INCIDENT 2026-09-10 09:04:32 trigger: php_procs=86 php_rss=3536MB mysql_conn=18 ================================================================== load: 1.39 1.72 1.61 4/803 868717 ncpu:10 mem_avail: 6226MB/13777MB (45.2%) swap_used:1475MB swapout:0/s blocked(D):0 running:4 iowait:0.0% steal:0.0% php: 86 procs / 3536MB heaviest user: evolution (82 procs, 3072MB) apache: 124 procs tcp_estab: 95 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 86 3080 mysql 1 2893 nobody 123 2157 root 250 1076 corpkicks 3 348 netdata 8 254 mailman 20 190 madalice 1 137 infinium 2 82 dovenull 6 67 wp-toolkit 3 62 cpanellogin 1 55 kurri 3 41 dovecot 3 28 polkitd 1 15 alison 1 14 lowrange 1 13 zabbix 1 8 nscd 1 6 named 1 6 --- php workers by user --- USER PROCS RSS_MB evolution 82 3072 corpkicks 2 336 madalice 1 137 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5523 MB Active(file): 4569 MB Inactive(file): 1037 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 621 MB CommitLimit: 10984 MB Committed_AS: 13455 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 849368 root 04:32 3096 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 9-06:42:08 4068 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 2963060 13.4 Ssl 2-04:19:05 /usr/sbin/mariadbd 868675 868085 corpkicks 284668 133 S 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 166870 1 netdata 198052 2.7 Ssl 4-06:42:14 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3701672 3652415 root 177540 0.0 S 06:29:20 spamd child 3701673 3652415 root 165148 0.0 S 06:29:20 spamd child 3652415 1 root 164276 0.0 Ss 06:39:41 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328754 1 root 154692 0.0 Ss 2-04:19:15 /usr/lib/systemd/systemd-journald 868627 167896 madalice 140796 20.3 S 00:06 php-fpm: pool madalice_com_au 868687 868530 corpkicks 72296 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 509236 509098 root 67088 0.0 Sl 13-06:44:54 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 865491 865072 evolution 58640 0.0 S 03:04 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849022 847572 evolution 57980 0.0 S 04:50 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 625148 1353308 cpanellogin 56684 0.0 S 01:07:23 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 864647 864165 evolution 56576 0.0 S 03:58 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 847868 1353308 infinium 56416 0.0 S 05:56 webmaild - serving 1.41.252.211 1353308 1 root 42528 0.0 Ss 50-06:23:20 cpsrvd (SSL) - waiting for connections 1469 1 root 41472 0.1 Ss 72-22:54:49 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 867350 847553 evolution 40808 0.0 S 01:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868681 868274 evolution 40432 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867481 865071 evolution 40292 0.0 S 01:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867421 866145 evolution 40136 0.0 S 01:11 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867926 867901 evolution 40116 0.0 S 00:55 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867471 848617 evolution 40036 0.0 S 01:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867482 866254 evolution 40016 0.0 S 01:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867478 866415 evolution 40004 0.0 S 01:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867962 866046 evolution 39384 0.0 S 00:53 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868014 864319 evolution 39348 0.0 S 00:50 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868024 867897 evolution 39348 0.0 S 00:47 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867975 866399 evolution 39320 0.0 S 00:51 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868015 867616 evolution 39312 0.0 S 00:49 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868020 867615 evolution 39268 0.0 S 00:48 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868023 867884 evolution 39232 0.0 S 00:47 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867495 866137 evolution 39208 0.0 S 01:06 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868012 866425 evolution 39176 0.0 S 00:50 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867972 866427 evolution 39096 0.0 S 00:52 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868018 867381 evolution 39064 0.0 S 00:49 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867982 866136 evolution 39004 0.0 S 00:51 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 864272 864210 evolution 38868 0.0 S 04:13 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 865046 865039 evolution 38648 0.0 S 03:29 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864689 848618 evolution 38632 0.0 S 03:54 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864954 864317 evolution 38628 0.0 S 03:32 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864368 830311 evolution 38620 0.0 S 04:04 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864814 864208 evolution 38620 0.0 S 03:43 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 867462 845441 evolution 38620 0.0 S 01:09 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 865914 865075 evolution 38616 0.0 S 02:43 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 855719 847540 evolution 38600 0.0 S 04:26 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 857147 848593 evolution 38600 0.0 S 04:26 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864214 864206 evolution 38600 0.0 S 04:14 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 867457 866143 evolution 38600 0.0 S 01:10 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849395 848580 evolution 38596 0.0 S 04:32 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864739 864318 evolution 38596 0.0 S 03:50 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 865047 865041 evolution 38596 0.0 S 03:29 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864754 845467 evolution 38592 0.0 S 03:45 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864862 848596 evolution 38588 0.0 S 03:35 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 866686 866238 evolution 38588 0.0 S 02:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849347 848579 evolution 38584 0.0 S 04:32 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864752 864316 evolution 38584 0.0 S 03:45 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864124 847091 evolution 38572 0.0 S 04:20 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864748 848060 evolution 38572 0.0 S 03:47 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864624 864164 evolution 38564 0.0 S 04:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 8996598 | claude | 108-1481181613 | Execute | 355 | Sending data | SELECT COUNT(*) AS n FROM `contacts` c WHERE DATEDIFF(CURDATE(), (SELECT MAX(NULLIF(j.`dateadded`, '0000-00-00')) FROM `jobs` j JOIN `customextrameta` m ON m.`metaname` LIKE CONCAT('shopify-%-job-', j.`id`, '-orderid') WHERE j.`clientid` = c.`clientid`)) <= 90 | | 9002845 | root | 108-1481181613 | Execute | 289 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9003585 | root | 108-1481181613 | Execute | 282 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9004214 | root | 108-1481181613 | Execute | 278 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9005097 | root | 108-1481181613 | Execute | 274 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9005726 | root | 108-1481181613 | Execute | 271 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9006750 | root | 108-1481181613 | Execute | 264 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9006858 | root | 108-1481181613 | Execute | 259 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9009077 | root | 108-1481181613 | Execute | 238 | Waiting for table level lock | SELECT *, IF(source = 'project', (SELECT jobcode FROM jobs WHERE jobs.id = sourceid), '') as jobcode FROM tasks WHERE id='11395' | | 9009257 | root | 108-1481181613 | Execute | 224 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9019135 | root | 108-1481181613 | Execute | 183 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.dateadded) as diff,contacts.company from jobs,contacts where jobs.clientid=contacts.clientid AND jobs.branch='3' AND jobs.status='1' AND new_flag='1' order by dateadded desc | | 9025941 | root | 108-1481181613 | Execute | 77 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | | 9030487 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9002845 | 108-1481181613 | 289 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9003585 | 108-1481181613 | 282 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9004214 | 108-1481181613 | 278 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9005097 | 108-1481181613 | 274 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9005726 | 108-1481181613 | 271 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9006750 | 108-1481181613 | 264 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9006858 | 108-1481181613 | 259 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9009077 | 108-1481181613 | 238 | Waiting for table level lock | SELECT *, IF(source = 'project', (SELECT jobcode FROM jobs WHERE jobs.id = sourceid), '') as jobcode FROM tasks WHERE id='11395' | | 9009257 | 108-1481181613 | 224 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9019135 | 108-1481181613 | 183 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.dateadded) as diff,contacts.company from jobs,contacts where jobs.clientid=contacts.clientid AND jobs.branch='3' AND jobs.status='1' AND new_flag='1' orde | | 9025941 | 108-1481181613 | 77 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 492 evolution/portal.evolutionerp.com.au-ssl_log 123 evolution/app.evolutionerp.com.au-ssl_log 113 evolution/staging.evolutionerp.com.au-ssl_log 54 evolution/staging.evolutionerp.com.au 48 madalice/madalice.com.au-ssl_log 3 olympic/olympicfencing.com.au-ssl_log 3 corpkicks/corporatekicks.com.au-ssl_log 1 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 176 103.104.165.99 123 203.54.180.238 113 40.115.94.245 102 45.148.10.125 73 180.181.236.49 64 120.150.225.142 63 182.239.240.254 50 150.228.151.88 23 165.225.233.89 16 1.144.107.82 8 147.161.213.71 8 1.145.125.62 7 103.104.164.114 2 45.61.187.148 2 165.225.233.87 --- top request paths across all vhosts (last 3 min) --- 122 GET /app/ajax.php 118 POST /functions.php 86 GET /api/getItem/LWFB2001KG 45 GET /heartbeat.php 40 GET /factory_session_checker.php 35 GET /index.php 27 GET /api/getItem/LWPG2001KG 25 POST /app/ajax.php 24 POST /clienteditsave.php 22 POST /app/ajax/selectFilterSingle.php 19 GET /factory_session_processed_qty.php 19 GET /factory_session_joiner.php 14 POST //functions.php 13 POST /plugins/csvexporter/plugin.php 12 POST /quoteditsave.php 12 POST /jobeditsave.php 10 POST /logsave.php 10 HEAD /index.php 6 POST /itemModify.php 6 POST /app/ajax/selectFilter.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 122 GET /app/ajax.php 118 POST /functions.php 35 GET /index.php 25 POST /app/ajax.php 24 POST /clienteditsave.php 22 POST /app/ajax/selectFilterSingle.php 14 POST //functions.php 13 POST /plugins/csvexporter/plugin.php 12 POST /quoteditsave.php 12 POST /jobeditsave.php 10 POST /logsave.php 10 HEAD /index.php -- last 10 requests -- 150.228.151.88 - - [10/Sep/2026:09:04:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2324" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:15 1.145.125.62 - - [10/Sep/2026:09:04:21 +1000] "POST /app/ajax.php?call=ts&tsact=tsUpdateTimesheetNominalRates HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=opportunities" "Mozilla/5.0 (Windows NT 10.0; 1.145.125.62 - - [10/Sep/2026:09:04:21 +1000] "POST /opportunityeditsave.php?call=getTheLeads HTTP/1.1" 200 95478 "https://my.evolutionerp.com.au/index.php?page=opportunities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) A 103.104.165.99 - - [10/Sep/2026:09:04:21 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Ch 180.181.236.49 - - [10/Sep/2026:09:04:22 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=timesheetHistory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 150.228.151.88 - - [10/Sep/2026:09:04:22 +1000] "GET /quoteditsave.php?itemid=4018&call=getKit&mode=true&discount=25&level=2 HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2035" "Mozilla 150.228.151.88 - - [10/Sep/2026:09:04:22 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2035" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 103.104.165.99 - - [10/Sep/2026:09:04:23 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Sa 150.228.151.88 - - [10/Sep/2026:09:04:23 +1000] "GET /quoteditsave.php?itemid=4018&call=getKit&mode=true&discount=25&level=2 HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2035" "Mozilla 1.145.125.62 - - [10/Sep/2026:09:04:24 +1000] "POST /app/ajax/selectFilter.php?call=filterstaffandcontractors&filter=&cursel=&curseltext=&fromMS=1&&nolimit=LIMIT%201000&excludelabour=1&include=5&returnobj=ts_add_staffSel == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 45 GET /heartbeat.php 40 GET /factory_session_checker.php 19 GET /factory_session_processed_qty.php 19 GET /factory_session_joiner.php -- last 10 requests -- 203.54.180.238 - - [10/Sep/2026:09:04:13 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:04:14 +1000] "GET /heartbeat.php?sentAt=1788995054&bytes=106,161,229,238&_=1788987691499 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [10/Sep/2026:09:04:18 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:04:20 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 140 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [10/Sep/2026:09:04:21 +1000] "GET /factory_session_joiner.php?id=35256 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [10/Sep/2026:09:04:21 +1000] "GET /heartbeat.php?sentAt=1788995061&bytes=106,161,229,245&_=1788957670820 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [10/Sep/2026:09:04:22 +1000] "GET /heartbeat.php?sentAt=1788995060&bytes=106,161,229,244&_=1788994126740 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [10/Sep/2026:09:04:23 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:04:24 +1000] "GET /heartbeat.php?sentAt=1788995064&bytes=106,161,229,248&_=1788987691500 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [10/Sep/2026:09:04:28 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 86 GET /api/getItem/LWFB2001KG 27 GET /api/getItem/LWPG2001KG -- last 10 requests -- 40.115.94.245 - - [10/Sep/2026:09:03:32 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:03:32 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:03:32 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:03:32 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:03:32 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:03:33 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:03:33 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:03:33 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:03:33 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:03:33 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-10 09:02:09 L1=2.39 run=2 blk=0 avail=6751 (49.0%) swpO=0 conn=14 myRSS=2893 php=59 phpRSS=2287 ap=120 tcp=122 topuser=evolution 2026-09-10 09:02:10 L1=2.36 run=5 blk=0 avail=6720 (48.8%) swpO=0 conn=16 myRSS=2893 php=60 phpRSS=2349 ap=121 tcp=127 topuser=evolution 2026-09-10 09:02:19 L1=2.33 run=2 blk=0 avail=6586 (47.8%) swpO=0 conn=13 myRSS=2893 php=57 phpRSS=2194 ap=151 tcp=115 topuser=evolution 2026-09-10 09:02:21 L1=2.22 run=6 blk=0 avail=6551 (47.6%) swpO=0 conn=16 myRSS=2893 php=59 phpRSS=2291 ap=149 tcp=115 topuser=evolution 2026-09-10 09:02:29 L1=2.12 run=2 blk=0 avail=6795 (49.3%) swpO=0 conn=13 myRSS=2893 php=56 phpRSS=2038 ap=141 tcp=128 topuser=evolution 2026-09-10 09:02:31 L1=2.03 run=5 blk=0 avail=6563 (47.6%) swpO=0 conn=15 myRSS=2893 php=58 phpRSS=2313 ap=139 tcp=120 topuser=evolution 2026-09-10 09:02:39 L1=1.95 run=2 blk=0 avail=6724 (48.8%) swpO=0 conn=14 myRSS=2893 php=60 phpRSS=2268 ap=131 tcp=107 topuser=evolution 2026-09-10 09:02:41 L1=1.87 run=3 blk=0 avail=6727 (48.8%) swpO=0 conn=14 myRSS=2893 php=60 phpRSS=2286 ap=129 tcp=111 topuser=evolution 2026-09-10 09:02:49 L1=1.80 run=2 blk=0 avail=6802 (49.4%) swpO=1 conn=13 myRSS=2893 php=59 phpRSS=2246 ap=121 tcp=90 topuser=evolution 2026-09-10 09:02:51 L1=1.82 run=3 blk=0 avail=6771 (49.1%) swpO=1 conn=15 myRSS=2893 php=61 phpRSS=2346 ap=119 tcp=90 topuser=evolution 2026-09-10 09:02:59 L1=1.75 run=2 blk=0 avail=6990 (50.7%) swpO=0 conn=13 myRSS=2893 php=58 phpRSS=2114 ap=111 tcp=80 topuser=evolution 2026-09-10 09:03:01 L1=1.69 run=4 blk=0 avail=6811 (49.4%) swpO=0 conn=15 myRSS=2893 php=61 phpRSS=2371 ap=109 tcp=84 topuser=evolution 2026-09-10 09:03:09 L1=1.64 run=4 blk=0 avail=6711 (48.7%) swpO=0 conn=15 myRSS=2893 php=63 phpRSS=2616 ap=101 tcp=84 topuser=evolution 2026-09-10 09:03:11 L1=1.75 run=5 blk=0 avail=6627 (48.1%) swpO=0 conn=16 myRSS=2893 php=64 phpRSS=2737 ap=99 tcp=79 topuser=evolution 2026-09-10 09:03:19 L1=1.69 run=3 blk=0 avail=6978 (50.6%) swpO=0 conn=15 myRSS=2893 php=61 phpRSS=2324 ap=93 tcp=95 topuser=evolution 2026-09-10 09:03:21 L1=1.63 run=4 blk=0 avail=6870 (49.9%) swpO=0 conn=16 myRSS=2893 php=64 phpRSS=2489 ap=92 tcp=95 topuser=evolution 2026-09-10 09:03:29 L1=1.58 run=3 blk=0 avail=6826 (49.5%) swpO=0 conn=17 myRSS=2893 php=69 phpRSS=2702 ap=91 tcp=93 topuser=evolution 2026-09-10 09:03:31 L1=1.69 run=5 blk=0 avail=6800 (49.4%) swpO=0 conn=17 myRSS=2893 php=72 phpRSS=2786 ap=92 tcp=99 topuser=evolution 2026-09-10 09:03:39 L1=1.66 run=2 blk=0 avail=6803 (49.4%) swpO=0 conn=15 myRSS=2893 php=70 phpRSS=2672 ap=102 tcp=95 topuser=evolution 2026-09-10 09:03:42 L1=1.66 run=2 blk=0 avail=6768 (49.1%) swpO=0 conn=16 myRSS=2893 php=75 phpRSS=2865 ap=100 tcp=90 topuser=evolution 2026-09-10 09:03:49 L1=1.63 run=3 blk=0 avail=6696 (48.6%) swpO=0 conn=15 myRSS=2893 php=81 phpRSS=3094 ap=98 tcp=90 topuser=evolution 2026-09-10 09:03:52 L1=1.63 run=3 blk=0 avail=6776 (49.2%) swpO=0 conn=16 myRSS=2893 php=81 phpRSS=3001 ap=99 tcp=96 topuser=evolution 2026-09-10 09:03:59 L1=1.54 run=4 blk=0 avail=6589 (47.8%) swpO=3 conn=15 myRSS=2893 php=84 phpRSS=3205 ap=112 tcp=97 topuser=evolution 2026-09-10 09:04:02 L1=1.54 run=3 blk=0 avail=6592 (47.8%) swpO=3 conn=16 myRSS=2893 php=84 phpRSS=3192 ap=110 tcp=93 topuser=evolution 2026-09-10 09:04:09 L1=1.45 run=2 blk=0 avail=6649 (48.3%) swpO=0 conn=15 myRSS=2893 php=82 phpRSS=3131 ap=106 tcp=87 topuser=evolution 2026-09-10 09:04:12 L1=1.45 run=2 blk=0 avail=6649 (48.3%) swpO=0 conn=16 myRSS=2893 php=84 phpRSS=3207 ap=103 tcp=90 topuser=evolution 2026-09-10 09:04:19 L1=1.46 run=3 blk=0 avail=6663 (48.4%) swpO=0 conn=15 myRSS=2893 php=83 phpRSS=3167 ap=102 tcp=99 topuser=evolution 2026-09-10 09:04:22 L1=1.46 run=2 blk=0 avail=6634 (48.2%) swpO=0 conn=17 myRSS=2893 php=84 phpRSS=3131 ap=116 tcp=109 topuser=evolution 2026-09-10 09:04:30 L1=1.39 run=2 blk=0 avail=6489 (47.1%) swpO=0 conn=15 myRSS=2893 php=83 phpRSS=3172 ap=127 tcp=95 topuser=evolution 2026-09-10 09:04:32 L1=1.39 run=4 blk=0 avail=6226 (45.2%) swpO=0 conn=18 myRSS=2893 php=86 phpRSS=3536 ap=124 tcp=95 topuser=evolution