INCIDENT 2026-09-10 11:39:01 trigger: php_procs=55 php_rss=2216MB ================================================================== load: 1.80 2.45 2.44 7/728 1458334 ncpu:10 mem_avail: 6917MB/13777MB (50.2%) swap_used:1414MB swapout:1/s blocked(D):0 running:4 iowait:0.1% steal:0.0% php: 55 procs / 2216MB heaviest user: evolution (53 procs, 2057MB) apache: 85 procs tcp_estab: 66 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2936 evolution 57 2067 nobody 84 1530 root 247 1155 netdata 8 256 mailman 20 183 madalice 1 155 dovenull 6 66 wp-toolkit 3 61 cpanellogin 1 50 alison 3 41 mailnull 4 37 dovecot 3 28 polkitd 1 15 lowrange 1 14 kurri 1 12 zabbix 1 9 nscd 1 6 named 1 5 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB evolution 53 2059 madalice 1 155 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5060 MB Active(file): 4458 MB Inactive(file): 714 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 524 MB CommitLimit: 10984 MB Committed_AS: 10975 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 9-09:16:37 3696 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 3006872 15.0 Ssl 2-06:53:34 /usr/sbin/mariadbd 166870 1 netdata 201228 2.7 Ssl 4-09:16:43 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2328754 1 root 194604 0.0 Ss 2-06:53:44 /usr/lib/systemd/systemd-journald 3701672 3652415 root 193032 0.1 S 09:03:49 spamd child 3701673 3652415 root 160876 0.0 S 09:03:49 spamd child 1457761 167896 madalice 159720 11.3 S 00:43 php-fpm: pool madalice_com_au 3652415 1 root 147988 0.0 Ss 09:14:10 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509236 509098 root 68164 0.0 Sl 13-09:19:23 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1458301 1456455 evolution 60036 0.0 R 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437265 1437120 evolution 59328 0.0 S 05:57 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1436920 1435595 evolution 59164 0.0 S 06:25 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1438671 1419096 evolution 58224 0.0 S 04:08 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1455541 1455515 evolution 57112 0.0 S 02:23 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456586 1456427 evolution 57108 0.1 S 01:42 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1382815 1353308 cpanellogin 51324 0.0 S 20:33 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 1353308 1 root 42392 0.0 Ss 50-08:57:49 cpsrvd (SSL) - waiting for connections 1454144 1435446 evolution 41524 0.0 S 03:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436669 1419737 evolution 41488 0.0 S 06:50 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1437554 1419738 evolution 41076 0.0 S 05:34 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436992 1435559 evolution 41016 0.0 S 06:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438043 1436907 evolution 40980 0.0 S 04:57 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436739 1435940 evolution 40884 0.0 S 06:43 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438231 1438076 evolution 40652 0.0 S 04:41 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437858 1437119 evolution 40648 0.0 S 05:09 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437497 1437325 evolution 40616 0.0 S 05:39 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456738 1455358 evolution 40588 0.0 S 01:29 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1436963 1435860 evolution 40584 0.0 S 06:20 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437252 1419739 evolution 40560 0.0 S 05:58 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1458313 1458290 root 40512 0.0 R 00:00 /usr/bin/python3 /usr/local/cpanel/bin/packman_get_list_json all ea-php*-php-common 1437654 1436586 evolution 40472 0.0 S 05:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1439120 1438976 evolution 40332 0.0 S 03:59 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1453831 1446040 evolution 40308 0.0 S 03:40 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1458221 1458055 evolution 40280 0.6 S 00:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 39812 0.1 Ss 73-01:29:18 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1456372 1455322 evolution 39396 0.0 S 01:59 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438494 1438439 evolution 39348 0.0 S 04:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1455138 1455129 evolution 39288 0.0 S 02:54 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1454380 1438021 evolution 39148 0.0 S 03:10 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1455576 1455361 evolution 39028 0.0 S 02:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438623 1437809 evolution 38872 0.0 S 04:11 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437335 1437319 evolution 38784 0.0 S 05:52 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1454393 1449042 evolution 38632 0.0 S 03:09 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1455722 1455539 evolution 38632 0.0 S 02:10 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1453909 1437324 evolution 38596 0.0 S 03:34 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1455542 1453967 evolution 38592 0.0 S 02:22 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1454202 1438690 evolution 38576 0.0 S 03:22 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456678 1455323 evolution 38560 0.0 S 01:36 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1457654 1457644 evolution 38536 0.0 S 00:53 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1457021 1456806 evolution 38524 0.0 S 01:05 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456779 1438952 evolution 38516 0.0 S 01:25 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1453908 1437320 evolution 38512 0.0 S 03:34 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1454027 1453986 evolution 38512 0.0 S 03:28 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456819 1456810 evolution 38512 0.0 S 01:21 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437525 1437322 evolution 38408 0.0 S 05:35 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456818 1456812 evolution 38408 0.0 S 01:21 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1458020 1457908 evolution 36776 0.1 S 00:21 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1457904 1457893 evolution 36764 0.1 S 00:32 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437327 1437105 evolution 36752 0.0 S 05:53 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456324 1455537 evolution 36728 0.0 S 02:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1457653 1457643 evolution 36680 0.0 S 00:53 /opt/cpanel/ea-php83/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9835654 | claude | 108-1481181613 | Query | 1635 | Sending data | SELECT 'job-items with BOTH picking and dispatch' k, COUNT(*) v FROM ( SELECT ji.id FROM jobInventory ji WHERE EXISTS(SELECT 1 FROM pickingitems pi JOIN picking p ON p.id=pi.pickingid WHERE pi.jobitemid=ji.id AND p.datecreated BETWEEN @from AND @to) AND EXISTS(SELECT 1 FROM dispatchitems di | | 9953837 | root | 108-1481181613 | Execute | 410 | Waiting for table level lock | update dispatchitems set qty = ?, dispatchbinsources = ? where id =? and dispatchid = ? | | 9957582 | root | 108-1481181613 | Execute | 385 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29402' AND dispatchitems.j | | 9962083 | root | 108-1481181613 | Execute | 356 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29405' AND dispatchitems.j | | 9964402 | root | 108-1481181613 | Execute | 334 | Waiting for table level lock | SELECT sum(dispatchitems.qty) as complete from dispatchitems,dispatch WHERE dispatchitems.jobitemid='200379' and dispatchitems.dispatchid=dispatch.id AND dispatch.status>='0' | | 9966195 | root | 108-1481181613 | Execute | 324 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9975761 | root | 108-1481181613 | Execute | 248 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29405' AND dispatchitems.j | | 9982965 | root | 108-1481181613 | Execute | 205 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9992249 | root | 108-1481181613 | Execute | 142 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29737' AND dispatchitems.j | | 9994739 | root | 108-1481181613 | Execute | 102 | Waiting for table level lock | select dispatch.*,dispatchitems.qty, (SELECT jobcode FROM jobs WHERE jobs.id = dispatch.jobid) as jobcode from dispatch,dispatchitems where dispatchitems.dispatchid=dispatch.id AND dispatch.status != '2' AND dispatchitems.itemid = ? | | 10000932 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9953837 | 108-1481181613 | 410 | Waiting for table level lock | update dispatchitems set qty = ?, dispatchbinsources = ? where id =? and dispatchid = ? | | 9957582 | 108-1481181613 | 385 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9962083 | 108-1481181613 | 357 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9964402 | 108-1481181613 | 334 | Waiting for table level lock | SELECT sum(dispatchitems.qty) as complete from dispatchitems,dispatch WHERE dispatchitems.jobitemid='200379' and dispatchitems.dispatchid=dispatch.id AND dispatch.status>='0' | | 9966195 | 108-1481181613 | 324 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9975761 | 108-1481181613 | 248 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9982965 | 108-1481181613 | 205 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9992249 | 108-1481181613 | 142 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9994739 | 108-1481181613 | 102 | Waiting for table level lock | select dispatch.*,dispatchitems.qty, (SELECT jobcode FROM jobs WHERE jobs.id = dispatch.jobid) as jobcode from dispatch,dispatchitems where dispatchitems.dispatchid=dispatch.id AND | +---------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 420 evolution/app.evolutionerp.com.au-ssl_log 104 evolution/portal.evolutionerp.com.au-ssl_log 17 alison/alisonarts.com.au-ssl_log 1 madalice/madalice.com.au-ssl_log 1 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 144 103.104.165.99 104 40.115.94.245 92 203.54.180.238 54 182.239.240.254 50 1.144.107.82 29 150.228.151.88 24 165.225.233.87 17 120.150.225.142 5 103.104.164.114 4 207.46.13.14 4 147.161.213.71 4 1.125.108.125 2 207.46.13.154 2 180.181.236.49 2 157.55.39.52 --- top request paths across all vhosts (last 3 min) --- 149 POST /functions.php 71 GET /app/ajax.php 41 GET /index.php 25 POST /app/ajax/selectFilter.php 17 GET /heartbeat.php 15 POST /quoteditsave.php 15 POST /plugins/csvexporter/plugin.php 15 POST /jobeditsave.php 13 POST /itemModify.php 12 POST /clienteditsave.php 9 POST /app/ajax/selectFilterSingle.php 9 POST /app/ajax.php 8 POST /plugins/fencecosting/plugin.php 7 GET /quoteditsave.php 6 POST /logsave.php 5 GET /api/getItem/SHSG656520 4 POST /inveditsave.php 4 HEAD /index.php 4 GET /api/getItem/SHSG656516 3 POST /purchaseaddsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 149 POST /functions.php 71 GET /app/ajax.php 41 GET /index.php 25 POST /app/ajax/selectFilter.php 15 POST /quoteditsave.php 15 POST /plugins/csvexporter/plugin.php 15 POST /jobeditsave.php 13 POST /itemModify.php 12 POST /clienteditsave.php 9 POST /app/ajax/selectFilterSingle.php 9 POST /app/ajax.php 8 POST /plugins/fencecosting/plugin.php -- last 10 requests -- 1.125.108.125 - - [10/Sep/2026:11:38:59 +1000] "GET /index.php?page%3Dquotereg HTTP/1.1" 200 36589 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K 103.104.165.99 - - [10/Sep/2026:11:38:58 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 3607 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12074" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe 103.104.165.99 - - [10/Sep/2026:11:38:58 +1000] "POST /plugins/fencecosting/plugin.php HTTP/1.1" 200 3913 "https://my.evolutionerp.com.au/index.php?page=jobedit&id=12074" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW 103.104.165.99 - - [10/Sep/2026:11:38:59 +1000] "GET /app/ajax.php?cn=&furi=true&uri=&call=getUserSetting&caller=ajaxSubmitLocal&seq=12218605771 HTTP/1.1" 200 241 "https://my.evolutionerp.com.au/index.php?page=jobedit&id 103.104.165.99 - - [10/Sep/2026:11:38:59 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=12216551250 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index 182.239.240.254 - - [10/Sep/2026:11:38:59 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 103.104.165.99 - - [10/Sep/2026:11:38:59 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Djobedit%26id%3D12074&call=getUserSetting&caller=ajaxSubmitLocal&seq=17315146523 HTTP/1.1" 200 113 "https://my. 103.104.165.99 - - [10/Sep/2026:11:38:59 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=19043214086 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/inde 103.104.165.99 - - [10/Sep/2026:11:38:59 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Djobedit%26id%3D12074&call=getUserSetting&caller=ajaxSubmitLocal&seq=10200795484 HTTP/1.1" 200 159 "https://my.evolutionerp.com.a 103.104.165.99 - - [10/Sep/2026:11:38:59 +1000] "GET /app/ajax.php?cn=tsExportSettingstimesheet&furi=false&uri=%2F&call=getUserSetting&caller=ajaxSubmitLocal&seq=14536974616 HTTP/1.1" 200 103 "https://my.evolutionerp.com == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 5 GET /api/getItem/SHSG656520 4 GET /api/getItem/SHSG656516 2 GET /api/getItem/SHSG8989508 2 GET /api/getItem/SHSG8989358 2 GET /api/getItem/SHSG8989258 2 GET /api/getItem/SHSG8989208 2 GET /api/getItem/SHSG7575508 2 GET /api/getItem/SHSG757540-8 2 GET /api/getItem/SHSG757540 2 GET /api/getItem/SHSG757530-8 2 GET /api/getItem/SHSG757530 2 GET /api/getItem/SHSG757525-8 -- last 10 requests -- 40.115.94.245 - - [10/Sep/2026:11:38:18 +1000] "GET /api/getItem/SHSG100100308 HTTP/1.1" 404 115 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:38:18 +1000] "GET /api/getItem/SHSG5050208 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:38:18 +1000] "GET /api/getItem/SHSG100100408 HTTP/1.1" 404 115 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:38:18 +1000] "GET /api/getItem/SHSG5050258 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:38:19 +1000] "GET /api/getItem/SHSG100100508 HTTP/1.1" 404 115 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:38:19 +1000] "GET /api/getItem/SHSG5050308 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:38:19 +1000] "GET /api/getItem/SHSG125125408 HTTP/1.1" 404 115 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:38:19 +1000] "GET /api/getItem/SHSG5050408 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:38:19 +1000] "GET /api/getItem/SHSG125125508 HTTP/1.1" 404 115 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:38:20 +1000] "GET /api/getItem/SHSG5050508 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 17 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [10/Sep/2026:11:37:34 +1000] "GET /heartbeat.php?sentAt=1789004254&bytes=106,162,9,222&_=1788987692419 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:37:40 +1000] "GET /heartbeat.php?sentAt=1789004261&bytes=106,162,9,229&_=1788957671740 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:37:44 +1000] "GET /heartbeat.php?sentAt=1789004264&bytes=106,162,9,232&_=1788987692420 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:37:50 +1000] "GET /heartbeat.php?sentAt=1789004271&bytes=106,162,9,239&_=1788957671741 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:37:54 +1000] "GET /heartbeat.php?sentAt=1789004274&bytes=106,162,9,242&_=1788987692421 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:38:00 +1000] "GET /heartbeat.php?sentAt=1789004281&bytes=106,162,9,249&_=1788957671742 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:38:04 +1000] "GET /heartbeat.php?sentAt=1789004284&bytes=106,162,9,252&_=1788987692422 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:38:10 +1000] "GET /heartbeat.php?sentAt=1789004291&bytes=106,162,10,3&_=1788957671743 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" " 203.54.180.238 - - [10/Sep/2026:11:38:14 +1000] "GET /heartbeat.php?sentAt=1789004294&bytes=106,162,10,6&_=1788987692423 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" " 203.54.180.238 - - [10/Sep/2026:11:38:20 +1000] "GET /heartbeat.php?sentAt=1789004301&bytes=106,162,10,13&_=1788957671744 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-09-10 11:36:33 L1=2.96 run=8 blk=0 avail=7032 (51.0%) swpO=0 conn=12 myRSS=2936 php=37 phpRSS=1709 ap=70 tcp=71 topuser=evolution 2026-09-10 11:36:39 L1=3.04 run=2 blk=0 avail=7163 (52.0%) swpO=0 conn=12 myRSS=2936 php=36 phpRSS=1491 ap=75 tcp=79 topuser=evolution 2026-09-10 11:36:43 L1=2.88 run=5 blk=0 avail=7287 (52.9%) swpO=0 conn=11 myRSS=2936 php=35 phpRSS=1316 ap=76 tcp=70 topuser=evolution 2026-09-10 11:36:49 L1=3.13 run=4 blk=0 avail=7135 (51.8%) swpO=0 conn=12 myRSS=2936 php=38 phpRSS=1557 ap=77 tcp=71 topuser=evolution 2026-09-10 11:36:53 L1=3.20 run=2 blk=0 avail=7140 (51.8%) swpO=0 conn=12 myRSS=2936 php=38 phpRSS=1567 ap=74 tcp=73 topuser=evolution 2026-09-10 11:36:59 L1=3.26 run=2 blk=0 avail=7229 (52.5%) swpO=0 conn=11 myRSS=2936 php=37 phpRSS=1510 ap=68 tcp=65 topuser=evolution 2026-09-10 11:37:03 L1=3.16 run=3 blk=0 avail=7173 (52.1%) swpO=0 conn=11 myRSS=2936 php=40 phpRSS=1622 ap=66 tcp=66 topuser=evolution 2026-09-10 11:37:10 L1=3.15 run=4 blk=0 avail=7210 (52.3%) swpO=0 conn=11 myRSS=2936 php=40 phpRSS=1620 ap=70 tcp=61 topuser=evolution 2026-09-10 11:37:13 L1=2.98 run=4 blk=0 avail=7186 (52.2%) swpO=0 conn=13 myRSS=2936 php=40 phpRSS=1669 ap=69 tcp=65 topuser=evolution 2026-09-10 11:37:20 L1=2.82 run=3 blk=0 avail=7207 (52.3%) swpO=0 conn=13 myRSS=2936 php=41 phpRSS=1697 ap=67 tcp=63 topuser=evolution 2026-09-10 11:37:23 L1=2.75 run=2 blk=0 avail=7239 (52.5%) swpO=0 conn=12 myRSS=2936 php=40 phpRSS=1640 ap=66 tcp=66 topuser=evolution 2026-09-10 11:37:30 L1=2.69 run=3 blk=0 avail=7229 (52.5%) swpO=0 conn=12 myRSS=2936 php=42 phpRSS=1714 ap=67 tcp=63 topuser=evolution 2026-09-10 11:37:33 L1=2.56 run=2 blk=0 avail=7216 (52.4%) swpO=0 conn=12 myRSS=2936 php=43 phpRSS=1754 ap=67 tcp=67 topuser=evolution 2026-09-10 11:37:40 L1=2.59 run=3 blk=0 avail=7191 (52.2%) swpO=0 conn=13 myRSS=2936 php=48 phpRSS=1821 ap=82 tcp=74 topuser=evolution 2026-09-10 11:37:43 L1=2.46 run=2 blk=0 avail=7217 (52.4%) swpO=0 conn=12 myRSS=2936 php=47 phpRSS=1781 ap=81 tcp=73 topuser=evolution 2026-09-10 11:37:50 L1=2.43 run=2 blk=0 avail=7035 (51.1%) swpO=0 conn=13 myRSS=2936 php=49 phpRSS=1954 ap=87 tcp=82 topuser=evolution 2026-09-10 11:37:53 L1=2.47 run=3 blk=0 avail=7024 (51.0%) swpO=0 conn=13 myRSS=2936 php=49 phpRSS=1970 ap=86 tcp=70 topuser=evolution 2026-09-10 11:38:00 L1=2.35 run=4 blk=0 avail=7012 (50.9%) swpO=0 conn=14 myRSS=2936 php=54 phpRSS=2160 ap=79 tcp=62 topuser=evolution 2026-09-10 11:38:03 L1=2.49 run=2 blk=0 avail=7113 (51.6%) swpO=0 conn=12 myRSS=2936 php=49 phpRSS=1952 ap=76 tcp=65 topuser=evolution 2026-09-10 11:38:11 L1=2.33 run=2 blk=0 avail=7165 (52.0%) swpO=0 conn=13 myRSS=2936 php=51 phpRSS=1932 ap=79 tcp=57 topuser=evolution 2026-09-10 11:38:13 L1=2.33 run=2 blk=0 avail=7195 (52.2%) swpO=0 conn=12 myRSS=2936 php=50 phpRSS=1893 ap=78 tcp=57 topuser=evolution 2026-09-10 11:38:21 L1=2.20 run=4 blk=0 avail=7088 (51.5%) swpO=0 conn=13 myRSS=2936 php=53 phpRSS=2078 ap=74 tcp=70 topuser=evolution 2026-09-10 11:38:24 L1=2.20 run=2 blk=0 avail=7093 (51.5%) swpO=0 conn=12 myRSS=2936 php=51 phpRSS=2025 ap=76 tcp=67 topuser=evolution 2026-09-10 11:38:31 L1=2.02 run=5 blk=0 avail=7023 (51.0%) swpO=0 conn=13 myRSS=2936 php=54 phpRSS=2153 ap=80 tcp=67 topuser=evolution 2026-09-10 11:38:34 L1=2.02 run=2 blk=0 avail=7045 (51.1%) swpO=0 conn=12 myRSS=2936 php=52 phpRSS=2061 ap=81 tcp=66 topuser=evolution 2026-09-10 11:38:41 L1=1.94 run=5 blk=0 avail=6900 (50.1%) swpO=0 conn=14 myRSS=2936 php=55 phpRSS=2305 ap=79 tcp=62 topuser=evolution 2026-09-10 11:38:44 L1=1.94 run=6 blk=0 avail=6946 (50.4%) swpO=0 conn=12 myRSS=2936 php=57 phpRSS=2288 ap=82 tcp=59 topuser=evolution 2026-09-10 11:38:51 L1=1.95 run=3 blk=0 avail=6998 (50.8%) swpO=0 conn=12 myRSS=2936 php=54 phpRSS=2158 ap=81 tcp=63 topuser=evolution 2026-09-10 11:38:54 L1=1.95 run=8 blk=0 avail=6948 (50.4%) swpO=1 conn=14 myRSS=2936 php=58 phpRSS=2343 ap=81 tcp=68 topuser=evolution 2026-09-10 11:39:01 L1=1.80 run=4 blk=0 avail=6917 (50.2%) swpO=1 conn=13 myRSS=2936 php=55 phpRSS=2216 ap=85 tcp=66 topuser=evolution