D51196%26tab%3Dquotestab&call=getUserSetting&caller=ajaxSubmitLocal&seq=10555952159 HTTP/1.1" 20 180.181.236.49 - - [10/Sep/2026:09:01:27 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobedit%26id%3D51196%26tab%3Dquotestab&call=getUserSetting&caller=ajaxSubmitLocal&seq=11486803609 HTTP/1.1" 200 169 "https://my. 180.181.236.49 - - [10/Sep/2026:09:01:27 +1000] "POST /app/ajax.php?call=ts&tsact=tsUpdateTimesheetNominalRates HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=51196&tab=quotestab" "Mozilla/5.0 103.104.165.99 - - [10/Sep/2026:09:01:27 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=billadd&billid=19699" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 180.181.236.49 - - [10/Sep/2026:09:01:28 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 2643 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=51196&tab=quotestab" "Mozilla/5.0 (Windows NT 10.0; Win64; 180.181.236.49 - - [10/Sep/2026:09:01:28 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 14785 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=51196&tab=quotestab" "Mozilla/5.0 (Windows NT 10.0; Win 203.54.180.238 - - [10/Sep/2026:09:01:29 +1000] "POST //login2save.php HTTP/1.1" 302 20 "https://my.evolutionerp.com.au//index.php?page=login2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G 180.181.236.49 - - [10/Sep/2026:09:01:29 +1000] "POST /app/ajax/selectFilter.php?call=filterstaffandcontractors&filter=&cursel=&curseltext=&fromMS=1&&nolimit=LIMIT%201000&excludelabour=1&include=18&contactid=90&returnobj 180.181.236.49 - - [10/Sep/2026:09:01:29 +1000] "GET /modalload.php?key=jobimportquote&id=51196 HTTP/1.1" 200 1120 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=51196&tab=quotestab" "Mozilla/5.0 (Windows NT 1 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 56 GET /factory_session_checker.php 42 GET /heartbeat.php 28 GET /factory_session_processed_qty.php 28 GET /factory_session_joiner.php 1 GET /index.php -- last 10 requests -- 203.54.180.238 - - [10/Sep/2026:09:01:08 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:01:08 +1000] "GET /factory_session_joiner.php?id=35256 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [10/Sep/2026:09:01:11 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:01:10 +1000] "GET /heartbeat.php?sentAt=1788994871&bytes=106,161,229,55&_=1788957670801 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:09:01:12 +1000] "GET /heartbeat.php?sentAt=1788994870&bytes=106,161,229,54&_=1788994126721 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:09:01:14 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:01:14 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [10/Sep/2026:09:01:14 +1000] "GET /factory_session_joiner.php?id=35258 HTTP/1.1" 200 86 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [10/Sep/2026:09:01:14 +1000] "GET /heartbeat.php?sentAt=1788994874&bytes=106,161,229,58&_=1788987691481 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:09:01:16 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 114 GET /api/getItem/LWFB2001KG -- last 10 requests -- 40.115.94.245 - - [10/Sep/2026:09:01:06 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:01:06 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:01:07 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:01:07 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:01:07 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:01:07 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:01:07 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:01:08 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:01:08 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:01:08 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-10 08:59:08 L1=1.60 run=6 blk=0 avail=7897 (57.3%) swpO=3 conn=3 myRSS=2892 php=6 phpRSS=314 ap=40 tcp=67 topuser=madalice 2026-09-10 08:59:09 L1=1.60 run=4 blk=0 avail=7917 (57.5%) swpO=3 conn=3 myRSS=2892 php=6 phpRSS=232 ap=48 tcp=64 topuser=madalice 2026-09-10 08:59:18 L1=1.91 run=3 blk=0 avail=7716 (56.0%) swpO=0 conn=3 myRSS=2892 php=5 phpRSS=214 ap=77 tcp=83 topuser=madalice 2026-09-10 08:59:19 L1=1.91 run=3 blk=0 avail=7718 (56.0%) swpO=0 conn=3 myRSS=2892 php=6 phpRSS=250 ap=77 tcp=82 topuser=madalice 2026-09-10 08:59:28 L1=1.84 run=2 blk=0 avail=7812 (56.7%) swpO=0 conn=3 myRSS=2892 php=4 phpRSS=157 ap=69 tcp=60 topuser=madalice 2026-09-10 08:59:29 L1=1.84 run=2 blk=0 avail=7817 (56.7%) swpO=0 conn=3 myRSS=2892 php=4 phpRSS=157 ap=68 tcp=55 topuser=madalice 2026-09-10 08:59:38 L1=1.87 run=2 blk=0 avail=7811 (56.7%) swpO=0 conn=3 myRSS=2892 php=4 phpRSS=158 ap=69 tcp=69 topuser=madalice 2026-09-10 08:59:39 L1=1.87 run=4 blk=0 avail=7816 (56.7%) swpO=0 conn=3 myRSS=2892 php=4 phpRSS=158 ap=69 tcp=67 topuser=madalice 2026-09-10 08:59:48 L1=2.12 run=2 blk=0 avail=7811 (56.7%) swpO=0 conn=3 myRSS=2892 php=5 phpRSS=214 ap=65 tcp=65 topuser=madalice 2026-09-10 08:59:49 L1=2.12 run=7 blk=0 avail=7792 (56.6%) swpO=0 conn=3 myRSS=2892 php=9 phpRSS=365 ap=65 tcp=65 topuser=evolution 2026-09-10 08:59:58 L1=2.10 run=4 blk=0 avail=7823 (56.8%) swpO=0 conn=3 myRSS=2892 php=9 phpRSS=352 ap=58 tcp=60 topuser=evolution 2026-09-10 08:59:59 L1=2.10 run=2 blk=0 avail=7825 (56.8%) swpO=0 conn=8 myRSS=2892 php=9 phpRSS=367 ap=57 tcp=63 topuser=evolution 2026-09-10 09:00:08 L1=2.17 run=3 blk=0 avail=7630 (55.4%) swpO=3 conn=3 myRSS=2892 php=18 phpRSS=764 ap=54 tcp=75 topuser=evolution 2026-09-10 09:00:09 L1=2.17 run=3 blk=0 avail=7642 (55.5%) swpO=3 conn=8 myRSS=2892 php=17 phpRSS=707 ap=56 tcp=73 topuser=evolution 2026-09-10 09:00:18 L1=2.30 run=3 blk=0 avail=7647 (55.5%) swpO=0 conn=3 myRSS=2892 php=19 phpRSS=764 ap=59 tcp=90 topuser=evolution 2026-09-10 09:00:19 L1=2.30 run=2 blk=0 avail=7591 (55.1%) swpO=0 conn=8 myRSS=2892 php=20 phpRSS=797 ap=69 tcp=93 topuser=evolution 2026-09-10 09:00:28 L1=2.18 run=4 blk=0 avail=7376 (53.5%) swpO=0 conn=11 myRSS=2892 php=24 phpRSS=932 ap=97 tcp=87 topuser=evolution 2026-09-10 09:00:29 L1=2.08 run=2 blk=0 avail=7365 (53.5%) swpO=0 conn=10 myRSS=2892 php=26 phpRSS=1002 ap=95 tcp=87 topuser=evolution 2026-09-10 09:00:38 L1=2.08 run=2 blk=0 avail=7345 (53.3%) swpO=0 conn=11 myRSS=2892 php=30 phpRSS=1169 ap=89 tcp=95 topuser=evolution 2026-09-10 09:00:39 L1=1.99 run=3 blk=0 avail=7306 (53.0%) swpO=0 conn=11 myRSS=2892 php=32 phpRSS=1244 ap=90 tcp=94 topuser=evolution 2026-09-10 09:00:48 L1=1.91 run=3 blk=0 avail=7239 (52.5%) swpO=0 conn=13 myRSS=2892 php=41 phpRSS=1600 ap=85 tcp=85 topuser=evolution 2026-09-10 09:00:50 L1=1.92 run=3 blk=0 avail=7216 (52.4%) swpO=0 conn=13 myRSS=2892 php=44 phpRSS=1716 ap=83 tcp=82 topuser=evolution 2026-09-10 09:00:58 L1=2.00 run=4 blk=0 avail=7337 (53.3%) swpO=0 conn=13 myRSS=2892 php=48 phpRSS=1745 ap=77 tcp=83 topuser=evolution 2026-09-10 09:01:00 L1=2.08 run=4 blk=0 avail=7348 (53.3%) swpO=0 conn=13 myRSS=2892 php=48 phpRSS=1757 ap=75 tcp=88 topuser=evolution 2026-09-10 09:01:08 L1=2.64 run=3 blk=0 avail=6985 (50.7%) swpO=0 conn=13 myRSS=2893 php=52 phpRSS=1992 ap=103 tcp=108 topuser=evolution 2026-09-10 09:01:10 L1=2.91 run=6 blk=0 avail=6977 (50.6%) swpO=0 conn=13 myRSS=2893 php=54 phpRSS=2063 ap=101 tcp=107 topuser=evolution 2026-09-10 09:01:18 L1=2.91 run=3 blk=0 avail=7080 (51.4%) swpO=3 conn=13 myRSS=2893 php=51 phpRSS=1948 ap=93 tcp=99 topuser=evolution 2026-09-10 09:01:20 L1=2.76 run=4 blk=0 avail=7131 (51.8%) swpO=3 conn=12 myRSS=2893 php=49 phpRSS=1857 ap=91 tcp=92 topuser=evolution 2026-09-10 09:01:28 L1=2.70 run=3 blk=0 avail=7120 (51.7%) swpO=0 conn=13 myRSS=2893 php=49 phpRSS=1909 ap=83 tcp=97 topuser=evolution 2026-09-10 09:01:30 L1=2.56 run=2 blk=0 avail=7133 (51.8%) swpO=0 conn=13 myRSS=2893 php=50 phpRSS=1915 ap=82 tcp=102 topuser=evolution