INCIDENT 2026-09-10 09:06:34 trigger: php_procs=146 php_rss=5585MB mysql_conn=18 ================================================================== load: 1.92 1.80 1.65 3/881 885391 ncpu:10 mem_avail: 5583MB/13777MB (40.5%) swap_used:1524MB swapout:0/s blocked(D):0 running:3 iowait:0.0% steal:0.0% php: 146 procs / 5585MB heaviest user: evolution (144 procs, 5450MB) apache: 153 procs tcp_estab: 201 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 147 5422 mysql 1 2863 nobody 152 2758 root 244 1054 netdata 8 254 mailman 20 186 madalice 1 132 infinium 2 83 dovenull 6 66 wp-toolkit 3 62 cpanellogin 1 55 kurri 3 41 dovecot 3 28 polkitd 1 15 aaa 1 13 zabbix 1 9 nscd 1 6 named 1 5 cpanelconnecttrack 1 4 mailnull 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 143 5414 madalice 1 132 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4807 MB Active(file): 3447 MB Inactive(file): 1267 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 582 MB CommitLimit: 10984 MB Committed_AS: 20812 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 849368 root 06:34 3096 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 9-06:44:10 3892 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 2932560 13.4 Ssl 2-04:21:07 /usr/sbin/mariadbd 166870 1 netdata 197952 2.7 Ssl 4-06:44:16 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3701672 3652415 root 175396 0.0 S 06:31:22 spamd child 3701673 3652415 root 164716 0.0 S 06:31:22 spamd child 3652415 1 root 162076 0.0 Ss 06:41:43 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328754 1 root 155320 0.0 Ss 2-04:21:17 /usr/lib/systemd/systemd-journald 885294 167896 madalice 135504 12.6 S 00:10 php-fpm: pool madalice_com_au 509236 509098 root 67020 0.0 Sl 13-06:46:56 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 865491 865072 evolution 58640 0.0 S 05:06 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 885357 885253 evolution 58504 4.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849022 847572 evolution 57980 0.0 S 06:52 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 625148 1353308 cpanellogin 56684 0.0 S 01:09:25 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 864647 864165 evolution 56576 0.0 S 06:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 847868 1353308 infinium 56416 0.0 S 07:58 webmaild - serving 1.41.252.211 1353308 1 root 42528 0.0 Ss 50-06:25:22 cpsrvd (SSL) - waiting for connections 1469 1 root 41248 0.1 Ss 72-22:56:51 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 867350 847553 evolution 40808 0.0 S 03:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 880957 868986 evolution 40608 0.0 S 01:24 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 884600 868274 evolution 40524 0.0 S 00:55 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867481 865071 evolution 40292 0.0 S 03:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867421 866145 evolution 40136 0.0 S 03:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867926 867901 evolution 40116 0.0 S 02:57 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867471 848617 evolution 40036 0.0 S 03:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867482 866254 evolution 40016 0.0 S 03:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867478 866415 evolution 40004 0.0 S 03:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867962 866046 evolution 39384 0.0 S 02:55 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885015 868959 evolution 39384 0.1 S 00:30 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885242 884994 evolution 39384 0.1 S 00:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 884911 868596 evolution 39380 0.0 S 00:33 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885187 885045 evolution 39380 0.1 S 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885353 885252 evolution 39380 0.6 S 00:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885314 865986 evolution 39376 0.2 S 00:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 883944 868974 evolution 39368 0.0 S 01:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885192 868983 evolution 39352 0.1 S 00:16 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868014 864319 evolution 39348 0.0 S 02:52 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868024 867897 evolution 39348 0.0 S 02:49 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 884978 868599 evolution 39348 0.0 S 00:31 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885305 865758 evolution 39348 0.3 S 00:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885035 868524 evolution 39344 0.0 S 00:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885189 868553 evolution 39340 0.1 S 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885029 885022 evolution 39332 0.1 S 00:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885188 885044 evolution 39332 0.1 S 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885304 885263 evolution 39328 0.2 S 00:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867975 866399 evolution 39320 0.0 S 02:53 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868015 867616 evolution 39312 0.0 S 02:51 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 883863 868533 evolution 39308 0.0 S 01:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 884963 868946 evolution 39308 0.0 S 00:31 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885186 885046 evolution 39308 0.1 S 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885312 868982 evolution 39276 0.2 S 00:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868020 867615 evolution 39268 0.0 S 02:50 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885243 868273 evolution 39268 0.1 S 00:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868023 867884 evolution 39232 0.0 S 02:49 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885105 868963 evolution 39228 0.0 S 00:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885307 868492 evolution 39228 0.3 S 00:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 884959 884907 evolution 39212 0.0 S 00:32 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867495 866137 evolution 39208 0.0 S 03:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 884680 868085 evolution 39208 0.0 S 00:50 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885316 868600 evolution 39208 0.3 S 00:06 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885057 885040 evolution 39200 0.1 S 00:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885322 885042 evolution 39196 0.5 S 00:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 8996598 | claude | 108-1481181613 | Execute | 477 | Sending data | SELECT COUNT(*) AS n FROM `contacts` c WHERE DATEDIFF(CURDATE(), (SELECT MAX(NULLIF(j.`dateadded`, '0000-00-00')) FROM `jobs` j JOIN `customextrameta` m ON m.`metaname` LIKE CONCAT('shopify-%-job-', j.`id`, '-orderid') WHERE j.`clientid` = c.`clientid`)) <= 90 | | 9002845 | root | 108-1481181613 | Execute | 410 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9003585 | root | 108-1481181613 | Execute | 404 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9004214 | root | 108-1481181613 | Execute | 400 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9005097 | root | 108-1481181613 | Execute | 396 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9005726 | root | 108-1481181613 | Execute | 393 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9006750 | root | 108-1481181613 | Execute | 385 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9006858 | root | 108-1481181613 | Execute | 381 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9009077 | root | 108-1481181613 | Execute | 359 | Waiting for table level lock | SELECT *, IF(source = 'project', (SELECT jobcode FROM jobs WHERE jobs.id = sourceid), '') as jobcode FROM tasks WHERE id='11395' | | 9009257 | root | 108-1481181613 | Execute | 346 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9019135 | root | 108-1481181613 | Execute | 305 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.dateadded) as diff,contacts.company from jobs,contacts where jobs.clientid=contacts.clientid AND jobs.branch='3' AND jobs.status='1' AND new_flag='1' order by dateadded desc | | 9025941 | root | 108-1481181613 | Execute | 198 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | | 9032495 | root | 108-1481181613 | Execute | 54 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='5' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.complete group by jobid | | 9037191 | root | 108-1481181613 | Execute | 2 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.nextaction) as diff,contacts.company FROM jobs,contacts where jobs.clientid=contacts.clientid and jobs.nextaction<'2026-09-10' and jobs.status='1' AND jobs.nextaction!='0000-00-00' ORDER BY diff desc | | 9037266 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9002845 | 108-1481181613 | 410 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9003585 | 108-1481181613 | 404 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9004214 | 108-1481181613 | 400 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9005097 | 108-1481181613 | 396 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9005726 | 108-1481181613 | 393 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9006750 | 108-1481181613 | 385 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9006858 | 108-1481181613 | 381 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9009077 | 108-1481181613 | 359 | Waiting for table level lock | SELECT *, IF(source = 'project', (SELECT jobcode FROM jobs WHERE jobs.id = sourceid), '') as jobcode FROM tasks WHERE id='11395' | | 9009257 | 108-1481181613 | 346 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9019135 | 108-1481181613 | 305 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.dateadded) as diff,contacts.company from jobs,contacts where jobs.clientid=contacts.clientid AND jobs.branch='3' AND jobs.status='1' AND new_flag='1' orde | | 9025941 | 108-1481181613 | 198 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | | 9032495 | 108-1481181613 | 54 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='5' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.comple | | 9037191 | 108-1481181613 | 2 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.nextaction) as diff,contacts.company FROM jobs,contacts where jobs.clientid=contacts.clientid and jobs.nextaction<'2026-09-10' and jobs.status='1' AN | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 393 evolution/portal.evolutionerp.com.au-ssl_log 186 evolution/app.evolutionerp.com.au-ssl_log 161 evolution/pdev.evolutionerp.com.au-ssl_log 74 evolution/staging.evolutionerp.com.au-ssl_log 55 evolution/pdev.evolutionerp.com.au 46 evolution/my.evolutionerp.com.au 45 evolution/portal.evolutionerp.com.au 40 evolution/staging.evolutionerp.com.au 31 aaa/aaadownunder.com.au-ssl_log 7 tubesupplies/tubesupplies.com.au-ssl_log 6 corpkicks/corporatekicks.com.au-ssl_log 3 alison/alisonarts.com.au-ssl_log 1 customc/customcentral.com.au-ssl_log 1 evolution/evolutionerp.com.au 1 (total vhosts taking traffic: 18) --- top client IPs across all vhosts (last 3 min) --- 476 45.148.10.125 161 40.115.94.245 142 103.104.165.99 96 203.54.180.238 54 150.228.151.88 30 180.181.236.49 27 1.144.107.82 13 1.145.125.62 9 182.239.240.254 7 147.161.213.71 7 120.150.225.142 7 103.104.164.114 3 165.225.233.87 3 118.127.40.55 2 91.92.243.249 --- top request paths across all vhosts (last 3 min) --- 161 GET /api/getItem/LWPG2001KG 115 POST /functions.php 45 GET /app/ajax.php 43 GET /heartbeat.php 25 GET /factory_session_checker.php 23 GET /index.php 17 POST /plugins/csvexporter/plugin.php 15 GET /.git/HEAD 14 GET / 13 GET /robots.txt 12 GET /factory_session_processed_qty.php 12 GET /factory_session_joiner.php 12 GET /docker-compose.yml 12 GET /config.yml 11 GET /web.config 11 GET /docker-compose.yaml 11 GET /application.properties 11 GET /actuator/health 11 GET /404.shtml 10 POST //functions.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 115 POST /functions.php 45 GET /app/ajax.php 22 GET /index.php 17 POST /plugins/csvexporter/plugin.php 10 POST //functions.php 10 POST /clienteditsave.php 10 POST /app/ajax.php 9 GET /quoteditsave.php 8 POST /app/ajax/selectFilterSingle.php 8 HEAD /index.php 7 POST /quoteditsave.php 7 POST /plugins/fencecosting/plugin.php -- last 10 requests -- 150.228.151.88 - - [10/Sep/2026:09:06:27 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=invedit&id=4032&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 150.228.151.88 - - [10/Sep/2026:09:06:28 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=invedit&id=4026&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 1.144.107.82 - - [10/Sep/2026:09:06:29 +1000] "GET /index.php?page=login2 HTTP/1.1" 200 43738 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152 1.144.107.82 - - [10/Sep/2026:09:06:30 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dlogin2&call=getUserSetting&caller=ajaxSubmitLocal&seq=10179403995 HTTP/1.1" 200 88 "https://my.evolutionerp.com.au/index.php?page= 1.144.107.82 - - [10/Sep/2026:09:06:31 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=login2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KH 1.144.107.82 - - [10/Sep/2026:09:06:32 +1000] "POST /login2save.php HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=login2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko 150.228.151.88 - - [10/Sep/2026:09:06:32 +1000] "GET /index.php?page=inveditsub&id=4032 HTTP/1.1" 200 18136 "https://my.evolutionerp.com.au/index.php?page=invedit&id=4032&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Wi 150.228.151.88 - - [10/Sep/2026:09:06:32 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=4032" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe 150.228.151.88 - - [10/Sep/2026:09:06:33 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinveditsub%26id%3D4032&call=getUserSetting&caller=ajaxSubmitLocal&seq=16621265623 HTTP/1.1" 200 100 "https://my.evolutionerp.com 150.228.151.88 - - [10/Sep/2026:09:06:34 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=4032" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 43 GET /heartbeat.php 25 GET /factory_session_checker.php 12 GET /factory_session_processed_qty.php 12 GET /factory_session_joiner.php 4 GET /.git/HEAD 2 GET /wp-config.php 2 GET /web.config 2 GET /.travis.yml 2 GET /storage/logs/laravel.log 2 GET /robots.txt 2 GET /phpinfo.php 2 GET /local_settings.py -- last 10 requests -- 203.54.180.238 - - [10/Sep/2026:09:06:00 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:06:00 +1000] "GET /heartbeat.php?sentAt=1788995161&bytes=106,161,230,89&_=1788957670830 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:09:06:02 +1000] "GET /heartbeat.php?sentAt=1788995160&bytes=106,161,230,88&_=1788994126750 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:09:06:04 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 140 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [10/Sep/2026:09:06:04 +1000] "GET /factory_session_joiner.php?id=35256 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [10/Sep/2026:09:06:05 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:06:04 +1000] "GET /heartbeat.php?sentAt=1788995164&bytes=106,161,230,92&_=1788987691510 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:09:06:10 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:06:10 +1000] "GET /heartbeat.php?sentAt=1788995171&bytes=106,161,230,99&_=1788957670831 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:09:06:12 +1000] "GET /heartbeat.php?sentAt=1788995170&bytes=106,161,230,98&_=1788994126751 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 161 GET /api/getItem/LWPG2001KG -- last 10 requests -- 40.115.94.245 - - [10/Sep/2026:09:06:06 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:06:06 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:06:06 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:06:07 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:06:07 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:06:07 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:06:07 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:06:08 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:06:08 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:06:08 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-10 09:04:09 L1=1.45 run=2 blk=0 avail=6649 (48.3%) swpO=0 conn=15 myRSS=2893 php=82 phpRSS=3131 ap=106 tcp=87 topuser=evolution 2026-09-10 09:04:12 L1=1.45 run=2 blk=0 avail=6649 (48.3%) swpO=0 conn=16 myRSS=2893 php=84 phpRSS=3207 ap=103 tcp=90 topuser=evolution 2026-09-10 09:04:19 L1=1.46 run=3 blk=0 avail=6663 (48.4%) swpO=0 conn=15 myRSS=2893 php=83 phpRSS=3167 ap=102 tcp=99 topuser=evolution 2026-09-10 09:04:22 L1=1.46 run=2 blk=0 avail=6634 (48.2%) swpO=0 conn=17 myRSS=2893 php=84 phpRSS=3131 ap=116 tcp=109 topuser=evolution 2026-09-10 09:04:30 L1=1.39 run=2 blk=0 avail=6489 (47.1%) swpO=0 conn=15 myRSS=2893 php=83 phpRSS=3172 ap=127 tcp=95 topuser=evolution 2026-09-10 09:04:32 L1=1.39 run=4 blk=0 avail=6226 (45.2%) swpO=0 conn=18 myRSS=2893 php=86 phpRSS=3536 ap=124 tcp=95 topuser=evolution 2026-09-10 09:04:40 L1=1.33 run=2 blk=0 avail=6267 (45.5%) swpO=0 conn=16 myRSS=2893 php=83 phpRSS=3172 ap=153 tcp=138 topuser=evolution 2026-09-10 09:04:43 L1=1.33 run=4 blk=0 avail=6270 (45.5%) swpO=0 conn=16 myRSS=2893 php=85 phpRSS=3252 ap=153 tcp=152 topuser=evolution 2026-09-10 09:04:50 L1=1.43 run=3 blk=0 avail=6394 (46.4%) swpO=0 conn=15 myRSS=2893 php=82 phpRSS=3035 ap=153 tcp=153 topuser=evolution 2026-09-10 09:04:53 L1=1.43 run=4 blk=0 avail=6374 (46.3%) swpO=0 conn=15 myRSS=2893 php=83 phpRSS=3072 ap=153 tcp=150 topuser=evolution 2026-09-10 09:05:00 L1=1.37 run=3 blk=0 avail=6265 (45.5%) swpO=0 conn=15 myRSS=2893 php=84 phpRSS=3205 ap=153 tcp=153 topuser=evolution 2026-09-10 09:05:03 L1=1.37 run=4 blk=1 avail=6246 (45.3%) swpO=0 conn=15 myRSS=2893 php=84 phpRSS=3205 ap=153 tcp=165 topuser=evolution 2026-09-10 09:05:10 L1=1.68 run=3 blk=0 avail=6257 (45.4%) swpO=0 conn=15 myRSS=2893 php=84 phpRSS=3205 ap=153 tcp=164 topuser=evolution 2026-09-10 09:05:13 L1=1.68 run=2 blk=0 avail=6223 (45.2%) swpO=0 conn=16 myRSS=2893 php=87 phpRSS=3322 ap=153 tcp=154 topuser=evolution 2026-09-10 09:05:20 L1=1.58 run=2 blk=0 avail=6308 (45.8%) swpO=0 conn=15 myRSS=2893 php=89 phpRSS=3299 ap=153 tcp=143 topuser=evolution 2026-09-10 09:05:23 L1=1.58 run=2 blk=0 avail=6271 (45.5%) swpO=0 conn=16 myRSS=2893 php=92 phpRSS=3415 ap=153 tcp=141 topuser=evolution 2026-09-10 09:05:30 L1=1.49 run=4 blk=0 avail=6161 (44.7%) swpO=1 conn=16 myRSS=2893 php=93 phpRSS=3558 ap=153 tcp=132 topuser=evolution 2026-09-10 09:05:33 L1=1.49 run=2 blk=0 avail=6177 (44.8%) swpO=1 conn=15 myRSS=2893 php=92 phpRSS=3507 ap=153 tcp=114 topuser=evolution 2026-09-10 09:05:40 L1=1.97 run=7 blk=0 avail=5442 (39.5%) swpO=1296 conn=19 myRSS=2863 php=99 phpRSS=4134 ap=146 tcp=116 topuser=evolution 2026-09-10 09:05:44 L1=1.97 run=2 blk=0 avail=6266 (45.5%) swpO=1178 conn=16 myRSS=2863 php=95 phpRSS=3619 ap=143 tcp=102 topuser=evolution 2026-09-10 09:05:50 L1=1.82 run=2 blk=0 avail=6389 (46.4%) swpO=0 conn=16 myRSS=2863 php=97 phpRSS=3601 ap=136 tcp=92 topuser=evolution 2026-09-10 09:05:54 L1=1.82 run=2 blk=0 avail=6400 (46.5%) swpO=0 conn=16 myRSS=2863 php=98 phpRSS=3639 ap=133 tcp=98 topuser=evolution 2026-09-10 09:06:00 L1=1.77 run=3 blk=0 avail=6272 (45.5%) swpO=0 conn=16 myRSS=2863 php=102 phpRSS=3882 ap=130 tcp=102 topuser=evolution 2026-09-10 09:06:04 L1=1.77 run=2 blk=0 avail=6212 (45.1%) swpO=0 conn=16 myRSS=2863 php=105 phpRSS=4001 ap=134 tcp=109 topuser=evolution 2026-09-10 09:06:10 L1=2.20 run=7 blk=0 avail=5566 (40.4%) swpO=0 conn=23 myRSS=2863 php=122 phpRSS=4999 ap=147 tcp=104 topuser=evolution 2026-09-10 09:06:14 L1=2.20 run=3 blk=0 avail=5920 (43.0%) swpO=0 conn=18 myRSS=2863 php=115 phpRSS=4464 ap=147 tcp=105 topuser=evolution 2026-09-10 09:06:20 L1=2.09 run=4 blk=0 avail=5981 (43.4%) swpO=0 conn=17 myRSS=2863 php=125 phpRSS=4670 ap=146 tcp=90 topuser=evolution 2026-09-10 09:06:24 L1=2.09 run=3 blk=0 avail=5855 (42.5%) swpO=0 conn=17 myRSS=2863 php=131 phpRSS=4900 ap=153 tcp=94 topuser=evolution 2026-09-10 09:06:30 L1=1.92 run=4 blk=0 avail=5631 (40.9%) swpO=0 conn=16 myRSS=2863 php=143 phpRSS=5453 ap=153 tcp=195 topuser=evolution 2026-09-10 09:06:34 L1=1.92 run=3 blk=0 avail=5583 (40.5%) swpO=0 conn=18 myRSS=2863 php=146 phpRSS=5585 ap=153 tcp=201 topuser=evolution