INCIDENT 2026-09-10 09:10:42 trigger: php_procs=72 php_rss=2945MB mysql_conn=21 ================================================================== load: 2.41 1.97 1.74 2/747 904233 ncpu:10 mem_avail: 6687MB/13777MB (48.5%) swap_used:1523MB swapout:0/s blocked(D):0 running:2 iowait:0.2% steal:0.0% php: 72 procs / 2945MB heaviest user: evolution (69 procs, 2632MB) apache: 94 procs tcp_estab: 74 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2864 evolution 74 2649 nobody 93 1724 root 245 1054 madalice 2 310 netdata 8 257 mailman 20 186 dovenull 6 66 wp-toolkit 3 62 cpanellogin 1 55 kurri 3 42 dovecot 3 28 polkitd 1 15 candyfabcom 1 13 zabbix 1 9 nscd 1 6 named 1 5 cpanelconnecttrack 1 4 mailnull 1 2 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 69 2632 madalice 2 310 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4946 MB Active(file): 3826 MB Inactive(file): 1164 MB Dirty: 3 MB Writeback: 0 MB SReclaimable: 585 MB CommitLimit: 10984 MB Committed_AS: 12868 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 849368 root 10:42 3096 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 9-06:48:18 3892 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 2932812 13.5 Ssl 2-04:25:15 /usr/sbin/mariadbd 166870 1 netdata 200744 2.7 Ssl 4-06:48:24 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3701672 3652415 root 175416 0.0 S 06:35:30 spamd child 3701673 3652415 root 164716 0.0 S 06:35:30 spamd child 3652415 1 root 162076 0.0 Ss 06:45:51 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 889126 167896 madalice 159436 7.7 S 00:44 php-fpm: pool madalice_com_au 889129 167896 madalice 158996 8.3 S 00:44 php-fpm: pool madalice_com_au 2328754 1 root 156120 0.0 Ss 2-04:25:25 /usr/lib/systemd/systemd-journald 509236 509098 root 66780 0.0 Sl 13-06:51:04 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 888409 866047 evolution 58416 0.1 S 01:31 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 889120 885262 evolution 58216 0.2 S 00:45 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888387 868596 evolution 57844 0.1 S 01:35 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888536 848499 evolution 57820 0.1 S 01:22 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 625148 1353308 cpanellogin 56684 0.0 S 01:13:33 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 904189 904059 evolution 56092 2.3 S 00:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888467 867897 evolution 44036 0.0 S 01:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 42528 0.0 Ss 50-06:29:30 cpsrvd (SSL) - waiting for connections 888406 868533 evolution 41720 0.0 S 01:31 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 41248 0.1 Ss 72-23:00:59 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 889280 888523 evolution 40632 0.1 S 00:40 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904203 885252 evolution 40576 4.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 888981 868532 evolution 40336 0.0 S 00:59 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 898112 848494 evolution 39332 0.0 S 00:34 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903825 866425 evolution 39308 0.1 S 00:30 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904040 903951 evolution 39284 0.1 S 00:12 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903854 865758 evolution 39276 0.0 S 00:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904149 888528 evolution 39272 0.3 S 00:06 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903952 868986 evolution 39268 0.1 S 00:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904182 904079 evolution 39264 0.4 S 00:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 889079 847091 evolution 39252 0.0 S 00:49 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904117 904044 evolution 39252 0.2 S 00:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904121 885263 evolution 39252 0.2 S 00:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903861 868553 evolution 39232 0.0 S 00:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 889085 866136 evolution 39228 0.0 S 00:48 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904147 904081 evolution 39228 0.3 S 00:06 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904048 868525 evolution 39212 0.1 S 00:12 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903865 868275 evolution 39200 0.1 S 00:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904148 865041 evolution 39196 0.3 S 00:06 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903955 864318 evolution 39172 0.1 S 00:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903959 867884 evolution 39172 0.1 S 00:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904184 868981 evolution 39108 0.4 S 00:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904151 904078 evolution 39000 0.3 S 00:06 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 888616 866145 evolution 38872 0.0 S 01:16 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 889208 864164 evolution 38636 0.0 S 00:41 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 902172 868599 evolution 38636 0.0 S 00:32 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888989 885042 evolution 38628 0.0 S 00:56 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 904053 866399 evolution 38628 0.1 S 00:11 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888545 848614 evolution 38620 0.0 S 01:21 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 904118 868951 evolution 38616 0.3 S 00:10 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888662 864316 evolution 38612 0.0 S 01:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888744 885260 evolution 38604 0.0 S 01:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 889033 864206 evolution 38600 0.0 S 00:52 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888657 885043 evolution 38596 0.0 S 01:13 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888666 868976 evolution 38592 0.0 S 01:11 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888706 846219 evolution 38588 0.0 S 01:09 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 889138 867896 evolution 38576 0.0 S 00:41 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 903864 888522 evolution 38576 0.0 S 00:27 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888540 848618 evolution 38572 0.0 S 01:21 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888643 868983 evolution 38564 0.0 S 01:15 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888664 864248 evolution 38556 0.0 S 01:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9050623 | claude | 108-1481181613 | Execute | 118 | Sending data | SELECT COUNT(*) AS n FROM `contacts` c WHERE DATEDIFF(CURDATE(), (SELECT MAX(NULLIF(j.`dateadded`, '0000-00-00')) FROM `jobs` j JOIN `customextrameta` m ON m.`metaname` LIKE CONCAT('shopify-%-job-', j.`id`, '-orderid') WHERE j.`clientid` = c.`clientid`)) <= 90 | | 9066039 | root | 108-1481181613 | Execute | 94 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9066050 | root | 108-1481181613 | Execute | 93 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9066049 | root | 108-1481181613 | Execute | 93 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9066085 | root | 108-1481181613 | Execute | 91 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.nextaction) as diff,contacts.company FROM jobs,contacts where jobs.clientid=contacts.clientid and jobs.nextaction<'2026-09-10' and jobs.status='1' AND jobs.nextaction!='0000-00-00' ORDER BY diff desc | | 9066058 | root | 108-1481181613 | Execute | 91 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='5' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.complete group by jobid | | 9066756 | root | 108-1481181613 | Execute | 86 | Waiting for table level lock | SELECT * FROM jobs WHERE id = ? | | 9066954 | root | 108-1481181613 | Execute | 81 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9067014 | root | 108-1481181613 | Execute | 79 | Waiting for table level lock | select * from jobs where clientid=? and status>'0' | | 9067202 | root | 108-1481181613 | Execute | 71 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9067200 | root | 108-1481181613 | Execute | 71 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9067250 | root | 108-1481181613 | Execute | 57 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9067330 | root | 108-1481181613 | Execute | 45 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.dateadded) as diff,contacts.company from jobs,contacts where jobs.clientid=contacts.clientid AND jobs.branch='3' AND jobs.status='1' AND new_flag='1' order by dateadded desc | | 9067346 | root | 108-1481181613 | Execute | 40 | Waiting for table level lock | SELECT picking.*,jobs.reference as jreference,jobs.company, (select sum(qty) from pickingitems where pickingid = picking.id) as qty, (select sum(picked) from pickingitems where pickingid = picking.id) as picked from picking,jobs where picking.jobid=jobs.id AND jobs.branch='3' AND picking.stat | | 9067634 | root | 108-1481181613 | Execute | 31 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9068272 | root | 108-1481181613 | Execute | 3 | Waiting for table level lock | SELECT staff.* FROM staff WHERE staff.status > '0' AND staff.id IN (SELECT DISTINCT pmId FROM jobs WHERE pmId > 0) ORDER BY staff.firstname | | 9068303 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9066039 | 108-1481181613 | 94 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9066050 | 108-1481181613 | 93 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9066049 | 108-1481181613 | 93 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9066085 | 108-1481181613 | 91 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.nextaction) as diff,contacts.company FROM jobs,contacts where jobs.clientid=contacts.clientid and jobs.nextaction<'2026-09-10' and jobs.status='1' AN | | 9066058 | 108-1481181613 | 91 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='5' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.comple | | 9066756 | 108-1481181613 | 86 | Waiting for table level lock | SELECT * FROM jobs WHERE id = ? | | 9066954 | 108-1481181613 | 81 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9067014 | 108-1481181613 | 79 | Waiting for table level lock | select * from jobs where clientid=? and status>'0' | | 9067202 | 108-1481181613 | 71 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9067200 | 108-1481181613 | 71 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9067250 | 108-1481181613 | 57 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9067330 | 108-1481181613 | 45 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.dateadded) as diff,contacts.company from jobs,contacts where jobs.clientid=contacts.clientid AND jobs.branch='3' AND jobs.status='1' AND new_flag='1' orde | | 9067346 | 108-1481181613 | 40 | Waiting for table level lock | SELECT picking.*,jobs.reference as jreference,jobs.company, (select sum(qty) from pickingitems where pickingid = picking.id) as qty, (select sum(picked) from pickingitems where pickingid = picking.id) | | 9067634 | 108-1481181613 | 31 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9068272 | 108-1481181613 | 3 | Waiting for table level lock | SELECT staff.* FROM staff WHERE staff.status > '0' AND staff.id IN (SELECT DISTINCT pmId FROM jobs WHERE pmId > 0) ORDER BY staff.firstname | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 525 evolution/app.evolutionerp.com.au-ssl_log 165 evolution/portal.evolutionerp.com.au-ssl_log 108 aaa/aaadownunder.com.au-ssl_log 39 madalice/madalice.com.au-ssl_log 12 evolution/pdev.evolutionerp.com.au-ssl_log 9 alison/alisonarts.com.au-ssl_log 2 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 309 203.54.180.238 165 40.115.94.245 78 150.228.151.88 73 182.239.240.254 58 180.181.236.49 53 103.104.165.99 37 203.54.162.106 17 165.225.233.87 17 1.144.107.82 9 49.179.54.99 8 103.104.164.114 6 1.145.125.62 5 207.46.13.141 5 147.161.213.71 2 65.55.210.3 --- top request paths across all vhosts (last 3 min) --- 268 POST /functions.php 147 GET /api/getItem/LWFBW2001KG 77 GET /app/ajax.php 45 GET /heartbeat.php 40 GET /index.php 23 GET /factory_session_checker.php 20 POST /app/ajax/selectFilter.php 18 GET /api/getItem/LWPG2001KG 14 POST /inveditsave.php 13 POST /app/ajax.php 12 POST /plugins/csvexporter/plugin.php 12 GET /factory_session_processed_qty.php 12 GET /factory_session_joiner.php 11 POST /app/ajax/selectFilterSingle.php 11 GET / 10 POST //functions.php 6 POST /quoteditsave.php 6 POST /clienteditsave.php 6 GET //app/ajax.php 5 POST /invoiceaddsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 268 POST /functions.php 77 GET /app/ajax.php 30 GET /index.php 20 POST /app/ajax/selectFilter.php 14 POST /inveditsave.php 13 POST /app/ajax.php 12 POST /plugins/csvexporter/plugin.php 11 POST /app/ajax/selectFilterSingle.php 10 POST //functions.php 7 GET / 6 POST /quoteditsave.php 6 POST /clienteditsave.php -- last 10 requests -- 103.104.165.99 - - [10/Sep/2026:09:10:37 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=36314" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 150.228.151.88 - - [10/Sep/2026:09:10:37 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinventory&call=getUserSetting&caller=ajaxSubmitLocal&seq=15701153871 HTTP/1.1" 200 91 "https://my.evolutionerp.com.au/index.php? 150.228.151.88 - - [10/Sep/2026:09:10:37 +1000] "POST /inveditsave.php?call=fetch_inventory HTTP/1.1" 200 11383 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe 150.228.151.88 - - [10/Sep/2026:09:10:38 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 150.228.151.88 - - [10/Sep/2026:09:10:38 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 103.104.164.114 - - [10/Sep/2026:09:10:38 +1000] "POST //functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au//index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, li 203.54.162.106 - - [10/Sep/2026:09:10:39 +1000] "POST /login2save.php HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page%3Djobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, l 103.104.165.99 - - [10/Sep/2026:09:10:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 975 "https://my.evolutionerp.com.au/index.php?page=opportunityedit&opportunityid=3227" "Mozilla/5.0 (Windows NT 10.0; Win6 103.104.165.99 - - [10/Sep/2026:09:10:39 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=opportunities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5 150.228.151.88 - - [10/Sep/2026:09:10:40 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=PALIS HTTP/1.1" 200 13041 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2035" "Mozilla/5.0 (Windows == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 147 GET /api/getItem/LWFBW2001KG 18 GET /api/getItem/LWPG2001KG -- last 10 requests -- 40.115.94.245 - - [10/Sep/2026:09:10:29 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:10:29 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:10:29 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:10:30 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:10:30 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:10:30 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:10:30 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:10:30 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:10:30 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:10:31 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 45 GET /heartbeat.php 23 GET /factory_session_checker.php 12 GET /factory_session_processed_qty.php 12 GET /factory_session_joiner.php 9 GET /index.php 4 POST /portal/register 2 POST /factory_functions.php 1 GET / -- last 10 requests -- 203.54.180.238 - - [10/Sep/2026:09:10:13 +1000] "GET /factory_session_joiner.php?id=35256 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [10/Sep/2026:09:10:14 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:10:14 +1000] "GET /heartbeat.php?sentAt=1788995414&bytes=106,161,231,86&_=1788987691535 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:09:10:19 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:10:20 +1000] "GET /heartbeat.php?sentAt=1788995421&bytes=106,161,231,93&_=1788957670856 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:09:10:22 +1000] "GET /heartbeat.php?sentAt=1788995420&bytes=106,161,231,92&_=1788994126776 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:09:10:23 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 140 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [10/Sep/2026:09:10:23 +1000] "GET /factory_session_joiner.php?id=35256 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [10/Sep/2026:09:10:25 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:10:24 +1000] "GET /heartbeat.php?sentAt=1788995424&bytes=106,161,231,96&_=1788987691536 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-09-10 09:08:16 L1=1.24 run=2 blk=0 avail=5530 (40.1%) swpO=0 conn=18 myRSS=2863 php=145 phpRSS=5568 ap=153 tcp=143 topuser=evolution 2026-09-10 09:08:21 L1=1.22 run=2 blk=0 avail=5535 (40.2%) swpO=0 conn=18 myRSS=2863 php=145 phpRSS=5568 ap=153 tcp=131 topuser=evolution 2026-09-10 09:08:26 L1=1.21 run=2 blk=0 avail=5522 (40.1%) swpO=0 conn=18 myRSS=2863 php=146 phpRSS=5589 ap=153 tcp=129 topuser=evolution 2026-09-10 09:08:31 L1=1.19 run=2 blk=0 avail=5508 (40.0%) swpO=0 conn=19 myRSS=2863 php=147 phpRSS=5629 ap=153 tcp=134 topuser=evolution 2026-09-10 09:08:36 L1=1.97 run=8 blk=0 avail=6113 (44.4%) swpO=0 conn=11 myRSS=2863 php=67 phpRSS=2853 ap=153 tcp=154 topuser=evolution 2026-09-10 09:08:41 L1=2.14 run=6 blk=0 avail=6245 (45.3%) swpO=0 conn=7 myRSS=2863 php=49 phpRSS=2282 ap=153 tcp=117 topuser=evolution 2026-09-10 09:08:46 L1=2.37 run=8 blk=0 avail=6533 (47.4%) swpO=0 conn=10 myRSS=2863 php=34 phpRSS=1653 ap=148 tcp=89 topuser=evolution 2026-09-10 09:08:51 L1=2.50 run=3 blk=0 avail=7017 (50.9%) swpO=0 conn=7 myRSS=2863 php=14 phpRSS=677 ap=143 tcp=77 topuser=evolution 2026-09-10 09:08:56 L1=2.46 run=3 blk=0 avail=7163 (52.0%) swpO=0 conn=10 myRSS=2863 php=5 phpRSS=318 ap=138 tcp=60 topuser=madalice 2026-09-10 09:09:01 L1=2.34 run=3 blk=0 avail=7329 (53.2%) swpO=0 conn=7 myRSS=2863 php=4 phpRSS=160 ap=133 tcp=56 topuser=madalice 2026-09-10 09:09:06 L1=2.55 run=3 blk=1 avail=7349 (53.3%) swpO=0 conn=4 myRSS=2863 php=5 phpRSS=198 ap=128 tcp=59 topuser=madalice 2026-09-10 09:09:11 L1=2.43 run=4 blk=0 avail=7339 (53.3%) swpO=0 conn=7 myRSS=2863 php=11 phpRSS=458 ap=123 tcp=55 topuser=evolution 2026-09-10 09:09:16 L1=2.31 run=6 blk=0 avail=7386 (53.6%) swpO=0 conn=4 myRSS=2863 php=11 phpRSS=417 ap=118 tcp=161 topuser=evolution 2026-09-10 09:09:21 L1=2.21 run=10 blk=1 avail=7127 (51.7%) swpO=0 conn=7 myRSS=2863 php=19 phpRSS=805 ap=132 tcp=76 topuser=evolution 2026-09-10 09:09:26 L1=2.11 run=2 blk=0 avail=7122 (51.7%) swpO=0 conn=4 myRSS=2864 php=16 phpRSS=752 ap=127 tcp=57 topuser=evolution 2026-09-10 09:09:32 L1=2.02 run=5 blk=0 avail=7094 (51.5%) swpO=0 conn=15 myRSS=2864 php=22 phpRSS=978 ap=122 tcp=49 topuser=evolution 2026-09-10 09:09:36 L1=2.02 run=4 blk=0 avail=7107 (51.6%) swpO=0 conn=4 myRSS=2864 php=24 phpRSS=1054 ap=117 tcp=59 topuser=evolution 2026-09-10 09:09:42 L1=2.02 run=2 blk=0 avail=7132 (51.8%) swpO=0 conn=15 myRSS=2864 php=25 phpRSS=1092 ap=112 tcp=48 topuser=evolution 2026-09-10 09:09:47 L1=1.94 run=2 blk=0 avail=7070 (51.3%) swpO=0 conn=16 myRSS=2864 php=29 phpRSS=1243 ap=107 tcp=52 topuser=evolution 2026-09-10 09:09:52 L1=1.86 run=5 blk=0 avail=6967 (50.6%) swpO=0 conn=18 myRSS=2864 php=33 phpRSS=1550 ap=102 tcp=66 topuser=evolution 2026-09-10 09:09:57 L1=1.79 run=2 blk=0 avail=7390 (53.6%) swpO=0 conn=17 myRSS=2864 php=31 phpRSS=1122 ap=97 tcp=70 topuser=evolution 2026-09-10 09:10:02 L1=1.89 run=4 blk=0 avail=7077 (51.4%) swpO=0 conn=18 myRSS=2864 php=40 phpRSS=1661 ap=92 tcp=74 topuser=evolution 2026-09-10 09:10:07 L1=1.98 run=3 blk=0 avail=7080 (51.4%) swpO=0 conn=18 myRSS=2864 php=41 phpRSS=1751 ap=87 tcp=64 topuser=evolution 2026-09-10 09:10:12 L1=2.62 run=2 blk=0 avail=7066 (51.3%) swpO=0 conn=20 myRSS=2864 php=46 phpRSS=1942 ap=82 tcp=68 topuser=evolution 2026-09-10 09:10:17 L1=2.49 run=2 blk=0 avail=7068 (51.3%) swpO=0 conn=19 myRSS=2864 php=50 phpRSS=2093 ap=77 tcp=64 topuser=evolution 2026-09-10 09:10:22 L1=2.37 run=2 blk=0 avail=7058 (51.2%) swpO=0 conn=20 myRSS=2864 php=54 phpRSS=2242 ap=72 tcp=67 topuser=evolution 2026-09-10 09:10:27 L1=2.34 run=2 blk=0 avail=7027 (51.0%) swpO=0 conn=19 myRSS=2864 php=56 phpRSS=2318 ap=75 tcp=69 topuser=evolution 2026-09-10 09:10:32 L1=2.31 run=6 blk=0 avail=6834 (49.6%) swpO=0 conn=21 myRSS=2864 php=63 phpRSS=2642 ap=90 tcp=77 topuser=evolution 2026-09-10 09:10:37 L1=2.53 run=3 blk=0 avail=6778 (49.2%) swpO=0 conn=19 myRSS=2864 php=68 phpRSS=2775 ap=90 tcp=76 topuser=evolution 2026-09-10 09:10:42 L1=2.41 run=2 blk=0 avail=6687 (48.5%) swpO=0 conn=21 myRSS=2864 php=72 phpRSS=2945 ap=94 tcp=74 topuser=evolution