INCIDENT 2026-09-10 11:34:58 trigger: php_procs=28 ================================================================== load: 2.35 2.67 2.47 6/662 1438725 ncpu:10 mem_avail: 7329MB/13777MB (53.2%) swap_used:1415MB swapout:0/s blocked(D):0 running:6 iowait:0.0% steal:0.0% php: 28 procs / 1369MB heaviest user: evolution (24 procs, 946MB) apache: 54 procs tcp_estab: 54 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2936 root 243 1083 nobody 53 973 evolution 28 955 madalice 2 290 netdata 8 254 mailman 20 183 olympic 1 130 dovenull 6 66 wp-toolkit 3 61 cpanellogin 1 50 alison 3 41 dovecot 3 28 polkitd 1 15 kurri 1 12 mailnull 2 10 zabbix 1 8 nscd 1 6 named 1 5 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB evolution 26 1015 madalice 2 290 olympic 1 130 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5090 MB Active(file): 4444 MB Inactive(file): 706 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 523 MB CommitLimit: 10984 MB Committed_AS: 9161 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 9-09:12:33 3696 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 3006552 14.9 Ssl 2-06:49:30 /usr/sbin/mariadbd 166870 1 netdata 199176 2.7 Ssl 4-09:12:39 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2328754 1 root 194076 0.0 Ss 2-06:49:40 /usr/lib/systemd/systemd-journald 3701672 3652415 root 193008 0.1 S 08:59:45 spamd child 3701673 3652415 root 160876 0.0 S 08:59:45 spamd child 1438173 167896 madalice 160012 15.3 S 00:41 php-fpm: pool madalice_com_au 3652415 1 root 148080 0.0 Ss 09:10:06 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1438453 167896 madalice 137144 6.1 S 00:21 php-fpm: pool madalice_com_au 1438687 1436162 olympic 133892 67.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509236 509098 root 68164 0.0 Sl 13-09:15:19 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1438696 1437099 evolution 59672 0.0 S 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1436920 1435595 evolution 59164 0.0 S 02:21 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1438671 1419096 evolution 58224 2.0 S 00:04 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437265 1437120 evolution 58004 0.0 S 01:53 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1382815 1353308 cpanellogin 51324 0.0 S 16:29 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 1438730 1436156 evolution 44780 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1353308 1 root 42368 0.0 Ss 50-08:53:45 cpsrvd (SSL) - waiting for connections 1436669 1419737 evolution 41488 0.0 S 02:46 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1437554 1419738 evolution 41076 0.0 S 01:30 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438043 1436907 evolution 40980 0.0 S 00:53 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436992 1435559 evolution 40976 0.0 S 02:14 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436739 1435940 evolution 40884 0.0 S 02:39 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438231 1438076 evolution 40652 0.0 S 00:37 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437858 1437119 evolution 40648 0.0 S 01:05 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437497 1437325 evolution 40616 0.0 S 01:35 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437654 1436586 evolution 40472 0.0 S 01:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 39812 0.1 Ss 73-01:25:14 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1438494 1438439 evolution 39348 0.1 S 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438623 1437809 evolution 38872 0.2 S 00:07 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437335 1437319 evolution 38784 0.0 S 01:48 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437252 1419739 evolution 38760 0.0 S 01:54 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1436963 1435860 evolution 38516 0.0 S 02:16 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437525 1437322 evolution 38408 0.0 S 01:31 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1438731 1438690 evolution 37004 0.0 S 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437327 1437105 evolution 36752 0.0 S 01:49 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1438694 1438441 evolution 36620 0.0 S 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 167562 166914 netdata 36504 0.1 Sl 4-09:12:34 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2495258 1 wp-toolkit 36160 0.0 Ss 1-10:21:04 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 3651775 1 root 30800 0.0 Ss 09:10:40 lfd - sleeping 2495169 1 wp-toolkit 24472 0.0 Ss 1-10:21:04 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1419738 506832 nobody 24088 0.0 S 05:51 /usr/sbin/httpd -k start 1419096 506832 nobody 23284 0.1 S 06:51 /usr/sbin/httpd -k start 1435559 506832 nobody 23228 0.0 S 04:11 /usr/sbin/httpd -k start 1419739 506832 nobody 22920 0.0 S 05:51 /usr/sbin/httpd -k start 1436586 506832 nobody 22476 0.1 S 02:51 /usr/sbin/httpd -k start 1435860 506832 nobody 22424 0.0 S 03:50 /usr/sbin/httpd -k start 1437320 506832 nobody 22104 0.0 S 01:49 /usr/sbin/httpd -k start 1436156 506832 nobody 21988 0.0 S 03:22 /usr/sbin/httpd -k start 1419737 506832 nobody 21588 0.0 S 05:51 /usr/sbin/httpd -k start 1435602 506832 nobody 21584 0.0 S 04:10 /usr/sbin/httpd -k start 1435595 506832 nobody 21460 0.0 S 04:10 /usr/sbin/httpd -k start 1436162 506832 nobody 21436 0.1 S 03:22 /usr/sbin/httpd -k start 1435446 506832 nobody 21220 0.0 S 04:22 /usr/sbin/httpd -k start 1437313 506832 nobody 21064 0.1 S 01:50 /usr/sbin/httpd -k start 1437275 506832 nobody 20912 0.0 S 01:52 /usr/sbin/httpd -k start 1438440 506832 nobody 20744 0.2 S 00:23 /usr/sbin/httpd -k start 1438034 506832 nobody 20568 0.1 S 00:53 /usr/sbin/httpd -k start 1436945 506832 nobody 20464 0.1 S 02:20 /usr/sbin/httpd -k start 1436571 506832 nobody 20352 0.0 S 02:52 /usr/sbin/httpd -k start 1437809 506832 nobody 20248 0.0 S 01:09 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+----------------------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+----------------------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9835654 | claude | 108-1481181613 | Query | 1391 | Sending data | SELECT 'job-items with BOTH picking and dispatch' k, COUNT(*) v FROM ( SELECT ji.id FROM jobInventory ji WHERE EXISTS(SELECT 1 FROM pickingitems pi JOIN picking p ON p.id=pi.pickingid WHERE pi.jobitemid=ji.id AND p.datecreated BETWEEN @from AND @to) AND EXISTS(SELECT 1 FROM dispatchitems di | | 9953837 | root | 108-1481181613 | Execute | 166 | Waiting for table level lock | update dispatchitems set qty = ?, dispatchbinsources = ? where id =? and dispatchid = ? | | 9957582 | root | 108-1481181613 | Execute | 141 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29402' AND dispatchitems.j | | 9962083 | root | 108-1481181613 | Execute | 113 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29405' AND dispatchitems.j | | 9964402 | root | 108-1481181613 | Execute | 90 | Waiting for table level lock | SELECT sum(dispatchitems.qty) as complete from dispatchitems,dispatch WHERE dispatchitems.jobitemid='200379' and dispatchitems.dispatchid=dispatch.id AND dispatch.status>='0' | | 9966195 | root | 108-1481181613 | Execute | 80 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9975761 | root | 108-1481181613 | Execute | 4 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29405' AND dispatchitems.j | | 9976214 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 9976213 | unauthenticated user | NULL | Connect | 0 | Reading from net | NULL | | 9976211 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 9976209 | root | 85-1559715131 | Execute | 0 | Sending data | SELECT id,name from uploads where category = '1' and subtype like '%Purchase%' AND status='1' | | 9975776 | olympic_wp | olympic_wp | Query | 0 | Preparing | SELECT * FROM nqNZ24_actionscheduler_logs WHERE action_id=42809 | +---------+----------------------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9953837 | 108-1481181613 | 166 | Waiting for table level lock | update dispatchitems set qty = ?, dispatchbinsources = ? where id =? and dispatchid = ? | | 9957582 | 108-1481181613 | 141 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9962083 | 108-1481181613 | 113 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9964402 | 108-1481181613 | 90 | Waiting for table level lock | SELECT sum(dispatchitems.qty) as complete from dispatchitems,dispatch WHERE dispatchitems.jobitemid='200379' and dispatchitems.dispatchid=dispatch.id AND dispatch.status>='0' | | 9966195 | 108-1481181613 | 80 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9975761 | 108-1481181613 | 4 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 908 evolution/portal.evolutionerp.com.au-ssl_log 45 evolution/app.evolutionerp.com.au-ssl_log 24 aaa/aaadownunder.com.au-ssl_log 23 nrg/nrgservices.net.au-ssl_log 12 madalice/madalice.com.au-ssl_log 7 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 361 103.104.165.99 213 203.54.180.238 103 120.150.225.142 90 1.144.107.82 68 182.239.240.254 50 103.104.164.114 44 150.228.151.88 35 1.125.108.125 24 40.115.94.245 11 93.152.221.156 4 180.181.236.49 3 114.119.146.16 2 165.225.233.87 2 104.28.125.11 1 52.167.144.197 --- top request paths across all vhosts (last 3 min) --- 269 POST /functions.php 207 GET /app/ajax.php 106 GET /index.php 54 POST /plugins/csvexporter/plugin.php 34 POST /jobeditsave.php 31 POST /app/ajax.php 28 POST /clienteditsave.php 28 GET /heartbeat.php 27 POST /app/ajax/selectFilterSingle.php 20 POST /app/ajax/selectFilter.php 18 POST /quoteditsave.php 14 POST /purchaseaddsave.php 13 HEAD /index.php 11 POST /plugins/fencecosting/plugin.php 11 POST /logsave.php 8 POST /itemModify.php 8 POST /inveditsave.php 7 POST /mfreqsave.php 6 POST /plugins/pipe/pipetopostsave.php 6 POST /dispatchsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 269 POST /functions.php 207 GET /app/ajax.php 93 GET /index.php 54 POST /plugins/csvexporter/plugin.php 34 POST /jobeditsave.php 31 POST /app/ajax.php 28 POST /clienteditsave.php 27 POST /app/ajax/selectFilterSingle.php 20 POST /app/ajax/selectFilter.php 18 POST /quoteditsave.php 14 POST /purchaseaddsave.php 13 HEAD /index.php -- last 10 requests -- 203.54.180.238 - - [10/Sep/2026:11:34:53 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 52 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=29709" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 203.54.180.238 - - [10/Sep/2026:11:34:53 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter= HTTP/1.1" 200 24112 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79299§ionid=0" "Mozilla/5.0 103.104.164.114 - - [10/Sep/2026:11:34:54 +1000] "POST /billaddsave.php HTTP/1.1" 200 61 "https://my.evolutionerp.com.au/index.php?page=billadd&billid=271" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K 157.55.39.48 - - [10/Sep/2026:11:34:54 +1000] "GET /index.php?page=jobedit&id=29537 HTTP/1.1" 200 5693 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Ch 203.54.180.238 - - [10/Sep/2026:11:34:54 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 52 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=26125" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 203.54.180.238 - - [10/Sep/2026:11:34:55 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobedit%26id%3D29730&call=getUserSetting&caller=ajaxSubmitLocal&seq=16734024498 HTTP/1.1" 200 98 "https://my.evolutionerp.com.au 103.104.165.99 - - [10/Sep/2026:11:34:56 +1000] "POST /tasksave.php HTTP/1.1" 302 21 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12138" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 203.54.180.238 - - [10/Sep/2026:11:34:57 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=76985" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 203.54.180.238 - - [10/Sep/2026:11:34:57 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobedit%26id%3D26125&call=getUserSetting&caller=ajaxSubmitLocal&seq=19918802206 HTTP/1.1" 200 98 "https://my.evolutionerp.com.au 103.104.165.99 - - [10/Sep/2026:11:34:57 +1000] "POST /purchaseaddsave.php?save=1 HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=11320" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) A == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 28 GET /heartbeat.php 13 GET /index.php 2 GET /uploadsave.php 1 POST /uploadsave.php 1 POST /login.php -- last 10 requests -- 203.54.180.238 - - [10/Sep/2026:11:33:30 +1000] "GET /heartbeat.php?sentAt=1789004011&bytes=106,162,8,235&_=1788957671715 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:33:34 +1000] "GET /heartbeat.php?sentAt=1789004014&bytes=106,162,8,238&_=1788987692395 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:33:40 +1000] "GET /heartbeat.php?sentAt=1789004021&bytes=106,162,8,245&_=1788957671716 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:33:44 +1000] "GET /heartbeat.php?sentAt=1789004024&bytes=106,162,8,248&_=1788987692396 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:33:50 +1000] "GET /heartbeat.php?sentAt=1789004031&bytes=106,162,8,255&_=1788957671717 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:33:54 +1000] "GET /heartbeat.php?sentAt=1789004034&bytes=106,162,9,2&_=1788987692397 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" "M 203.54.180.238 - - [10/Sep/2026:11:34:00 +1000] "GET /heartbeat.php?sentAt=1789004041&bytes=106,162,9,9&_=1788957671718 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" "M 203.54.180.238 - - [10/Sep/2026:11:34:04 +1000] "GET /heartbeat.php?sentAt=1789004044&bytes=106,162,9,12&_=1788987692398 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" " 203.54.180.238 - - [10/Sep/2026:11:34:10 +1000] "GET /heartbeat.php?sentAt=1789004051&bytes=106,162,9,19&_=1788957671719 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" " 203.54.180.238 - - [10/Sep/2026:11:34:14 +1000] "GET /heartbeat.php?sentAt=1789004054&bytes=106,162,9,22&_=1788987692399 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" " == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 1 GET /api/getItem/SGC-100 1 GET /api/getItem/PC5025BL 1 GET /api/getItem/PC19 1 GET /api/getItem/PC16 1 GET /api/getItem/PC15050 1 GET /api/getItem/PC1212 1 GET /api/getItem/PC10050 1 GET /api/getItem/K125MSGB 1 GET /api/getItem/IPC90NB 1 GET /api/getItem/IPC7575 1 GET /api/getItem/IPC7550 1 GET /api/getItem/IPC6565 -- last 10 requests -- 40.115.94.245 - - [10/Sep/2026:11:32:05 +1000] "GET /api/getItem/IPC6565 HTTP/1.1" 200 1469 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:32:05 +1000] "GET /api/getItem/IPC7550 HTTP/1.1" 200 1321 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:32:06 +1000] "GET /api/getItem/IPC7575 HTTP/1.1" 200 1473 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:32:06 +1000] "GET /api/getItem/IPC90NB HTTP/1.1" 200 1338 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:32:07 +1000] "GET /api/getItem/PC10050 HTTP/1.1" 404 109 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:32:07 +1000] "GET /api/getItem/PC1212 HTTP/1.1" 200 1338 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:32:07 +1000] "GET /api/getItem/PC15050 HTTP/1.1" 404 109 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:32:08 +1000] "GET /api/getItem/PC16 HTTP/1.1" 200 1618 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:32:08 +1000] "GET /api/getItem/PC19 HTTP/1.1" 404 106 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:32:08 +1000] "GET /api/getItem/PC5025BL HTTP/1.1" 200 1489 "-" "RestSharp/106.13.0.0" --- last 30 samples (run-up to this incident) --- 2026-09-10 11:32:31 L1=2.77 run=2 blk=0 avail=8037 (58.3%) swpO=0 conn=3 myRSS=2936 php=6 phpRSS=217 ap=36 tcp=31 topuser=madalice 2026-09-10 11:32:37 L1=2.70 run=2 blk=0 avail=7993 (58.0%) swpO=0 conn=5 myRSS=2936 php=7 phpRSS=275 ap=37 tcp=43 topuser=evolution 2026-09-10 11:32:41 L1=2.65 run=5 blk=0 avail=7884 (57.2%) swpO=0 conn=3 myRSS=2936 php=9 phpRSS=425 ap=38 tcp=35 topuser=infinium 2026-09-10 11:32:47 L1=2.52 run=3 blk=0 avail=8091 (58.7%) swpO=0 conn=5 myRSS=2936 php=8 phpRSS=218 ap=36 tcp=36 topuser=evolution 2026-09-10 11:32:51 L1=2.47 run=4 blk=0 avail=7936 (57.6%) swpO=0 conn=7 myRSS=2936 php=10 phpRSS=404 ap=36 tcp=40 topuser=evolution 2026-09-10 11:32:57 L1=2.68 run=2 blk=0 avail=7768 (56.4%) swpO=0 conn=5 myRSS=2936 php=11 phpRSS=542 ap=43 tcp=49 topuser=evolution 2026-09-10 11:33:01 L1=2.62 run=2 blk=0 avail=7821 (56.8%) swpO=0 conn=7 myRSS=2936 php=10 phpRSS=485 ap=42 tcp=39 topuser=madalice 2026-09-10 11:33:07 L1=2.49 run=2 blk=0 avail=7733 (56.1%) swpO=0 conn=5 myRSS=2936 php=13 phpRSS=636 ap=42 tcp=52 topuser=evolution 2026-09-10 11:33:11 L1=2.45 run=3 blk=0 avail=7615 (55.3%) swpO=0 conn=7 myRSS=2936 php=15 phpRSS=711 ap=54 tcp=51 topuser=evolution 2026-09-10 11:33:17 L1=2.42 run=3 blk=0 avail=7860 (57.1%) swpO=0 conn=8 myRSS=2936 php=13 phpRSS=441 ap=52 tcp=45 topuser=evolution 2026-09-10 11:33:22 L1=2.30 run=5 blk=0 avail=7919 (57.5%) swpO=0 conn=7 myRSS=2936 php=12 phpRSS=386 ap=48 tcp=43 topuser=evolution 2026-09-10 11:33:27 L1=2.28 run=9 blk=0 avail=7731 (56.1%) swpO=0 conn=8 myRSS=2936 php=19 phpRSS=752 ap=49 tcp=54 topuser=evolution 2026-09-10 11:33:32 L1=2.17 run=2 blk=0 avail=7734 (56.1%) swpO=0 conn=7 myRSS=2936 php=16 phpRSS=638 ap=52 tcp=49 topuser=evolution 2026-09-10 11:33:37 L1=2.32 run=2 blk=0 avail=7716 (56.0%) swpO=0 conn=8 myRSS=2936 php=18 phpRSS=739 ap=50 tcp=46 topuser=evolution 2026-09-10 11:33:42 L1=2.30 run=4 blk=0 avail=7661 (55.6%) swpO=0 conn=7 myRSS=2936 php=22 phpRSS=902 ap=46 tcp=47 topuser=evolution 2026-09-10 11:33:47 L1=2.19 run=3 blk=0 avail=7678 (55.7%) swpO=0 conn=8 myRSS=2936 php=18 phpRSS=805 ap=46 tcp=56 topuser=evolution 2026-09-10 11:33:52 L1=2.42 run=2 blk=0 avail=7739 (56.2%) swpO=0 conn=8 myRSS=2936 php=17 phpRSS=698 ap=48 tcp=48 topuser=evolution 2026-09-10 11:33:57 L1=2.38 run=4 blk=0 avail=7742 (56.2%) swpO=0 conn=8 myRSS=2936 php=19 phpRSS=784 ap=47 tcp=46 topuser=evolution 2026-09-10 11:34:02 L1=2.35 run=5 blk=0 avail=7572 (55.0%) swpO=0 conn=8 myRSS=2936 php=20 phpRSS=965 ap=46 tcp=54 topuser=evolution 2026-09-10 11:34:07 L1=2.48 run=3 blk=0 avail=7606 (55.2%) swpO=0 conn=8 myRSS=2936 php=20 phpRSS=834 ap=61 tcp=61 topuser=evolution 2026-09-10 11:34:12 L1=2.37 run=3 blk=0 avail=7711 (56.0%) swpO=0 conn=8 myRSS=2936 php=19 phpRSS=727 ap=59 tcp=50 topuser=evolution 2026-09-10 11:34:17 L1=2.26 run=6 blk=0 avail=7590 (55.1%) swpO=0 conn=11 myRSS=2936 php=21 phpRSS=934 ap=54 tcp=55 topuser=evolution 2026-09-10 11:34:22 L1=2.16 run=3 blk=0 avail=7676 (55.7%) swpO=0 conn=8 myRSS=2936 php=21 phpRSS=834 ap=55 tcp=58 topuser=evolution 2026-09-10 11:34:27 L1=2.06 run=4 blk=0 avail=7586 (55.1%) swpO=0 conn=11 myRSS=2936 php=24 phpRSS=1003 ap=54 tcp=50 topuser=evolution 2026-09-10 11:34:32 L1=2.06 run=6 blk=0 avail=7618 (55.3%) swpO=0 conn=8 myRSS=2936 php=22 phpRSS=932 ap=54 tcp=56 topuser=evolution 2026-09-10 11:34:37 L1=2.05 run=4 blk=0 avail=7478 (54.3%) swpO=0 conn=11 myRSS=2936 php=21 phpRSS=988 ap=60 tcp=44 topuser=evolution 2026-09-10 11:34:42 L1=1.97 run=3 blk=0 avail=7534 (54.7%) swpO=0 conn=8 myRSS=2936 php=22 phpRSS=991 ap=56 tcp=44 topuser=evolution 2026-09-10 11:34:47 L1=2.05 run=2 blk=0 avail=7560 (54.9%) swpO=0 conn=11 myRSS=2936 php=22 phpRSS=991 ap=51 tcp=52 topuser=evolution 2026-09-10 11:34:52 L1=2.21 run=2 blk=0 avail=7552 (54.8%) swpO=0 conn=8 myRSS=2936 php=23 phpRSS=1029 ap=51 tcp=53 topuser=evolution 2026-09-10 11:34:58 L1=2.35 run=6 blk=0 avail=7329 (53.2%) swpO=0 conn=12 myRSS=2936 php=28 phpRSS=1369 ap=54 tcp=54 topuser=evolution