INCIDENT 2026-09-10 09:02:31 trigger: php_procs=58 php_rss=2313MB mysql_conn=15 ================================================================== load: 2.03 1.92 1.64 3/791 866658 ncpu:10 mem_avail: 6563MB/13777MB (47.6%) swap_used:1475MB swapout:0/s blocked(D):0 running:5 iowait:0.1% steal:0.0% php: 58 procs / 2313MB heaviest user: evolution (56 procs, 2076MB) apache: 139 procs tcp_estab: 120 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2893 nobody 138 2422 evolution 60 2084 root 251 1076 netdata 8 256 madalice 1 241 mailman 20 190 infinium 2 80 dovenull 6 67 wp-toolkit 3 62 cpanellogin 1 55 kurri 3 41 candyfabcom 3 41 dovecot 3 28 polkitd 1 15 lowrange 1 14 zabbix 1 8 mailnull 2 7 nscd 1 6 named 1 6 --- php workers by user --- USER PROCS RSS_MB evolution 56 2076 madalice 1 242 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5477 MB Active(file): 4572 MB Inactive(file): 1038 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 620 MB CommitLimit: 10984 MB Committed_AS: 10727 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 849368 root 02:31 3096 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 9-06:40:07 4068 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 2963076 13.3 Ssl 2-04:17:04 /usr/sbin/mariadbd 866617 167896 madalice 250772 63.0 S 00:02 php-fpm: pool madalice_com_au 166870 1 netdata 200128 2.7 Ssl 4-06:40:13 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3701672 3652415 root 177540 0.0 S 06:27:19 spamd child 3701673 3652415 root 165148 0.0 S 06:27:19 spamd child 3652415 1 root 164284 0.0 Ss 06:37:40 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328754 1 root 154188 0.0 Ss 2-04:17:14 /usr/lib/systemd/systemd-journald 509236 509098 root 67088 0.0 Sl 13-06:42:53 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 865491 865072 evolution 58640 0.1 S 01:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849022 847572 evolution 57980 0.0 S 02:49 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864647 864165 evolution 56576 0.0 S 01:57 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 625148 1353308 cpanellogin 56548 0.0 S 01:05:22 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 847868 1353308 infinium 56416 0.0 S 03:55 webmaild - serving 1.41.252.211 1353308 1 root 42528 0.0 Ss 50-06:21:19 cpsrvd (SSL) - waiting for connections 1469 1 root 41472 0.1 Ss 72-22:52:48 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 866625 866141 evolution 40476 4.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 864272 864210 evolution 38868 0.0 S 02:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 865046 865039 evolution 38648 0.0 S 01:28 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864689 848618 evolution 38632 0.0 S 01:53 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864954 864317 evolution 38628 0.0 S 01:31 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864368 830311 evolution 38620 0.0 S 02:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864814 864208 evolution 38620 0.0 S 01:42 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 865914 865075 evolution 38616 0.0 S 00:42 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 855719 847540 evolution 38600 0.0 S 02:25 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 857147 848593 evolution 38600 0.0 S 02:25 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864214 864206 evolution 38600 0.0 S 02:13 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849395 848580 evolution 38596 0.0 S 02:31 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864739 864318 evolution 38596 0.0 S 01:49 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 865047 865041 evolution 38596 0.0 S 01:28 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864754 845467 evolution 38592 0.0 S 01:44 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864862 848596 evolution 38588 0.0 S 01:34 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 866686 866238 evolution 38588 0.0 S 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849347 848579 evolution 38584 0.0 S 02:31 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864752 864316 evolution 38584 0.0 S 01:44 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864124 847091 evolution 38572 0.0 S 02:19 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864748 848060 evolution 38572 0.0 S 01:46 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864624 864164 evolution 38564 0.0 S 02:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 866148 866135 evolution 38560 0.1 S 00:30 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864820 848499 evolution 38556 0.0 S 01:41 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864338 848459 evolution 38552 0.0 S 02:04 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864755 864254 evolution 38548 0.0 S 01:44 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 857180 846219 evolution 38540 0.0 S 02:25 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 855648 848607 evolution 38516 0.0 S 02:26 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849278 848595 evolution 38512 0.0 S 02:34 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 858008 848582 evolution 38512 0.0 S 02:24 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 865757 848497 evolution 38512 0.0 S 01:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864623 864259 evolution 38508 0.0 S 02:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849152 846055 evolution 38492 0.0 S 02:42 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864273 864252 evolution 38488 0.0 S 02:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864661 864203 evolution 38488 0.0 S 01:54 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864741 848575 evolution 38488 0.0 S 01:49 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864899 848597 evolution 38488 0.0 S 01:33 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864271 864248 evolution 38412 0.0 S 02:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864747 864247 evolution 38412 0.0 S 01:46 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864372 848598 evolution 38408 0.0 S 02:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 865364 864159 evolution 38408 0.0 S 01:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864699 864257 evolution 38404 0.0 S 01:53 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849211 848498 evolution 38392 0.0 S 02:38 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864298 848614 evolution 37836 0.0 S 02:09 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 167562 166914 netdata 37468 0.1 Sl 4-06:40:08 /usr/libexec/netdata/plugins.d/go.d.plugin 1 --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 8996598 | claude | 108-1481181613 | Execute | 233 | Sending data | SELECT COUNT(*) AS n FROM `contacts` c WHERE DATEDIFF(CURDATE(), (SELECT MAX(NULLIF(j.`dateadded`, '0000-00-00')) FROM `jobs` j JOIN `customextrameta` m ON m.`metaname` LIKE CONCAT('shopify-%-job-', j.`id`, '-orderid') WHERE j.`clientid` = c.`clientid`)) <= 90 | | 9002845 | root | 108-1481181613 | Execute | 167 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9003585 | root | 108-1481181613 | Execute | 161 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9004214 | root | 108-1481181613 | Execute | 157 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9005097 | root | 108-1481181613 | Execute | 153 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9005726 | root | 108-1481181613 | Execute | 150 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9006750 | root | 108-1481181613 | Execute | 142 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9006858 | root | 108-1481181613 | Execute | 138 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9009077 | root | 108-1481181613 | Execute | 116 | Waiting for table level lock | SELECT *, IF(source = 'project', (SELECT jobcode FROM jobs WHERE jobs.id = sourceid), '') as jobcode FROM tasks WHERE id='11395' | | 9009257 | root | 108-1481181613 | Execute | 103 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9019135 | root | 108-1481181613 | Execute | 61 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.dateadded) as diff,contacts.company from jobs,contacts where jobs.clientid=contacts.clientid AND jobs.branch='3' AND jobs.status='1' AND new_flag='1' order by dateadded desc | | 9023981 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9002845 | 108-1481181613 | 167 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9003585 | 108-1481181613 | 161 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9004214 | 108-1481181613 | 157 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9005097 | 108-1481181613 | 153 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9005726 | 108-1481181613 | 150 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9006750 | 108-1481181613 | 142 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9006858 | 108-1481181613 | 138 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9009077 | 108-1481181613 | 116 | Waiting for table level lock | SELECT *, IF(source = 'project', (SELECT jobcode FROM jobs WHERE jobs.id = sourceid), '') as jobcode FROM tasks WHERE id='11395' | | 9009257 | 108-1481181613 | 103 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9019135 | 108-1481181613 | 62 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.dateadded) as diff,contacts.company from jobs,contacts where jobs.clientid=contacts.clientid AND jobs.branch='3' AND jobs.status='1' AND new_flag='1' orde | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 652 evolution/portal.evolutionerp.com.au-ssl_log 154 evolution/app.evolutionerp.com.au-ssl_log 118 evolution/pdev.evolutionerp.com.au-ssl_log 59 evolution/pdev.evolutionerp.com.au 36 evolution/staging.evolutionerp.com.au-ssl_log 36 evolution/staging.evolutionerp.com.au 30 madalice/madalice.com.au-ssl_log 10 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 174 103.104.165.99 168 203.54.180.238 161 45.148.10.125 157 182.239.240.254 147 180.181.236.49 118 40.115.94.245 57 150.228.151.88 52 120.150.225.142 24 165.225.233.89 7 103.104.164.114 6 147.161.213.71 5 1.144.107.82 3 1.145.125.62 2 165.225.233.87 2 114.119.143.14 --- top request paths across all vhosts (last 3 min) --- 144 GET /app/ajax.php 118 GET /api/getItem/LWFB2001KG 117 POST /functions.php 55 GET /factory_session_checker.php 55 GET //app/ajax.php 46 GET /index.php 42 GET /heartbeat.php 32 POST /clienteditsave.php 29 GET /factory_session_processed_qty.php 28 POST /app/ajax.php 28 GET /factory_session_joiner.php 25 POST /app/ajax/selectFilterSingle.php 22 POST //functions.php 15 POST /plugins/csvexporter/plugin.php 14 HEAD /index.php 13 POST /quoteditsave.php 13 POST /logsave.php 13 POST /app/ajax/selectFilter.php 13 POST //app/ajax.php 12 POST //clienteditsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 144 GET /app/ajax.php 117 POST /functions.php 55 GET //app/ajax.php 46 GET /index.php 32 POST /clienteditsave.php 28 POST /app/ajax.php 25 POST /app/ajax/selectFilterSingle.php 22 POST //functions.php 15 POST /plugins/csvexporter/plugin.php 14 HEAD /index.php 13 POST /quoteditsave.php 13 POST /logsave.php -- last 10 requests -- 182.239.240.254 - - [10/Sep/2026:09:02:27 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 165.225.233.89 - - [10/Sep/2026:09:02:27 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 4750 "https://my.evolutionerp.com.au/index.php?page=siteedit&siteid=1585" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Ap 103.104.165.99 - - [10/Sep/2026:09:02:27 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=jobadd"eid=37188" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 1.144.107.82 - - [10/Sep/2026:09:02:28 +1000] "GET /index.php?page=login2 HTTP/1.1" 200 44034 "https://my.evolutionerp.com.au/index.php?page=invoicereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM 1.144.107.82 - - [10/Sep/2026:09:02:29 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dlogin2&call=getUserSetting&caller=ajaxSubmitLocal&seq=17766667157 HTTP/1.1" 200 86 "https://my.evolutionerp.com.au/index.php?page= 207.46.13.36 - - [10/Sep/2026:09:02:29 +1000] "GET /index.php?page=activities&keyword=gomasio+por+que+se+llama+asi HTTP/1.1" 200 5403 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http 180.181.236.49 - - [10/Sep/2026:09:02:29 +1000] "GET /index.php?page=quotedit HTTP/1.1" 200 147030 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K 120.150.225.142 - - [10/Sep/2026:09:02:30 +1000] "POST /quoteditsave.php?call=addLineItem HTTP/1.1" 200 272 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=21280§ionid=0" "Mozilla/5.0 (Windows NT 10.0 180.181.236.49 - - [10/Sep/2026:09:02:30 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=13401400296 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 180.181.236.49 - - [10/Sep/2026:09:02:30 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=11620537379 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 55 GET /factory_session_checker.php 42 GET /heartbeat.php 29 GET /factory_session_processed_qty.php 28 GET /factory_session_joiner.php -- last 10 requests -- 203.54.180.238 - - [10/Sep/2026:09:02:10 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:02:10 +1000] "GET /heartbeat.php?sentAt=1788994931&bytes=106,161,229,115&_=1788957670807 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [10/Sep/2026:09:02:12 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:02:12 +1000] "GET /heartbeat.php?sentAt=1788994930&bytes=106,161,229,114&_=1788994126727 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [10/Sep/2026:09:02:14 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 125 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [10/Sep/2026:09:02:14 +1000] "GET /factory_session_joiner.php?id=35258 HTTP/1.1" 200 86 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [10/Sep/2026:09:02:15 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:02:15 +1000] "GET /heartbeat.php?sentAt=1788994934&bytes=106,161,229,118&_=1788987691487 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [10/Sep/2026:09:02:17 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:02:19 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 140 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 118 GET /api/getItem/LWFB2001KG -- last 10 requests -- 40.115.94.245 - - [10/Sep/2026:09:02:19 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:02:19 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:02:19 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:02:19 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:02:20 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:02:20 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:02:20 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:02:20 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:02:20 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:02:21 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-10 09:00:08 L1=2.17 run=3 blk=0 avail=7630 (55.4%) swpO=3 conn=3 myRSS=2892 php=18 phpRSS=764 ap=54 tcp=75 topuser=evolution 2026-09-10 09:00:09 L1=2.17 run=3 blk=0 avail=7642 (55.5%) swpO=3 conn=8 myRSS=2892 php=17 phpRSS=707 ap=56 tcp=73 topuser=evolution 2026-09-10 09:00:18 L1=2.30 run=3 blk=0 avail=7647 (55.5%) swpO=0 conn=3 myRSS=2892 php=19 phpRSS=764 ap=59 tcp=90 topuser=evolution 2026-09-10 09:00:19 L1=2.30 run=2 blk=0 avail=7591 (55.1%) swpO=0 conn=8 myRSS=2892 php=20 phpRSS=797 ap=69 tcp=93 topuser=evolution 2026-09-10 09:00:28 L1=2.18 run=4 blk=0 avail=7376 (53.5%) swpO=0 conn=11 myRSS=2892 php=24 phpRSS=932 ap=97 tcp=87 topuser=evolution 2026-09-10 09:00:29 L1=2.08 run=2 blk=0 avail=7365 (53.5%) swpO=0 conn=10 myRSS=2892 php=26 phpRSS=1002 ap=95 tcp=87 topuser=evolution 2026-09-10 09:00:38 L1=2.08 run=2 blk=0 avail=7345 (53.3%) swpO=0 conn=11 myRSS=2892 php=30 phpRSS=1169 ap=89 tcp=95 topuser=evolution 2026-09-10 09:00:39 L1=1.99 run=3 blk=0 avail=7306 (53.0%) swpO=0 conn=11 myRSS=2892 php=32 phpRSS=1244 ap=90 tcp=94 topuser=evolution 2026-09-10 09:00:48 L1=1.91 run=3 blk=0 avail=7239 (52.5%) swpO=0 conn=13 myRSS=2892 php=41 phpRSS=1600 ap=85 tcp=85 topuser=evolution 2026-09-10 09:00:50 L1=1.92 run=3 blk=0 avail=7216 (52.4%) swpO=0 conn=13 myRSS=2892 php=44 phpRSS=1716 ap=83 tcp=82 topuser=evolution 2026-09-10 09:00:58 L1=2.00 run=4 blk=0 avail=7337 (53.3%) swpO=0 conn=13 myRSS=2892 php=48 phpRSS=1745 ap=77 tcp=83 topuser=evolution 2026-09-10 09:01:00 L1=2.08 run=4 blk=0 avail=7348 (53.3%) swpO=0 conn=13 myRSS=2892 php=48 phpRSS=1757 ap=75 tcp=88 topuser=evolution 2026-09-10 09:01:08 L1=2.64 run=3 blk=0 avail=6985 (50.7%) swpO=0 conn=13 myRSS=2893 php=52 phpRSS=1992 ap=103 tcp=108 topuser=evolution 2026-09-10 09:01:10 L1=2.91 run=6 blk=0 avail=6977 (50.6%) swpO=0 conn=13 myRSS=2893 php=54 phpRSS=2063 ap=101 tcp=107 topuser=evolution 2026-09-10 09:01:18 L1=2.91 run=3 blk=0 avail=7080 (51.4%) swpO=3 conn=13 myRSS=2893 php=51 phpRSS=1948 ap=93 tcp=99 topuser=evolution 2026-09-10 09:01:20 L1=2.76 run=4 blk=0 avail=7131 (51.8%) swpO=3 conn=12 myRSS=2893 php=49 phpRSS=1857 ap=91 tcp=92 topuser=evolution 2026-09-10 09:01:28 L1=2.70 run=3 blk=0 avail=7120 (51.7%) swpO=0 conn=13 myRSS=2893 php=49 phpRSS=1909 ap=83 tcp=97 topuser=evolution 2026-09-10 09:01:30 L1=2.56 run=2 blk=0 avail=7133 (51.8%) swpO=0 conn=13 myRSS=2893 php=50 phpRSS=1915 ap=82 tcp=102 topuser=evolution 2026-09-10 09:01:38 L1=2.44 run=3 blk=0 avail=7110 (51.6%) swpO=0 conn=14 myRSS=2893 php=51 phpRSS=1985 ap=80 tcp=95 topuser=evolution 2026-09-10 09:01:40 L1=2.56 run=4 blk=0 avail=6853 (49.7%) swpO=0 conn=17 myRSS=2893 php=55 phpRSS=2351 ap=80 tcp=96 topuser=evolution 2026-09-10 09:01:48 L1=2.44 run=2 blk=0 avail=7134 (51.8%) swpO=0 conn=13 myRSS=2893 php=52 phpRSS=2011 ap=76 tcp=89 topuser=evolution 2026-09-10 09:01:50 L1=2.32 run=3 blk=0 avail=7033 (51.1%) swpO=0 conn=15 myRSS=2893 php=55 phpRSS=2207 ap=76 tcp=89 topuser=evolution 2026-09-10 09:01:58 L1=2.38 run=3 blk=0 avail=7096 (51.5%) swpO=0 conn=14 myRSS=2893 php=55 phpRSS=2142 ap=79 tcp=95 topuser=evolution 2026-09-10 09:02:00 L1=2.51 run=6 blk=0 avail=7039 (51.1%) swpO=0 conn=15 myRSS=2893 php=58 phpRSS=2186 ap=91 tcp=108 topuser=evolution 2026-09-10 09:02:09 L1=2.39 run=2 blk=0 avail=6751 (49.0%) swpO=0 conn=14 myRSS=2893 php=59 phpRSS=2287 ap=120 tcp=122 topuser=evolution 2026-09-10 09:02:10 L1=2.36 run=5 blk=0 avail=6720 (48.8%) swpO=0 conn=16 myRSS=2893 php=60 phpRSS=2349 ap=121 tcp=127 topuser=evolution 2026-09-10 09:02:19 L1=2.33 run=2 blk=0 avail=6586 (47.8%) swpO=0 conn=13 myRSS=2893 php=57 phpRSS=2194 ap=151 tcp=115 topuser=evolution 2026-09-10 09:02:21 L1=2.22 run=6 blk=0 avail=6551 (47.6%) swpO=0 conn=16 myRSS=2893 php=59 phpRSS=2291 ap=149 tcp=115 topuser=evolution 2026-09-10 09:02:29 L1=2.12 run=2 blk=0 avail=6795 (49.3%) swpO=0 conn=13 myRSS=2893 php=56 phpRSS=2038 ap=141 tcp=128 topuser=evolution 2026-09-10 09:02:31 L1=2.03 run=5 blk=0 avail=6563 (47.6%) swpO=0 conn=15 myRSS=2893 php=58 phpRSS=2313 ap=139 tcp=120 topuser=evolution