INCIDENT 2026-09-10 09:11:43 trigger: php_procs=88 php_rss=3404MB mysql_conn=22 ================================================================== load: 2.00 1.93 1.73 2/783 905200 ncpu:10 mem_avail: 6530MB/13777MB (47.4%) swap_used:1523MB swapout:2/s blocked(D):0 running:2 iowait:0.1% steal:0.0% php: 88 procs / 3404MB heaviest user: evolution (86 procs, 3267MB) apache: 112 procs tcp_estab: 83 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 90 3275 mysql 1 2863 nobody 111 2038 root 248 1069 netdata 8 256 mailman 20 186 madalice 1 134 dovenull 6 66 wp-toolkit 3 62 cpanellogin 1 56 kurri 3 42 dovecot 3 28 polkitd 1 15 vinesit 1 14 zabbix 1 8 nscd 1 6 named 1 5 cpanelconnecttrack 1 4 mailnull 1 2 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 86 3267 madalice 1 134 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4954 MB Active(file): 3829 MB Inactive(file): 1165 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 585 MB CommitLimit: 10984 MB Committed_AS: 13709 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 849368 root 11:43 3096 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 9-06:49:19 3892 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 2932712 13.6 Ssl 2-04:26:16 /usr/sbin/mariadbd 166870 1 netdata 200108 2.7 Ssl 4-06:49:25 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3701672 3652415 root 175416 0.0 S 06:36:31 spamd child 3701673 3652415 root 164716 0.0 S 06:36:31 spamd child 3652415 1 root 162076 0.0 Ss 06:46:52 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328754 1 root 156392 0.0 Ss 2-04:26:26 /usr/lib/systemd/systemd-journald 905014 167896 madalice 138148 9.4 S 00:13 php-fpm: pool madalice_com_au 509236 509098 root 66780 0.0 Sl 13-06:52:05 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 888409 866047 evolution 58416 0.0 S 02:32 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 889120 885262 evolution 58216 0.1 S 01:46 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 625148 1353308 cpanellogin 58068 0.0 S 01:14:34 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 888387 868596 evolution 57844 0.0 S 02:36 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888536 848499 evolution 57820 0.0 S 02:23 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 904189 904059 evolution 56092 0.1 S 01:04 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888467 867897 evolution 44036 0.0 S 02:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 42552 0.0 Ss 50-06:30:31 cpsrvd (SSL) - waiting for connections 888406 868533 evolution 41720 0.0 S 02:32 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904500 904058 evolution 41660 0.0 S 00:56 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 41248 0.1 Ss 72-23:02:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 904612 904611 evolution 40736 0.0 S 00:46 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 889280 888523 evolution 40632 0.0 S 01:41 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 888981 868532 evolution 40336 0.0 S 02:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 898112 848494 evolution 39332 0.0 S 01:35 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903825 866425 evolution 39308 0.0 S 01:31 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904040 903951 evolution 39284 0.0 S 01:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903854 865758 evolution 39276 0.0 S 01:30 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904149 888528 evolution 39272 0.0 S 01:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903952 868986 evolution 39268 0.0 S 01:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904182 904079 evolution 39264 0.0 S 01:06 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 889079 847091 evolution 39252 0.0 S 01:50 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904117 904044 evolution 39252 0.0 S 01:11 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904121 885263 evolution 39252 0.0 S 01:11 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903861 868553 evolution 39232 0.0 S 01:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 889085 866136 evolution 39228 0.0 S 01:49 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904147 904081 evolution 39228 0.0 S 01:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904048 868525 evolution 39212 0.0 S 01:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903865 868275 evolution 39200 0.0 S 01:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904148 865041 evolution 39196 0.0 S 01:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903955 864318 evolution 39172 0.0 S 01:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903959 867884 evolution 39172 0.0 S 01:19 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904184 868981 evolution 39108 0.0 S 01:06 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904505 865064 evolution 39064 0.0 S 00:54 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904151 904078 evolution 39000 0.0 S 01:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 888616 866145 evolution 38872 0.0 S 02:17 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 889208 864164 evolution 38636 0.0 S 01:42 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 902172 868599 evolution 38636 0.0 S 01:33 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888989 885042 evolution 38628 0.0 S 01:57 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 904053 866399 evolution 38628 0.0 S 01:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 904610 885252 evolution 38628 0.0 S 00:46 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888545 848614 evolution 38620 0.0 S 02:22 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 904118 868951 evolution 38616 0.0 S 01:11 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888662 864316 evolution 38612 0.0 S 02:13 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888744 885260 evolution 38604 0.0 S 02:04 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 889033 864206 evolution 38600 0.0 S 01:53 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888657 885043 evolution 38596 0.0 S 02:14 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888666 868976 evolution 38592 0.0 S 02:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 904703 904080 evolution 38592 0.0 S 00:41 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 905017 904882 evolution 38592 0.1 S 00:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888706 846219 evolution 38588 0.0 S 02:10 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 904984 904958 evolution 38588 0.1 S 00:16 /opt/cpanel/ea-php83/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9050623 | claude | 108-1481181613 | Execute | 179 | Sending data | SELECT COUNT(*) AS n FROM `contacts` c WHERE DATEDIFF(CURDATE(), (SELECT MAX(NULLIF(j.`dateadded`, '0000-00-00')) FROM `jobs` j JOIN `customextrameta` m ON m.`metaname` LIKE CONCAT('shopify-%-job-', j.`id`, '-orderid') WHERE j.`clientid` = c.`clientid`)) <= 90 | | 9066039 | root | 108-1481181613 | Execute | 154 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9066049 | root | 108-1481181613 | Execute | 154 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9066050 | root | 108-1481181613 | Execute | 153 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9066058 | root | 108-1481181613 | Execute | 152 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='5' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.complete group by jobid | | 9066085 | root | 108-1481181613 | Execute | 151 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.nextaction) as diff,contacts.company FROM jobs,contacts where jobs.clientid=contacts.clientid and jobs.nextaction<'2026-09-10' and jobs.status='1' AND jobs.nextaction!='0000-00-00' ORDER BY diff desc | | 9066756 | root | 108-1481181613 | Execute | 147 | Waiting for table level lock | SELECT * FROM jobs WHERE id = ? | | 9066954 | root | 108-1481181613 | Execute | 142 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9067014 | root | 108-1481181613 | Execute | 140 | Waiting for table level lock | select * from jobs where clientid=? and status>'0' | | 9067202 | root | 108-1481181613 | Execute | 132 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9067200 | root | 108-1481181613 | Execute | 132 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9067250 | root | 108-1481181613 | Execute | 118 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9067330 | root | 108-1481181613 | Execute | 106 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.dateadded) as diff,contacts.company from jobs,contacts where jobs.clientid=contacts.clientid AND jobs.branch='3' AND jobs.status='1' AND new_flag='1' order by dateadded desc | | 9067346 | root | 108-1481181613 | Execute | 101 | Waiting for table level lock | SELECT picking.*,jobs.reference as jreference,jobs.company, (select sum(qty) from pickingitems where pickingid = picking.id) as qty, (select sum(picked) from pickingitems where pickingid = picking.id) as picked from picking,jobs where picking.jobid=jobs.id AND jobs.branch='3' AND picking.stat | | 9067634 | root | 108-1481181613 | Execute | 92 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9068272 | root | 108-1481181613 | Execute | 64 | Waiting for table level lock | SELECT staff.* FROM staff WHERE staff.status > '0' AND staff.id IN (SELECT DISTINCT pmId FROM jobs WHERE pmId > 0) ORDER BY staff.firstname | | 9068389 | root | 108-1481181613 | Execute | 54 | Waiting for table level lock | SELECT picking.*,jobs.reference as jreference,jobs.company, (select sum(qty) from pickingitems where pickingid = picking.id) as qty, (select sum(picked) from pickingitems where pickingid = picking.id) as picked from picking,jobs where picking.jobid=jobs.id AND jobs.branch='3' AND picking.stat | | 9068775 | root | 108-1481181613 | Execute | 45 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | | 9070269 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9066039 | 108-1481181613 | 154 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9066049 | 108-1481181613 | 154 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9066050 | 108-1481181613 | 153 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9066058 | 108-1481181613 | 152 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='5' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.comple | | 9066085 | 108-1481181613 | 151 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.nextaction) as diff,contacts.company FROM jobs,contacts where jobs.clientid=contacts.clientid and jobs.nextaction<'2026-09-10' and jobs.status='1' AN | | 9066756 | 108-1481181613 | 147 | Waiting for table level lock | SELECT * FROM jobs WHERE id = ? | | 9066954 | 108-1481181613 | 142 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9067014 | 108-1481181613 | 140 | Waiting for table level lock | select * from jobs where clientid=? and status>'0' | | 9067202 | 108-1481181613 | 132 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9067200 | 108-1481181613 | 132 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9067250 | 108-1481181613 | 118 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9067330 | 108-1481181613 | 106 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.dateadded) as diff,contacts.company from jobs,contacts where jobs.clientid=contacts.clientid AND jobs.branch='3' AND jobs.status='1' AND new_flag='1' orde | | 9067346 | 108-1481181613 | 101 | Waiting for table level lock | SELECT picking.*,jobs.reference as jreference,jobs.company, (select sum(qty) from pickingitems where pickingid = picking.id) as qty, (select sum(picked) from pickingitems where pickingid = picking.id) | | 9067634 | 108-1481181613 | 92 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9068272 | 108-1481181613 | 64 | Waiting for table level lock | SELECT staff.* FROM staff WHERE staff.status > '0' AND staff.id IN (SELECT DISTINCT pmId FROM jobs WHERE pmId > 0) ORDER BY staff.firstname | | 9068389 | 108-1481181613 | 54 | Waiting for table level lock | SELECT picking.*,jobs.reference as jreference,jobs.company, (select sum(qty) from pickingitems where pickingid = picking.id) as qty, (select sum(picked) from pickingitems where pickingid = picking.id) | | 9068775 | 108-1481181613 | 45 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 353 evolution/app.evolutionerp.com.au-ssl_log 169 evolution/portal.evolutionerp.com.au-ssl_log 120 aaa/aaadownunder.com.au-ssl_log 26 madalice/madalice.com.au-ssl_log 14 alison/alisonarts.com.au-ssl_log 2 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 169 40.115.94.245 140 203.54.180.238 83 150.228.151.88 74 103.104.165.99 63 180.181.236.49 48 182.239.240.254 32 165.225.233.87 17 149.102.230.138 9 203.54.162.106 6 1.145.125.62 6 103.104.164.114 5 1.144.107.82 4 207.46.13.141 3 207.46.13.7 2 91.92.243.234 --- top request paths across all vhosts (last 3 min) --- 169 GET /api/getItem/LWFBW2001KG 127 POST /functions.php 71 GET /app/ajax.php 53 GET /heartbeat.php 31 GET /index.php 30 GET /factory_session_checker.php 16 POST /inveditsave.php 16 GET /factory_session_processed_qty.php 16 GET /factory_session_joiner.php 14 POST /app/ajax/selectFilter.php 13 POST /plugins/csvexporter/plugin.php 12 POST /app/ajax/selectFilterSingle.php 12 POST /app/ajax.php 9 POST /quoteditsave.php 9 POST //functions.php 7 GET / 5 POST /jobeditsave.php 4 POST /testTagUploadsave.php 4 POST /itemModify.php 4 POST /clienteditsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 127 POST /functions.php 71 GET /app/ajax.php 29 GET /index.php 16 POST /inveditsave.php 14 POST /app/ajax/selectFilter.php 13 POST /plugins/csvexporter/plugin.php 12 POST /app/ajax/selectFilterSingle.php 12 POST /app/ajax.php 9 POST /quoteditsave.php 9 POST //functions.php 5 POST /jobeditsave.php 4 POST /testTagUploadsave.php -- last 10 requests -- 150.228.151.88 - - [10/Sep/2026:09:11:35 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2324" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:15 180.181.236.49 - - [10/Sep/2026:09:11:35 +1000] "POST /quoteditsave.php HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=6964§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 180.181.236.49 - - [10/Sep/2026:09:11:35 +1000] "GET /index.php?page=quotedit"eid=6964§ionid=0 HTTP/1.1" 200 135445 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=6964§ionid=0" "Mozilla/5.0 ( 103.104.165.99 - - [10/Sep/2026:09:11:35 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 51 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=1751&tab=clienteditgeneral" "Mozilla/5.0 (Windows NT 1.145.125.62 - - [10/Sep/2026:09:11:35 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=opportunities" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 165.225.233.87 - - [10/Sep/2026:09:11:36 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=14280" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 180.181.236.49 - - [10/Sep/2026:09:11:36 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=14105620733 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 180.181.236.49 - - [10/Sep/2026:09:11:36 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=10500014320 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 180.181.236.49 - - [10/Sep/2026:09:11:36 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotedit%26quoteid6964&call=getUserSetting&caller=ajaxSubmitLocal&seq=12928782985 HTTP/1.1" 200 99 "https://my.evolutionerp.com. 180.181.236.49 - - [10/Sep/2026:09:11:36 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dquotedit%26quoteid%3D6964%26sectionid%3D0&call=getUserSetting&caller=ajaxSubmitLocal&seq=19323447941 HTTP/1.1" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 169 GET /api/getItem/LWFBW2001KG -- last 10 requests -- 40.115.94.245 - - [10/Sep/2026:09:11:41 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:11:41 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:11:41 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:11:42 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:11:42 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:11:42 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:11:42 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:11:43 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:11:43 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:11:43 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 53 GET /heartbeat.php 30 GET /factory_session_checker.php 16 GET /factory_session_processed_qty.php 16 GET /factory_session_joiner.php 2 POST /portal/register 2 GET /index.php 1 POST /factory_functions.php -- last 10 requests -- 203.54.180.238 - - [10/Sep/2026:09:11:24 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 140 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [10/Sep/2026:09:11:24 +1000] "GET /factory_session_joiner.php?id=35256 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [10/Sep/2026:09:11:24 +1000] "GET /heartbeat.php?sentAt=1788995484&bytes=106,161,231,156&_=1788987691542 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [10/Sep/2026:09:11:26 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:11:31 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:11:30 +1000] "GET /heartbeat.php?sentAt=1788995491&bytes=106,161,231,163&_=1788957670863 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [10/Sep/2026:09:11:32 +1000] "GET /heartbeat.php?sentAt=1788995490&bytes=106,161,231,162&_=1788994126783 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [10/Sep/2026:09:11:34 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 140 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [10/Sep/2026:09:11:34 +1000] "GET /factory_session_joiner.php?id=35256 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [10/Sep/2026:09:11:34 +1000] "GET /heartbeat.php?sentAt=1788995494&bytes=106,161,231,166&_=1788987691543 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 --- last 30 samples (run-up to this incident) --- 2026-09-10 09:09:16 L1=2.31 run=6 blk=0 avail=7386 (53.6%) swpO=0 conn=4 myRSS=2863 php=11 phpRSS=417 ap=118 tcp=161 topuser=evolution 2026-09-10 09:09:21 L1=2.21 run=10 blk=1 avail=7127 (51.7%) swpO=0 conn=7 myRSS=2863 php=19 phpRSS=805 ap=132 tcp=76 topuser=evolution 2026-09-10 09:09:26 L1=2.11 run=2 blk=0 avail=7122 (51.7%) swpO=0 conn=4 myRSS=2864 php=16 phpRSS=752 ap=127 tcp=57 topuser=evolution 2026-09-10 09:09:32 L1=2.02 run=5 blk=0 avail=7094 (51.5%) swpO=0 conn=15 myRSS=2864 php=22 phpRSS=978 ap=122 tcp=49 topuser=evolution 2026-09-10 09:09:36 L1=2.02 run=4 blk=0 avail=7107 (51.6%) swpO=0 conn=4 myRSS=2864 php=24 phpRSS=1054 ap=117 tcp=59 topuser=evolution 2026-09-10 09:09:42 L1=2.02 run=2 blk=0 avail=7132 (51.8%) swpO=0 conn=15 myRSS=2864 php=25 phpRSS=1092 ap=112 tcp=48 topuser=evolution 2026-09-10 09:09:47 L1=1.94 run=2 blk=0 avail=7070 (51.3%) swpO=0 conn=16 myRSS=2864 php=29 phpRSS=1243 ap=107 tcp=52 topuser=evolution 2026-09-10 09:09:52 L1=1.86 run=5 blk=0 avail=6967 (50.6%) swpO=0 conn=18 myRSS=2864 php=33 phpRSS=1550 ap=102 tcp=66 topuser=evolution 2026-09-10 09:09:57 L1=1.79 run=2 blk=0 avail=7390 (53.6%) swpO=0 conn=17 myRSS=2864 php=31 phpRSS=1122 ap=97 tcp=70 topuser=evolution 2026-09-10 09:10:02 L1=1.89 run=4 blk=0 avail=7077 (51.4%) swpO=0 conn=18 myRSS=2864 php=40 phpRSS=1661 ap=92 tcp=74 topuser=evolution 2026-09-10 09:10:07 L1=1.98 run=3 blk=0 avail=7080 (51.4%) swpO=0 conn=18 myRSS=2864 php=41 phpRSS=1751 ap=87 tcp=64 topuser=evolution 2026-09-10 09:10:12 L1=2.62 run=2 blk=0 avail=7066 (51.3%) swpO=0 conn=20 myRSS=2864 php=46 phpRSS=1942 ap=82 tcp=68 topuser=evolution 2026-09-10 09:10:17 L1=2.49 run=2 blk=0 avail=7068 (51.3%) swpO=0 conn=19 myRSS=2864 php=50 phpRSS=2093 ap=77 tcp=64 topuser=evolution 2026-09-10 09:10:22 L1=2.37 run=2 blk=0 avail=7058 (51.2%) swpO=0 conn=20 myRSS=2864 php=54 phpRSS=2242 ap=72 tcp=67 topuser=evolution 2026-09-10 09:10:27 L1=2.34 run=2 blk=0 avail=7027 (51.0%) swpO=0 conn=19 myRSS=2864 php=56 phpRSS=2318 ap=75 tcp=69 topuser=evolution 2026-09-10 09:10:32 L1=2.31 run=6 blk=0 avail=6834 (49.6%) swpO=0 conn=21 myRSS=2864 php=63 phpRSS=2642 ap=90 tcp=77 topuser=evolution 2026-09-10 09:10:37 L1=2.53 run=3 blk=0 avail=6778 (49.2%) swpO=0 conn=19 myRSS=2864 php=68 phpRSS=2775 ap=90 tcp=76 topuser=evolution 2026-09-10 09:10:42 L1=2.41 run=2 blk=0 avail=6687 (48.5%) swpO=0 conn=21 myRSS=2864 php=72 phpRSS=2945 ap=94 tcp=74 topuser=evolution 2026-09-10 09:10:47 L1=2.29 run=2 blk=0 avail=6818 (49.5%) swpO=0 conn=20 myRSS=2864 php=72 phpRSS=2825 ap=94 tcp=74 topuser=evolution 2026-09-10 09:10:53 L1=2.19 run=2 blk=0 avail=6919 (50.2%) swpO=0 conn=21 myRSS=2864 php=74 phpRSS=2785 ap=93 tcp=74 topuser=evolution 2026-09-10 09:10:57 L1=2.09 run=5 blk=0 avail=6874 (49.9%) swpO=0 conn=21 myRSS=2864 php=76 phpRSS=2858 ap=96 tcp=79 topuser=evolution 2026-09-10 09:11:03 L1=2.17 run=3 blk=0 avail=6708 (48.7%) swpO=0 conn=22 myRSS=2864 php=79 phpRSS=3072 ap=100 tcp=83 topuser=evolution 2026-09-10 09:11:07 L1=2.15 run=3 blk=0 avail=6650 (48.3%) swpO=0 conn=23 myRSS=2864 php=81 phpRSS=3148 ap=105 tcp=79 topuser=evolution 2026-09-10 09:11:13 L1=2.06 run=4 blk=0 avail=6522 (47.3%) swpO=0 conn=22 myRSS=2864 php=83 phpRSS=3336 ap=104 tcp=76 topuser=evolution 2026-09-10 09:11:17 L1=1.98 run=3 blk=0 avail=6512 (47.3%) swpO=0 conn=22 myRSS=2864 php=85 phpRSS=3410 ap=102 tcp=77 topuser=evolution 2026-09-10 09:11:23 L1=2.30 run=2 blk=0 avail=6477 (47.0%) swpO=0 conn=22 myRSS=2864 php=86 phpRSS=3447 ap=105 tcp=90 topuser=evolution 2026-09-10 09:11:27 L1=2.19 run=2 blk=0 avail=6427 (46.6%) swpO=0 conn=22 myRSS=2864 php=87 phpRSS=3474 ap=112 tcp=92 topuser=evolution 2026-09-10 09:11:33 L1=2.18 run=3 blk=0 avail=6534 (47.4%) swpO=0 conn=22 myRSS=2864 php=88 phpRSS=3405 ap=112 tcp=92 topuser=evolution 2026-09-10 09:11:37 L1=2.08 run=3 blk=0 avail=6528 (47.4%) swpO=2 conn=22 myRSS=2863 php=88 phpRSS=3390 ap=115 tcp=89 topuser=evolution 2026-09-10 09:11:43 L1=2.00 run=2 blk=0 avail=6530 (47.4%) swpO=2 conn=22 myRSS=2863 php=88 phpRSS=3404 ap=112 tcp=83 topuser=evolution