INCIDENT 2026-09-10 09:09:42 trigger: php_procs=25 mysql_conn=15 ================================================================== load: 2.02 1.83 1.68 2/723 888778 ncpu:10 mem_avail: 7132MB/13777MB (51.8%) swap_used:1523MB swapout:0/s blocked(D):0 running:2 iowait:0.1% steal:0.0% php: 25 procs / 1092MB heaviest user: evolution (22 procs, 817MB) apache: 112 procs tcp_estab: 48 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2864 nobody 111 2078 root 244 1069 evolution 27 834 madalice 2 273 netdata 8 256 mailman 20 186 dovenull 6 66 wp-toolkit 3 62 cpanellogin 1 55 kurri 3 42 dovecot 3 28 mailnull 3 24 polkitd 1 15 corpkicks 1 14 lowrange 1 11 zabbix 1 9 nscd 1 6 named 1 5 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB evolution 22 817 madalice 2 273 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4761 MB Active(file): 3757 MB Inactive(file): 1100 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 586 MB CommitLimit: 10984 MB Committed_AS: 9510 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 849368 root 09:41 3096 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 9-06:47:17 3892 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 2932744 13.5 Ssl 2-04:24:14 /usr/sbin/mariadbd 166870 1 netdata 199352 2.7 Ssl 4-06:47:23 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3701672 3652415 root 175416 0.0 S 06:34:29 spamd child 3701673 3652415 root 164716 0.0 S 06:34:29 spamd child 3652415 1 root 162076 0.0 Ss 06:44:50 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 888469 167896 madalice 158340 17.7 S 00:25 php-fpm: pool madalice_com_au 2328754 1 root 156120 0.0 Ss 2-04:24:24 /usr/lib/systemd/systemd-journald 888579 167896 madalice 121276 7.4 S 00:19 php-fpm: pool madalice_com_au 509236 509098 root 66780 0.0 Sl 13-06:50:03 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 888409 866047 evolution 58416 0.3 S 00:30 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888387 868596 evolution 57844 0.4 S 00:34 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888536 848499 evolution 57820 0.5 S 00:21 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 625148 1353308 cpanellogin 56684 0.0 S 01:12:32 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 888467 867897 evolution 44036 0.1 S 00:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 42528 0.0 Ss 50-06:28:29 cpsrvd (SSL) - waiting for connections 888406 868533 evolution 41720 0.1 S 00:30 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 41248 0.1 Ss 72-22:59:58 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 888616 866145 evolution 38872 0.2 S 00:15 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888545 848614 evolution 38620 0.2 S 00:20 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888662 864316 evolution 38612 0.3 S 00:11 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888744 885260 evolution 38604 2.0 S 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888657 885043 evolution 38596 0.3 S 00:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888666 868976 evolution 38592 0.4 S 00:10 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888706 846219 evolution 38588 0.3 S 00:08 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888540 848618 evolution 38572 0.2 S 00:20 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888643 868983 evolution 38564 0.3 S 00:14 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888664 864248 evolution 38556 0.3 S 00:11 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888399 867381 evolution 38544 0.1 S 00:32 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888708 848497 evolution 38540 0.5 S 00:07 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888400 868943 evolution 38516 0.1 S 00:32 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888656 868492 evolution 38488 0.3 S 00:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 167562 166914 netdata 37096 0.1 Sl 4-06:47:18 /usr/libexec/netdata/plugins.d/go.d.plugin 1 888404 885261 evolution 36704 0.0 S 00:31 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2495258 1 wp-toolkit 36348 0.0 Ss 1-07:55:48 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 3651775 1 root 31800 0.0 Ss 06:45:24 lfd - sleeping 2495169 1 wp-toolkit 24916 0.0 Ss 1-07:55:48 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 847091 506832 nobody 24232 0.0 S 12:02 /usr/sbin/httpd -k start 868948 506832 nobody 24196 0.1 S 05:05 /usr/sbin/httpd -k start 868943 506832 nobody 23512 0.0 S 05:07 /usr/sbin/httpd -k start 830314 506832 nobody 23468 0.0 S 14:52 /usr/sbin/httpd -k start 868959 506832 nobody 23396 0.0 S 05:04 /usr/sbin/httpd -k start 848494 506832 nobody 23184 0.0 S 10:33 /usr/sbin/httpd -k start 885261 506832 nobody 22976 0.1 S 03:17 /usr/sbin/httpd -k start 885260 506832 nobody 22716 0.0 S 03:17 /usr/sbin/httpd -k start 868976 506832 nobody 22576 0.1 S 05:03 /usr/sbin/httpd -k start 868951 506832 nobody 22484 0.1 S 05:05 /usr/sbin/httpd -k start 848617 506832 nobody 22372 0.0 S 10:24 /usr/sbin/httpd -k start 848575 506832 nobody 22308 0.0 S 10:27 /usr/sbin/httpd -k start 868492 506832 nobody 22220 0.0 S 05:23 /usr/sbin/httpd -k start 885262 506832 nobody 22188 0.0 S 03:17 /usr/sbin/httpd -k start 865758 506832 nobody 22024 0.0 S 08:10 /usr/sbin/httpd -k start 868599 506832 nobody 22008 0.0 S 05:19 /usr/sbin/httpd -k start 846055 506832 nobody 21664 0.0 S 13:23 /usr/sbin/httpd -k start 868978 506832 nobody 21644 0.0 S 05:03 /usr/sbin/httpd -k start 848597 506832 nobody 21636 0.0 S 10:25 /usr/sbin/httpd -k start 848618 506832 nobody 21564 0.0 S 10:24 /usr/sbin/httpd -k start 866399 506832 nobody 21388 0.0 S 07:26 /usr/sbin/httpd -k start 848598 506832 nobody 21240 0.0 S 10:25 /usr/sbin/httpd -k start 865072 506832 nobody 21164 0.0 S 08:37 /usr/sbin/httpd -k start 867900 506832 nobody 21140 0.0 S 06:08 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9050623 | claude | 108-1481181613 | Execute | 57 | Sending data | SELECT COUNT(*) AS n FROM `contacts` c WHERE DATEDIFF(CURDATE(), (SELECT MAX(NULLIF(j.`dateadded`, '0000-00-00')) FROM `jobs` j JOIN `customextrameta` m ON m.`metaname` LIKE CONCAT('shopify-%-job-', j.`id`, '-orderid') WHERE j.`clientid` = c.`clientid`)) <= 90 | | 9066039 | root | 108-1481181613 | Execute | 33 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9066050 | root | 108-1481181613 | Execute | 32 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9066049 | root | 108-1481181613 | Execute | 32 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9066085 | root | 108-1481181613 | Execute | 30 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.nextaction) as diff,contacts.company FROM jobs,contacts where jobs.clientid=contacts.clientid and jobs.nextaction<'2026-09-10' and jobs.status='1' AND jobs.nextaction!='0000-00-00' ORDER BY diff desc | | 9066058 | root | 108-1481181613 | Execute | 30 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='5' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.complete group by jobid | | 9066756 | root | 108-1481181613 | Execute | 25 | Waiting for table level lock | SELECT * FROM jobs WHERE id = ? | | 9066954 | root | 108-1481181613 | Execute | 20 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9067014 | root | 108-1481181613 | Execute | 19 | Waiting for table level lock | select * from jobs where clientid=? and status>'0' | | 9067200 | root | 108-1481181613 | Execute | 11 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9067202 | root | 108-1481181613 | Execute | 10 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9067239 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9066039 | 108-1481181613 | 33 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9066050 | 108-1481181613 | 32 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9066049 | 108-1481181613 | 32 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9066085 | 108-1481181613 | 30 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.nextaction) as diff,contacts.company FROM jobs,contacts where jobs.clientid=contacts.clientid and jobs.nextaction<'2026-09-10' and jobs.status='1' AN | | 9066058 | 108-1481181613 | 30 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='5' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.comple | | 9066756 | 108-1481181613 | 26 | Waiting for table level lock | SELECT * FROM jobs WHERE id = ? | | 9066954 | 108-1481181613 | 20 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9067014 | 108-1481181613 | 19 | Waiting for table level lock | select * from jobs where clientid=? and status>'0' | | 9067200 | 108-1481181613 | 11 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9067202 | 108-1481181613 | 10 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 438 evolution/app.evolutionerp.com.au-ssl_log 147 evolution/portal.evolutionerp.com.au-ssl_log 72 madalice/madalice.com.au-ssl_log 12 evolution/pdev.evolutionerp.com.au-ssl_log 9 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 260 203.54.180.238 147 40.115.94.245 62 182.239.240.254 42 150.228.151.88 37 103.104.165.99 36 180.181.236.49 29 203.54.162.106 13 165.225.233.87 11 1.144.107.82 9 49.179.54.99 5 103.104.164.114 4 207.46.13.141 3 1.145.125.62 2 65.55.210.3 2 172.105.25.110 --- top request paths across all vhosts (last 3 min) --- 227 POST /functions.php 87 GET /api/getItem/LWFBW2001KG 69 GET /app/ajax.php 60 GET /api/getItem/LWPG2001KG 35 GET /index.php 30 GET /heartbeat.php 17 POST /app/ajax/selectFilter.php 12 POST /app/ajax.php 12 GET /factory_session_checker.php 10 POST /plugins/csvexporter/plugin.php 10 POST /app/ajax/selectFilterSingle.php 8 GET / 7 POST //functions.php 7 GET /factory_session_processed_qty.php 7 GET /factory_session_joiner.php 6 POST /clienteditsave.php 6 GET //app/ajax.php 5 POST /quoteditsave.php 5 POST /invoiceaddsave.php 5 POST /inveditsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 227 POST /functions.php 69 GET /app/ajax.php 25 GET /index.php 17 POST /app/ajax/selectFilter.php 12 POST /app/ajax.php 10 POST /plugins/csvexporter/plugin.php 10 POST /app/ajax/selectFilterSingle.php 7 POST //functions.php 6 POST /clienteditsave.php 6 GET //app/ajax.php 5 POST /quoteditsave.php 5 POST /invoiceaddsave.php -- last 10 requests -- 103.104.165.99 - - [10/Sep/2026:09:09:26 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 973 "https://my.evolutionerp.com.au/index.php?page=opportunityedit&opportunityid=3227" "Mozilla/5.0 (Windows NT 10.0; Win6 150.228.151.88 - - [10/Sep/2026:09:09:27 +1000] "POST /inveditsave.php?call=fetch_inventory HTTP/1.1" 200 4605 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 182.239.240.254 - - [10/Sep/2026:09:09:27 +1000] "POST //functions.php?call=heartbeat HTTP/1.1" 200 233 "https://my.evolutionerp.com.au//index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, li 103.104.165.99 - - [10/Sep/2026:09:09:27 +1000] "POST /app/ajax/selectFilter.php?call=filterstaffandcontractors&filter=&cursel=&curseltext=&fromMS=1&&nolimit=LIMIT%201000&excludelabour=1&include=89&clientid=1751&contacti 150.228.151.88 - - [10/Sep/2026:09:09:28 +1000] "POST /inveditsave.php?call=fetch_inventory HTTP/1.1" 200 3235 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 103.104.165.99 - - [10/Sep/2026:09:09:28 +1000] "POST /app/ajax.php?cn=&furi=true&uri=page%3Dopportunityedit%26opportunityid%3D3227 HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=opportunityedit&opportun 182.239.240.254 - - [10/Sep/2026:09:09:29 +1000] "POST //functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au//index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ 150.228.151.88 - - [10/Sep/2026:09:09:30 +1000] "POST /inveditsave.php?call=fetch_inventory HTTP/1.1" 200 3235 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb 180.181.236.49 - - [10/Sep/2026:09:09:30 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Ch 150.228.151.88 - - [10/Sep/2026:09:09:30 +1000] "POST /inveditsave.php?call=fetch_inventory HTTP/1.1" 200 3235 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 87 GET /api/getItem/LWFBW2001KG 60 GET /api/getItem/LWPG2001KG -- last 10 requests -- 40.115.94.245 - - [10/Sep/2026:09:09:16 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:09:17 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:09:17 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:09:17 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:09:17 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:09:17 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:09:17 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:09:18 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:09:18 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:09:18 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 30 GET /heartbeat.php 12 GET /factory_session_checker.php 9 GET /index.php 7 GET /factory_session_processed_qty.php 7 GET /factory_session_joiner.php 4 POST /portal/register 2 POST /factory_functions.php 1 GET / -- last 10 requests -- 203.54.180.238 - - [10/Sep/2026:09:09:13 +1000] "GET /factory_session_joiner.php?id=35256 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [10/Sep/2026:09:09:13 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:09:13 +1000] "GET /heartbeat.php?sentAt=1788995353&bytes=106,161,231,25&_=1788995342810 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=5" 203.54.180.238 - - [10/Sep/2026:09:09:14 +1000] "GET /heartbeat.php?sentAt=1788995354&bytes=106,161,231,26&_=1788987691529 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:09:09:15 +1000] "POST /factory_functions.php?factory_session_create HTTP/1.1" 302 20 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=5" "Mozilla/5.0 (Linux; A 203.54.180.238 - - [10/Sep/2026:09:09:18 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:09:21 +1000] "GET /heartbeat.php?sentAt=1788995361&bytes=106,161,231,33&_=1788957670850 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:09:09:22 +1000] "GET /heartbeat.php?sentAt=1788995360&bytes=106,161,231,32&_=1788994126770 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:09:09:23 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 140 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [10/Sep/2026:09:09:23 +1000] "GET /factory_session_joiner.php?id=35256 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe --- last 30 samples (run-up to this incident) --- 2026-09-10 09:07:15 L1=1.54 run=2 blk=0 avail=5678 (41.2%) swpO=0 conn=17 myRSS=2863 php=144 phpRSS=5416 ap=153 tcp=193 topuser=evolution 2026-09-10 09:07:21 L1=1.49 run=2 blk=0 avail=5674 (41.2%) swpO=0 conn=18 myRSS=2863 php=144 phpRSS=5416 ap=153 tcp=179 topuser=evolution 2026-09-10 09:07:25 L1=1.45 run=5 blk=0 avail=5673 (41.2%) swpO=0 conn=18 myRSS=2863 php=144 phpRSS=5416 ap=153 tcp=178 topuser=evolution 2026-09-10 09:07:31 L1=1.42 run=2 blk=0 avail=5678 (41.2%) swpO=0 conn=18 myRSS=2863 php=144 phpRSS=5416 ap=153 tcp=174 topuser=evolution 2026-09-10 09:07:35 L1=1.38 run=2 blk=0 avail=5676 (41.2%) swpO=0 conn=18 myRSS=2863 php=144 phpRSS=5416 ap=153 tcp=169 topuser=evolution 2026-09-10 09:07:41 L1=1.35 run=2 blk=0 avail=5677 (41.2%) swpO=0 conn=18 myRSS=2863 php=144 phpRSS=5416 ap=153 tcp=173 topuser=evolution 2026-09-10 09:07:45 L1=1.41 run=4 blk=0 avail=5383 (39.1%) swpO=0 conn=20 myRSS=2863 php=146 phpRSS=5760 ap=153 tcp=174 topuser=evolution 2026-09-10 09:07:51 L1=1.37 run=2 blk=0 avail=5425 (39.4%) swpO=0 conn=18 myRSS=2863 php=146 phpRSS=5701 ap=153 tcp=173 topuser=evolution 2026-09-10 09:07:55 L1=1.34 run=2 blk=0 avail=5395 (39.2%) swpO=0 conn=20 myRSS=2863 php=148 phpRSS=5780 ap=153 tcp=168 topuser=evolution 2026-09-10 09:08:01 L1=1.31 run=3 blk=0 avail=5407 (39.2%) swpO=0 conn=18 myRSS=2863 php=147 phpRSS=5720 ap=153 tcp=157 topuser=evolution 2026-09-10 09:08:06 L1=1.29 run=2 blk=0 avail=5419 (39.3%) swpO=0 conn=18 myRSS=2863 php=147 phpRSS=5724 ap=153 tcp=156 topuser=evolution 2026-09-10 09:08:11 L1=1.27 run=2 blk=0 avail=5532 (40.2%) swpO=0 conn=18 myRSS=2863 php=146 phpRSS=5584 ap=153 tcp=150 topuser=evolution 2026-09-10 09:08:16 L1=1.24 run=2 blk=0 avail=5530 (40.1%) swpO=0 conn=18 myRSS=2863 php=145 phpRSS=5568 ap=153 tcp=143 topuser=evolution 2026-09-10 09:08:21 L1=1.22 run=2 blk=0 avail=5535 (40.2%) swpO=0 conn=18 myRSS=2863 php=145 phpRSS=5568 ap=153 tcp=131 topuser=evolution 2026-09-10 09:08:26 L1=1.21 run=2 blk=0 avail=5522 (40.1%) swpO=0 conn=18 myRSS=2863 php=146 phpRSS=5589 ap=153 tcp=129 topuser=evolution 2026-09-10 09:08:31 L1=1.19 run=2 blk=0 avail=5508 (40.0%) swpO=0 conn=19 myRSS=2863 php=147 phpRSS=5629 ap=153 tcp=134 topuser=evolution 2026-09-10 09:08:36 L1=1.97 run=8 blk=0 avail=6113 (44.4%) swpO=0 conn=11 myRSS=2863 php=67 phpRSS=2853 ap=153 tcp=154 topuser=evolution 2026-09-10 09:08:41 L1=2.14 run=6 blk=0 avail=6245 (45.3%) swpO=0 conn=7 myRSS=2863 php=49 phpRSS=2282 ap=153 tcp=117 topuser=evolution 2026-09-10 09:08:46 L1=2.37 run=8 blk=0 avail=6533 (47.4%) swpO=0 conn=10 myRSS=2863 php=34 phpRSS=1653 ap=148 tcp=89 topuser=evolution 2026-09-10 09:08:51 L1=2.50 run=3 blk=0 avail=7017 (50.9%) swpO=0 conn=7 myRSS=2863 php=14 phpRSS=677 ap=143 tcp=77 topuser=evolution 2026-09-10 09:08:56 L1=2.46 run=3 blk=0 avail=7163 (52.0%) swpO=0 conn=10 myRSS=2863 php=5 phpRSS=318 ap=138 tcp=60 topuser=madalice 2026-09-10 09:09:01 L1=2.34 run=3 blk=0 avail=7329 (53.2%) swpO=0 conn=7 myRSS=2863 php=4 phpRSS=160 ap=133 tcp=56 topuser=madalice 2026-09-10 09:09:06 L1=2.55 run=3 blk=1 avail=7349 (53.3%) swpO=0 conn=4 myRSS=2863 php=5 phpRSS=198 ap=128 tcp=59 topuser=madalice 2026-09-10 09:09:11 L1=2.43 run=4 blk=0 avail=7339 (53.3%) swpO=0 conn=7 myRSS=2863 php=11 phpRSS=458 ap=123 tcp=55 topuser=evolution 2026-09-10 09:09:16 L1=2.31 run=6 blk=0 avail=7386 (53.6%) swpO=0 conn=4 myRSS=2863 php=11 phpRSS=417 ap=118 tcp=161 topuser=evolution 2026-09-10 09:09:21 L1=2.21 run=10 blk=1 avail=7127 (51.7%) swpO=0 conn=7 myRSS=2863 php=19 phpRSS=805 ap=132 tcp=76 topuser=evolution 2026-09-10 09:09:26 L1=2.11 run=2 blk=0 avail=7122 (51.7%) swpO=0 conn=4 myRSS=2864 php=16 phpRSS=752 ap=127 tcp=57 topuser=evolution 2026-09-10 09:09:32 L1=2.02 run=5 blk=0 avail=7094 (51.5%) swpO=0 conn=15 myRSS=2864 php=22 phpRSS=978 ap=122 tcp=49 topuser=evolution 2026-09-10 09:09:36 L1=2.02 run=4 blk=0 avail=7107 (51.6%) swpO=0 conn=4 myRSS=2864 php=24 phpRSS=1054 ap=117 tcp=59 topuser=evolution 2026-09-10 09:09:42 L1=2.02 run=2 blk=0 avail=7132 (51.8%) swpO=0 conn=15 myRSS=2864 php=25 phpRSS=1092 ap=112 tcp=48 topuser=evolution