INCIDENT 2026-09-10 11:35:58 trigger: php_procs=33 ================================================================== load: 2.65 2.70 2.49 6/683 1454498 ncpu:10 mem_avail: 7350MB/13777MB (53.3%) swap_used:1415MB swapout:0/s blocked(D):0 running:6 iowait:0.1% steal:0.0% php: 33 procs / 1336MB heaviest user: evolution (31 procs, 1199MB) apache: 65 procs tcp_estab: 60 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2936 evolution 36 1241 nobody 64 1181 root 242 907 kamcool 3 386 netdata 8 256 mailman 20 183 madalice 1 134 dovenull 6 66 wp-toolkit 3 61 cpanellogin 1 50 alison 3 41 dovecot 3 28 mailnull 3 25 polkitd 1 15 vinesit 1 14 kurri 1 12 zabbix 1 9 nscd 1 6 named 1 5 --- php workers by user --- USER PROCS RSS_MB evolution 32 1237 madalice 1 134 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5040 MB Active(file): 4451 MB Inactive(file): 711 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 523 MB CommitLimit: 10984 MB Committed_AS: 9630 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 9-09:13:34 3696 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 3006648 14.9 Ssl 2-06:50:31 /usr/sbin/mariadbd 166870 1 netdata 200472 2.7 Ssl 4-09:13:40 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2328754 1 root 194076 0.0 Ss 2-06:50:41 /usr/lib/systemd/systemd-journald 3701672 3652415 kamcool 193016 0.1 R 09:00:46 spamd child 1454468 3701672 kamcool 189356 0.0 S 00:00 spamd child (razor2) 3701673 3652415 root 160876 0.0 S 09:00:46 spamd child 3652415 1 root 148060 0.0 Ss 09:11:07 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1454298 167896 madalice 138024 9.6 S 00:14 php-fpm: pool madalice_com_au 509236 509098 root 68164 0.0 Sl 13-09:16:20 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1436920 1435595 evolution 59164 0.0 S 03:22 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1438671 1419096 evolution 58224 0.1 S 01:05 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437265 1437120 evolution 58088 0.0 S 02:54 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1382815 1353308 cpanellogin 51324 0.0 S 17:30 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 1353308 1 root 42368 0.0 Ss 50-08:54:46 cpsrvd (SSL) - waiting for connections 1454144 1435446 evolution 41524 0.1 S 00:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436669 1419737 evolution 41488 0.0 S 03:47 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1437554 1419738 evolution 41076 0.0 S 02:31 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436992 1435559 evolution 41016 0.0 S 03:15 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438043 1436907 evolution 40980 0.0 S 01:54 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436739 1435940 evolution 40884 0.0 S 03:40 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438231 1438076 evolution 40652 0.0 S 01:38 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437858 1437119 evolution 40648 0.0 S 02:06 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437497 1437325 evolution 40616 0.0 S 02:36 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1436963 1435860 evolution 40584 0.0 S 03:17 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437252 1419739 evolution 40560 0.0 S 02:55 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437654 1436586 evolution 40472 0.0 S 02:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1439120 1438976 evolution 40332 0.0 S 00:56 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1453831 1446040 evolution 40308 0.1 S 00:37 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1469 1 root 39812 0.1 Ss 73-01:26:15 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1438494 1438439 evolution 39348 0.0 S 01:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1454493 1437313 evolution 39288 0.0 S 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1454380 1438021 evolution 39148 0.2 S 00:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438623 1437809 evolution 38872 0.0 S 01:08 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437335 1437319 evolution 38784 0.0 S 02:49 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1454393 1449042 evolution 38632 0.3 S 00:06 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1453909 1437324 evolution 38596 0.0 S 00:31 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1454202 1438690 evolution 38576 0.2 S 00:19 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1453908 1437320 evolution 38512 0.1 S 00:31 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1454027 1453986 evolution 38512 0.1 S 00:25 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437525 1437322 evolution 38408 0.0 S 02:32 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1454531 1438440 evolution 37236 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437327 1437105 evolution 36752 0.0 S 02:50 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 167562 166914 netdata 36504 0.1 Sl 4-09:13:35 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2495258 1 wp-toolkit 36160 0.0 Ss 1-10:22:05 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 3651775 1 root 30800 0.0 Ss 09:11:41 lfd - sleeping 2495169 1 wp-toolkit 24472 0.0 Ss 1-10:22:05 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1419738 506832 nobody 24088 0.0 S 06:52 /usr/sbin/httpd -k start 1436571 506832 nobody 23800 0.0 S 03:53 /usr/sbin/httpd -k start 1419096 506832 nobody 23284 0.0 S 07:52 /usr/sbin/httpd -k start 1435559 506832 nobody 23228 0.0 S 05:12 /usr/sbin/httpd -k start 1435602 506832 nobody 23020 0.0 S 05:11 /usr/sbin/httpd -k start 1419739 506832 nobody 22920 0.0 S 06:52 /usr/sbin/httpd -k start 1437313 506832 nobody 22760 0.1 S 02:51 /usr/sbin/httpd -k start 1437275 506832 nobody 22544 0.0 S 02:53 /usr/sbin/httpd -k start 1436586 506832 nobody 22476 0.0 S 03:52 /usr/sbin/httpd -k start 1435860 506832 nobody 22424 0.0 S 04:51 /usr/sbin/httpd -k start 1435446 506832 nobody 22348 0.0 S 05:23 /usr/sbin/httpd -k start 1436156 506832 nobody 22328 0.0 S 04:23 /usr/sbin/httpd -k start 1437320 506832 nobody 22240 0.0 S 02:50 /usr/sbin/httpd -k start 1438440 506832 nobody 22060 0.1 S 01:24 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9835654 | claude | 108-1481181613 | Query | 1452 | Sending data | SELECT 'job-items with BOTH picking and dispatch' k, COUNT(*) v FROM ( SELECT ji.id FROM jobInventory ji WHERE EXISTS(SELECT 1 FROM pickingitems pi JOIN picking p ON p.id=pi.pickingid WHERE pi.jobitemid=ji.id AND p.datecreated BETWEEN @from AND @to) AND EXISTS(SELECT 1 FROM dispatchitems di | | 9953837 | root | 108-1481181613 | Execute | 227 | Waiting for table level lock | update dispatchitems set qty = ?, dispatchbinsources = ? where id =? and dispatchid = ? | | 9957582 | root | 108-1481181613 | Execute | 201 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29402' AND dispatchitems.j | | 9962083 | root | 108-1481181613 | Execute | 173 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29405' AND dispatchitems.j | | 9964402 | root | 108-1481181613 | Execute | 151 | Waiting for table level lock | SELECT sum(dispatchitems.qty) as complete from dispatchitems,dispatch WHERE dispatchitems.jobitemid='200379' and dispatchitems.dispatchid=dispatch.id AND dispatch.status>='0' | | 9966195 | root | 108-1481181613 | Execute | 141 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9975761 | root | 108-1481181613 | Execute | 65 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29405' AND dispatchitems.j | | 9982965 | root | 108-1481181613 | Execute | 22 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9987770 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9953837 | 108-1481181613 | 227 | Waiting for table level lock | update dispatchitems set qty = ?, dispatchbinsources = ? where id =? and dispatchid = ? | | 9957582 | 108-1481181613 | 201 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9962083 | 108-1481181613 | 173 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9964402 | 108-1481181613 | 151 | Waiting for table level lock | SELECT sum(dispatchitems.qty) as complete from dispatchitems,dispatch WHERE dispatchitems.jobitemid='200379' and dispatchitems.dispatchid=dispatch.id AND dispatch.status>='0' | | 9966195 | 108-1481181613 | 141 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9975761 | 108-1481181613 | 65 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9982965 | 108-1481181613 | 22 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 1023 evolution/portal.evolutionerp.com.au-ssl_log 41 nrg/nrgservices.net.au-ssl_log 21 nrg/nrgservices.net.au 20 aaa/aaadownunder.com.au-ssl_log 15 madalice/madalice.com.au-ssl_log 9 corpkicks/corporatekicks.com.au-ssl_log 8 alison/alisonarts.com.au-ssl_log 4 evolution/evolutionerp.com.au-ssl_log 3 olympic/olympicfencing.com.au-ssl_log 3 customc/customcentral.com.au-ssl_log 2 infinium/infinium.net.au-ssl_log 2 otterfencing/otterfencing.com.au-ssl_log 2 customkidscom/customkids.com.au-ssl_log 1 evolution/evolutionerp.com.au 1 (total vhosts taking traffic: 17) --- top client IPs across all vhosts (last 3 min) --- 338 103.104.165.99 256 203.54.180.238 120 120.150.225.142 118 1.144.107.82 91 103.104.164.114 78 182.239.240.254 44 150.228.151.88 38 93.152.221.156 13 1.125.108.125 8 147.161.213.71 8 118.127.40.55 4 83.99.206.113 3 49.233.45.47 3 180.181.236.49 3 165.225.233.87 --- top request paths across all vhosts (last 3 min) --- 282 POST /functions.php 237 GET /app/ajax.php 112 GET /index.php 54 POST /plugins/csvexporter/plugin.php 40 POST /app/ajax/selectFilter.php 34 POST /app/ajax.php 34 GET /heartbeat.php 32 POST /clienteditsave.php 32 POST /app/ajax/selectFilterSingle.php 29 POST /jobeditsave.php 25 POST /quoteditsave.php 16 POST /purchaseaddsave.php 16 POST /itemModify.php 13 POST /dispatchsave.php 13 HEAD /index.php 12 POST /logsave.php 11 POST /inveditsave.php 11 GET / 10 POST /billaddsave.php 8 POST /wp-cron.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 282 POST /functions.php 237 GET /app/ajax.php 105 GET /index.php 54 POST /plugins/csvexporter/plugin.php 40 POST /app/ajax/selectFilter.php 34 POST /app/ajax.php 32 POST /clienteditsave.php 32 POST /app/ajax/selectFilterSingle.php 29 POST /jobeditsave.php 25 POST /quoteditsave.php 16 POST /purchaseaddsave.php 16 POST /itemModify.php -- last 10 requests -- 103.104.164.114 - - [10/Sep/2026:11:35:56 +1000] "GET /index.php?page=invoiceadd&invoiceid=5043 HTTP/1.1" 200 50907 "https://my.evolutionerp.com.au/index.php?page=dispatchedit&dispatchid=291" "Mozilla/5.0 (Windows NT 10. 103.104.164.114 - - [10/Sep/2026:11:35:57 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dinvoiceadd%26invoiceid%3D5043%26tab%3Dmaintab&call=getUserSetting&caller=ajaxSubmitLocal&seq=19431037481 HTTP 103.104.164.114 - - [10/Sep/2026:11:35:57 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=17910706073 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/inde 103.104.164.114 - - [10/Sep/2026:11:35:57 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=10241491025 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/ind 103.104.164.114 - - [10/Sep/2026:11:35:57 +1000] "POST /app/ajax/selectFilter.php?call=filterinv&filter=&cursel=Please%20Select&curseltext=&fromMS=1&&nolimit=LIMIT%2050&include=&tid=%25%25&invjobid=174&clientid=48&return 103.104.164.114 - - [10/Sep/2026:11:35:57 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvoiceadd%26invoiceid%3D5043%26tab%3Dmaintab&call=getUserSetting&caller=ajaxSubmitLocal&seq=16253646558 HTTP/1.1" 200 112 "htt 103.104.164.114 - - [10/Sep/2026:11:35:57 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=5043&tab=maintab" "Mozilla/5.0 (Windows NT 103.104.164.114 - - [10/Sep/2026:11:35:57 +1000] "POST /clienteditsave.php?clientid=48&call=getCategoryDiscounts HTTP/1.1" 200 25 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=5043&tab=maintab" "Moz 203.54.180.238 - - [10/Sep/2026:11:35:57 +1000] "POST /app/ajax.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=77613" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K 103.104.164.114 - - [10/Sep/2026:11:35:58 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=5043&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 34 GET /heartbeat.php 7 GET /index.php -- last 10 requests -- 203.54.180.238 - - [10/Sep/2026:11:35:04 +1000] "GET /heartbeat.php?sentAt=1789004104&bytes=106,162,9,72&_=1788987692404 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" " 203.54.180.238 - - [10/Sep/2026:11:35:10 +1000] "GET /heartbeat.php?sentAt=1789004111&bytes=106,162,9,79&_=1788957671725 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" " 203.54.180.238 - - [10/Sep/2026:11:35:14 +1000] "GET /heartbeat.php?sentAt=1789004114&bytes=106,162,9,82&_=1788987692405 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" " 203.54.180.238 - - [10/Sep/2026:11:35:20 +1000] "GET /heartbeat.php?sentAt=1789004121&bytes=106,162,9,89&_=1788957671726 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" " 203.54.180.238 - - [10/Sep/2026:11:35:24 +1000] "GET /heartbeat.php?sentAt=1789004124&bytes=106,162,9,92&_=1788987692406 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" " 203.54.180.238 - - [10/Sep/2026:11:35:30 +1000] "GET /heartbeat.php?sentAt=1789004131&bytes=106,162,9,99&_=1788957671727 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" " 203.54.180.238 - - [10/Sep/2026:11:35:32 +1000] "GET /index.php?page=dispatches HTTP/1.1" 200 52704 "https://portal.evolutionerp.com.au/index.php?page=delivery_commit&id=34218" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [10/Sep/2026:11:35:34 +1000] "GET /heartbeat.php?sentAt=1789004134&bytes=106,162,9,102&_=1788987692407 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:35:40 +1000] "GET /heartbeat.php?sentAt=1789004141&bytes=106,162,9,109&_=1788957671728 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:35:44 +1000] "GET /heartbeat.php?sentAt=1789004144&bytes=106,162,9,112&_=1788987692408 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" == nrg/nrgservices.net.au-ssl_log == -- top paths -- 2 GET / 1 GET /wp-json/vsfw/v1/videos 1 GET /test.php 1 GET /_profiler/phpinfo 1 GET /pi.php 1 GET /pinfo.php 1 GET /php_version.php 1 GET /php.php 1 GET /phpinfo.php 1 GET /php_info.php 1 GET /phpinfo 1 GET /i.php -- last 10 requests -- 93.152.221.156 - - [10/Sep/2026:11:34:19 +1000] "GET /admin/phpinfo.php HTTP/1.1" 403 12 "http://nrgservices.net.au/admin/phpinfo.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chr 93.152.221.156 - - [10/Sep/2026:11:34:19 +1000] "GET /pinfo.php HTTP/1.1" 200 19 "http://nrgservices.net.au/pinfo.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/5 93.152.221.156 - - [10/Sep/2026:11:34:20 +1000] "GET /php_version.php HTTP/1.1" 200 19 "http://nrgservices.net.au/php_version.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472. 93.152.221.156 - - [10/Sep/2026:11:34:20 +1000] "GET /.aws/credentials HTTP/1.1" 403 13 "http://nrgservices.net.au/.aws/credentials" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrom 93.152.221.156 - - [10/Sep/2026:11:34:21 +1000] "GET /.env HTTP/1.1" 403 12 "http://nrgservices.net.au/.env" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" 93.152.221.156 - - [10/Sep/2026:11:34:22 +1000] "GET /.env.example HTTP/1.1" 403 12 "http://nrgservices.net.au/.env.example" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4 93.152.221.156 - - [10/Sep/2026:11:34:22 +1000] "GET /.env.local HTTP/1.1" 403 12 "http://nrgservices.net.au/.env.local" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0 93.152.221.156 - - [10/Sep/2026:11:34:23 +1000] "GET /.env.backup HTTP/1.1" 403 12 "http://nrgservices.net.au/.env.backup" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.447 93.152.221.156 - - [10/Sep/2026:11:34:23 +1000] "GET /config/.env HTTP/1.1" 403 12 "http://nrgservices.net.au/config/.env" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safa 103.24.233.22 - - [10/Sep/2026:11:34:59 +1000] "GET / HTTP/1.1" 301 288 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" --- last 30 samples (run-up to this incident) --- 2026-09-10 11:33:32 L1=2.17 run=2 blk=0 avail=7734 (56.1%) swpO=0 conn=7 myRSS=2936 php=16 phpRSS=638 ap=52 tcp=49 topuser=evolution 2026-09-10 11:33:37 L1=2.32 run=2 blk=0 avail=7716 (56.0%) swpO=0 conn=8 myRSS=2936 php=18 phpRSS=739 ap=50 tcp=46 topuser=evolution 2026-09-10 11:33:42 L1=2.30 run=4 blk=0 avail=7661 (55.6%) swpO=0 conn=7 myRSS=2936 php=22 phpRSS=902 ap=46 tcp=47 topuser=evolution 2026-09-10 11:33:47 L1=2.19 run=3 blk=0 avail=7678 (55.7%) swpO=0 conn=8 myRSS=2936 php=18 phpRSS=805 ap=46 tcp=56 topuser=evolution 2026-09-10 11:33:52 L1=2.42 run=2 blk=0 avail=7739 (56.2%) swpO=0 conn=8 myRSS=2936 php=17 phpRSS=698 ap=48 tcp=48 topuser=evolution 2026-09-10 11:33:57 L1=2.38 run=4 blk=0 avail=7742 (56.2%) swpO=0 conn=8 myRSS=2936 php=19 phpRSS=784 ap=47 tcp=46 topuser=evolution 2026-09-10 11:34:02 L1=2.35 run=5 blk=0 avail=7572 (55.0%) swpO=0 conn=8 myRSS=2936 php=20 phpRSS=965 ap=46 tcp=54 topuser=evolution 2026-09-10 11:34:07 L1=2.48 run=3 blk=0 avail=7606 (55.2%) swpO=0 conn=8 myRSS=2936 php=20 phpRSS=834 ap=61 tcp=61 topuser=evolution 2026-09-10 11:34:12 L1=2.37 run=3 blk=0 avail=7711 (56.0%) swpO=0 conn=8 myRSS=2936 php=19 phpRSS=727 ap=59 tcp=50 topuser=evolution 2026-09-10 11:34:17 L1=2.26 run=6 blk=0 avail=7590 (55.1%) swpO=0 conn=11 myRSS=2936 php=21 phpRSS=934 ap=54 tcp=55 topuser=evolution 2026-09-10 11:34:22 L1=2.16 run=3 blk=0 avail=7676 (55.7%) swpO=0 conn=8 myRSS=2936 php=21 phpRSS=834 ap=55 tcp=58 topuser=evolution 2026-09-10 11:34:27 L1=2.06 run=4 blk=0 avail=7586 (55.1%) swpO=0 conn=11 myRSS=2936 php=24 phpRSS=1003 ap=54 tcp=50 topuser=evolution 2026-09-10 11:34:32 L1=2.06 run=6 blk=0 avail=7618 (55.3%) swpO=0 conn=8 myRSS=2936 php=22 phpRSS=932 ap=54 tcp=56 topuser=evolution 2026-09-10 11:34:37 L1=2.05 run=4 blk=0 avail=7478 (54.3%) swpO=0 conn=11 myRSS=2936 php=21 phpRSS=988 ap=60 tcp=44 topuser=evolution 2026-09-10 11:34:42 L1=1.97 run=3 blk=0 avail=7534 (54.7%) swpO=0 conn=8 myRSS=2936 php=22 phpRSS=991 ap=56 tcp=44 topuser=evolution 2026-09-10 11:34:47 L1=2.05 run=2 blk=0 avail=7560 (54.9%) swpO=0 conn=11 myRSS=2936 php=22 phpRSS=991 ap=51 tcp=52 topuser=evolution 2026-09-10 11:34:52 L1=2.21 run=2 blk=0 avail=7552 (54.8%) swpO=0 conn=8 myRSS=2936 php=23 phpRSS=1029 ap=51 tcp=53 topuser=evolution 2026-09-10 11:34:58 L1=2.35 run=6 blk=0 avail=7329 (53.2%) swpO=0 conn=12 myRSS=2936 php=28 phpRSS=1369 ap=54 tcp=54 topuser=evolution 2026-09-10 11:35:02 L1=2.40 run=5 blk=0 avail=7389 (53.6%) swpO=0 conn=9 myRSS=2936 php=26 phpRSS=1161 ap=61 tcp=66 topuser=evolution 2026-09-10 11:35:08 L1=2.45 run=10 blk=0 avail=7307 (53.0%) swpO=0 conn=11 myRSS=2936 php=29 phpRSS=1325 ap=65 tcp=73 topuser=evolution 2026-09-10 11:35:12 L1=2.66 run=5 blk=0 avail=7295 (53.0%) swpO=0 conn=10 myRSS=2936 php=26 phpRSS=1181 ap=76 tcp=61 topuser=evolution 2026-09-10 11:35:18 L1=2.60 run=4 blk=0 avail=7352 (53.4%) swpO=0 conn=11 myRSS=2936 php=26 phpRSS=1186 ap=70 tcp=58 topuser=evolution 2026-09-10 11:35:22 L1=2.64 run=4 blk=0 avail=7470 (54.2%) swpO=0 conn=11 myRSS=2936 php=28 phpRSS=1146 ap=66 tcp=59 topuser=evolution 2026-09-10 11:35:28 L1=2.50 run=2 blk=0 avail=7458 (54.1%) swpO=0 conn=10 myRSS=2936 php=29 phpRSS=1201 ap=61 tcp=77 topuser=evolution 2026-09-10 11:35:32 L1=2.38 run=6 blk=0 avail=7383 (53.6%) swpO=0 conn=9 myRSS=2936 php=28 phpRSS=1151 ap=76 tcp=76 topuser=evolution 2026-09-10 11:35:38 L1=2.35 run=4 blk=0 avail=7456 (54.1%) swpO=0 conn=12 myRSS=2936 php=30 phpRSS=1143 ap=75 tcp=64 topuser=evolution 2026-09-10 11:35:42 L1=2.64 run=4 blk=0 avail=7470 (54.2%) swpO=0 conn=12 myRSS=2936 php=31 phpRSS=1181 ap=70 tcp=66 topuser=evolution 2026-09-10 11:35:48 L1=2.59 run=2 blk=0 avail=7388 (53.6%) swpO=0 conn=10 myRSS=2936 php=31 phpRSS=1261 ap=68 tcp=66 topuser=evolution 2026-09-10 11:35:52 L1=2.71 run=3 blk=0 avail=7330 (53.2%) swpO=0 conn=12 myRSS=2936 php=34 phpRSS=1394 ap=67 tcp=74 topuser=evolution 2026-09-10 11:35:58 L1=2.65 run=6 blk=0 avail=7350 (53.3%) swpO=0 conn=11 myRSS=2936 php=33 phpRSS=1336 ap=65 tcp=60 topuser=evolution