INCIDENT 2026-09-10 09:12:44 trigger: php_procs=97 php_rss=3759MB mysql_conn=22 ================================================================== load: 2.19 2.00 1.77 2/808 906127 ncpu:10 mem_avail: 6295MB/13777MB (45.7%) swap_used:1523MB swapout:0/s blocked(D):0 running:4 iowait:0.0% steal:0.0% php: 97 procs / 3759MB heaviest user: evolution (95 procs, 3600MB) apache: 127 procs tcp_estab: 90 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 99 3608 mysql 1 2864 nobody 126 2284 root 247 1089 netdata 8 256 mailman 20 186 madalice 1 156 dovenull 6 66 wp-toolkit 3 62 cpanellogin 1 58 kurri 3 42 dovecot 3 28 mailnull 2 22 polkitd 1 15 alison 1 14 zabbix 1 9 nscd 1 6 named 1 5 cpanelconnecttrack 1 4 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 95 3600 madalice 1 156 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4972 MB Active(file): 3845 MB Inactive(file): 1164 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 585 MB CommitLimit: 10984 MB Committed_AS: 14372 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 849368 root 12:44 3096 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 9-06:50:20 3892 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 2932740 13.6 Ssl 2-04:27:17 /usr/sbin/mariadbd 166870 1 netdata 199504 2.7 Ssl 4-06:50:26 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3701672 3652415 root 175416 0.0 S 06:37:32 spamd child 3701673 3652415 root 164716 0.0 S 06:37:32 spamd child 3652415 1 root 162076 0.0 Ss 06:47:53 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 905955 167896 madalice 159980 33.0 S 00:16 php-fpm: pool madalice_com_au 2328754 1 root 156392 0.0 Ss 2-04:27:27 /usr/lib/systemd/systemd-journald 509236 509098 root 66780 0.0 Sl 13-06:53:06 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 625148 1353308 cpanellogin 59852 0.0 S 01:15:35 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 888409 866047 evolution 58416 0.0 S 03:33 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 889120 885262 evolution 58216 0.0 S 02:47 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888387 868596 evolution 57844 0.0 S 03:37 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888536 848499 evolution 57820 0.0 S 03:24 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 904189 904059 evolution 56092 0.0 S 02:05 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888467 867897 evolution 44036 0.0 S 03:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 42560 0.0 Ss 50-06:31:32 cpsrvd (SSL) - waiting for connections 888406 868533 evolution 41720 0.0 S 03:33 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904500 904058 evolution 41660 0.0 S 01:57 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 41248 0.1 Ss 72-23:03:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 904612 904611 evolution 40736 0.0 S 01:47 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 906098 905610 evolution 40704 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 889280 888523 evolution 40632 0.0 S 02:42 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 888981 868532 evolution 40336 0.0 S 03:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 898112 848494 evolution 39332 0.0 S 02:36 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903825 866425 evolution 39308 0.0 S 02:32 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904040 903951 evolution 39284 0.0 S 02:14 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903854 865758 evolution 39276 0.0 S 02:31 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904149 888528 evolution 39272 0.0 S 02:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903952 868986 evolution 39268 0.0 S 02:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904182 904079 evolution 39264 0.0 S 02:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 889079 847091 evolution 39252 0.0 S 02:51 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904117 904044 evolution 39252 0.0 S 02:12 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904121 885263 evolution 39252 0.0 S 02:12 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903861 868553 evolution 39232 0.0 S 02:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 889085 866136 evolution 39228 0.0 S 02:50 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904147 904081 evolution 39228 0.0 S 02:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904048 868525 evolution 39212 0.0 S 02:14 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903865 868275 evolution 39200 0.0 S 02:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904148 865041 evolution 39196 0.0 S 02:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903955 864318 evolution 39172 0.0 S 02:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 903959 867884 evolution 39172 0.0 S 02:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904184 868981 evolution 39108 0.0 S 02:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904505 865064 evolution 39064 0.0 S 01:55 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 904151 904078 evolution 39000 0.0 S 02:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 888616 866145 evolution 38872 0.0 S 03:18 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 889208 864164 evolution 38636 0.0 S 02:43 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 902172 868599 evolution 38636 0.0 S 02:34 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888989 885042 evolution 38628 0.0 S 02:58 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 904053 866399 evolution 38628 0.0 S 02:13 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 904610 885252 evolution 38628 0.0 S 01:47 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888545 848614 evolution 38620 0.0 S 03:23 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 904118 868951 evolution 38616 0.0 S 02:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888662 864316 evolution 38612 0.0 S 03:14 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888744 885260 evolution 38604 0.0 S 03:05 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 889033 864206 evolution 38600 0.0 S 02:54 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888657 885043 evolution 38596 0.0 S 03:15 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888666 868976 evolution 38592 0.0 S 03:13 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 904703 904080 evolution 38592 0.0 S 01:42 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 905017 904882 evolution 38592 0.0 S 01:13 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 888706 846219 evolution 38588 0.0 S 03:11 /opt/cpanel/ea-php83/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9050623 | claude | 108-1481181613 | Execute | 239 | Sending data | SELECT COUNT(*) AS n FROM `contacts` c WHERE DATEDIFF(CURDATE(), (SELECT MAX(NULLIF(j.`dateadded`, '0000-00-00')) FROM `jobs` j JOIN `customextrameta` m ON m.`metaname` LIKE CONCAT('shopify-%-job-', j.`id`, '-orderid') WHERE j.`clientid` = c.`clientid`)) <= 90 | | 9066039 | root | 108-1481181613 | Execute | 215 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9066050 | root | 108-1481181613 | Execute | 214 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9066049 | root | 108-1481181613 | Execute | 214 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9066085 | root | 108-1481181613 | Execute | 212 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.nextaction) as diff,contacts.company FROM jobs,contacts where jobs.clientid=contacts.clientid and jobs.nextaction<'2026-09-10' and jobs.status='1' AND jobs.nextaction!='0000-00-00' ORDER BY diff desc | | 9066058 | root | 108-1481181613 | Execute | 212 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='5' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.complete group by jobid | | 9066756 | root | 108-1481181613 | Execute | 208 | Waiting for table level lock | SELECT * FROM jobs WHERE id = ? | | 9066954 | root | 108-1481181613 | Execute | 202 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9067014 | root | 108-1481181613 | Execute | 201 | Waiting for table level lock | select * from jobs where clientid=? and status>'0' | | 9067202 | root | 108-1481181613 | Execute | 193 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9067200 | root | 108-1481181613 | Execute | 193 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9067250 | root | 108-1481181613 | Execute | 178 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9067330 | root | 108-1481181613 | Execute | 166 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.dateadded) as diff,contacts.company from jobs,contacts where jobs.clientid=contacts.clientid AND jobs.branch='3' AND jobs.status='1' AND new_flag='1' order by dateadded desc | | 9067346 | root | 108-1481181613 | Execute | 161 | Waiting for table level lock | SELECT picking.*,jobs.reference as jreference,jobs.company, (select sum(qty) from pickingitems where pickingid = picking.id) as qty, (select sum(picked) from pickingitems where pickingid = picking.id) as picked from picking,jobs where picking.jobid=jobs.id AND jobs.branch='3' AND picking.stat | | 9067634 | root | 108-1481181613 | Execute | 153 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 9068272 | root | 108-1481181613 | Execute | 124 | Waiting for table level lock | SELECT staff.* FROM staff WHERE staff.status > '0' AND staff.id IN (SELECT DISTINCT pmId FROM jobs WHERE pmId > 0) ORDER BY staff.firstname | | 9068389 | root | 108-1481181613 | Execute | 115 | Waiting for table level lock | SELECT picking.*,jobs.reference as jreference,jobs.company, (select sum(qty) from pickingitems where pickingid = picking.id) as qty, (select sum(picked) from pickingitems where pickingid = picking.id) as picked from picking,jobs where picking.jobid=jobs.id AND jobs.branch='3' AND picking.stat | | 9068775 | root | 108-1481181613 | Execute | 106 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | | 9072477 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9066039 | 108-1481181613 | 215 | Waiting for table level lock | UPDATE jobs SET estimated_revenue = ?, price = ?, invoiced_total = ? WHERE id = ? | | 9066050 | 108-1481181613 | 214 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9066049 | 108-1481181613 | 214 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9066085 | 108-1481181613 | 212 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.nextaction) as diff,contacts.company FROM jobs,contacts where jobs.clientid=contacts.clientid and jobs.nextaction<'2026-09-10' and jobs.status='1' AN | | 9066058 | 108-1481181613 | 212 | Waiting for table level lock | SELECT jobs.* from jobs,mfshoporderprocs WHERE mfshoporderprocs.jobid=jobs.id AND mfshoporderprocs.processid='5' AND (mfshoporderprocs.qty * mfshoporderprocs.qty_break) > mfshoporderprocs.comple | | 9066756 | 108-1481181613 | 208 | Waiting for table level lock | SELECT * FROM jobs WHERE id = ? | | 9066954 | 108-1481181613 | 202 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9067014 | 108-1481181613 | 201 | Waiting for table level lock | select * from jobs where clientid=? and status>'0' | | 9067202 | 108-1481181613 | 193 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9067200 | 108-1481181613 | 193 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9067250 | 108-1481181613 | 178 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9067330 | 108-1481181613 | 166 | Waiting for table level lock | SELECT jobs.*,datediff('2026-09-10',jobs.dateadded) as diff,contacts.company from jobs,contacts where jobs.clientid=contacts.clientid AND jobs.branch='3' AND jobs.status='1' AND new_flag='1' orde | | 9067346 | 108-1481181613 | 161 | Waiting for table level lock | SELECT picking.*,jobs.reference as jreference,jobs.company, (select sum(qty) from pickingitems where pickingid = picking.id) as qty, (select sum(picked) from pickingitems where pickingid = picking.id) | | 9067634 | 108-1481181613 | 153 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 9068272 | 108-1481181613 | 125 | Waiting for table level lock | SELECT staff.* FROM staff WHERE staff.status > '0' AND staff.id IN (SELECT DISTINCT pmId FROM jobs WHERE pmId > 0) ORDER BY staff.firstname | | 9068389 | 108-1481181613 | 115 | Waiting for table level lock | SELECT picking.*,jobs.reference as jreference,jobs.company, (select sum(qty) from pickingitems where pickingid = picking.id) as qty, (select sum(picked) from pickingitems where pickingid = picking.id) | | 9068775 | 108-1481181613 | 106 | Waiting for table level lock | select picking.*, jobs.company, jobs.reference as jref from picking,jobs where jobs.id=picking.jobid and picking.id = ? | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 328 evolution/portal.evolutionerp.com.au-ssl_log 108 evolution/app.evolutionerp.com.au-ssl_log 107 aaa/aaadownunder.com.au-ssl_log 17 madalice/madalice.com.au-ssl_log 12 evolution/pdev.evolutionerp.com.au-ssl_log 8 evolution/evolutionerp.com.au-ssl_log 4 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 115 150.228.151.88 108 203.54.180.238 107 40.115.94.245 63 180.181.236.49 58 103.104.165.99 25 165.225.233.87 20 103.104.164.114 17 149.102.230.138 14 182.239.240.254 14 124.170.183.15 8 203.54.162.106 6 1.145.125.62 3 157.55.39.58 3 1.144.107.82 3 114.119.143.14 --- top request paths across all vhosts (last 3 min) --- 119 POST /functions.php 107 GET /api/getItem/LWFBW2001KG 58 GET /app/ajax.php 47 GET /heartbeat.php 36 GET /index.php 30 GET /factory_session_checker.php 16 POST /quoteditsave.php 15 POST /app/ajax/selectFilter.php 15 GET /factory_session_processed_qty.php 15 GET /factory_session_joiner.php 14 POST /plugins/csvexporter/plugin.php 13 POST /app/ajax/selectFilterSingle.php 11 GET /quoteditsave.php 8 POST //functions.php 8 POST /app/ajax.php 7 POST /inveditsave.php 7 GET / 6 POST /itemModify.php 5 POST /jobeditsave.php 5 POST /clienteditsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 119 POST /functions.php 58 GET /app/ajax.php 34 GET /index.php 16 POST /quoteditsave.php 15 POST /app/ajax/selectFilter.php 14 POST /plugins/csvexporter/plugin.php 13 POST /app/ajax/selectFilterSingle.php 11 GET /quoteditsave.php 8 POST //functions.php 8 POST /app/ajax.php 7 POST /inveditsave.php 6 POST /itemModify.php -- last 10 requests -- 103.104.164.114 - - [10/Sep/2026:09:12:41 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dinvoiceadd%26invoiceid%3D4302%26tab%3Dmaintab&call=getUserSetting&caller=ajaxSubmitLocal&seq=12037897338 HTTP 103.104.164.114 - - [10/Sep/2026:09:12:41 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=&cursel=Please%20Select&curseltext=&fromMS=1&&nolimit=LIMIT%2050&include=&tid=%25%25&invjobid=0&clientid=56&returnob 103.104.164.114 - - [10/Sep/2026:09:12:41 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvoiceadd%26invoiceid%3D4302%26tab%3Dmaintab&call=getUserSetting&caller=ajaxSubmitLocal&seq=12717179314 HTTP/1.1" 200 173 "htt 103.104.164.114 - - [10/Sep/2026:09:12:41 +1000] "POST /clienteditsave.php?clientid=56&call=getCategoryDiscounts HTTP/1.1" 200 25 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4302&tab=maintab" "Moz 150.228.151.88 - - [10/Sep/2026:09:12:41 +1000] "POST /quoteditsave.php?call=addLineItem HTTP/1.1" 200 341 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2035" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 103.104.164.114 - - [10/Sep/2026:09:12:41 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4302&tab=maintab" "Mozilla/5.0 (Windows NT 150.228.151.88 - - [10/Sep/2026:09:12:41 +1000] "POST /quoteditsave.php?call=addLineItem HTTP/1.1" 200 403 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=2035" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 182.239.240.254 - - [10/Sep/2026:09:12:42 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 982 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=4242" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 103.104.164.114 - - [10/Sep/2026:09:12:42 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4302&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; 103.104.164.114 - - [10/Sep/2026:09:12:42 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 16289 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=4302&tab=maintab" "Mozilla/5.0 (Windows NT 1 == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 47 GET /heartbeat.php 30 GET /factory_session_checker.php 15 GET /factory_session_processed_qty.php 15 GET /factory_session_joiner.php 1 POST /factory_functions.php -- last 10 requests -- 203.54.180.238 - - [10/Sep/2026:09:12:17 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:12:20 +1000] "GET /heartbeat.php?sentAt=1788995541&bytes=106,161,231,213&_=1788957670868 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [10/Sep/2026:09:12:22 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:12:22 +1000] "GET /heartbeat.php?sentAt=1788995540&bytes=106,161,231,212&_=1788994126788 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [10/Sep/2026:09:12:25 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 140 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [10/Sep/2026:09:12:25 +1000] "GET /factory_session_joiner.php?id=35256 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [10/Sep/2026:09:12:24 +1000] "GET /heartbeat.php?sentAt=1788995544&bytes=106,161,231,216&_=1788987691548 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [10/Sep/2026:09:12:27 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [10/Sep/2026:09:12:30 +1000] "GET /heartbeat.php?sentAt=1788995551&bytes=106,161,231,223&_=1788957670869 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6 203.54.180.238 - - [10/Sep/2026:09:12:32 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 107 GET /api/getItem/LWFBW2001KG -- last 10 requests -- 40.115.94.245 - - [10/Sep/2026:09:11:41 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:11:41 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:11:41 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:11:42 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:11:42 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:11:42 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:11:42 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:11:43 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:11:43 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:09:11:43 +1000] "GET /api/getItem/LWFBW2001KG HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-10 09:10:17 L1=2.49 run=2 blk=0 avail=7068 (51.3%) swpO=0 conn=19 myRSS=2864 php=50 phpRSS=2093 ap=77 tcp=64 topuser=evolution 2026-09-10 09:10:22 L1=2.37 run=2 blk=0 avail=7058 (51.2%) swpO=0 conn=20 myRSS=2864 php=54 phpRSS=2242 ap=72 tcp=67 topuser=evolution 2026-09-10 09:10:27 L1=2.34 run=2 blk=0 avail=7027 (51.0%) swpO=0 conn=19 myRSS=2864 php=56 phpRSS=2318 ap=75 tcp=69 topuser=evolution 2026-09-10 09:10:32 L1=2.31 run=6 blk=0 avail=6834 (49.6%) swpO=0 conn=21 myRSS=2864 php=63 phpRSS=2642 ap=90 tcp=77 topuser=evolution 2026-09-10 09:10:37 L1=2.53 run=3 blk=0 avail=6778 (49.2%) swpO=0 conn=19 myRSS=2864 php=68 phpRSS=2775 ap=90 tcp=76 topuser=evolution 2026-09-10 09:10:42 L1=2.41 run=2 blk=0 avail=6687 (48.5%) swpO=0 conn=21 myRSS=2864 php=72 phpRSS=2945 ap=94 tcp=74 topuser=evolution 2026-09-10 09:10:47 L1=2.29 run=2 blk=0 avail=6818 (49.5%) swpO=0 conn=20 myRSS=2864 php=72 phpRSS=2825 ap=94 tcp=74 topuser=evolution 2026-09-10 09:10:53 L1=2.19 run=2 blk=0 avail=6919 (50.2%) swpO=0 conn=21 myRSS=2864 php=74 phpRSS=2785 ap=93 tcp=74 topuser=evolution 2026-09-10 09:10:57 L1=2.09 run=5 blk=0 avail=6874 (49.9%) swpO=0 conn=21 myRSS=2864 php=76 phpRSS=2858 ap=96 tcp=79 topuser=evolution 2026-09-10 09:11:03 L1=2.17 run=3 blk=0 avail=6708 (48.7%) swpO=0 conn=22 myRSS=2864 php=79 phpRSS=3072 ap=100 tcp=83 topuser=evolution 2026-09-10 09:11:07 L1=2.15 run=3 blk=0 avail=6650 (48.3%) swpO=0 conn=23 myRSS=2864 php=81 phpRSS=3148 ap=105 tcp=79 topuser=evolution 2026-09-10 09:11:13 L1=2.06 run=4 blk=0 avail=6522 (47.3%) swpO=0 conn=22 myRSS=2864 php=83 phpRSS=3336 ap=104 tcp=76 topuser=evolution 2026-09-10 09:11:17 L1=1.98 run=3 blk=0 avail=6512 (47.3%) swpO=0 conn=22 myRSS=2864 php=85 phpRSS=3410 ap=102 tcp=77 topuser=evolution 2026-09-10 09:11:23 L1=2.30 run=2 blk=0 avail=6477 (47.0%) swpO=0 conn=22 myRSS=2864 php=86 phpRSS=3447 ap=105 tcp=90 topuser=evolution 2026-09-10 09:11:27 L1=2.19 run=2 blk=0 avail=6427 (46.6%) swpO=0 conn=22 myRSS=2864 php=87 phpRSS=3474 ap=112 tcp=92 topuser=evolution 2026-09-10 09:11:33 L1=2.18 run=3 blk=0 avail=6534 (47.4%) swpO=0 conn=22 myRSS=2864 php=88 phpRSS=3405 ap=112 tcp=92 topuser=evolution 2026-09-10 09:11:37 L1=2.08 run=3 blk=0 avail=6528 (47.4%) swpO=2 conn=22 myRSS=2863 php=88 phpRSS=3390 ap=115 tcp=89 topuser=evolution 2026-09-10 09:11:43 L1=2.00 run=2 blk=0 avail=6530 (47.4%) swpO=2 conn=22 myRSS=2863 php=88 phpRSS=3404 ap=112 tcp=83 topuser=evolution 2026-09-10 09:11:47 L1=1.92 run=4 blk=0 avail=6538 (47.5%) swpO=0 conn=22 myRSS=2863 php=89 phpRSS=3442 ap=109 tcp=82 topuser=evolution 2026-09-10 09:11:53 L1=1.92 run=2 blk=0 avail=6647 (48.2%) swpO=0 conn=22 myRSS=2863 php=89 phpRSS=3343 ap=109 tcp=80 topuser=evolution 2026-09-10 09:11:57 L1=1.85 run=4 blk=0 avail=6603 (47.9%) swpO=0 conn=23 myRSS=2863 php=90 phpRSS=3407 ap=109 tcp=82 topuser=evolution 2026-09-10 09:12:04 L1=2.02 run=2 blk=0 avail=6401 (46.5%) swpO=0 conn=22 myRSS=2863 php=93 phpRSS=3589 ap=124 tcp=100 topuser=evolution 2026-09-10 09:12:07 L1=1.94 run=2 blk=0 avail=6404 (46.5%) swpO=0 conn=22 myRSS=2863 php=93 phpRSS=3589 ap=122 tcp=97 topuser=evolution 2026-09-10 09:12:14 L1=2.59 run=3 blk=0 avail=6388 (46.4%) swpO=0 conn=22 myRSS=2863 php=94 phpRSS=3626 ap=122 tcp=99 topuser=evolution 2026-09-10 09:12:18 L1=2.46 run=4 blk=0 avail=6400 (46.5%) swpO=0 conn=22 myRSS=2863 php=94 phpRSS=3626 ap=120 tcp=96 topuser=evolution 2026-09-10 09:12:24 L1=2.34 run=2 blk=0 avail=6488 (47.1%) swpO=0 conn=22 myRSS=2863 php=95 phpRSS=3563 ap=119 tcp=91 topuser=evolution 2026-09-10 09:12:28 L1=2.23 run=4 blk=0 avail=6467 (46.9%) swpO=0 conn=24 myRSS=2863 php=97 phpRSS=3641 ap=119 tcp=93 topuser=evolution 2026-09-10 09:12:34 L1=2.21 run=3 blk=0 avail=6325 (45.9%) swpO=0 conn=21 myRSS=2864 php=96 phpRSS=3718 ap=122 tcp=105 topuser=evolution 2026-09-10 09:12:38 L1=2.12 run=2 blk=0 avail=6258 (45.4%) swpO=0 conn=21 myRSS=2864 php=96 phpRSS=3718 ap=133 tcp=97 topuser=evolution 2026-09-10 09:12:44 L1=2.19 run=4 blk=0 avail=6295 (45.7%) swpO=0 conn=22 myRSS=2864 php=97 phpRSS=3759 ap=127 tcp=90 topuser=evolution