Update notes for 2019-04-07

content/posts/2019-04.md

@@ -351,5 +351,44 @@ $ http --print b 'http://localhost:8080/solr/statistics/select?q=type%3A0+AND+ti
   - See: [DS-3832](https://jira.duraspace.org/browse/DS-3832)
   - DSpace 5.10 upgraded to use GeoIP2, but we are on 5.8 so I just copied the missing database file from another server because it has been *removed* from MaxMind's server as of 2018-04-01
   - Now I made 100 requests and I see them in the Solr statistics... fuck my life for wasting five hours debugging this
+- UptimeRobot said CGSpace went down and up a few times tonight, and my first instict was to check `iostat 1 10` and I saw that CPU steal is around 10–30 percent right now...
+- The load average is super high right now, as I've noticed the last few times UptimeRobot said that CGSpace went down:
+
+```
+$ cat /proc/loadavg 
+10.70 9.17 8.85 18/633 4198
+```
+
+- According to the server logs there is actually not much going on right now:
+
+```
+# zcat --force /var/log/nginx/{access,library-access}.log /var/log/nginx/{access,library-access}.log.1 | grep -E "07/Apr/2019:(18|19)" | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 10
+    116 40.77.167.128
+    128 207.46.13.219
+    129 167.114.64.100
+    159 207.46.13.129
+    179 207.46.13.33
+    188 2408:8214:7a00:868f:7c1e:e0f3:20c6:c142
+    195 66.249.79.59
+    363 40.77.167.21
+    740 2a01:4f8:140:3192::2
+   3711 45.5.184.72
+# zcat --force /var/log/nginx/{rest,oai}.log /var/log/nginx/{rest,oai}.log.1 | grep -E "07/Apr/2019:(18|19)" | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 10
+      3 2a02:1206:4576:bae0:95ff:8bbd:a274:6223
+      3 66.249.79.62
+      3 66.249.83.196
+      5 82.145.222.150
+      6 2a01:4f9:2b:1263::2
+      6 41.204.190.40
+      7 35.174.176.49
+     10 40.77.167.21
+     11 194.246.119.6
+     11 66.249.79.59
+```
+
+- `45.5.184.72` is CIAT, who I already blocked and am waiting to hear from
+- `2a01:4f8:140:3192::2` is BLEXbot, which should be handled by the Tomcat Crawler Session Manager Valve
+- `2408:8214:7a00:868f:7c1e:e0f3:20c6:c142` is some stupid Chinese bot making malicious POST requests
+- Anyways, it seems that the issue with CGSpace being "down" is actually because of CPU steal again!!!
 
 <!-- vim: set sw=2 ts=2: -->