mirror of
https://github.com/alanorth/cgspace-notes.git
synced 2024-06-09 13:25:10 +02:00
288 lines
7.9 KiB
HTML
288 lines
7.9 KiB
HTML
|
<!DOCTYPE html>
|
||
|
|
<html lang="en">
|
||
|
|
|
||
|
|
<head>
|
||
|
|
<meta charset="utf-8">
|
||
|
|
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
|
||
|
|
|
||
|
|
<meta property="og:title" content="September, 2019" />
|
||
|
|
<meta property="og:description" content="2019-09-01
|
||
|
|
|
||
|
|
|
||
|
|
Linode emailed to say that CGSpace (linode18) had a high rate of outbound traffic for several hours this morning
|
||
|
|
|
||
|
|
Here are the top ten IPs in the nginx XMLUI and REST/OAI logs this morning:
|
||
|
|
|
||
|
|
# zcat --force /var/log/nginx/access.log /var/log/nginx/access.log.1 | grep -E "01/Sep/2019:0" | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 10
|
||
|
|
440 17.58.101.255
|
||
|
|
441 157.55.39.101
|
||
|
|
485 207.46.13.43
|
||
|
|
728 169.60.128.125
|
||
|
|
730 207.46.13.108
|
||
|
|
758 157.55.39.9
|
||
|
|
808 66.160.140.179
|
||
|
|
814 207.46.13.212
|
||
|
|
2472 163.172.71.23
|
||
|
|
6092 3.94.211.189
|
||
|
|
# zcat --force /var/log/nginx/rest.log /var/log/nginx/rest.log.1 /var/log/nginx/oai.log /var/log/nginx/oai.log.1 | grep -E "01/Sep/2019:0" | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 10
|
||
|
|
33 2a01:7e00::f03c:91ff:fe16:fcb
|
||
|
|
57 3.83.192.124
|
||
|
|
57 3.87.77.25
|
||
|
|
57 54.82.1.8
|
||
|
|
822 2a01:9cc0:47:1:1a:4:0:2
|
||
|
|
1223 45.5.184.72
|
||
|
|
1633 172.104.229.92
|
||
|
|
5112 205.186.128.185
|
||
|
|
7249 2a01:7e00::f03c:91ff:fe18:7396
|
||
|
|
9124 45.5.186.2
|
||
|
|
|
||
|
|
" />
|
||
|
|
<meta property="og:type" content="article" />
|
||
|
|
<meta property="og:url" content="https://alanorth.github.io/cgspace-notes/2019-09/" />
|
||
|
|
<meta property="article:published_time" content="2019-09-01T10:17:51+03:00" />
|
||
|
|
<meta property="article:modified_time" content="2019-09-01T10:17:51+03:00" />
|
||
|
|
|
||
|
|
<meta name="twitter:card" content="summary"/>
|
||
|
|
<meta name="twitter:title" content="September, 2019"/>
|
||
|
|
<meta name="twitter:description" content="2019-09-01
|
||
|
|
|
||
|
|
|
||
|
|
Linode emailed to say that CGSpace (linode18) had a high rate of outbound traffic for several hours this morning
|
||
|
|
|
||
|
|
Here are the top ten IPs in the nginx XMLUI and REST/OAI logs this morning:
|
||
|
|
|
||
|
|
# zcat --force /var/log/nginx/access.log /var/log/nginx/access.log.1 | grep -E "01/Sep/2019:0" | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 10
|
||
|
|
440 17.58.101.255
|
||
|
|
441 157.55.39.101
|
||
|
|
485 207.46.13.43
|
||
|
|
728 169.60.128.125
|
||
|
|
730 207.46.13.108
|
||
|
|
758 157.55.39.9
|
||
|
|
808 66.160.140.179
|
||
|
|
814 207.46.13.212
|
||
|
|
2472 163.172.71.23
|
||
|
|
6092 3.94.211.189
|
||
|
|
# zcat --force /var/log/nginx/rest.log /var/log/nginx/rest.log.1 /var/log/nginx/oai.log /var/log/nginx/oai.log.1 | grep -E "01/Sep/2019:0" | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 10
|
||
|
|
33 2a01:7e00::f03c:91ff:fe16:fcb
|
||
|
|
57 3.83.192.124
|
||
|
|
57 3.87.77.25
|
||
|
|
57 54.82.1.8
|
||
|
|
822 2a01:9cc0:47:1:1a:4:0:2
|
||
|
|
1223 45.5.184.72
|
||
|
|
1633 172.104.229.92
|
||
|
|
5112 205.186.128.185
|
||
|
|
7249 2a01:7e00::f03c:91ff:fe18:7396
|
||
|
|
9124 45.5.186.2
|
||
|
|
|
||
|
|
"/>
|
||
|
|
<meta name="generator" content="Hugo 0.57.2" />
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<script type="application/ld+json">
|
||
|
|
{
|
||
|
|
"@context": "http://schema.org",
|
||
|
|
"@type": "BlogPosting",
|
||
|
|
"headline": "September, 2019",
|
||
|
|
"url": "https:\/\/alanorth.github.io\/cgspace-notes\/2019-09\/",
|
||
|
|
"wordCount": "247",
|
||
|
|
"datePublished": "2019-09-01T10:17:51\x2b03:00",
|
||
|
|
"dateModified": "2019-09-01T10:17:51\x2b03:00",
|
||
|
|
"author": {
|
||
|
|
"@type": "Person",
|
||
|
|
"name": "Alan Orth"
|
||
|
|
},
|
||
|
|
"keywords": "Notes"
|
||
|
|
}
|
||
|
|
</script>
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<link rel="canonical" href="https://alanorth.github.io/cgspace-notes/2019-09/">
|
||
|
|
|
||
|
|
<title>September, 2019 | CGSpace Notes</title>
|
||
|
|
|
||
|
|
<!-- combined, minified CSS -->
|
||
|
|
<link href="https://alanorth.github.io/cgspace-notes/css/style.css" rel="stylesheet" integrity="sha384-G5B34w7DFTumWTswxYzTX7NWfbvQEg1HbFFEg6ItN03uTAAoS2qkPS/fu3LhuuSA" crossorigin="anonymous">
|
||
|
|
|
||
|
|
<!-- RSS 2.0 feed -->
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
</head>
|
||
|
|
|
||
|
|
<body>
|
||
|
|
|
||
|
|
|
||
|
|
<div class="blog-masthead">
|
||
|
|
<div class="container">
|
||
|
|
<nav class="nav blog-nav">
|
||
|
|
<a class="nav-link " href="https://alanorth.github.io/cgspace-notes/">Home</a>
|
||
|
|
</nav>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<header class="blog-header">
|
||
|
|
<div class="container">
|
||
|
|
<h1 class="blog-title"><a href="https://alanorth.github.io/cgspace-notes/" rel="home">CGSpace Notes</a></h1>
|
||
|
|
<p class="lead blog-description">Documenting day-to-day work on the <a href="https://cgspace.cgiar.org">CGSpace</a> repository.</p>
|
||
|
|
</div>
|
||
|
|
</header>
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<div class="container">
|
||
|
|
<div class="row">
|
||
|
|
<div class="col-sm-8 blog-main">
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<article class="blog-post">
|
||
|
|
<header>
|
||
|
|
<h2 class="blog-post-title"><a href="https://alanorth.github.io/cgspace-notes/2019-09/">September, 2019</a></h2>
|
||
|
|
<p class="blog-post-meta"><time datetime="2019-09-01T10:17:51+03:00">Sun Sep 01, 2019</time> by Alan Orth in
|
||
|
|
|
||
|
|
<i class="fa fa-tag" aria-hidden="true"></i> <a href="/cgspace-notes/tags/notes" rel="tag">Notes</a>
|
||
|
|
|
||
|
|
</p>
|
||
|
|
</header>
|
||
|
|
<h2 id="2019-09-01">2019-09-01</h2>
|
||
|
|
|
||
|
|
<ul>
|
||
|
|
<li>Linode emailed to say that CGSpace (linode18) had a high rate of outbound traffic for several hours this morning</li>
|
||
|
|
|
||
|
|
<li><p>Here are the top ten IPs in the nginx XMLUI and REST/OAI logs this morning:</p>
|
||
|
|
|
||
|
|
<pre><code># zcat --force /var/log/nginx/access.log /var/log/nginx/access.log.1 | grep -E "01/Sep/2019:0" | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 10
|
||
|
|
440 17.58.101.255
|
||
|
|
441 157.55.39.101
|
||
|
|
485 207.46.13.43
|
||
|
|
728 169.60.128.125
|
||
|
|
730 207.46.13.108
|
||
|
|
758 157.55.39.9
|
||
|
|
808 66.160.140.179
|
||
|
|
814 207.46.13.212
|
||
|
|
2472 163.172.71.23
|
||
|
|
6092 3.94.211.189
|
||
|
|
# zcat --force /var/log/nginx/rest.log /var/log/nginx/rest.log.1 /var/log/nginx/oai.log /var/log/nginx/oai.log.1 | grep -E "01/Sep/2019:0" | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 10
|
||
|
|
33 2a01:7e00::f03c:91ff:fe16:fcb
|
||
|
|
57 3.83.192.124
|
||
|
|
57 3.87.77.25
|
||
|
|
57 54.82.1.8
|
||
|
|
822 2a01:9cc0:47:1:1a:4:0:2
|
||
|
|
1223 45.5.184.72
|
||
|
|
1633 172.104.229.92
|
||
|
|
5112 205.186.128.185
|
||
|
|
7249 2a01:7e00::f03c:91ff:fe18:7396
|
||
|
|
9124 45.5.186.2
|
||
|
|
</code></pre></li>
|
||
|
|
</ul>
|
||
|
|
|
||
|
|
<ul>
|
||
|
|
<li><code>3.94.211.189</code> is MauiBot, and most of its requests are to Discovery and get rate limited with HTTP 503</li>
|
||
|
|
|
||
|
|
<li><p><code>163.172.71.23</code> is some IP on Online SAS in France and its user agent is:</p>
|
||
|
|
|
||
|
|
<pre><code>Mozilla/5.0 ((Windows; U; Windows NT 6.1; fr; rv:1.9.2) Gecko/20100115 Firefox/3.6)
|
||
|
|
</code></pre></li>
|
||
|
|
|
||
|
|
<li><p>It actually got mostly HTTP 200 responses:</p>
|
||
|
|
|
||
|
|
<pre><code># zcat --force /var/log/nginx/access.log /var/log/nginx/access.log.1 | grep -E "01/Sep/2019:0" | grep 163.172.71.23 | awk '{print $9}' | sort | uniq -c
|
||
|
|
1775 200
|
||
|
|
703 499
|
||
|
|
72 503
|
||
|
|
</code></pre></li>
|
||
|
|
|
||
|
|
<li><p>And it was mostly requesting Discover pages:</p>
|
||
|
|
|
||
|
|
<pre><code># zcat --force /var/log/nginx/access.log /var/log/nginx/access.log.1 | grep -E "01/Sep/2019:0" | grep 163.172.71.23 | grep -o -E "(bitstream|discover|handle)" | sort | uniq -c
|
||
|
|
2350 discover
|
||
|
|
71 handle
|
||
|
|
</code></pre></li>
|
||
|
|
|
||
|
|
<li><p>I’m not sure why the outbound traffic rate was so high…</p></li>
|
||
|
|
</ul>
|
||
|
|
|
||
|
|
<!-- vim: set sw=2 ts=2: -->
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
</article>
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
</div> <!-- /.blog-main -->
|
||
|
|
|
||
|
|
<aside class="col-sm-3 ml-auto blog-sidebar">
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<section class="sidebar-module">
|
||
|
|
<h4>Recent Posts</h4>
|
||
|
|
<ol class="list-unstyled">
|
||
|
|
|
||
|
|
|
||
|
|
<li><a href="/cgspace-notes/posts/">Posts</a></li>
|
||
|
|
|
||
|
|
<li><a href="/cgspace-notes/2019-09/">September, 2019</a></li>
|
||
|
|
|
||
|
|
<li><a href="/cgspace-notes/2019-08/">August, 2019</a></li>
|
||
|
|
|
||
|
|
<li><a href="/cgspace-notes/2019-07/">July, 2019</a></li>
|
||
|
|
|
||
|
|
<li><a href="/cgspace-notes/2019-06/">June, 2019</a></li>
|
||
|
|
|
||
|
|
</ol>
|
||
|
|
</section>
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<section class="sidebar-module">
|
||
|
|
<h4>Links</h4>
|
||
|
|
<ol class="list-unstyled">
|
||
|
|
|
||
|
|
<li><a href="https://cgspace.cgiar.org">CGSpace</a></li>
|
||
|
|
|
||
|
|
<li><a href="https://dspacetest.cgiar.org">DSpace Test</a></li>
|
||
|
|
|
||
|
|
<li><a href="https://github.com/ilri/DSpace">CGSpace @ GitHub</a></li>
|
||
|
|
|
||
|
|
</ol>
|
||
|
|
</section>
|
||
|
|
|
||
|
|
</aside>
|
||
|
|
|
||
|
|
|
||
|
|
</div> <!-- /.row -->
|
||
|
|
</div> <!-- /.container -->
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<footer class="blog-footer">
|
||
|
|
<p>
|
||
|
|
|
||
|
|
Blog template created by <a href="https://twitter.com/mdo">@mdo</a>, ported to Hugo by <a href='https://twitter.com/mralanorth'>@mralanorth</a>.
|
||
|
|
|
||
|
|
</p>
|
||
|
|
<p>
|
||
|
|
<a href="#">Back to top</a>
|
||
|
|
</p>
|
||
|
|
</footer>
|
||
|
|
|
||
|
|
|
||
|
|
</body>
|
||
|
|
|
||
|
|
</html>
|