INCIDENT 2026-09-10 11:43:05 trigger: php_procs=121 php_rss=4594MB mysql_conn=21 ================================================================== load: 1.86 2.24 2.37 3/854 1476925 ncpu:10 mem_avail: 5913MB/13777MB (42.9%) swap_used:1429MB swapout:374/s blocked(D):0 running:3 iowait:0.3% steal:0.0% php: 121 procs / 4594MB heaviest user: evolution (120 procs, 4592MB) apache: 145 procs tcp_estab: 96 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 125 4609 mysql 1 2931 nobody 144 2555 root 247 1114 netdata 8 257 mailman 20 181 dovenull 6 66 wp-toolkit 3 61 cpanellogin 1 51 dovecot 3 28 mailnull 3 27 polkitd 1 15 lowrange 1 14 kurri 1 12 zabbix 1 10 nscd 1 6 named 1 5 cpanelconnecttrack 1 4 dbus 1 2 chrony 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 120 4591 root 1 2 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4909 MB Active(file): 4146 MB Inactive(file): 801 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 522 MB CommitLimit: 10984 MB Committed_AS: 15727 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 9-09:20:41 3696 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2330591 1 mysql 3001516 15.2 Ssl 2-06:57:38 /usr/sbin/mariadbd 166870 1 netdata 201492 2.7 Ssl 4-09:20:47 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2328754 1 root 196740 0.0 Ss 2-06:57:48 /usr/lib/systemd/systemd-journald 3701672 3652415 root 192516 0.1 S 09:07:53 spamd child 3701673 3652415 root 160472 0.0 S 09:07:53 spamd child 3652415 1 root 144084 0.0 Ss 09:18:14 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509236 509098 root 68132 0.0 Sl 13-09:23:27 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1437265 1437120 evolution 59328 0.0 S 10:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1436920 1435595 evolution 59164 0.0 S 10:29 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1475487 1457894 evolution 58716 0.1 S 01:45 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1438671 1419096 evolution 58224 0.0 S 08:12 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1458755 1457633 evolution 58016 0.0 S 03:45 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1455541 1455515 evolution 57112 0.0 S 06:27 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456586 1456427 evolution 57108 0.0 S 05:46 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1382815 1353308 cpanellogin 52616 0.0 S 24:37 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 1353308 1 root 42392 0.0 Ss 50-09:01:53 cpsrvd (SSL) - waiting for connections 1454144 1435446 evolution 41524 0.0 S 07:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436669 1419737 evolution 41488 0.0 S 10:54 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1476343 1475997 evolution 41388 0.4 S 00:51 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1437554 1419738 evolution 41076 0.0 S 09:38 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436992 1435559 evolution 41016 0.0 S 10:22 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438043 1436907 evolution 40980 0.0 S 09:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1436739 1435940 evolution 40884 0.0 S 10:47 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438231 1438076 evolution 40652 0.0 S 08:45 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437858 1437119 evolution 40648 0.0 S 09:13 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437497 1437325 evolution 40616 0.0 S 09:43 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1456738 1455358 evolution 40588 0.0 S 05:33 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1436963 1435860 evolution 40584 0.0 S 10:24 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437252 1419739 evolution 40560 0.0 S 10:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437654 1436586 evolution 40472 0.0 S 09:28 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1439120 1438976 evolution 40332 0.0 S 08:03 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1453831 1446040 evolution 40308 0.0 S 07:44 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1458221 1458055 evolution 40280 0.0 S 04:09 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1476426 1475999 evolution 40244 0.0 S 00:42 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1469 1 root 39812 0.1 Ss 73-01:33:22 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1456372 1455322 evolution 39396 0.0 S 06:03 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1476721 1476316 evolution 39360 0.3 S 00:11 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438494 1438439 evolution 39348 0.0 S 08:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1476500 1476336 evolution 39332 0.0 S 00:38 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1476684 1476682 evolution 39328 0.1 S 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1476803 1476436 evolution 39320 0.6 S 00:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1455138 1455129 evolution 39288 0.0 S 06:58 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1476863 1476706 evolution 39276 1.5 S 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1476403 1476011 evolution 39264 0.0 S 00:47 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1476434 1476010 evolution 39264 0.0 S 00:41 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1476645 1476590 evolution 39248 0.1 S 00:20 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1476804 1476583 evolution 39236 0.6 S 00:05 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1476581 1475352 evolution 39224 0.1 S 00:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1474517 1459398 evolution 39196 0.0 S 02:34 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1476580 1459396 evolution 39176 0.0 S 00:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1474300 1459399 evolution 39160 0.0 S 02:53 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1454380 1438021 evolution 39148 0.0 S 07:14 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1476435 1475787 evolution 39064 0.0 S 00:41 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1476579 1476512 evolution 39044 0.1 S 00:29 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1455576 1455361 evolution 39028 0.0 S 06:25 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1476685 1475806 evolution 39012 0.1 S 00:17 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1438623 1437809 evolution 38872 0.0 S 08:15 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1437335 1437319 evolution 38784 0.0 S 09:56 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1475365 1459376 evolution 38636 0.0 S 01:58 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 1476612 1476285 evolution 38636 0.1 S 00:22 /opt/cpanel/ea-php83/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9835654 | claude | 108-1481181613 | Query | 1879 | Sending data | SELECT 'job-items with BOTH picking and dispatch' k, COUNT(*) v FROM ( SELECT ji.id FROM jobInventory ji WHERE EXISTS(SELECT 1 FROM pickingitems pi JOIN picking p ON p.id=pi.pickingid WHERE pi.jobitemid=ji.id AND p.datecreated BETWEEN @from AND @to) AND EXISTS(SELECT 1 FROM dispatchitems di | | 9953837 | root | 108-1481181613 | Execute | 654 | Waiting for table level lock | update dispatchitems set qty = ?, dispatchbinsources = ? where id =? and dispatchid = ? | | 9957582 | root | 108-1481181613 | Execute | 628 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29402' AND dispatchitems.j | | 9962083 | root | 108-1481181613 | Execute | 600 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29405' AND dispatchitems.j | | 9964402 | root | 108-1481181613 | Execute | 578 | Waiting for table level lock | SELECT sum(dispatchitems.qty) as complete from dispatchitems,dispatch WHERE dispatchitems.jobitemid='200379' and dispatchitems.dispatchid=dispatch.id AND dispatch.status>='0' | | 9966195 | root | 108-1481181613 | Execute | 568 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9975761 | root | 108-1481181613 | Execute | 492 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29405' AND dispatchitems.j | | 9982965 | root | 108-1481181613 | Execute | 449 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9992249 | root | 108-1481181613 | Execute | 386 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29737' AND dispatchitems.j | | 9994739 | root | 108-1481181613 | Execute | 345 | Waiting for table level lock | select dispatch.*,dispatchitems.qty, (SELECT jobcode FROM jobs WHERE jobs.id = dispatch.jobid) as jobcode from dispatch,dispatchitems where dispatchitems.dispatchid=dispatch.id AND dispatch.status != '2' AND dispatchitems.itemid = ? | | 10003548 | root | 108-1481181613 | Execute | 224 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE dispatchitems.dispatchid=dispatch.id AND dispatch.jobid='29405' AND dispatchitems.j | | 10010187 | root | 108-1481181613 | Execute | 105 | Waiting for table level lock | UPDATE jobs SET nextaction = '2025-11-07 00:00:00' WHERE id = '25016' | | 10010660 | root | 108-1481181613 | Execute | 102 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 10010814 | root | 108-1481181613 | Execute | 97 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 10011331 | root | 108-1481181613 | Execute | 81 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 10012329 | root | 108-1481181613 | Execute | 61 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 10012431 | root | 108-1481181613 | Execute | 56 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInventory.reference as itemreference , description , code | | 10012600 | root | 108-1481181613 | Execute | 48 | Waiting for table level lock | UPDATE jobs SET nextaction = '2026-09-08' WHERE id = '29032' | | 10015535 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+--------+----------------+---------+------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- +----------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | DB | TIME | STATE | q | +----------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 9953837 | 108-1481181613 | 654 | Waiting for table level lock | update dispatchitems set qty = ?, dispatchbinsources = ? where id =? and dispatchid = ? | | 9957582 | 108-1481181613 | 628 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9962083 | 108-1481181613 | 600 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9964402 | 108-1481181613 | 578 | Waiting for table level lock | SELECT sum(dispatchitems.qty) as complete from dispatchitems,dispatch WHERE dispatchitems.jobitemid='200379' and dispatchitems.dispatchid=dispatch.id AND dispatch.status>='0' | | 9966195 | 108-1481181613 | 568 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9975761 | 108-1481181613 | 492 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9982965 | 108-1481181613 | 449 | Waiting for table level lock | SELECT jobInventory.*, dispatchitems.id as dispatchitemid from dispatchitems,jobInventory WHERE dispatchitems.jobitemid=jobInventory.id AND dispatchitems.dispatchid='34217' | | 9992249 | 108-1481181613 | 386 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 9994739 | 108-1481181613 | 345 | Waiting for table level lock | select dispatch.*,dispatchitems.qty, (SELECT jobcode FROM jobs WHERE jobs.id = dispatch.jobid) as jobcode from dispatch,dispatchitems where dispatchitems.dispatchid=dispatch.id AND | | 10003548 | 108-1481181613 | 224 | Waiting for table level lock | SELECT dispatchitems.*, dispatch.date, dispatch.status, jobInventory.parentid, jobInventory.referenceid FROM dispatch, dispatchitems, jobInventory WHERE | | 10010187 | 108-1481181613 | 105 | Waiting for table level lock | UPDATE jobs SET nextaction = '2025-11-07 00:00:00' WHERE id = '25016' | | 10010660 | 108-1481181613 | 102 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 10010814 | 108-1481181613 | 97 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 10011331 | 108-1481181613 | 81 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 10012329 | 108-1481181613 | 61 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 10012431 | 108-1481181613 | 56 | Waiting for table level lock | SELECT timesheets_timer.* , jobcode , jobs.reference , company , jobInvento | | 10012600 | 108-1481181613 | 48 | Waiting for table level lock | UPDATE jobs SET nextaction = '2026-09-08' WHERE id = '29032' | +----------+----------------+------+------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 269 evolution/app.evolutionerp.com.au-ssl_log 86 evolution/portal.evolutionerp.com.au-ssl_log 36 corpkicks/corporatekicks.com.au-ssl_log 6 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 95 103.104.165.99 87 1.144.107.82 86 40.115.94.245 65 203.54.180.238 21 182.239.240.254 10 1.145.47.227 10 103.104.164.114 4 165.225.233.87 4 150.228.151.88 2 83.99.206.15 2 207.46.13.14 2 180.181.236.49 2 120.150.225.142 2 118.127.40.55 1 98.94.3.237 --- top request paths across all vhosts (last 3 min) --- 129 POST /functions.php 35 GET /app/ajax.php 31 GET /index.php 23 POST /app/ajax/selectFilter.php 23 GET /heartbeat.php 19 POST /plugins/csvexporter/plugin.php 9 POST /quoteditsave.php 4 POST /inveditsave.php 4 POST /app/ajax.php 4 GET /api/getItem/SHSG252516-8 4 GET /api/getItem/SHSG252516-6.5 4 GET /api/getItem/19R-8000 4 GET /api/getItem/19R-7320 3 POST /portal/register 3 POST /itemModify.php 3 POST /app/ajax/selectFilterSingle.php 3 GET /api/getItem/RHSG15050208 3 GET /api/getItem/LOOP2100 2 POST /wp-cron.php 2 POST /purchaseaddsave.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 129 POST /functions.php 35 GET /app/ajax.php 28 GET /index.php 23 POST /app/ajax/selectFilter.php 19 POST /plugins/csvexporter/plugin.php 9 POST /quoteditsave.php 4 POST /inveditsave.php 4 POST /app/ajax.php 3 POST /itemModify.php 3 POST /app/ajax/selectFilterSingle.php 2 POST /purchaseaddsave.php 2 POST /plugins/fencecosting/plugin.php -- last 10 requests -- 103.104.165.99 - - [10/Sep/2026:11:42:53 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=35533§ionid=33058" "Mozilla/5.0 (Windows NT 10.0; 1.144.107.82 - - [10/Sep/2026:11:42:53 +1000] "POST /plugins/csvexporter/plugin.php HTTP/1.1" 200 20 "https://my.evolutionerp.com.au/index.php?page=inveditspecs&id=1245&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 1.144.107.82 - - [10/Sep/2026:11:42:54 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dinveditspecs%26id%3D1245%26string%3D&call=getUserSetting&caller=ajaxSubmitLocal&seq=16074743345 HTTP/1.1" 200 109 "https://my.evol 103.104.165.99 - - [10/Sep/2026:11:42:54 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotedit%26quoteid%3D35533&call=getUserSetting&caller=ajaxSubmitLocal&seq=17746779697 HTTP/1.1" 200 162 "https://my.evolutionerp 103.104.165.99 - - [10/Sep/2026:11:42:54 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotedit%26quoteid%3D35533&call=getUserSetting&caller=ajaxSubmitLocal&seq=15493955247 HTTP/1.1" 200 162 "https://my.evolutionerp 1.144.107.82 - - [10/Sep/2026:11:42:55 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=inveditspecs&id=1245&string=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 182.239.240.254 - - [10/Sep/2026:11:42:58 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like 103.104.165.99 - - [10/Sep/2026:11:42:57 +1000] "POST /quoteditsave.php?call=addLineItem HTTP/1.1" 200 329 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=35533§ionid=33058" "Mozilla/5.0 (Windows NT 1 120.150.225.142 - - [10/Sep/2026:11:42:58 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invoiceadd&invoiceid=3218&tab=maintab" "Mozilla/5.0 (Windows NT 10.0; 1.144.107.82 - - [10/Sep/2026:11:42:59 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=invedit&id=10819&tab=generaltab" "Mozilla/5.0 (Windows NT 10.0; Win64; x6 == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 4 GET /api/getItem/SHSG252516-8 4 GET /api/getItem/SHSG252516-6.5 4 GET /api/getItem/19R-8000 4 GET /api/getItem/19R-7320 3 GET /api/getItem/RHSG15050208 3 GET /api/getItem/LOOP2100 2 GET /api/getItem/RHSP200100608 2 GET /api/getItem/RHSP200100508 2 GET /api/getItem/RHSG15050308 2 GET /api/getItem/RHSG150100408 2 GET /api/getItem/RHSG12575408 2 GET /api/getItem/RHSG12575308 -- last 10 requests -- 40.115.94.245 - - [10/Sep/2026:11:43:02 +1000] "GET /api/getItem/19R-8000 HTTP/1.1" 200 1857 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:43:02 +1000] "GET /api/getItem/RHSG501009-2400 HTTP/1.1" 200 1152 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:43:02 +1000] "GET /api/getItem/RHSG501009-7320 HTTP/1.1" 200 1502 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:43:02 +1000] "GET /api/getItem/SHSG252516-6.5 HTTP/1.1" 200 1670 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:43:02 +1000] "GET /api/getItem/RHSG502516-8 HTTP/1.1" 200 1290 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:43:02 +1000] "GET /api/getItem/SHSG252516-8 HTTP/1.1" 200 1635 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:43:03 +1000] "GET /api/getItem/RHSG502520-8 HTTP/1.1" 200 1452 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:43:03 +1000] "GET /api/getItem/PS252512-1800G HTTP/1.1" 200 1500 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:43:03 +1000] "GET /api/getItem/RHSG65161255 HTTP/1.1" 200 1358 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [10/Sep/2026:11:43:03 +1000] "GET /api/getItem/PS252512-1800G-DI HTTP/1.1" 200 1639 "-" "RestSharp/106.13.0.0" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 23 GET /heartbeat.php 3 POST /portal/register 3 GET /index.php 2 GET /uploadsave.php 1 GET /factory_session_processed_qty.php 1 GET /factory_session_joiner.php 1 GET /factory_session_checker.php 1 GET /api/runsheets.php 1 GET /api/api-check.php -- last 10 requests -- 1.145.47.227 - - [10/Sep/2026:11:42:31 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php?page=runsheets" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko 1.145.47.227 - - [10/Sep/2026:11:42:31 +1000] "GET /api/api-check.php?_=1789004551510 HTTP/1.1" 200 30 "https://portal.evolutionerp.com.au/index.php?page=runsheets" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 1.145.47.227 - - [10/Sep/2026:11:42:31 +1000] "GET /api/runsheets.php?date=2026-09-10&staff_id=64&_=1789004551511 HTTP/1.1" 200 773 "https://portal.evolutionerp.com.au/index.php?page=runsheets" "Mozilla/5.0 (Linux; Andro 203.54.180.238 - - [10/Sep/2026:11:42:34 +1000] "GET /heartbeat.php?sentAt=1789004554&bytes=106,162,11,10&_=1788987692449 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:42:40 +1000] "GET /heartbeat.php?sentAt=1789004561&bytes=106,162,11,17&_=1788957671770 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [10/Sep/2026:11:42:44 +1000] "GET /heartbeat.php?sentAt=1789004564&bytes=106,162,11,20&_=1788987692450 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 1.145.47.227 - - [10/Sep/2026:11:42:50 +1000] "GET /index.php?page=delivery_commit&id=16500 HTTP/1.1" 200 21823 "https://portal.evolutionerp.com.au/index.php?page=runsheets" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKi 1.145.47.227 - - [10/Sep/2026:11:42:50 +1000] "POST /portal/register HTTP/1.1" 404 - "https://portal.evolutionerp.com.au/index.php?page=delivery_commit&id=16500" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KH 1.145.47.227 - - [10/Sep/2026:11:42:50 +1000] "GET /uploadsave.php?call=get_uploads&sourceId=16500&subType=delivery_commit HTTP/1.1" 200 22 "https://portal.evolutionerp.com.au/index.php?page=delivery_commit&id=16500" "Mo 203.54.180.238 - - [10/Sep/2026:11:42:50 +1000] "GET /heartbeat.php?sentAt=1789004571&bytes=106,162,11,27&_=1788957671771 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" --- last 30 samples (run-up to this incident) --- 2026-09-10 11:40:35 L1=1.94 run=4 blk=0 avail=6976 (50.6%) swpO=0 conn=15 myRSS=2936 php=61 phpRSS=2370 ap=83 tcp=55 topuser=evolution 2026-09-10 11:40:43 L1=2.19 run=12 blk=0 avail=6431 (46.7%) swpO=0 conn=17 myRSS=2936 php=64 phpRSS=2891 ap=93 tcp=69 topuser=evolution 2026-09-10 11:40:45 L1=2.19 run=4 blk=0 avail=6521 (47.3%) swpO=0 conn=15 myRSS=2936 php=65 phpRSS=2775 ap=101 tcp=76 topuser=evolution 2026-09-10 11:40:53 L1=2.48 run=3 blk=0 avail=6518 (47.3%) swpO=0 conn=13 myRSS=2936 php=64 phpRSS=2788 ap=97 tcp=64 topuser=evolution 2026-09-10 11:40:55 L1=2.48 run=4 blk=0 avail=6382 (46.3%) swpO=0 conn=17 myRSS=2936 php=67 phpRSS=3026 ap=97 tcp=68 topuser=evolution 2026-09-10 11:41:04 L1=2.49 run=2 blk=0 avail=6544 (47.5%) swpO=0 conn=13 myRSS=2936 php=64 phpRSS=2789 ap=93 tcp=72 topuser=evolution 2026-09-10 11:41:05 L1=2.49 run=3 blk=0 avail=6515 (47.3%) swpO=0 conn=13 myRSS=2936 php=66 phpRSS=2864 ap=95 tcp=78 topuser=evolution 2026-09-10 11:41:14 L1=2.49 run=6 blk=0 avail=6179 (44.9%) swpO=0 conn=17 myRSS=2936 php=70 phpRSS=3304 ap=96 tcp=77 topuser=evolution 2026-09-10 11:41:15 L1=2.49 run=5 blk=0 avail=6272 (45.5%) swpO=0 conn=13 myRSS=2936 php=68 phpRSS=3154 ap=96 tcp=73 topuser=evolution 2026-09-10 11:41:24 L1=2.26 run=2 blk=0 avail=6536 (47.4%) swpO=0 conn=16 myRSS=2936 php=73 phpRSS=3025 ap=95 tcp=74 topuser=evolution 2026-09-10 11:41:25 L1=2.26 run=2 blk=0 avail=6537 (47.4%) swpO=0 conn=15 myRSS=2936 php=74 phpRSS=3056 ap=97 tcp=75 topuser=evolution 2026-09-10 11:41:34 L1=2.06 run=2 blk=0 avail=6429 (46.7%) swpO=0 conn=17 myRSS=2936 php=79 phpRSS=3245 ap=101 tcp=73 topuser=evolution 2026-09-10 11:41:35 L1=2.06 run=2 blk=0 avail=6572 (47.7%) swpO=0 conn=16 myRSS=2936 php=77 phpRSS=3046 ap=101 tcp=71 topuser=evolution 2026-09-10 11:41:44 L1=1.98 run=4 blk=0 avail=6545 (47.5%) swpO=0 conn=18 myRSS=2936 php=84 phpRSS=3288 ap=98 tcp=70 topuser=evolution 2026-09-10 11:41:45 L1=1.98 run=2 blk=0 avail=6544 (47.5%) swpO=0 conn=17 myRSS=2936 php=84 phpRSS=3286 ap=98 tcp=67 topuser=evolution 2026-09-10 11:41:54 L1=1.98 run=6 blk=0 avail=6408 (46.5%) swpO=0 conn=19 myRSS=2936 php=91 phpRSS=3568 ap=105 tcp=72 topuser=evolution 2026-09-10 11:41:55 L1=1.98 run=2 blk=0 avail=6458 (46.9%) swpO=0 conn=17 myRSS=2936 php=88 phpRSS=3433 ap=105 tcp=72 topuser=evolution 2026-09-10 11:42:04 L1=2.06 run=4 blk=0 avail=6314 (45.8%) swpO=0 conn=21 myRSS=2936 php=97 phpRSS=3772 ap=112 tcp=78 topuser=evolution 2026-09-10 11:42:05 L1=2.06 run=2 blk=0 avail=6433 (46.7%) swpO=0 conn=19 myRSS=2936 php=94 phpRSS=3563 ap=113 tcp=79 topuser=evolution 2026-09-10 11:42:15 L1=1.89 run=7 blk=0 avail=6246 (45.3%) swpO=0 conn=22 myRSS=2936 php=99 phpRSS=3851 ap=119 tcp=78 topuser=evolution 2026-09-10 11:42:15 L1=1.89 run=5 blk=0 avail=6254 (45.4%) swpO=0 conn=22 myRSS=2936 php=98 phpRSS=3811 ap=119 tcp=77 topuser=evolution 2026-09-10 11:42:25 L1=1.98 run=2 blk=0 avail=6171 (44.8%) swpO=0 conn=21 myRSS=2936 php=102 phpRSS=3966 ap=119 tcp=78 topuser=evolution 2026-09-10 11:42:25 L1=1.98 run=2 blk=0 avail=6170 (44.8%) swpO=0 conn=21 myRSS=2936 php=102 phpRSS=3966 ap=119 tcp=78 topuser=evolution 2026-09-10 11:42:35 L1=1.83 run=3 blk=0 avail=6278 (45.6%) swpO=0 conn=21 myRSS=2936 php=102 phpRSS=3871 ap=120 tcp=76 topuser=evolution 2026-09-10 11:42:35 L1=1.83 run=2 blk=0 avail=6273 (45.5%) swpO=0 conn=21 myRSS=2936 php=102 phpRSS=3871 ap=121 tcp=76 topuser=evolution 2026-09-10 11:42:45 L1=1.93 run=2 blk=0 avail=6041 (43.9%) swpO=0 conn=21 myRSS=2936 php=110 phpRSS=4291 ap=124 tcp=78 topuser=evolution 2026-09-10 11:42:46 L1=1.93 run=2 blk=0 avail=6029 (43.8%) swpO=0 conn=21 myRSS=2936 php=111 phpRSS=4330 ap=124 tcp=80 topuser=evolution 2026-09-10 11:42:55 L1=1.93 run=2 blk=0 avail=5899 (42.8%) swpO=0 conn=21 myRSS=2936 php=114 phpRSS=4445 ap=135 tcp=88 topuser=evolution 2026-09-10 11:42:56 L1=1.93 run=2 blk=0 avail=5892 (42.8%) swpO=0 conn=21 myRSS=2936 php=114 phpRSS=4445 ap=137 tcp=86 topuser=evolution 2026-09-10 11:43:05 L1=1.86 run=3 blk=0 avail=5913 (42.9%) swpO=374 conn=21 myRSS=2931 php=121 phpRSS=4594 ap=145 tcp=96 topuser=evolution