INCIDENT 2026-09-10 11:38:00 trigger: php_procs=54 php_rss=2160MB ================================================================== load: 2.35 2.66 2.51 3/714 1457065 ncpu:10 mem_avail: 7012MB/13777MB (50.9%) swap_used:1414MB swapout:0/s blocked(D):0 running:4 iowait:0.0% steal:0.0% php: 54 procs / 2160MB heaviest user: evolution (52 procs, 2025MB) apache: 79 procs tcp_estab: 62 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2936 evolution 56 2032 nobody 78 1427 root 242 1096 netdata 8 255 mailman 20 183 madalice 1 132 dovenull 6 66 wp-toolkit 3 61 cpanellogin 1 50 alison 3 41 dovecot 3 28 mailnull 4 25 polkitd 1 15 lowrange 1 14 kurri 1 12 zabbix 1 9 nscd 1 6 named 1 5 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB evolution 52 2025 madalice 1 132 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5057 MB Active(file): 4455 MB Inactive(file): 714 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 523 MB CommitLimit: 10984 MB Committed_AS: 10769 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 9-09:15:36 3696 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 3006832 15.0 Ssl 2-06:52:33 /usr/sbin/mariadbd 166870 1 netdata 199760 2.7 Ssl 4-09:15:42 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2328754 1 root 194604 0.0 Ss 2-06:52:43 /usr/lib/systemd/systemd-journald 3701672 3652415 root 193032 0.1 S 09:02:48 spamd child 3701673 3652415 root 160876 0.0 S 09:02:48 spamd child 3652415 1 root 148008 0.0 Ss 09:13:09 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1456896 167896 madalice 135796 8.0 S 00:15 php-fpm: pool madalice_com_au 509236 509098 root 68164 0.0 Sl 13-09:18:22 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1437265 1437120 evolution 59328 0.0 S 04:56 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1436920 1435595 evolution 59164 0.0 S 05:24 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1438671 1419096 evolution 58224 0.0 S 03:07 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1455541 1455515 evolution 57112 0.0 S 01:22 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456586 1456427 evolution 57108 0.3 S 00:41 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1457031 1455582 evolution 56876 9.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1382815 1353308 cpanellogin 51324 0.0 S 19:32 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 1353308 1 root 42392 0.0 Ss 50-08:56:48 cpsrvd (SSL) - waiting for connections 1454144 1435446 evolution 41524 0.0 S 02:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436669 1419737 evolution 41488 0.0 S 05:49 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1437554 1419738 evolution 41076 0.0 S 04:33 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436992 1435559 evolution 41016 0.0 S 05:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438043 1436907 evolution 40980 0.0 S 03:56 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436739 1435940 evolution 40884 0.0 S 05:42 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438231 1438076 evolution 40652 0.0 S 03:40 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437858 1437119 evolution 40648 0.0 S 04:08 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437497 1437325 evolution 40616 0.0 S 04:38 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1457035 1437313 evolution 40604 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1456738 1455358 evolution 40588 0.1 S 00:28 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1436963 1435860 evolution 40584 0.0 S 05:19 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437252 1419739 evolution 40560 0.0 S 04:57 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437654 1436586 evolution 40472 0.0 S 04:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1439120 1438976 evolution 40332 0.0 S 02:58 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1453831 1446040 evolution 40308 0.0 S 02:39 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1469 1 root 39812 0.1 Ss 73-01:28:17 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1456372 1455322 evolution 39396 0.0 S 00:58 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438494 1438439 evolution 39348 0.0 S 03:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1455138 1455129 evolution 39288 0.0 S 01:53 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1454380 1438021 evolution 39148 0.0 S 02:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1455576 1455361 evolution 39028 0.0 S 01:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438623 1437809 evolution 38872 0.0 S 03:10 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437335 1437319 evolution 38784 0.0 S 04:51 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1454393 1449042 evolution 38632 0.0 S 02:08 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1455722 1455539 evolution 38632 0.0 S 01:09 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1453909 1437324 evolution 38596 0.0 S 02:33 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1455542 1453967 evolution 38592 0.0 S 01:21 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1454202 1438690 evolution 38576 0.0 S 02:21 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456678 1455323 evolution 38560 0.0 S 00:35 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1457021 1456806 evolution 38524 1.0 S 00:04 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456779 1438952 evolution 38516 0.2 S 00:24 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1453908 1437320 evolution 38512 0.0 S 02:33 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1454027 1453986 evolution 38512 0.0 S 02:27 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456819 1456810 evolution 38512 0.2 S 00:20 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437525 1437322 evolution 38408 0.0 S 04:34 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456818 1456812 evolution 38408 0.2 S 00:20 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1457033 1456809 evolution 36876 0.0 S 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1457032 1438279 evolution 36840 0.0 S 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437327 1437105 evolution 36752 0.0 S 04:52 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456324 1455537 evolution 36728 0.0 S 01:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456796 1456792 evolution 36656 0.0 S 00:23 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456680 1455124 evolution 36648 0.0 S 00:34 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456798 1456794 evolution 36552 0.1 S 00:22 /opt/cpanel/ea-php83/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9835654 | claude | 108-1481181613 | Query | 1574 | Sending data | SELECT 'job-items with BOTH picking and dispatch' k, COUNT(*) v FROM ( SELECT ji.id FROM jobInventory ji WHERE EXISTS(SELECT 1 FROM pickingitems pi JOIN picking p ON p.id=pi.pickingid WHERE pi.jobitemid=ji.id AND p.datecreated BETWEEN @from AND @to) AND EXISTS(SELECT 1 FROM dispatchitems di | | 9953837 | root | 108-1481181613 | Execute | 349 | Waiting for table level lock | update dispatchitems set qty = ?, dispatchbinsources = ? where id =? and dispatchid = ? | | 9957582 | root | 108-1481181613 | Execute | 323 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29402' AND dispatchitems.j | | 9962083 | root | 108-1481181613 | Execute | 295 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29405' AND dispatchitems.j | | 9964402 | root | 108-1481181613 | Execute | 273 | Waiting for table level lock | SELECT sum(dispatchitems.qty) as complete from dispatchitems,dispatch WHERE dispatchitems.jobitemid='200379' and dispatchitems.dispatchid=dispatch.id AND dispatch.status>='0' | | 9966195 | root | 108-1481181613 | Execute | 263 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9975761 | root | 108-1481181613 | Execute | 187 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29405' AND dispatchitems.j | | 9982965 | root | 108-1481181613 | Execute | 144 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9992249 | root | 108-1481181613 | Execute | 81 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29737' AND dispatchitems.j | | 9994739 | root | 108-1481181613 | Execute | 41 | Waiting for table level lock | select dispatch.*,dispatchitems.qty, (SELECT jobcode FROM jobs WHERE jobs.id = dispatch.jobid) as jobcode from dispatch,dispatchitems where dispatchitems.dispatchid=dispatch.id AND dispatch.status != '2' AND dispatchitems.itemid = ? | | 9997186 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9953837 | 108-1481181613 | 349 | Waiting for table level lock | update dispatchitems set qty = ?, dispatchbinsources = ? where id =? and dispatchid = ? | | 9957582 | 108-1481181613 | 324 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9962083 | 108-1481181613 | 295 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9964402 | 108-1481181613 | 273 | Waiting for table level lock | SELECT sum(dispatchitems.qty) as complete from dispatchitems,dispatch WHERE dispatchitems.jobitemid='200379' and dispatchitems.dispatchid=dispatch.id AND dispatch.status>='0' | | 9966195 | 108-1481181613 | 263 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9975761 | 108-1481181613 | 187 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9982965 | 108-1481181613 | 144 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9992249 | 108-1481181613 | 81 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9994739 | 108-1481181613 | 41 | Waiting for table level lock | select dispatch.*,dispatchitems.qty, (SELECT jobcode FROM jobs WHERE jobs.id = dispatch.jobid) as jobcode from dispatch,dispatchitems where dispatchitems.dispatchid=dispatch.id AND | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 457 evolution/app.evolutionerp.com.au-ssl_log 68 evolution/portal.evolutionerp.com.au-ssl_log 18 madalice/madalice.com.au-ssl_log 3 olympic/olympicfencing.com.au-ssl_log 3 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 151 103.104.165.99 87 203.54.180.238 77 1.144.107.82 68 40.115.94.245 46 182.239.240.254 41 103.104.164.114 34 165.225.233.87 24 150.228.151.88 4 147.161.213.71 4 120.150.225.142 2 48.215.3.173 2 180.181.236.49 2 114.119.143.104 1 52.112.125.9 1 207.46.13.14 --- top request paths across all vhosts (last 3 min) --- 154 POST /functions.php 84 GET /app/ajax.php 44 GET /index.php 23 POST /app/ajax/selectFilter.php 22 POST /plugins/csvexporter/plugin.php 21 POST /quoteditsave.php 18 GET /heartbeat.php 14 POST /clienteditsave.php 14 POST /app/ajax.php 14 GET /quoteditsave.php 13 POST /itemModify.php 12 POST /app/ajax/selectFilterSingle.php 10 POST /plugins/fencecosting/plugin.php 7 POST /inveditsave.php 6 POST /jobeditsave.php 5 POST /plugins/pipe/pipetopostsave.php 4 POST /testTagUploadsave.php 4 POST /logsave.php 3 POST /print.php 3 POST /invoiceaddsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 154 POST /functions.php 84 GET /app/ajax.php 44 GET /index.php 23 POST /app/ajax/selectFilter.php 22 POST /plugins/csvexporter/plugin.php 21 POST /quoteditsave.php 14 POST /clienteditsave.php 14 POST /app/ajax.php 14 GET /quoteditsave.php 13 POST /itemModify.php 12 POST /app/ajax/selectFilterSingle.php 10 POST /plugins/fencecosting/plugin.php -- last 10 requests -- 207.46.13.154 - - [10/Sep/2026:11:38:00 +1000] "GET /index.php?page=jobedit&id=29038 HTTP/1.1" 200 5693 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) C 207.46.13.154 - - [10/Sep/2026:11:38:00 +1000] "GET /index.php?page=quotedit"eid=36634§ionid=0 HTTP/1.1" 200 5702 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing. 103.104.165.99 - - [10/Sep/2026:11:37:58 +1000] "GET /index.php?page=jobedit&id=12144 HTTP/1.1" 200 209089 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12144" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 103.104.165.99 - - [10/Sep/2026:11:38:00 +1000] "POST /logsave.php?call=getHistory&id=12144&module=job HTTP/1.1" 200 700 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12144" "Mozilla/5.0 (Windows NT 10.0; Win 103.104.165.99 - - [10/Sep/2026:11:38:00 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 103.104.165.99 - - [10/Sep/2026:11:38:00 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 103.104.165.99 - - [10/Sep/2026:11:38:00 +1000] "POST /clienteditsave.php?call=getSettings HTTP/1.1" 200 60 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12144" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl 103.104.165.99 - - [10/Sep/2026:11:38:00 +1000] "POST /clienteditsave.php?clientid=3510&call=getCategoryDiscounts HTTP/1.1" 200 498 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12144" "Mozilla/5.0 (Windows N 103.104.165.99 - - [10/Sep/2026:11:38:00 +1000] "POST /plugins/fencecosting/plugin.php HTTP/1.1" 200 3913 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12144" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 103.104.165.99 - - [10/Sep/2026:11:38:01 +1000] "HEAD /index.php?page=jobedit&id=12144 HTTP/1.1" 200 - "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12144" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 2 GET /api/getItem/SHSG656520 2 GET /api/getItem/SHSG656516 2 GET /api/getItem/SHSG404016 2 GET /api/getItem/PXLG50 2 GET /api/getItem/PXLG40 2 GET /api/getItem/PXLG32 2 GET /api/getItem/PXLG25 2 GET /api/getItem/PXLG20 2 GET /api/getItem/PMG90 2 GET /api/getItem/PMG80 2 GET /api/getItem/PMG65 2 GET /api/getItem/PMG50 -- last 10 requests -- 40.115.94.245 - - [10/Sep/2026:11:37:05 +1000] "GET /api/getItem/PMG90 HTTP/1.1" 200 1862 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:37:05 +1000] "GET /api/getItem/SHSG757540-8 HTTP/1.1" 200 1557 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:37:05 +1000] "GET /api/getItem/PMG100 HTTP/1.1" 200 1952 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:37:06 +1000] "GET /api/getItem/SHSG7575508 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:37:06 +1000] "GET /api/getItem/PMG125 HTTP/1.1" 200 1527 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:37:06 +1000] "GET /api/getItem/SHSG8989208 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:37:06 +1000] "GET /api/getItem/PMG150 HTTP/1.1" 200 1955 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:37:07 +1000] "GET /api/getItem/SHSG8989258 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:37:07 +1000] "GET /api/getItem/SHSG404016 HTTP/1.1" 200 1591 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:37:07 +1000] "GET /api/getItem/SHSG8989358 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 18 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [10/Sep/2026:11:36:40 +1000] "GET /heartbeat.php?sentAt=1789004201&bytes=106,162,9,169&_=1788957671734 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:36:44 +1000] "GET /heartbeat.php?sentAt=1789004204&bytes=106,162,9,172&_=1788987692414 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:36:50 +1000] "GET /heartbeat.php?sentAt=1789004211&bytes=106,162,9,179&_=1788957671735 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:36:54 +1000] "GET /heartbeat.php?sentAt=1789004214&bytes=106,162,9,182&_=1788987692415 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:37:00 +1000] "GET /heartbeat.php?sentAt=1789004221&bytes=106,162,9,189&_=1788957671736 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:37:04 +1000] "GET /heartbeat.php?sentAt=1789004224&bytes=106,162,9,192&_=1788987692416 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:37:10 +1000] "GET /heartbeat.php?sentAt=1789004231&bytes=106,162,9,199&_=1788957671737 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:37:14 +1000] "GET /heartbeat.php?sentAt=1789004234&bytes=106,162,9,202&_=1788987692417 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:37:20 +1000] "GET /heartbeat.php?sentAt=1789004241&bytes=106,162,9,209&_=1788957671738 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:37:24 +1000] "GET /heartbeat.php?sentAt=1789004244&bytes=106,162,9,212&_=1788987692418 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-09-10 11:35:32 L1=2.38 run=6 blk=0 avail=7383 (53.6%) swpO=0 conn=9 myRSS=2936 php=28 phpRSS=1151 ap=76 tcp=76 topuser=evolution 2026-09-10 11:35:38 L1=2.35 run=4 blk=0 avail=7456 (54.1%) swpO=0 conn=12 myRSS=2936 php=30 phpRSS=1143 ap=75 tcp=64 topuser=evolution 2026-09-10 11:35:42 L1=2.64 run=4 blk=0 avail=7470 (54.2%) swpO=0 conn=12 myRSS=2936 php=31 phpRSS=1181 ap=70 tcp=66 topuser=evolution 2026-09-10 11:35:48 L1=2.59 run=2 blk=0 avail=7388 (53.6%) swpO=0 conn=10 myRSS=2936 php=31 phpRSS=1261 ap=68 tcp=66 topuser=evolution 2026-09-10 11:35:52 L1=2.71 run=3 blk=0 avail=7330 (53.2%) swpO=0 conn=12 myRSS=2936 php=34 phpRSS=1394 ap=67 tcp=74 topuser=evolution 2026-09-10 11:35:58 L1=2.65 run=6 blk=0 avail=7350 (53.3%) swpO=0 conn=11 myRSS=2936 php=33 phpRSS=1336 ap=65 tcp=60 topuser=evolution 2026-09-10 11:36:03 L1=2.68 run=4 blk=0 avail=7376 (53.5%) swpO=0 conn=10 myRSS=2936 php=32 phpRSS=1280 ap=61 tcp=62 topuser=evolution 2026-09-10 11:36:09 L1=2.54 run=4 blk=0 avail=7463 (54.2%) swpO=0 conn=10 myRSS=2936 php=33 phpRSS=1224 ap=64 tcp=66 topuser=evolution 2026-09-10 11:36:13 L1=2.74 run=3 blk=0 avail=7353 (53.4%) swpO=0 conn=10 myRSS=2936 php=33 phpRSS=1320 ap=64 tcp=66 topuser=evolution 2026-09-10 11:36:19 L1=2.68 run=5 blk=0 avail=7302 (53.0%) swpO=0 conn=12 myRSS=2936 php=35 phpRSS=1437 ap=62 tcp=65 topuser=evolution 2026-09-10 11:36:23 L1=2.95 run=4 blk=0 avail=7077 (51.4%) swpO=0 conn=14 myRSS=2936 php=36 phpRSS=1638 ap=68 tcp=81 topuser=evolution 2026-09-10 11:36:29 L1=2.87 run=2 blk=0 avail=7255 (52.7%) swpO=0 conn=10 myRSS=2936 php=33 phpRSS=1341 ap=74 tcp=63 topuser=evolution 2026-09-10 11:36:33 L1=2.96 run=8 blk=0 avail=7032 (51.0%) swpO=0 conn=12 myRSS=2936 php=37 phpRSS=1709 ap=70 tcp=71 topuser=evolution 2026-09-10 11:36:39 L1=3.04 run=2 blk=0 avail=7163 (52.0%) swpO=0 conn=12 myRSS=2936 php=36 phpRSS=1491 ap=75 tcp=79 topuser=evolution 2026-09-10 11:36:43 L1=2.88 run=5 blk=0 avail=7287 (52.9%) swpO=0 conn=11 myRSS=2936 php=35 phpRSS=1316 ap=76 tcp=70 topuser=evolution 2026-09-10 11:36:49 L1=3.13 run=4 blk=0 avail=7135 (51.8%) swpO=0 conn=12 myRSS=2936 php=38 phpRSS=1557 ap=77 tcp=71 topuser=evolution 2026-09-10 11:36:53 L1=3.20 run=2 blk=0 avail=7140 (51.8%) swpO=0 conn=12 myRSS=2936 php=38 phpRSS=1567 ap=74 tcp=73 topuser=evolution 2026-09-10 11:36:59 L1=3.26 run=2 blk=0 avail=7229 (52.5%) swpO=0 conn=11 myRSS=2936 php=37 phpRSS=1510 ap=68 tcp=65 topuser=evolution 2026-09-10 11:37:03 L1=3.16 run=3 blk=0 avail=7173 (52.1%) swpO=0 conn=11 myRSS=2936 php=40 phpRSS=1622 ap=66 tcp=66 topuser=evolution 2026-09-10 11:37:10 L1=3.15 run=4 blk=0 avail=7210 (52.3%) swpO=0 conn=11 myRSS=2936 php=40 phpRSS=1620 ap=70 tcp=61 topuser=evolution 2026-09-10 11:37:13 L1=2.98 run=4 blk=0 avail=7186 (52.2%) swpO=0 conn=13 myRSS=2936 php=40 phpRSS=1669 ap=69 tcp=65 topuser=evolution 2026-09-10 11:37:20 L1=2.82 run=3 blk=0 avail=7207 (52.3%) swpO=0 conn=13 myRSS=2936 php=41 phpRSS=1697 ap=67 tcp=63 topuser=evolution 2026-09-10 11:37:23 L1=2.75 run=2 blk=0 avail=7239 (52.5%) swpO=0 conn=12 myRSS=2936 php=40 phpRSS=1640 ap=66 tcp=66 topuser=evolution 2026-09-10 11:37:30 L1=2.69 run=3 blk=0 avail=7229 (52.5%) swpO=0 conn=12 myRSS=2936 php=42 phpRSS=1714 ap=67 tcp=63 topuser=evolution 2026-09-10 11:37:33 L1=2.56 run=2 blk=0 avail=7216 (52.4%) swpO=0 conn=12 myRSS=2936 php=43 phpRSS=1754 ap=67 tcp=67 topuser=evolution 2026-09-10 11:37:40 L1=2.59 run=3 blk=0 avail=7191 (52.2%) swpO=0 conn=13 myRSS=2936 php=48 phpRSS=1821 ap=82 tcp=74 topuser=evolution 2026-09-10 11:37:43 L1=2.46 run=2 blk=0 avail=7217 (52.4%) swpO=0 conn=12 myRSS=2936 php=47 phpRSS=1781 ap=81 tcp=73 topuser=evolution 2026-09-10 11:37:50 L1=2.43 run=2 blk=0 avail=7035 (51.1%) swpO=0 conn=13 myRSS=2936 php=49 phpRSS=1954 ap=87 tcp=82 topuser=evolution 2026-09-10 11:37:53 L1=2.47 run=3 blk=0 avail=7024 (51.0%) swpO=0 conn=13 myRSS=2936 php=49 phpRSS=1970 ap=86 tcp=70 topuser=evolution 2026-09-10 11:38:00 L1=2.35 run=4 blk=0 avail=7012 (50.9%) swpO=0 conn=14 myRSS=2936 php=54 phpRSS=2160 ap=79 tcp=62 topuser=evolution