INCIDENT 2026-09-10 09:07:35 trigger: php_procs=144 php_rss=5416MB mysql_conn=18 ================================================================== load: 1.38 1.67 1.61 3/879 886335 ncpu:10 mem_avail: 5676MB/13777MB (41.2%) swap_used:1524MB swapout:0/s blocked(D):0 running:2 iowait:0.0% steal:0.0% php: 144 procs / 5416MB heaviest user: evolution (143 procs, 5414MB) apache: 153 procs tcp_estab: 169 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 148 5431 mysql 1 2863 nobody 152 2780 root 244 1067 netdata 8 254 mailman 20 186 infinium 2 83 dovenull 6 66 wp-toolkit 3 62 cpanellogin 1 55 kurri 3 41 dovecot 3 28 polkitd 1 15 mailnull 2 10 zabbix 1 8 nscd 1 6 named 1 5 cpanelconnecttrack 1 4 dbus 1 2 chrony 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 143 5414 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4796 MB Active(file): 3450 MB Inactive(file): 1254 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 587 MB CommitLimit: 10984 MB Committed_AS: 20711 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 849368 root 07:35 3096 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 9-06:45:11 3892 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 2932560 13.4 Ssl 2-04:22:08 /usr/sbin/mariadbd 166870 1 netdata 198464 2.7 Ssl 4-06:45:17 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3701672 3652415 root 175396 0.0 S 06:32:23 spamd child 3701673 3652415 root 164716 0.0 S 06:32:23 spamd child 3652415 1 root 162076 0.0 Ss 06:42:44 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328754 1 root 155320 0.0 Ss 2-04:22:18 /usr/lib/systemd/systemd-journald 509236 509098 root 67020 0.0 Sl 13-06:47:57 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 865491 865072 evolution 58640 0.0 S 06:07 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 885357 885253 evolution 58504 0.1 S 01:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 849022 847572 evolution 57980 0.0 S 07:53 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 625148 1353308 cpanellogin 56684 0.0 S 01:10:26 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 864647 864165 evolution 56576 0.0 S 07:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 847868 1353308 infinium 56416 0.0 S 08:59 webmaild - serving 1.41.252.211 1353308 1 root 42528 0.0 Ss 50-06:26:23 cpsrvd (SSL) - waiting for connections 1469 1 root 41248 0.1 Ss 72-22:57:52 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 867350 847553 evolution 40808 0.0 S 04:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 880957 868986 evolution 40608 0.0 S 02:25 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 884600 868274 evolution 40524 0.0 S 01:56 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867481 865071 evolution 40292 0.0 S 04:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867421 866145 evolution 40136 0.0 S 04:14 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867926 867901 evolution 40116 0.0 S 03:58 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867471 848617 evolution 40036 0.0 S 04:11 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867482 866254 evolution 40016 0.0 S 04:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867478 866415 evolution 40004 0.0 S 04:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867962 866046 evolution 39384 0.0 S 03:56 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885015 868959 evolution 39384 0.0 S 01:31 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885242 884994 evolution 39384 0.0 S 01:14 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 884911 868596 evolution 39380 0.0 S 01:34 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885187 885045 evolution 39380 0.0 S 01:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885353 885252 evolution 39380 0.0 S 01:04 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885314 865986 evolution 39376 0.0 S 01:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 883944 868974 evolution 39368 0.0 S 02:14 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885192 868983 evolution 39352 0.0 S 01:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868014 864319 evolution 39348 0.0 S 03:53 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868024 867897 evolution 39348 0.0 S 03:50 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 884978 868599 evolution 39348 0.0 S 01:32 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885305 865758 evolution 39348 0.0 S 01:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885035 868524 evolution 39344 0.0 S 01:30 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885189 868553 evolution 39340 0.0 S 01:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885029 885022 evolution 39332 0.0 S 01:30 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885188 885044 evolution 39332 0.0 S 01:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885304 885263 evolution 39328 0.0 S 01:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867975 866399 evolution 39320 0.0 S 03:54 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868015 867616 evolution 39312 0.0 S 03:52 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 883863 868533 evolution 39308 0.0 S 02:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 884963 868946 evolution 39308 0.0 S 01:32 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885186 885046 evolution 39308 0.0 S 01:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885312 868982 evolution 39276 0.0 S 01:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868020 867615 evolution 39268 0.0 S 03:51 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885243 868273 evolution 39268 0.0 S 01:14 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 868023 867884 evolution 39232 0.0 S 03:50 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885105 868963 evolution 39228 0.0 S 01:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885307 868492 evolution 39228 0.0 S 01:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 884959 884907 evolution 39212 0.0 S 01:33 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 867495 866137 evolution 39208 0.0 S 04:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 884680 868085 evolution 39208 0.0 S 01:51 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885316 868600 evolution 39208 0.0 S 01:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885057 885040 evolution 39200 0.0 S 01:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885322 885042 evolution 39196 0.0 S 01:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 885244 868984 evolution 39192 0.0 S 01:14 /opt/cpanel/ea-php74/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 8996598 | claude | 108-1481181613 | Execute | 537 | Sending data | SELECT COUNT(*) AS n FROM `contacts` c WHERE DATEDIFF(CURDATE(), (SELECT MAX(NULLIF(j.`dateadded`, '0000-00-00')) FROM `jobs` j JOIN `customextrameta` m ON m.`metaname` LIKE CONCAT('shopify-%-job-', j.`id`, '-orderid') WHERE j.`clientid` = c.`clientid`)) <= 90 | | 9002845 | root | 108-1481181613 | Execute | 471 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9003585 | root | 108-1481181613 | Execute | 465 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9004214 | root | 108-1481181613 | Execute | 461 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9005097 | root | 108-1481181613 | Execute | 457 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9005726 | root | 108-1481181613 | Execute | 454 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9006750 | root | 108-1481181613 | Execute | 446 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9006858 | root | 108-1481181613 | Execute | 442 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9009077 | root | 108-1481181613 | Execute | 420 | Waiting for table level lock | SELECT *, IF(source = 'project', (SELECT jobcode FROM jobs WHERE jobs.id = sourceid), '') as jobcode FROM tasks WHERE id='11395' | | 9009257 | root | 108-1481181613 | Execute | 407 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9019135 | root | 108-1481181613 | Execute | 366 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.dateadded) as diff,contacts.company from jobs,contacts where jobs.clientid=contacts.clientid AND jobs.branch='3' AND jobs.status='1' AND new_flag='1' order by dateadded desc | | 9025941 | root | 108-1481181613 | Execute | 259 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | | 9032495 | root | 108-1481181613 | Execute | 115 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='5' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.complete group by jobid | | 9037191 | root | 108-1481181613 | Execute | 63 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.nextaction) as diff,contacts.company FROM jobs,contacts where jobs.clientid=contacts.clientid and jobs.nextaction<'2026-09-10' and jobs.status='1' AND jobs.nextaction!='0000-00-00' ORDER BY diff desc | | 9037293 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9002845 | 108-1481181613 | 471 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9003585 | 108-1481181613 | 465 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9004214 | 108-1481181613 | 461 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9005097 | 108-1481181613 | 457 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9005726 | 108-1481181613 | 454 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9006750 | 108-1481181613 | 446 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9006858 | 108-1481181613 | 442 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9009077 | 108-1481181613 | 420 | Waiting for table level lock | SELECT *, IF(source = 'project', (SELECT jobcode FROM jobs WHERE jobs.id = sourceid), '') as jobcode FROM tasks WHERE id='11395' | | 9009257 | 108-1481181613 | 407 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9019135 | 108-1481181613 | 366 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.dateadded) as diff,contacts.company from jobs,contacts where jobs.clientid=contacts.clientid AND jobs.branch='3' AND jobs.status='1' AND new_flag='1' orde | | 9025941 | 108-1481181613 | 259 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | | 9032495 | 108-1481181613 | 115 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='5' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.comple | | 9037191 | 108-1481181613 | 63 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.nextaction) as diff,contacts.company FROM jobs,contacts where jobs.clientid=contacts.clientid and jobs.nextaction<'2026-09-10' and jobs.status='1' AN | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 243 evolution/app.evolutionerp.com.au-ssl_log 99 evolution/portal.evolutionerp.com.au-ssl_log 95 evolution/staging.evolutionerp.com.au-ssl_log 50 evolution/staging.evolutionerp.com.au 27 evolution/pdev.evolutionerp.com.au-ssl_log 24 evolution/pdev.evolutionerp.com.au 15 evolution/portal.evolutionerp.com.au 14 evolution/my.evolutionerp.com.au 12 madalice/madalice.com.au-ssl_log 3 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 219 45.148.10.125 101 103.104.165.99 99 40.115.94.245 53 203.54.180.238 35 150.228.151.88 26 1.144.107.82 20 180.181.236.49 5 182.239.240.254 5 120.150.225.142 4 147.161.213.71 4 103.104.164.114 3 1.145.125.62 1 207.46.13.7 1 207.46.13.141 1 165.225.233.89 --- top request paths across all vhosts (last 3 min) --- 99 GET /api/getItem/LWPG2001KG 77 POST /functions.php 38 GET /app/ajax.php 25 GET /heartbeat.php 20 GET /index.php 14 POST /plugins/csvexporter/plugin.php 14 GET /factory_session_checker.php 11 GET /.git/HEAD 10 POST /clienteditsave.php 10 GET /web.config 10 GET /_profiler/phpinfo 10 GET /actuator/health 9 GET /config.yml 8 GET /docker-compose.yaml 8 GET /application.properties 7 GET /config.yaml 7 GET /.aws/config 6 POST //functions.php 6 POST /app/ajax/selectFilterSingle.php 6 GET /.npmrc --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 77 POST /functions.php 38 GET /app/ajax.php 19 GET /index.php 14 POST /plugins/csvexporter/plugin.php 10 POST /clienteditsave.php 6 POST //functions.php 6 POST /app/ajax/selectFilterSingle.php 5 POST /plugins/fencecosting/plugin.php 5 POST /app/ajax.php 5 HEAD /index.php 4 GET / 3 POST /logsave.php -- last 10 requests -- 150.228.151.88 - - [10/Sep/2026:09:06:27 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=invedit&id=4032&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 150.228.151.88 - - [10/Sep/2026:09:06:28 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=invedit&id=4026&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x 1.144.107.82 - - [10/Sep/2026:09:06:29 +1000] "GET /index.php?page=login2 HTTP/1.1" 200 43738 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152 1.144.107.82 - - [10/Sep/2026:09:06:30 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dlogin2&call=getUserSetting&caller=ajaxSubmitLocal&seq=10179403995 HTTP/1.1" 200 88 "https://my.evolutionerp.com.au/index.php?page= 1.144.107.82 - - [10/Sep/2026:09:06:31 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=login2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KH 1.144.107.82 - - [10/Sep/2026:09:06:32 +1000] "POST /login2save.php HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=login2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko 150.228.151.88 - - [10/Sep/2026:09:06:32 +1000] "GET /index.php?page=inveditsub&id=4032 HTTP/1.1" 200 18136 "https://my.evolutionerp.com.au/index.php?page=invedit&id=4032&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Wi 150.228.151.88 - - [10/Sep/2026:09:06:32 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=4032" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe 150.228.151.88 - - [10/Sep/2026:09:06:33 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinveditsub%26id%3D4032&call=getUserSetting&caller=ajaxSubmitLocal&seq=16621265623 HTTP/1.1" 200 100 "https://my.evolutionerp.com 150.228.151.88 - - [10/Sep/2026:09:06:34 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=inveditsub&id=4032" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 99 GET /api/getItem/LWPG2001KG -- last 10 requests -- 40.115.94.245 - - [10/Sep/2026:09:06:06 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:06:06 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:06:06 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:06:07 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:06:07 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:06:07 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:06:07 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:06:08 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:06:08 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:06:08 +1000] "GET /api/getItem/LWPG2001KG HTTP/1.1" 200 1334 "-" "RestSharp/106.13.0.0" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 25 GET /heartbeat.php 14 GET /factory_session_checker.php 6 GET /factory_session_processed_qty.php 6 GET /factory_session_joiner.php 4 GET /.git/HEAD 2 GET /web.config 2 GET /storage/logs/laravel.log 2 GET /.git/config 2 GET /error.log 2 GET /.env.save 2 GET /config.yml 2 GET /backend/.env -- last 10 requests -- 203.54.180.238 - - [10/Sep/2026:09:06:00 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:06:00 +1000] "GET /heartbeat.php?sentAt=1788995161&bytes=106,161,230,89&_=1788957670830 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:09:06:02 +1000] "GET /heartbeat.php?sentAt=1788995160&bytes=106,161,230,88&_=1788994126750 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:09:06:04 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 140 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [10/Sep/2026:09:06:04 +1000] "GET /factory_session_joiner.php?id=35256 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [10/Sep/2026:09:06:05 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:06:04 +1000] "GET /heartbeat.php?sentAt=1788995164&bytes=106,161,230,92&_=1788987691510 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:09:06:10 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:06:10 +1000] "GET /heartbeat.php?sentAt=1788995171&bytes=106,161,230,99&_=1788957670831 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:09:06:12 +1000] "GET /heartbeat.php?sentAt=1788995170&bytes=106,161,230,98&_=1788994126751 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-09-10 09:05:10 L1=1.68 run=3 blk=0 avail=6257 (45.4%) swpO=0 conn=15 myRSS=2893 php=84 phpRSS=3205 ap=153 tcp=164 topuser=evolution 2026-09-10 09:05:13 L1=1.68 run=2 blk=0 avail=6223 (45.2%) swpO=0 conn=16 myRSS=2893 php=87 phpRSS=3322 ap=153 tcp=154 topuser=evolution 2026-09-10 09:05:20 L1=1.58 run=2 blk=0 avail=6308 (45.8%) swpO=0 conn=15 myRSS=2893 php=89 phpRSS=3299 ap=153 tcp=143 topuser=evolution 2026-09-10 09:05:23 L1=1.58 run=2 blk=0 avail=6271 (45.5%) swpO=0 conn=16 myRSS=2893 php=92 phpRSS=3415 ap=153 tcp=141 topuser=evolution 2026-09-10 09:05:30 L1=1.49 run=4 blk=0 avail=6161 (44.7%) swpO=1 conn=16 myRSS=2893 php=93 phpRSS=3558 ap=153 tcp=132 topuser=evolution 2026-09-10 09:05:33 L1=1.49 run=2 blk=0 avail=6177 (44.8%) swpO=1 conn=15 myRSS=2893 php=92 phpRSS=3507 ap=153 tcp=114 topuser=evolution 2026-09-10 09:05:40 L1=1.97 run=7 blk=0 avail=5442 (39.5%) swpO=1296 conn=19 myRSS=2863 php=99 phpRSS=4134 ap=146 tcp=116 topuser=evolution 2026-09-10 09:05:44 L1=1.97 run=2 blk=0 avail=6266 (45.5%) swpO=1178 conn=16 myRSS=2863 php=95 phpRSS=3619 ap=143 tcp=102 topuser=evolution 2026-09-10 09:05:50 L1=1.82 run=2 blk=0 avail=6389 (46.4%) swpO=0 conn=16 myRSS=2863 php=97 phpRSS=3601 ap=136 tcp=92 topuser=evolution 2026-09-10 09:05:54 L1=1.82 run=2 blk=0 avail=6400 (46.5%) swpO=0 conn=16 myRSS=2863 php=98 phpRSS=3639 ap=133 tcp=98 topuser=evolution 2026-09-10 09:06:00 L1=1.77 run=3 blk=0 avail=6272 (45.5%) swpO=0 conn=16 myRSS=2863 php=102 phpRSS=3882 ap=130 tcp=102 topuser=evolution 2026-09-10 09:06:04 L1=1.77 run=2 blk=0 avail=6212 (45.1%) swpO=0 conn=16 myRSS=2863 php=105 phpRSS=4001 ap=134 tcp=109 topuser=evolution 2026-09-10 09:06:10 L1=2.20 run=7 blk=0 avail=5566 (40.4%) swpO=0 conn=23 myRSS=2863 php=122 phpRSS=4999 ap=147 tcp=104 topuser=evolution 2026-09-10 09:06:14 L1=2.20 run=3 blk=0 avail=5920 (43.0%) swpO=0 conn=18 myRSS=2863 php=115 phpRSS=4464 ap=147 tcp=105 topuser=evolution 2026-09-10 09:06:20 L1=2.09 run=4 blk=0 avail=5981 (43.4%) swpO=0 conn=17 myRSS=2863 php=125 phpRSS=4670 ap=146 tcp=90 topuser=evolution 2026-09-10 09:06:24 L1=2.09 run=3 blk=0 avail=5855 (42.5%) swpO=0 conn=17 myRSS=2863 php=131 phpRSS=4900 ap=153 tcp=94 topuser=evolution 2026-09-10 09:06:30 L1=1.92 run=4 blk=0 avail=5631 (40.9%) swpO=0 conn=16 myRSS=2863 php=143 phpRSS=5453 ap=153 tcp=195 topuser=evolution 2026-09-10 09:06:34 L1=1.92 run=3 blk=0 avail=5583 (40.5%) swpO=0 conn=18 myRSS=2863 php=146 phpRSS=5585 ap=153 tcp=201 topuser=evolution 2026-09-10 09:06:40 L1=1.85 run=2 blk=0 avail=5577 (40.5%) swpO=0 conn=17 myRSS=2863 php=145 phpRSS=5548 ap=153 tcp=209 topuser=evolution 2026-09-10 09:06:45 L1=1.79 run=2 blk=0 avail=5580 (40.5%) swpO=0 conn=17 myRSS=2863 php=145 phpRSS=5548 ap=153 tcp=210 topuser=evolution 2026-09-10 09:06:50 L1=1.72 run=2 blk=0 avail=5684 (41.3%) swpO=0 conn=17 myRSS=2863 php=144 phpRSS=5416 ap=153 tcp=208 topuser=evolution 2026-09-10 09:06:55 L1=1.66 run=2 blk=0 avail=5678 (41.2%) swpO=0 conn=17 myRSS=2863 php=144 phpRSS=5416 ap=153 tcp=207 topuser=evolution 2026-09-10 09:07:01 L1=1.69 run=2 blk=0 avail=5677 (41.2%) swpO=0 conn=17 myRSS=2863 php=144 phpRSS=5416 ap=153 tcp=202 topuser=evolution 2026-09-10 09:07:05 L1=1.64 run=2 blk=0 avail=5676 (41.2%) swpO=0 conn=17 myRSS=2863 php=144 phpRSS=5416 ap=153 tcp=196 topuser=evolution 2026-09-10 09:07:11 L1=1.58 run=2 blk=0 avail=5680 (41.2%) swpO=0 conn=17 myRSS=2863 php=144 phpRSS=5416 ap=153 tcp=194 topuser=evolution 2026-09-10 09:07:15 L1=1.54 run=2 blk=0 avail=5678 (41.2%) swpO=0 conn=17 myRSS=2863 php=144 phpRSS=5416 ap=153 tcp=193 topuser=evolution 2026-09-10 09:07:21 L1=1.49 run=2 blk=0 avail=5674 (41.2%) swpO=0 conn=18 myRSS=2863 php=144 phpRSS=5416 ap=153 tcp=179 topuser=evolution 2026-09-10 09:07:25 L1=1.45 run=5 blk=0 avail=5673 (41.2%) swpO=0 conn=18 myRSS=2863 php=144 phpRSS=5416 ap=153 tcp=178 topuser=evolution 2026-09-10 09:07:31 L1=1.42 run=2 blk=0 avail=5678 (41.2%) swpO=0 conn=18 myRSS=2863 php=144 phpRSS=5416 ap=153 tcp=174 topuser=evolution 2026-09-10 09:07:35 L1=1.38 run=2 blk=0 avail=5676 (41.2%) swpO=0 conn=18 myRSS=2863 php=144 phpRSS=5416 ap=153 tcp=169 topuser=evolution