INCIDENT 2026-09-10 11:42:04 trigger: php_procs=97 php_rss=3772MB mysql_conn=21 ================================================================== load: 2.06 2.35 2.41 3/790 1476091 ncpu:10 mem_avail: 6314MB/13777MB (45.8%) swap_used:1414MB swapout:0/s blocked(D):0 running:4 iowait:0.1% steal:0.0% php: 97 procs / 3772MB heaviest user: evolution (95 procs, 3639MB) apache: 112 procs tcp_estab: 78 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 99 3617 mysql 1 2936 nobody 111 1973 root 244 1085 netdata 8 256 mailman 20 183 olympic 1 130 dovenull 6 66 wp-toolkit 3 61 cpanellogin 1 50 kurri 3 41 dovecot 3 28 polkitd 1 15 lowrange 1 14 corpkicks 1 14 zabbix 1 10 nscd 1 6 named 1 5 cpanelconnecttrack 1 4 mailnull 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 94 3600 olympic 1 130 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5192 MB Active(file): 4517 MB Inactive(file): 711 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 524 MB CommitLimit: 10984 MB Committed_AS: 12827 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 9-09:19:40 3696 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 3006976 15.1 Ssl 2-06:56:37 /usr/sbin/mariadbd 166870 1 netdata 201252 2.7 Ssl 4-09:19:46 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2328754 1 root 196740 0.0 Ss 2-06:56:47 /usr/lib/systemd/systemd-journald 3701672 3652415 root 193028 0.1 S 09:06:52 spamd child 3701673 3652415 root 160872 0.0 S 09:06:52 spamd child 3652415 1 root 147972 0.0 Ss 09:17:13 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1476020 1475806 olympic 133764 62.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509236 509098 root 68164 0.0 Sl 13-09:22:26 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1437265 1437120 evolution 59328 0.0 S 09:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1436920 1435595 evolution 59164 0.0 S 09:28 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1475487 1457894 evolution 58716 0.2 S 00:44 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1438671 1419096 evolution 58224 0.0 S 07:11 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1458755 1457633 evolution 58016 0.0 S 02:44 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1455541 1455515 evolution 57112 0.0 S 05:26 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456586 1456427 evolution 57108 0.0 S 04:45 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1382815 1353308 cpanellogin 51324 0.0 S 23:36 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 1353308 1 root 42392 0.0 Ss 50-09:00:52 cpsrvd (SSL) - waiting for connections 1454144 1435446 evolution 41524 0.0 S 06:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436669 1419737 evolution 41488 0.0 S 09:53 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1437554 1419738 evolution 41076 0.0 S 08:37 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436992 1435559 evolution 41016 0.0 S 09:21 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438043 1436907 evolution 40980 0.0 S 08:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436739 1435940 evolution 40884 0.0 S 09:46 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438231 1438076 evolution 40652 0.0 S 07:44 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437858 1437119 evolution 40648 0.0 S 08:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437497 1437325 evolution 40616 0.0 S 08:42 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456738 1455358 evolution 40588 0.0 S 04:32 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1436963 1435860 evolution 40584 0.0 S 09:23 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437252 1419739 evolution 40560 0.0 S 09:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437654 1436586 evolution 40472 0.0 S 08:27 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1476055 1476011 evolution 40432 4.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1439120 1438976 evolution 40332 0.0 S 07:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1453831 1446040 evolution 40308 0.0 S 06:43 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1458221 1458055 evolution 40280 0.0 S 03:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 39812 0.1 Ss 73-01:32:21 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1456372 1455322 evolution 39396 0.0 S 05:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438494 1438439 evolution 39348 0.0 S 07:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1455138 1455129 evolution 39288 0.0 S 05:57 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1474517 1459398 evolution 39196 0.0 S 01:33 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1474300 1459399 evolution 39160 0.0 S 01:52 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1454380 1438021 evolution 39148 0.0 S 06:13 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1455576 1455361 evolution 39028 0.0 S 05:24 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438623 1437809 evolution 38872 0.0 S 07:14 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437335 1437319 evolution 38784 0.0 S 08:55 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1475365 1459376 evolution 38636 0.0 S 00:57 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1454393 1449042 evolution 38632 0.0 S 06:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1455722 1455539 evolution 38632 0.0 S 05:13 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1458621 1457887 evolution 38632 0.0 S 02:56 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1458702 1458661 evolution 38632 0.0 S 02:50 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1475724 1458658 evolution 38620 0.1 S 00:20 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1453909 1437324 evolution 38596 0.0 S 06:37 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1475692 1474869 evolution 38596 0.1 S 00:26 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1455542 1453967 evolution 38592 0.0 S 05:25 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1475698 1475354 evolution 38592 0.1 S 00:24 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1476058 1475807 evolution 38592 0.0 S 00:00 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1475581 1475552 evolution 38584 0.0 S 00:38 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1475754 1456809 evolution 38584 0.2 S 00:20 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1475491 1458660 evolution 38580 0.0 S 00:44 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1454202 1438690 evolution 38576 0.0 S 06:25 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1476003 1474870 evolution 38572 0.6 S 00:05 /opt/cpanel/ea-php83/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9835654 | claude | 108-1481181613 | Query | 1818 | Sending data | SELECT 'job-items with BOTH picking and dispatch' k, COUNT(*) v FROM ( SELECT ji.id FROM jobInventory ji WHERE EXISTS(SELECT 1 FROM pickingitems pi JOIN picking p ON p.id=pi.pickingid WHERE pi.jobitemid=ji.id AND p.datecreated BETWEEN @from AND @to) AND EXISTS(SELECT 1 FROM dispatchitems di | | 9953837 | root | 108-1481181613 | Execute | 593 | Waiting for table level lock | update dispatchitems set qty = ?, dispatchbinsources = ? where id =? and dispatchid = ? | | 9957582 | root | 108-1481181613 | Execute | 567 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29402' AND dispatchitems.j | | 9962083 | root | 108-1481181613 | Execute | 539 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29405' AND dispatchitems.j | | 9964402 | root | 108-1481181613 | Execute | 517 | Waiting for table level lock | SELECT sum(dispatchitems.qty) as complete from dispatchitems,dispatch WHERE dispatchitems.jobitemid='200379' and dispatchitems.dispatchid=dispatch.id AND dispatch.status>='0' | | 9966195 | root | 108-1481181613 | Execute | 507 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9975761 | root | 108-1481181613 | Execute | 431 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29405' AND dispatchitems.j | | 9982965 | root | 108-1481181613 | Execute | 388 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9992249 | root | 108-1481181613 | Execute | 325 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29737' AND dispatchitems.j | | 9994739 | root | 108-1481181613 | Execute | 285 | Waiting for table level lock | select dispatch.*,dispatchitems.qty, (SELECT jobcode FROM jobs WHERE jobs.id = dispatch.jobid) as jobcode from dispatch,dispatchitems where dispatchitems.dispatchid=dispatch.id AND dispatch.status != '2' AND dispatchitems.itemid = ? | | 10003548 | root | 108-1481181613 | Execute | 164 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29405' AND dispatchitems.j | | 10010187 | root | 108-1481181613 | Execute | 44 | Waiting for table level lock | UPDATE jobs SET nextaction = '2025-11-07 00:00:00' WHERE id = '25016' | | 10010660 | root | 108-1481181613 | Execute | 41 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 10010814 | root | 108-1481181613 | Execute | 36 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 10011331 | root | 108-1481181613 | Execute | 20 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 10012379 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 10012329 | root | 108-1481181613 | Execute | 0 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 10012268 | olympic_wp | olympic_wp | Query | 0 | init | SELECT * FROM nqNZ24_actionscheduler_actions WHERE action_id=44504 | +----------+------------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +----------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +----------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9953837 | 108-1481181613 | 593 | Waiting for table level lock | update dispatchitems set qty = ?, dispatchbinsources = ? where id =? and dispatchid = ? | | 9957582 | 108-1481181613 | 567 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9962083 | 108-1481181613 | 539 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9964402 | 108-1481181613 | 517 | Waiting for table level lock | SELECT sum(dispatchitems.qty) as complete from dispatchitems,dispatch WHERE dispatchitems.jobitemid='200379' and dispatchitems.dispatchid=dispatch.id AND dispatch.status>='0' | | 9966195 | 108-1481181613 | 507 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9975761 | 108-1481181613 | 431 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9982965 | 108-1481181613 | 388 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9992249 | 108-1481181613 | 325 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9994739 | 108-1481181613 | 285 | Waiting for table level lock | select dispatch.*,dispatchitems.qty, (SELECT jobcode FROM jobs WHERE jobs.id = dispatch.jobid) as jobcode from dispatch,dispatchitems where dispatchitems.dispatchid=dispatch.id AND | | 10003548 | 108-1481181613 | 164 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 10010187 | 108-1481181613 | 44 | Waiting for table level lock | UPDATE jobs SET nextaction = '2025-11-07 00:00:00' WHERE id = '25016' | | 10010660 | 108-1481181613 | 41 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 10010814 | 108-1481181613 | 36 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 10011331 | 108-1481181613 | 20 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 10012329 | 108-1481181613 | 0 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | +----------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 431 evolution/app.evolutionerp.com.au-ssl_log 115 evolution/portal.evolutionerp.com.au-ssl_log 23 madalice/madalice.com.au-ssl_log 12 aaa/aaadownunder.com.au-ssl_log 5 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 154 103.104.165.99 132 203.54.180.238 115 40.115.94.245 103 1.144.107.82 20 182.239.240.254 19 150.228.151.88 7 120.150.225.142 6 45.61.185.89 6 103.104.164.114 4 165.225.233.87 3 207.46.13.14 2 157.55.39.13 2 147.161.213.71 2 146.19.125.65 2 118.127.40.55 --- top request paths across all vhosts (last 3 min) --- 169 POST /functions.php 77 GET /app/ajax.php 49 GET /index.php 35 POST /plugins/csvexporter/plugin.php 23 POST /app/ajax/selectFilter.php 23 GET /heartbeat.php 10 POST /quoteditsave.php 10 POST /app/ajax.php 8 POST /app/ajax/selectFilterSingle.php 8 HEAD /index.php 7 POST /jobeditsave.php 7 POST /inveditsave.php 6 POST /clienteditsave.php 4 GET /api/getItem/RHSG1257530 4 GET / 3 POST /wp-admin/admin-ajax.php 3 POST /purchaseaddsave.php 3 POST /itemModify.php 3 GET /api/getItem/RHSP200100508 3 GET /api/getItem/RHSG10050208 --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 169 POST /functions.php 77 GET /app/ajax.php 49 GET /index.php 35 POST /plugins/csvexporter/plugin.php 23 POST /app/ajax/selectFilter.php 10 POST /quoteditsave.php 10 POST /app/ajax.php 8 POST /app/ajax/selectFilterSingle.php 8 HEAD /index.php 7 POST /jobeditsave.php 7 POST /inveditsave.php 6 POST /clienteditsave.php -- last 10 requests -- 1.144.107.82 - - [10/Sep/2026:11:41:57 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinvedit%26id%3D7085%26tab%3Dgeneraltab&call=getUserSetting&caller=ajaxSubmitLocal&seq=10710863507 HTTP/1.1" 200 109 "https://my.ev 182.239.240.254 - - [10/Sep/2026:11:41:58 +1000] "GET /index.php HTTP/1.1" 200 18100 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152 1.144.107.82 - - [10/Sep/2026:11:41:59 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=invedit&id=7085&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 1.144.107.82 - - [10/Sep/2026:11:41:59 +1000] "GET /index.php?page=invedit&id=7617 HTTP/1.1" 200 34344 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 103.104.165.99 - - [10/Sep/2026:11:41:59 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 1.144.107.82 - - [10/Sep/2026:11:41:59 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=invedit&id=7617&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 1.144.107.82 - - [10/Sep/2026:11:41:59 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=inventory" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 1.144.107.82 - - [10/Sep/2026:11:42:00 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invedit&id=1245&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x64 103.104.165.99 - - [10/Sep/2026:11:42:00 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 182.239.240.254 - - [10/Sep/2026:11:42:01 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 4 GET /api/getItem/RHSG1257530 3 GET /api/getItem/RHSP200100508 3 GET /api/getItem/RHSG10050208 3 GET /api/getItem/RHSG1005020 2 GET /api/getItem/SHSG252516-8 2 GET /api/getItem/SHSG252516-6.5 2 GET /api/getItem/RHSP7550608 2 GET /api/getItem/RHSP200100608 2 GET /api/getItem/RHSP200100408 2 GET /api/getItem/RHSP15050608 2 GET /api/getItem/RHSP150100608 2 GET /api/getItem/RHSP150100508 -- last 10 requests -- 40.115.94.245 - - [10/Sep/2026:11:41:55 +1000] "GET /api/getItem/RHSP200100408 HTTP/1.1" 404 115 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:41:55 +1000] "GET /api/getItem/RHSG1005020-SP25-8 HTTP/1.1" 200 1415 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:41:55 +1000] "GET /api/getItem/RHSP200100508 HTTP/1.1" 404 115 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:41:56 +1000] "GET /api/getItem/RHSG10050208 HTTP/1.1" 200 1617 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:41:56 +1000] "GET /api/getItem/RHSP200100608 HTTP/1.1" 404 115 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:41:56 +1000] "GET /api/getItem/SHSG2020168 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:41:56 +1000] "GET /api/getItem/RHSG10050258 HTTP/1.1" 200 1570 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:41:57 +1000] "GET /api/getItem/SHSG2020258 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:41:57 +1000] "GET /api/getItem/RHSG10050308 HTTP/1.1" 200 1698 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:41:57 +1000] "GET /api/getItem/SHSG2020308 HTTP/1.1" 404 113 "-" "RestSharp/106.13.0.0" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 23 GET /heartbeat.php -- last 10 requests -- 203.54.180.238 - - [10/Sep/2026:11:41:04 +1000] "GET /heartbeat.php?sentAt=1789004464&bytes=106,162,10,176&_=1788987692440 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:41:10 +1000] "GET /heartbeat.php?sentAt=1789004471&bytes=106,162,10,183&_=1788957671761 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:41:14 +1000] "GET /heartbeat.php?sentAt=1789004474&bytes=106,162,10,186&_=1788987692441 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:41:20 +1000] "GET /heartbeat.php?sentAt=1789004481&bytes=106,162,10,193&_=1788957671762 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:41:24 +1000] "GET /heartbeat.php?sentAt=1789004484&bytes=106,162,10,196&_=1788987692442 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:41:30 +1000] "GET /heartbeat.php?sentAt=1789004491&bytes=106,162,10,203&_=1788957671763 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:41:34 +1000] "GET /heartbeat.php?sentAt=1789004494&bytes=106,162,10,206&_=1788987692443 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:41:40 +1000] "GET /heartbeat.php?sentAt=1789004501&bytes=106,162,10,213&_=1788957671764 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:41:44 +1000] "GET /heartbeat.php?sentAt=1789004504&bytes=106,162,10,216&_=1788987692444 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:41:50 +1000] "GET /heartbeat.php?sentAt=1789004511&bytes=106,162,10,223&_=1788957671765 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-09-10 11:39:34 L1=2.37 run=2 blk=0 avail=6921 (50.2%) swpO=0 conn=14 myRSS=2936 php=59 phpRSS=2369 ap=83 tcp=61 topuser=evolution 2026-09-10 11:39:42 L1=2.16 run=3 blk=0 avail=7059 (51.2%) swpO=0 conn=13 myRSS=2936 php=58 phpRSS=2197 ap=82 tcp=57 topuser=evolution 2026-09-10 11:39:44 L1=2.16 run=3 blk=0 avail=6935 (50.3%) swpO=0 conn=15 myRSS=2936 php=59 phpRSS=2352 ap=82 tcp=62 topuser=evolution 2026-09-10 11:39:52 L1=1.98 run=3 blk=0 avail=6921 (50.2%) swpO=0 conn=13 myRSS=2936 php=58 phpRSS=2304 ap=87 tcp=58 topuser=evolution 2026-09-10 11:39:54 L1=1.98 run=2 blk=0 avail=6887 (50.0%) swpO=0 conn=14 myRSS=2936 php=59 phpRSS=2366 ap=87 tcp=65 topuser=evolution 2026-09-10 11:40:02 L1=1.98 run=5 blk=0 avail=6763 (49.1%) swpO=0 conn=13 myRSS=2936 php=60 phpRSS=2403 ap=101 tcp=65 topuser=evolution 2026-09-10 11:40:04 L1=1.98 run=8 blk=0 avail=6790 (49.3%) swpO=0 conn=14 myRSS=2936 php=59 phpRSS=2366 ap=99 tcp=70 topuser=evolution 2026-09-10 11:40:13 L1=2.13 run=4 blk=0 avail=6660 (48.3%) swpO=0 conn=14 myRSS=2936 php=62 phpRSS=2611 ap=93 tcp=58 topuser=evolution 2026-09-10 11:40:14 L1=2.13 run=4 blk=0 avail=6648 (48.3%) swpO=0 conn=14 myRSS=2936 php=66 phpRSS=2764 ap=92 tcp=61 topuser=evolution 2026-09-10 11:40:23 L1=2.11 run=4 blk=0 avail=6787 (49.3%) swpO=0 conn=13 myRSS=2936 php=60 phpRSS=2498 ap=84 tcp=58 topuser=evolution 2026-09-10 11:40:24 L1=2.11 run=2 blk=0 avail=6785 (49.3%) swpO=0 conn=14 myRSS=2936 php=61 phpRSS=2538 ap=84 tcp=57 topuser=evolution 2026-09-10 11:40:33 L1=1.94 run=2 blk=0 avail=6928 (50.3%) swpO=0 conn=13 myRSS=2936 php=60 phpRSS=2381 ap=84 tcp=55 topuser=evolution 2026-09-10 11:40:35 L1=1.94 run=4 blk=0 avail=6976 (50.6%) swpO=0 conn=15 myRSS=2936 php=61 phpRSS=2370 ap=83 tcp=55 topuser=evolution 2026-09-10 11:40:43 L1=2.19 run=12 blk=0 avail=6431 (46.7%) swpO=0 conn=17 myRSS=2936 php=64 phpRSS=2891 ap=93 tcp=69 topuser=evolution 2026-09-10 11:40:45 L1=2.19 run=4 blk=0 avail=6521 (47.3%) swpO=0 conn=15 myRSS=2936 php=65 phpRSS=2775 ap=101 tcp=76 topuser=evolution 2026-09-10 11:40:53 L1=2.48 run=3 blk=0 avail=6518 (47.3%) swpO=0 conn=13 myRSS=2936 php=64 phpRSS=2788 ap=97 tcp=64 topuser=evolution 2026-09-10 11:40:55 L1=2.48 run=4 blk=0 avail=6382 (46.3%) swpO=0 conn=17 myRSS=2936 php=67 phpRSS=3026 ap=97 tcp=68 topuser=evolution 2026-09-10 11:41:04 L1=2.49 run=2 blk=0 avail=6544 (47.5%) swpO=0 conn=13 myRSS=2936 php=64 phpRSS=2789 ap=93 tcp=72 topuser=evolution 2026-09-10 11:41:05 L1=2.49 run=3 blk=0 avail=6515 (47.3%) swpO=0 conn=13 myRSS=2936 php=66 phpRSS=2864 ap=95 tcp=78 topuser=evolution 2026-09-10 11:41:14 L1=2.49 run=6 blk=0 avail=6179 (44.9%) swpO=0 conn=17 myRSS=2936 php=70 phpRSS=3304 ap=96 tcp=77 topuser=evolution 2026-09-10 11:41:15 L1=2.49 run=5 blk=0 avail=6272 (45.5%) swpO=0 conn=13 myRSS=2936 php=68 phpRSS=3154 ap=96 tcp=73 topuser=evolution 2026-09-10 11:41:24 L1=2.26 run=2 blk=0 avail=6536 (47.4%) swpO=0 conn=16 myRSS=2936 php=73 phpRSS=3025 ap=95 tcp=74 topuser=evolution 2026-09-10 11:41:25 L1=2.26 run=2 blk=0 avail=6537 (47.4%) swpO=0 conn=15 myRSS=2936 php=74 phpRSS=3056 ap=97 tcp=75 topuser=evolution 2026-09-10 11:41:34 L1=2.06 run=2 blk=0 avail=6429 (46.7%) swpO=0 conn=17 myRSS=2936 php=79 phpRSS=3245 ap=101 tcp=73 topuser=evolution 2026-09-10 11:41:35 L1=2.06 run=2 blk=0 avail=6572 (47.7%) swpO=0 conn=16 myRSS=2936 php=77 phpRSS=3046 ap=101 tcp=71 topuser=evolution 2026-09-10 11:41:44 L1=1.98 run=4 blk=0 avail=6545 (47.5%) swpO=0 conn=18 myRSS=2936 php=84 phpRSS=3288 ap=98 tcp=70 topuser=evolution 2026-09-10 11:41:45 L1=1.98 run=2 blk=0 avail=6544 (47.5%) swpO=0 conn=17 myRSS=2936 php=84 phpRSS=3286 ap=98 tcp=67 topuser=evolution 2026-09-10 11:41:54 L1=1.98 run=6 blk=0 avail=6408 (46.5%) swpO=0 conn=19 myRSS=2936 php=91 phpRSS=3568 ap=105 tcp=72 topuser=evolution 2026-09-10 11:41:55 L1=1.98 run=2 blk=0 avail=6458 (46.9%) swpO=0 conn=17 myRSS=2936 php=88 phpRSS=3433 ap=105 tcp=72 topuser=evolution 2026-09-10 11:42:04 L1=2.06 run=4 blk=0 avail=6314 (45.8%) swpO=0 conn=21 myRSS=2936 php=97 phpRSS=3772 ap=112 tcp=78 topuser=evolution