Update notes for 2022-04-18

content/posts/2022-04.md

@@ -169,5 +169,27 @@ $ aggregate6 /tmp/ipv6-networks.txt | wc -l
 - I deployed these lists on CGSpace, ran all updates, and rebooted the server
   - This list is SURELY too broad because we will block legitimate users in China... but right now how can I discern?
   - Also, I need to purge the hits from these 14,000 IPs in Solr when I get time
+- Looking back at the Munin graphs a few hours later I see this was indeed some kind of spike that was out of the ordinary:
+
+![PostgreSQL connections day](/cgspace-notes/2022/04/postgres_connections_ALL-day.png)
+![DSpace sessions day](/cgspace-notes/2022/04/jmx_dspace_sessions-day.png)
+
+- I used `grepcidr` with the aggregated network lists to extract IPs matching those networks from the nginx logs for the past day:
+
+```console
+# cat /var/log/nginx/access.log /var/log/nginx/access.log.1 | awk '{print $1}' | sort -u > /tmp/ips.log
+# while read -r network; do grepcidr $network /tmp/ips.log >> /tmp/ipv4-ips.txt; done < /tmp/ipv4-networks-aggregated.txt
+# while read -r network; do grepcidr $network /tmp/ips.log >> /tmp/ipv6-ips.txt; done < /tmp/ipv6-networks-aggregated.txt
+# wc -l /tmp/ipv4-ips.txt  
+15313 /tmp/ipv4-ips.txt
+# wc -l /tmp/ipv6-ips.txt 
+19 /tmp/ipv6-ips.txt
+```
+
+- Then I purged them from Solr using the `check-spider-ip-hits.sh`:
+
+```console
+$ ./ilri/check-spider-ip-hits.sh -f /tmp/ipv4-ips.txt -p
+```
 
 <!-- vim: set sw=2 ts=2: -->