diff --git a/content/posts/2018-11.md b/content/posts/2018-11.md
index 7d3acef8d..ebeb922ff 100644
--- a/content/posts/2018-11.md
+++ b/content/posts/2018-11.md
@@ -408,4 +408,25 @@ $ time schedtool -D -e ionice -c2 -n7 nice -n19 dspace index-discovery -b
 - More work on the AReS terms of reference for CodeObia
 - Erica from AgriKnowledge emailed me to say that they have implemented the changes in their item page UI so that they include the permanent identifier on items harvested from CGSpace, for example: https://www.agriknowledge.org/concern/generics/wd375w33s
 
+## 2018-11-27
+
+- Linode alerted me that the outbound traffic rate on CGSpace (linode19) was very high
+- The top users this morning are:
+
+```
+# zcat --force /var/log/nginx/*.log /var/log/nginx/*.log.1 | grep -E "27/Nov/2018" | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 10
+    229 46.101.86.248
+    261 66.249.64.61
+    447 66.249.64.59
+    541 207.46.13.77
+    548 40.77.167.97
+    564 35.237.175.180
+    595 40.77.167.135
+    611 157.55.39.91
+   4564 205.186.128.185
+   4564 70.32.83.92
+```
+
+- We know 70.32.83.92 is CCAFS harvester on MediaTemple, but 205.186.128.185 is new appears to be a new CCAFS harvester
+
 <!-- vim: set sw=2 ts=2: -->
diff --git a/docs/2018-11/index.html b/docs/2018-11/index.html
index a8f9f98aa..467c34fa2 100644
--- a/docs/2018-11/index.html
+++ b/docs/2018-11/index.html
@@ -21,7 +21,7 @@ Today these are the top 10 IPs:
 " />
 <meta property="og:type" content="article" />
 <meta property="og:url" content="https://alanorth.github.io/cgspace-notes/2018-11/" /><meta property="article:published_time" content="2018-11-01T16:41:30&#43;02:00"/>
-<meta property="article:modified_time" content="2018-11-26T17:55:09&#43;02:00"/>
+<meta property="article:modified_time" content="2018-11-26T22:46:12&#43;02:00"/>
 
 <meta name="twitter:card" content="summary"/>
 <meta name="twitter:title" content="November, 2018"/>
@@ -48,9 +48,9 @@ Today these are the top 10 IPs:
   "@type": "BlogPosting",
   "headline": "November, 2018",
   "url": "https://alanorth.github.io/cgspace-notes/2018-11/",
-  "wordCount": "2401",
+  "wordCount": "2486",
   "datePublished": "2018-11-01T16:41:30&#43;02:00",
-  "dateModified": "2018-11-26T17:55:09&#43;02:00",
+  "dateModified": "2018-11-26T22:46:12&#43;02:00",
   "author": {
     "@type": "Person",
     "name": "Alan Orth"
@@ -584,6 +584,30 @@ $ time schedtool -D -e ionice -c2 -n7 nice -n19 dspace index-discovery
 <li>Erica from AgriKnowledge emailed me to say that they have implemented the changes in their item page UI so that they include the permanent identifier on items harvested from CGSpace, for example: <a href="https://www.agriknowledge.org/concern/generics/wd375w33s">https://www.agriknowledge.org/concern/generics/wd375w33s</a></li>
 </ul>
 
+<h2 id="2018-11-27">2018-11-27</h2>
+
+<ul>
+<li>Linode alerted me that the outbound traffic rate on CGSpace (linode19) was very high</li>
+<li>The top users this morning are:</li>
+</ul>
+
+<pre><code># zcat --force /var/log/nginx/*.log /var/log/nginx/*.log.1 | grep -E &quot;27/Nov/2018&quot; | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 10
+    229 46.101.86.248
+    261 66.249.64.61
+    447 66.249.64.59
+    541 207.46.13.77
+    548 40.77.167.97
+    564 35.237.175.180
+    595 40.77.167.135
+    611 157.55.39.91
+   4564 205.186.128.185
+   4564 70.32.83.92
+</code></pre>
+
+<ul>
+<li>We know 70.32.83.92 is CCAFS harvester on MediaTemple, but 205.186.128.185 is new appears to be a new CCAFS harvester</li>
+</ul>
+
 <!-- vim: set sw=2 ts=2: -->
 
   
diff --git a/docs/sitemap.xml b/docs/sitemap.xml
index 994188230..1dd525c94 100644
--- a/docs/sitemap.xml
+++ b/docs/sitemap.xml
@@ -4,7 +4,7 @@
   
   <url>
     <loc>https://alanorth.github.io/cgspace-notes/2018-11/</loc>
-    <lastmod>2018-11-26T17:55:09+02:00</lastmod>
+    <lastmod>2018-11-26T22:46:12+02:00</lastmod>
   </url>
   
   <url>
@@ -194,7 +194,7 @@
   
   <url>
     <loc>https://alanorth.github.io/cgspace-notes/</loc>
-    <lastmod>2018-11-26T17:55:09+02:00</lastmod>
+    <lastmod>2018-11-26T22:46:12+02:00</lastmod>
     <priority>0</priority>
   </url>
   
@@ -205,7 +205,7 @@
   
   <url>
     <loc>https://alanorth.github.io/cgspace-notes/tags/notes/</loc>
-    <lastmod>2018-11-26T17:55:09+02:00</lastmod>
+    <lastmod>2018-11-26T22:46:12+02:00</lastmod>
     <priority>0</priority>
   </url>
   
@@ -217,13 +217,13 @@
   
   <url>
     <loc>https://alanorth.github.io/cgspace-notes/posts/</loc>
-    <lastmod>2018-11-26T17:55:09+02:00</lastmod>
+    <lastmod>2018-11-26T22:46:12+02:00</lastmod>
     <priority>0</priority>
   </url>
   
   <url>
     <loc>https://alanorth.github.io/cgspace-notes/tags/</loc>
-    <lastmod>2018-11-26T17:55:09+02:00</lastmod>
+    <lastmod>2018-11-26T22:46:12+02:00</lastmod>
     <priority>0</priority>
   </url>