INCIDENT 2026-09-10 09:05:33 trigger: php_procs=92 php_rss=3507MB mysql_conn=15 ================================================================== load: 1.49 1.69 1.61 2/837 884077 ncpu:10 mem_avail: 6177MB/13777MB (44.8%) swap_used:1474MB swapout:1/s blocked(D):0 running:2 iowait:0.1% steal:0.0% php: 92 procs / 3507MB heaviest user: evolution (90 procs, 3373MB) apache: 153 procs tcp_estab: 114 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 94 3381 mysql 1 2893 nobody 152 2714 root 248 1080 netdata 8 254 mailman 20 190 madalice 1 132 infinium 2 82 dovenull 6 67 wp-toolkit 3 62 cpanellogin 1 55 kurri 3 41 mailnull 6 39 dovecot 3 28 polkitd 1 15 lowrange 1 13 zabbix 1 9 nscd 1 6 named 1 6 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB evolution 90 3373 madalice 1 132 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5220 MB Active(file): 4041 MB Inactive(file): 1239 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 621 MB CommitLimit: 10984 MB Committed_AS: 14126 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 849368 root 05:33 3096 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 869266 root 00:32 1384 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : 3926885 root 9-06:43:09 4068 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 2963048 13.4 Ssl 2-04:20:06 /usr/sbin/mariadbd 166870 1 netdata 198316 2.7 Ssl 4-06:43:15 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3701672 3652415 root 177540 0.0 S 06:30:21 spamd child 3701673 3652415 root 165148 0.0 S 06:30:21 spamd child 3652415 1 root 164272 0.0 Ss 06:40:42 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328754 1 root 155016 0.0 Ss 2-04:20:16 /usr/lib/systemd/systemd-journald 883999 167896 madalice 135500 18.1 S 00:07 php-fpm: pool madalice_com_au 509236 509098 root 67088 0.0 Sl 13-06:45:55 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 865491 865072 evolution 58640 0.0 S 04:05 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849022 847572 evolution 57980 0.0 S 05:51 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 625148 1353308 cpanellogin 56684 0.0 S 01:08:24 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 864647 864165 evolution 56576 0.0 S 04:59 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 847868 1353308 infinium 56416 0.0 S 06:57 webmaild - serving 1.41.252.211 1353308 1 root 42528 0.0 Ss 50-06:24:21 cpsrvd (SSL) - waiting for connections 1469 1 root 41468 0.1 Ss 72-22:55:50 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 867350 847553 evolution 40808 0.0 S 02:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 880957 868986 evolution 40608 0.1 S 00:23 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 867481 865071 evolution 40292 0.0 S 02:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867421 866145 evolution 40136 0.0 S 02:12 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867926 867901 evolution 40116 0.0 S 01:56 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867471 848617 evolution 40036 0.0 S 02:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867482 866254 evolution 40016 0.0 S 02:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867478 866415 evolution 40004 0.0 S 02:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867962 866046 evolution 39384 0.0 S 01:54 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 883944 868974 evolution 39368 0.1 S 00:12 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868014 864319 evolution 39348 0.0 S 01:51 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868024 867897 evolution 39348 0.0 S 01:48 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867975 866399 evolution 39320 0.0 S 01:52 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868015 867616 evolution 39312 0.0 S 01:50 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 883863 868533 evolution 39308 0.1 S 00:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868020 867615 evolution 39268 0.0 S 01:49 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868023 867884 evolution 39232 0.0 S 01:48 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867495 866137 evolution 39208 0.0 S 02:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868012 866425 evolution 39176 0.0 S 01:51 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867972 866427 evolution 39096 0.0 S 01:53 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868018 867381 evolution 39064 0.0 S 01:50 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867982 866136 evolution 39004 0.0 S 01:52 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 864272 864210 evolution 38868 0.0 S 05:14 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 865046 865039 evolution 38648 0.0 S 04:30 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864689 848618 evolution 38632 0.0 S 04:55 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864954 864317 evolution 38628 0.0 S 04:33 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864368 830311 evolution 38620 0.0 S 05:05 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864814 864208 evolution 38620 0.0 S 04:44 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 867462 845441 evolution 38620 0.0 S 02:10 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 869159 868987 evolution 38620 0.0 S 00:43 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 865914 865075 evolution 38616 0.0 S 03:44 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 855719 847540 evolution 38600 0.0 S 05:27 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 857147 848593 evolution 38600 0.0 S 05:27 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864214 864206 evolution 38600 0.0 S 05:15 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 867457 866143 evolution 38600 0.0 S 02:11 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849395 848580 evolution 38596 0.0 S 05:33 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864739 864318 evolution 38596 0.0 S 04:51 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 865047 865041 evolution 38596 0.0 S 04:30 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864754 845467 evolution 38592 0.0 S 04:46 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864862 848596 evolution 38588 0.0 S 04:36 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 866686 866238 evolution 38588 0.0 S 03:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 883914 868961 evolution 38588 0.2 S 00:14 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849347 848579 evolution 38584 0.0 S 05:33 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864752 864316 evolution 38584 0.0 S 04:46 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 864124 847091 evolution 38572 0.0 S 05:21 /opt/cpanel/ea-php83/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 8996598 | claude | 108-1481181613 | Execute | 416 | Sending data | SELECT COUNT(*) AS n FROM `contacts` c WHERE DATEDIFF(CURDATE(), (SELECT MAX(NULLIF(j.`dateadded`, '0000-00-00')) FROM `jobs` j JOIN `customextrameta` m ON m.`metaname` LIKE CONCAT('shopify-%-job-', j.`id`, '-orderid') WHERE j.`clientid` = c.`clientid`)) <= 90 | | 9002845 | root | 108-1481181613 | Execute | 349 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9003585 | root | 108-1481181613 | Execute | 343 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9004214 | root | 108-1481181613 | Execute | 339 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9005097 | root | 108-1481181613 | Execute | 335 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9005726 | root | 108-1481181613 | Execute | 332 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9006750 | root | 108-1481181613 | Execute | 324 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9006858 | root | 108-1481181613 | Execute | 320 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9009077 | root | 108-1481181613 | Execute | 298 | Waiting for table level lock | SELECT *, IF(source = 'project', (SELECT jobcode FROM jobs WHERE jobs.id = sourceid), '') as jobcode FROM tasks WHERE id='11395' | | 9009257 | root | 108-1481181613 | Execute | 285 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9019135 | root | 108-1481181613 | Execute | 244 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.dateadded) as diff,contacts.company from jobs,contacts where jobs.clientid=contacts.clientid AND jobs.branch='3' AND jobs.status='1' AND new_flag='1' order by dateadded desc | | 9025941 | root | 108-1481181613 | Execute | 137 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | | 9032247 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9002845 | 108-1481181613 | 349 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9003585 | 108-1481181613 | 343 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9004214 | 108-1481181613 | 339 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9005097 | 108-1481181613 | 335 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9005726 | 108-1481181613 | 332 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9006750 | 108-1481181613 | 324 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9006858 | 108-1481181613 | 320 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9009077 | 108-1481181613 | 298 | Waiting for table level lock | SELECT *, IF(source = 'project', (SELECT jobcode FROM jobs WHERE jobs.id = sourceid), '') as jobcode FROM tasks WHERE id='11395' | | 9009257 | 108-1481181613 | 285 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9019135 | 108-1481181613 | 244 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.dateadded) as diff,contacts.company from jobs,contacts where jobs.clientid=contacts.clientid AND jobs.branch='3' AND jobs.status='1' AND new_flag='1' orde | | 9025941 | 108-1481181613 | 137 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 419 evolution/portal.evolutionerp.com.au-ssl_log 189 evolution/app.evolutionerp.com.au-ssl_log 124 evolution/pdev.evolutionerp.com.au-ssl_log 74 evolution/staging.evolutionerp.com.au-ssl_log 55 evolution/pdev.evolutionerp.com.au 46 evolution/my.evolutionerp.com.au 45 evolution/portal.evolutionerp.com.au 40 evolution/staging.evolutionerp.com.au 31 aaa/aaadownunder.com.au-ssl_log 9 olympic/olympicfencing.com.au-ssl_log 7 corpkicks/corporatekicks.com.au-ssl_log 6 tubesupplies/tubesupplies.com.au-ssl_log 6 madalice/madalice.com.au-ssl_log 4 otterfencing/otterfencing.com.au-ssl_log 2 (total vhosts taking traffic: 24) --- top client IPs across all vhosts (last 3 min) --- 474 45.148.10.125 159 103.104.165.99 124 40.115.94.245 101 203.54.180.238 37 150.228.151.88 36 182.239.240.254 31 180.181.236.49 28 120.150.225.142 11 1.145.125.62 9 103.104.164.114 8 118.127.40.55 6 147.161.213.71 5 1.144.107.82 3 193.124.20.178 2 91.92.243.249 --- top request paths across all vhosts (last 3 min) --- 110 POST /functions.php 99 GET /api/getItem/LWPG2001KG 54 GET /app/ajax.php 44 GET /heartbeat.php 28 GET /factory_session_checker.php 25 GET /api/getItem/LWFB2001KG 16 GET /index.php 15 POST //functions.php 14 POST /clienteditsave.php 14 GET /robots.txt 14 GET /factory_session_joiner.php 13 GET /.git/HEAD 13 GET /factory_session_processed_qty.php 12 GET /docker-compose.yml 12 GET /config.yml 11 POST /app/ajax.php 11 GET /web.config 11 GET /.env 11 GET /docker-compose.yaml 11 GET /application.properties --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 110 POST /functions.php 54 GET /app/ajax.php 16 GET /index.php 15 POST //functions.php 14 POST /clienteditsave.php 11 POST /app/ajax.php 10 POST /plugins/csvexporter/plugin.php 10 POST /jobeditsave.php 10 GET /quoteditsave.php 9 HEAD /index.php 8 POST /quoteditsave.php 8 POST /app/ajax/selectFilterSingle.php -- last 10 requests -- 103.104.165.99 - - [10/Sep/2026:09:05:22 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 51 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=1751&tab=clienteditgeneral" "Mozilla/5.0 (Windows NT 150.228.151.88 - - [10/Sep/2026:09:05:23 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2035" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 103.104.165.99 - - [10/Sep/2026:09:05:24 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 877494 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=1751&tab=clienteditgeneral" "Mozilla/5.0 (Win 45.148.10.125 - - [10/Sep/2026:09:05:24 +1000] "GET /.git/HEAD HTTP/1.1" 404 - "http://www.my.evolutionerp.com.au/.git/HEAD" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari 182.239.240.254 - - [10/Sep/2026:09:05:25 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 51 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=89&tab=clienteditgeneral" "Mozilla/5.0 (Windows NT 103.104.165.99 - - [10/Sep/2026:09:05:25 +1000] "HEAD /index.php?page=jobedit&id=12149&tab=generaltab HTTP/1.1" 200 - "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12149&tab=generaltab" "Mozilla/5.0 (Windows 103.104.165.99 - - [10/Sep/2026:09:05:25 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 180.181.236.49 - - [10/Sep/2026:09:05:30 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Ch 150.228.151.88 - - [10/Sep/2026:09:05:30 +1000] "GET /index.php?page=inveditsub&id=4032 HTTP/1.1" 200 18136 "https://my.evolutionerp.com.au/index.php?page=invedit&id=4032&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Wi 150.228.151.88 - - [10/Sep/2026:09:05:30 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=4032" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 44 GET /heartbeat.php 28 GET /factory_session_checker.php 14 GET /factory_session_joiner.php 13 GET /factory_session_processed_qty.php 2 GET /wp-config.php 2 GET /web.config 2 GET /.travis.yml 2 GET /storage/logs/laravel.log 2 GET /robots.txt 2 GET /phpinfo.php 2 GET /local_settings.py 2 GET /info.php -- last 10 requests -- 203.54.180.238 - - [10/Sep/2026:09:05:22 +1000] "GET /heartbeat.php?sentAt=1788995121&bytes=106,161,230,49&_=1788957670826 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 45.148.10.125 - - [10/Sep/2026:09:05:23 +1000] "GET /application.properties HTTP/1.1" 404 - "http://www.portal.evolutionerp.com.au/application.properties" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537. 203.54.180.238 - - [10/Sep/2026:09:05:23 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 140 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 45.148.10.125 - - [10/Sep/2026:09:05:23 +1000] "GET /application.yml HTTP/1.1" 404 - "http://www.portal.evolutionerp.com.au/application.yml" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Geck 203.54.180.238 - - [10/Sep/2026:09:05:23 +1000] "GET /factory_session_joiner.php?id=35256 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 45.148.10.125 - - [10/Sep/2026:09:05:24 +1000] "GET /application-prod.properties HTTP/1.1" 404 - "http://www.portal.evolutionerp.com.au/application-prod.properties" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 203.54.180.238 - - [10/Sep/2026:09:05:23 +1000] "GET /heartbeat.php?sentAt=1788995120&bytes=106,161,230,48&_=1788994126746 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:09:05:24 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 45.148.10.125 - - [10/Sep/2026:09:05:24 +1000] "GET /application-prod.yml HTTP/1.1" 404 - "http://www.portal.evolutionerp.com.au/application-prod.yml" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 F 45.148.10.125 - - [10/Sep/2026:09:05:25 +1000] "GET /.htaccess HTTP/1.1" 404 - "http://www.portal.evolutionerp.com.au/.htaccess" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 99 GET /api/getItem/LWPG2001KG 25 GET /api/getItem/LWFB2001KG -- last 10 requests -- 40.115.94.245 - - [10/Sep/2026:09:04:47 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:04:48 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:04:48 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:04:48 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:04:48 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:04:48 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:04:49 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:04:49 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:04:49 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:04:49 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 429 62 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-10 09:03:09 L1=1.64 run=4 blk=0 avail=6711 (48.7%) swpO=0 conn=15 myRSS=2893 php=63 phpRSS=2616 ap=101 tcp=84 topuser=evolution 2026-09-10 09:03:11 L1=1.75 run=5 blk=0 avail=6627 (48.1%) swpO=0 conn=16 myRSS=2893 php=64 phpRSS=2737 ap=99 tcp=79 topuser=evolution 2026-09-10 09:03:19 L1=1.69 run=3 blk=0 avail=6978 (50.6%) swpO=0 conn=15 myRSS=2893 php=61 phpRSS=2324 ap=93 tcp=95 topuser=evolution 2026-09-10 09:03:21 L1=1.63 run=4 blk=0 avail=6870 (49.9%) swpO=0 conn=16 myRSS=2893 php=64 phpRSS=2489 ap=92 tcp=95 topuser=evolution 2026-09-10 09:03:29 L1=1.58 run=3 blk=0 avail=6826 (49.5%) swpO=0 conn=17 myRSS=2893 php=69 phpRSS=2702 ap=91 tcp=93 topuser=evolution 2026-09-10 09:03:31 L1=1.69 run=5 blk=0 avail=6800 (49.4%) swpO=0 conn=17 myRSS=2893 php=72 phpRSS=2786 ap=92 tcp=99 topuser=evolution 2026-09-10 09:03:39 L1=1.66 run=2 blk=0 avail=6803 (49.4%) swpO=0 conn=15 myRSS=2893 php=70 phpRSS=2672 ap=102 tcp=95 topuser=evolution 2026-09-10 09:03:42 L1=1.66 run=2 blk=0 avail=6768 (49.1%) swpO=0 conn=16 myRSS=2893 php=75 phpRSS=2865 ap=100 tcp=90 topuser=evolution 2026-09-10 09:03:49 L1=1.63 run=3 blk=0 avail=6696 (48.6%) swpO=0 conn=15 myRSS=2893 php=81 phpRSS=3094 ap=98 tcp=90 topuser=evolution 2026-09-10 09:03:52 L1=1.63 run=3 blk=0 avail=6776 (49.2%) swpO=0 conn=16 myRSS=2893 php=81 phpRSS=3001 ap=99 tcp=96 topuser=evolution 2026-09-10 09:03:59 L1=1.54 run=4 blk=0 avail=6589 (47.8%) swpO=3 conn=15 myRSS=2893 php=84 phpRSS=3205 ap=112 tcp=97 topuser=evolution 2026-09-10 09:04:02 L1=1.54 run=3 blk=0 avail=6592 (47.8%) swpO=3 conn=16 myRSS=2893 php=84 phpRSS=3192 ap=110 tcp=93 topuser=evolution 2026-09-10 09:04:09 L1=1.45 run=2 blk=0 avail=6649 (48.3%) swpO=0 conn=15 myRSS=2893 php=82 phpRSS=3131 ap=106 tcp=87 topuser=evolution 2026-09-10 09:04:12 L1=1.45 run=2 blk=0 avail=6649 (48.3%) swpO=0 conn=16 myRSS=2893 php=84 phpRSS=3207 ap=103 tcp=90 topuser=evolution 2026-09-10 09:04:19 L1=1.46 run=3 blk=0 avail=6663 (48.4%) swpO=0 conn=15 myRSS=2893 php=83 phpRSS=3167 ap=102 tcp=99 topuser=evolution 2026-09-10 09:04:22 L1=1.46 run=2 blk=0 avail=6634 (48.2%) swpO=0 conn=17 myRSS=2893 php=84 phpRSS=3131 ap=116 tcp=109 topuser=evolution 2026-09-10 09:04:30 L1=1.39 run=2 blk=0 avail=6489 (47.1%) swpO=0 conn=15 myRSS=2893 php=83 phpRSS=3172 ap=127 tcp=95 topuser=evolution 2026-09-10 09:04:32 L1=1.39 run=4 blk=0 avail=6226 (45.2%) swpO=0 conn=18 myRSS=2893 php=86 phpRSS=3536 ap=124 tcp=95 topuser=evolution 2026-09-10 09:04:40 L1=1.33 run=2 blk=0 avail=6267 (45.5%) swpO=0 conn=16 myRSS=2893 php=83 phpRSS=3172 ap=153 tcp=138 topuser=evolution 2026-09-10 09:04:43 L1=1.33 run=4 blk=0 avail=6270 (45.5%) swpO=0 conn=16 myRSS=2893 php=85 phpRSS=3252 ap=153 tcp=152 topuser=evolution 2026-09-10 09:04:50 L1=1.43 run=3 blk=0 avail=6394 (46.4%) swpO=0 conn=15 myRSS=2893 php=82 phpRSS=3035 ap=153 tcp=153 topuser=evolution 2026-09-10 09:04:53 L1=1.43 run=4 blk=0 avail=6374 (46.3%) swpO=0 conn=15 myRSS=2893 php=83 phpRSS=3072 ap=153 tcp=150 topuser=evolution 2026-09-10 09:05:00 L1=1.37 run=3 blk=0 avail=6265 (45.5%) swpO=0 conn=15 myRSS=2893 php=84 phpRSS=3205 ap=153 tcp=153 topuser=evolution 2026-09-10 09:05:03 L1=1.37 run=4 blk=1 avail=6246 (45.3%) swpO=0 conn=15 myRSS=2893 php=84 phpRSS=3205 ap=153 tcp=165 topuser=evolution 2026-09-10 09:05:10 L1=1.68 run=3 blk=0 avail=6257 (45.4%) swpO=0 conn=15 myRSS=2893 php=84 phpRSS=3205 ap=153 tcp=164 topuser=evolution 2026-09-10 09:05:13 L1=1.68 run=2 blk=0 avail=6223 (45.2%) swpO=0 conn=16 myRSS=2893 php=87 phpRSS=3322 ap=153 tcp=154 topuser=evolution 2026-09-10 09:05:20 L1=1.58 run=2 blk=0 avail=6308 (45.8%) swpO=0 conn=15 myRSS=2893 php=89 phpRSS=3299 ap=153 tcp=143 topuser=evolution 2026-09-10 09:05:23 L1=1.58 run=2 blk=0 avail=6271 (45.5%) swpO=0 conn=16 myRSS=2893 php=92 phpRSS=3415 ap=153 tcp=141 topuser=evolution 2026-09-10 09:05:30 L1=1.49 run=4 blk=0 avail=6161 (44.7%) swpO=1 conn=16 myRSS=2893 php=93 phpRSS=3558 ap=153 tcp=132 topuser=evolution 2026-09-10 09:05:33 L1=1.49 run=2 blk=0 avail=6177 (44.8%) swpO=1 conn=15 myRSS=2893 php=92 phpRSS=3507 ap=153 tcp=114 topuser=evolution