INCIDENT 2026-09-10 11:41:04 trigger: php_procs=64 php_rss=2789MB ================================================================== load: 2.49 2.48 2.46 2/739 1475112 ncpu:10 mem_avail: 6544MB/13777MB (47.5%) swap_used:1414MB swapout:0/s blocked(D):0 running:2 iowait:0.0% steal:0.0% php: 64 procs / 2789MB heaviest user: evolution (60 procs, 2319MB) apache: 93 procs tcp_estab: 72 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2936 evolution 64 2327 nobody 92 1648 root 247 1096 madalice 3 467 netdata 8 258 mailman 20 183 dovenull 6 66 wp-toolkit 3 61 cpanellogin 1 50 dovecot 3 28 vinesit 1 15 polkitd 1 15 lowrange 1 14 kurri 1 12 zabbix 1 10 nscd 1 6 named 1 5 cpanelconnecttrack 1 4 mailnull 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 60 2319 madalice 3 467 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5135 MB Active(file): 4525 MB Inactive(file): 714 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 524 MB CommitLimit: 10984 MB Committed_AS: 11777 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 9-09:18:39 3696 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 3006956 15.1 Ssl 2-06:55:36 /usr/sbin/mariadbd 166870 1 netdata 202544 2.7 Ssl 4-09:18:45 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2328754 1 root 195936 0.0 Ss 2-06:55:46 /usr/lib/systemd/systemd-journald 3701672 3652415 root 193032 0.1 S 09:05:51 spamd child 1474731 167896 madalice 160992 23.5 S 00:21 php-fpm: pool madalice_com_au 3701673 3652415 root 160876 0.0 S 09:05:51 spamd child 1474764 167896 madalice 158932 12.8 S 00:21 php-fpm: pool madalice_com_au 1474726 167896 madalice 158648 21.7 S 00:21 php-fpm: pool madalice_com_au 3652415 1 root 147988 0.0 Ss 09:16:12 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509236 509098 root 68164 0.0 Sl 13-09:21:25 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1437265 1437120 evolution 59328 0.0 S 07:59 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1436920 1435595 evolution 59164 0.0 S 08:27 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1438671 1419096 evolution 58224 0.0 S 06:10 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1458755 1457633 evolution 58016 0.0 S 01:43 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1455541 1455515 evolution 57112 0.0 S 04:25 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456586 1456427 evolution 57108 0.0 S 03:44 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1382815 1353308 cpanellogin 51324 0.0 S 22:35 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 1353308 1 root 42392 0.0 Ss 50-08:59:51 cpsrvd (SSL) - waiting for connections 1454144 1435446 evolution 41524 0.0 S 05:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436669 1419737 evolution 41488 0.0 S 08:52 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1437554 1419738 evolution 41076 0.0 S 07:36 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436992 1435559 evolution 41016 0.0 S 08:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438043 1436907 evolution 40980 0.0 S 06:59 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436739 1435940 evolution 40884 0.0 S 08:45 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438231 1438076 evolution 40652 0.0 S 06:43 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437858 1437119 evolution 40648 0.0 S 07:11 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437497 1437325 evolution 40616 0.0 S 07:41 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456738 1455358 evolution 40588 0.0 S 03:31 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1436963 1435860 evolution 40584 0.0 S 08:22 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437252 1419739 evolution 40560 0.0 S 08:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437654 1436586 evolution 40472 0.0 S 07:26 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1439120 1438976 evolution 40332 0.0 S 06:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1453831 1446040 evolution 40308 0.0 S 05:42 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1458221 1458055 evolution 40280 0.0 S 02:07 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 39812 0.1 Ss 73-01:31:20 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1456372 1455322 evolution 39396 0.0 S 04:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438494 1438439 evolution 39348 0.0 S 06:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1455138 1455129 evolution 39288 0.0 S 04:56 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1474517 1459398 evolution 39196 0.0 S 00:32 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1474300 1459399 evolution 39160 0.0 S 00:51 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1454380 1438021 evolution 39148 0.0 S 05:12 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1455576 1455361 evolution 39028 0.0 S 04:23 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438623 1437809 evolution 38872 0.0 S 06:13 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437335 1437319 evolution 38784 0.0 S 07:54 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1454393 1449042 evolution 38632 0.0 S 05:11 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1455722 1455539 evolution 38632 0.0 S 04:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1458621 1457887 evolution 38632 0.0 S 01:55 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1458702 1458661 evolution 38632 0.0 S 01:49 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1453909 1437324 evolution 38596 0.0 S 05:36 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1455542 1453967 evolution 38592 0.0 S 04:24 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1454202 1438690 evolution 38576 0.0 S 05:24 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1474605 1459400 evolution 38568 0.1 S 00:27 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456678 1455323 evolution 38560 0.0 S 03:38 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1457654 1457644 evolution 38536 0.0 S 02:55 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1457021 1456806 evolution 38524 0.0 S 03:07 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456779 1438952 evolution 38516 0.0 S 03:27 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1453908 1437320 evolution 38512 0.0 S 05:36 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1454027 1453986 evolution 38512 0.0 S 05:30 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456819 1456810 evolution 38512 0.0 S 03:23 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437525 1437322 evolution 38408 0.0 S 07:37 /opt/cpanel/ea-php83/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9835654 | claude | 108-1481181613 | Query | 1757 | Sending data | SELECT 'job-items with BOTH picking and dispatch' k, COUNT(*) v FROM ( SELECT ji.id FROM jobInventory ji WHERE EXISTS(SELECT 1 FROM pickingitems pi JOIN picking p ON p.id=pi.pickingid WHERE pi.jobitemid=ji.id AND p.datecreated BETWEEN @from AND @to) AND EXISTS(SELECT 1 FROM dispatchitems di | | 9953837 | root | 108-1481181613 | Execute | 532 | Waiting for table level lock | update dispatchitems set qty = ?, dispatchbinsources = ? where id =? and dispatchid = ? | | 9957582 | root | 108-1481181613 | Execute | 507 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29402' AND dispatchitems.j | | 9962083 | root | 108-1481181613 | Execute | 479 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29405' AND dispatchitems.j | | 9964402 | root | 108-1481181613 | Execute | 456 | Waiting for table level lock | SELECT sum(dispatchitems.qty) as complete from dispatchitems,dispatch WHERE dispatchitems.jobitemid='200379' and dispatchitems.dispatchid=dispatch.id AND dispatch.status>='0' | | 9966195 | root | 108-1481181613 | Execute | 446 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9975761 | root | 108-1481181613 | Execute | 370 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29405' AND dispatchitems.j | | 9982965 | root | 108-1481181613 | Execute | 327 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9992249 | root | 108-1481181613 | Execute | 264 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29737' AND dispatchitems.j | | 9994739 | root | 108-1481181613 | Execute | 224 | Waiting for table level lock | select dispatch.*,dispatchitems.qty, (SELECT jobcode FROM jobs WHERE jobs.id = dispatch.jobid) as jobcode from dispatch,dispatchitems where dispatchitems.dispatchid=dispatch.id AND dispatch.status != '2' AND dispatchitems.itemid = ? | | 10003548 | root | 108-1481181613 | Execute | 103 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29405' AND dispatchitems.j | | 10009412 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +----------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +----------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9953837 | 108-1481181613 | 532 | Waiting for table level lock | update dispatchitems set qty = ?, dispatchbinsources = ? where id =? and dispatchid = ? | | 9957582 | 108-1481181613 | 507 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9962083 | 108-1481181613 | 479 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9964402 | 108-1481181613 | 456 | Waiting for table level lock | SELECT sum(dispatchitems.qty) as complete from dispatchitems,dispatch WHERE dispatchitems.jobitemid='200379' and dispatchitems.dispatchid=dispatch.id AND dispatch.status>='0' | | 9966195 | 108-1481181613 | 446 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9975761 | 108-1481181613 | 370 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9982965 | 108-1481181613 | 327 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9992249 | 108-1481181613 | 264 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9994739 | 108-1481181613 | 224 | Waiting for table level lock | select dispatch.*,dispatchitems.qty, (SELECT jobcode FROM jobs WHERE jobs.id = dispatch.jobid) as jobcode from dispatch,dispatchitems where dispatchitems.dispatchid=dispatch.id AND | | 10003548 | 108-1481181613 | 103 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | +----------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 465 evolution/app.evolutionerp.com.au-ssl_log 112 evolution/portal.evolutionerp.com.au-ssl_log 24 aaa/aaadownunder.com.au-ssl_log 11 madalice/madalice.com.au-ssl_log 7 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 182 103.104.165.99 118 203.54.180.238 112 40.115.94.245 53 1.144.107.82 52 120.150.225.142 25 182.239.240.254 25 150.228.151.88 19 1.125.108.125 6 103.104.164.114 4 207.46.13.14 4 165.225.233.87 2 207.46.13.154 2 180.181.236.49 2 157.55.39.13 2 147.161.213.71 --- top request paths across all vhosts (last 3 min) --- 156 POST /functions.php 97 GET /app/ajax.php 48 GET /index.php 29 POST /plugins/csvexporter/plugin.php 24 GET /heartbeat.php 16 POST /app/ajax/selectFilter.php 15 HEAD /index.php 13 POST /app/ajax/selectFilterSingle.php 13 POST /app/ajax.php 10 POST /quoteditsave.php 10 POST /clienteditsave.php 8 POST /billaddsave.php 7 POST /purchaseaddsave.php 7 POST /jobeditsave.php 5 POST /inveditsave.php 4 POST /plugins/fencecosting/plugin.php 4 POST /logsave.php 4 POST /itemModify.php 4 POST /app/ajax/setPurchaseSent.php 3 POST /mfreqsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 156 POST /functions.php 97 GET /app/ajax.php 48 GET /index.php 29 POST /plugins/csvexporter/plugin.php 16 POST /app/ajax/selectFilter.php 15 HEAD /index.php 13 POST /app/ajax/selectFilterSingle.php 13 POST /app/ajax.php 10 POST /quoteditsave.php 10 POST /clienteditsave.php 8 POST /billaddsave.php 7 POST /purchaseaddsave.php -- last 10 requests -- 157.55.39.13 - - [10/Sep/2026:11:40:59 +1000] "GET /index.php?page=invoiceadd HTTP/1.1" 200 5684 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/1 203.54.180.238 - - [10/Sep/2026:11:40:59 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=purchaseadd&purchaseid=13575" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 103.104.165.99 - - [10/Sep/2026:11:40:59 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 203.54.180.238 - - [10/Sep/2026:11:41:00 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 237 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=79292§ionid=0" "Mozilla/5.0 (Windows NT 10.0; Win6 103.104.165.99 - - [10/Sep/2026:11:41:00 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 876950 "https://my.evolutionerp.com.au/index.php?page=clientedit&clientid=404&tab=clienteditpricing" "Mozilla/5.0 (Wind 203.54.180.238 - - [10/Sep/2026:11:41:00 +1000] "GET /index.php?page=jobregister HTTP/1.1" 200 11145 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Ed 203.54.180.238 - - [10/Sep/2026:11:41:01 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=jobregister" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53 103.104.165.99 - - [10/Sep/2026:11:41:01 +1000] "POST /quoteditsave.php?call=addLineItem HTTP/1.1" 200 303 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=35533§ionid=33058" "Mozilla/5.0 (Windows NT 1 157.55.39.13 - - [10/Sep/2026:11:41:01 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvoiceadd&call=getUserSetting&caller=ajaxSubmitLocal&seq=18800978784 HTTP/1.1" 200 92 "https://my.evolutionerp.com.au/index.php?p 103.104.165.99 - - [10/Sep/2026:11:41:02 +1000] "POST /itemModify.php?call=updateQuoteItem HTTP/1.1" 200 180 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=35533§ionid=33058" "Mozilla/5.0 (Windows NT == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 3 GET /api/getItem/SHSG125125408 3 GET /api/getItem/RHSG7550168 2 GET /api/getItem/SHSP8989608 2 GET /api/getItem/SHSP200200608 2 GET /api/getItem/SHSP200200508 2 GET /api/getItem/SHSP150150608 2 GET /api/getItem/SHSP150150508 2 GET /api/getItem/SHSP125125608 2 GET /api/getItem/SHSP100100608 2 GET /api/getItem/SHSG125125508 2 GET /api/getItem/RHSG7550258 2 GET /api/getItem/RHSG755020 -- last 10 requests -- 40.115.94.245 - - [10/Sep/2026:11:40:43 +1000] "GET /api/getItem/RHSG15050258 HTTP/1.1" 404 114 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:40:43 +1000] "GET /api/getItem/RHSG7525208 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:40:43 +1000] "GET /api/getItem/RHSG15050308 HTTP/1.1" 200 1343 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:40:43 +1000] "GET /api/getItem/RHSG7525258 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:40:44 +1000] "GET /api/getItem/RHSG15050408 HTTP/1.1" 404 114 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:40:44 +1000] "GET /api/getItem/RHSG7550168 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:40:44 +1000] "GET /api/getItem/RHSG15050508 HTTP/1.1" 404 114 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:40:44 +1000] "GET /api/getItem/RHSG755020 HTTP/1.1" 200 1502 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:40:44 +1000] "GET /api/getItem/RHSP15050608 HTTP/1.1" 404 114 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:40:45 +1000] "GET /api/getItem/RHSG7550258 HTTP/1.1" 200 1340 "-" "RestSharp/106.13.0.0" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 24 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [10/Sep/2026:11:40:10 +1000] "GET /heartbeat.php?sentAt=1789004411&bytes=106,162,10,123&_=1788957671755 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:40:14 +1000] "GET /heartbeat.php?sentAt=1789004414&bytes=106,162,10,126&_=1788987692435 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:40:20 +1000] "GET /heartbeat.php?sentAt=1789004421&bytes=106,162,10,133&_=1788957671756 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:40:24 +1000] "GET /heartbeat.php?sentAt=1789004424&bytes=106,162,10,136&_=1788987692436 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:40:30 +1000] "GET /heartbeat.php?sentAt=1789004431&bytes=106,162,10,143&_=1788957671757 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:40:34 +1000] "GET /heartbeat.php?sentAt=1789004434&bytes=106,162,10,146&_=1788987692437 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:40:40 +1000] "GET /heartbeat.php?sentAt=1789004441&bytes=106,162,10,153&_=1788957671758 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:40:44 +1000] "GET /heartbeat.php?sentAt=1789004444&bytes=106,162,10,156&_=1788987692438 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:40:50 +1000] "GET /heartbeat.php?sentAt=1789004451&bytes=106,162,10,163&_=1788957671759 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:40:54 +1000] "GET /heartbeat.php?sentAt=1789004454&bytes=106,162,10,166&_=1788987692439 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-09-10 11:38:34 L1=2.02 run=2 blk=0 avail=7045 (51.1%) swpO=0 conn=12 myRSS=2936 php=52 phpRSS=2061 ap=81 tcp=66 topuser=evolution 2026-09-10 11:38:41 L1=1.94 run=5 blk=0 avail=6900 (50.1%) swpO=0 conn=14 myRSS=2936 php=55 phpRSS=2305 ap=79 tcp=62 topuser=evolution 2026-09-10 11:38:44 L1=1.94 run=6 blk=0 avail=6946 (50.4%) swpO=0 conn=12 myRSS=2936 php=57 phpRSS=2288 ap=82 tcp=59 topuser=evolution 2026-09-10 11:38:51 L1=1.95 run=3 blk=0 avail=6998 (50.8%) swpO=0 conn=12 myRSS=2936 php=54 phpRSS=2158 ap=81 tcp=63 topuser=evolution 2026-09-10 11:38:54 L1=1.95 run=8 blk=0 avail=6948 (50.4%) swpO=1 conn=14 myRSS=2936 php=58 phpRSS=2343 ap=81 tcp=68 topuser=evolution 2026-09-10 11:39:01 L1=1.80 run=4 blk=0 avail=6917 (50.2%) swpO=1 conn=13 myRSS=2936 php=55 phpRSS=2216 ap=85 tcp=66 topuser=evolution 2026-09-10 11:39:04 L1=1.80 run=3 blk=0 avail=6945 (50.4%) swpO=0 conn=13 myRSS=2936 php=55 phpRSS=2199 ap=85 tcp=62 topuser=evolution 2026-09-10 11:39:12 L1=2.37 run=2 blk=0 avail=6880 (49.9%) swpO=0 conn=12 myRSS=2936 php=55 phpRSS=2176 ap=100 tcp=64 topuser=evolution 2026-09-10 11:39:14 L1=2.37 run=6 blk=0 avail=6848 (49.7%) swpO=0 conn=14 myRSS=2936 php=59 phpRSS=2342 ap=98 tcp=66 topuser=evolution 2026-09-10 11:39:22 L1=2.53 run=3 blk=0 avail=6886 (50.0%) swpO=0 conn=13 myRSS=2936 php=58 phpRSS=2329 ap=90 tcp=61 topuser=evolution 2026-09-10 11:39:24 L1=2.53 run=2 blk=0 avail=6882 (50.0%) swpO=0 conn=14 myRSS=2936 php=59 phpRSS=2369 ap=88 tcp=61 topuser=evolution 2026-09-10 11:39:32 L1=2.37 run=3 blk=0 avail=6903 (50.1%) swpO=0 conn=13 myRSS=2936 php=58 phpRSS=2329 ap=83 tcp=58 topuser=evolution 2026-09-10 11:39:34 L1=2.37 run=2 blk=0 avail=6921 (50.2%) swpO=0 conn=14 myRSS=2936 php=59 phpRSS=2369 ap=83 tcp=61 topuser=evolution 2026-09-10 11:39:42 L1=2.16 run=3 blk=0 avail=7059 (51.2%) swpO=0 conn=13 myRSS=2936 php=58 phpRSS=2197 ap=82 tcp=57 topuser=evolution 2026-09-10 11:39:44 L1=2.16 run=3 blk=0 avail=6935 (50.3%) swpO=0 conn=15 myRSS=2936 php=59 phpRSS=2352 ap=82 tcp=62 topuser=evolution 2026-09-10 11:39:52 L1=1.98 run=3 blk=0 avail=6921 (50.2%) swpO=0 conn=13 myRSS=2936 php=58 phpRSS=2304 ap=87 tcp=58 topuser=evolution 2026-09-10 11:39:54 L1=1.98 run=2 blk=0 avail=6887 (50.0%) swpO=0 conn=14 myRSS=2936 php=59 phpRSS=2366 ap=87 tcp=65 topuser=evolution 2026-09-10 11:40:02 L1=1.98 run=5 blk=0 avail=6763 (49.1%) swpO=0 conn=13 myRSS=2936 php=60 phpRSS=2403 ap=101 tcp=65 topuser=evolution 2026-09-10 11:40:04 L1=1.98 run=8 blk=0 avail=6790 (49.3%) swpO=0 conn=14 myRSS=2936 php=59 phpRSS=2366 ap=99 tcp=70 topuser=evolution 2026-09-10 11:40:13 L1=2.13 run=4 blk=0 avail=6660 (48.3%) swpO=0 conn=14 myRSS=2936 php=62 phpRSS=2611 ap=93 tcp=58 topuser=evolution 2026-09-10 11:40:14 L1=2.13 run=4 blk=0 avail=6648 (48.3%) swpO=0 conn=14 myRSS=2936 php=66 phpRSS=2764 ap=92 tcp=61 topuser=evolution 2026-09-10 11:40:23 L1=2.11 run=4 blk=0 avail=6787 (49.3%) swpO=0 conn=13 myRSS=2936 php=60 phpRSS=2498 ap=84 tcp=58 topuser=evolution 2026-09-10 11:40:24 L1=2.11 run=2 blk=0 avail=6785 (49.3%) swpO=0 conn=14 myRSS=2936 php=61 phpRSS=2538 ap=84 tcp=57 topuser=evolution 2026-09-10 11:40:33 L1=1.94 run=2 blk=0 avail=6928 (50.3%) swpO=0 conn=13 myRSS=2936 php=60 phpRSS=2381 ap=84 tcp=55 topuser=evolution 2026-09-10 11:40:35 L1=1.94 run=4 blk=0 avail=6976 (50.6%) swpO=0 conn=15 myRSS=2936 php=61 phpRSS=2370 ap=83 tcp=55 topuser=evolution 2026-09-10 11:40:43 L1=2.19 run=12 blk=0 avail=6431 (46.7%) swpO=0 conn=17 myRSS=2936 php=64 phpRSS=2891 ap=93 tcp=69 topuser=evolution 2026-09-10 11:40:45 L1=2.19 run=4 blk=0 avail=6521 (47.3%) swpO=0 conn=15 myRSS=2936 php=65 phpRSS=2775 ap=101 tcp=76 topuser=evolution 2026-09-10 11:40:53 L1=2.48 run=3 blk=0 avail=6518 (47.3%) swpO=0 conn=13 myRSS=2936 php=64 phpRSS=2788 ap=97 tcp=64 topuser=evolution 2026-09-10 11:40:55 L1=2.48 run=4 blk=0 avail=6382 (46.3%) swpO=0 conn=17 myRSS=2936 php=67 phpRSS=3026 ap=97 tcp=68 topuser=evolution 2026-09-10 11:41:04 L1=2.49 run=2 blk=0 avail=6544 (47.5%) swpO=0 conn=13 myRSS=2936 php=64 phpRSS=2789 ap=93 tcp=72 topuser=evolution