diff --git a/content/posts/2019-01.md b/content/posts/2019-01.md
index c7d5e9943..004c1cf48 100644
--- a/content/posts/2019-01.md
+++ b/content/posts/2019-01.md
@@ -908,4 +908,26 @@ identify: CorruptImageProfile `xmp' @ warning/profile.c/SetImageProfileInternal/
   - So now DSpace Test (linode19) is running Tomcat 7.0.92... w00t
   - Now we need to monitor it for a few weeks to see if there is anything we missed, and then I can change CGSpace (linode18) as well, and we're ready for Ubuntu 18.04 too!
 
+## 2019-01-27
+
+- Linode sent an email that the server was using a lot of CPU this morning, and these were the top IPs in the web server logs at the time:
+
+```
+# zcat --force /var/log/nginx/*.log /var/log/nginx/*.log.1 | grep -E "27/Jan/2019:0(6|7|8)" | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 10
+    189 40.77.167.108
+    191 157.55.39.2
+    263 34.218.226.147
+    283 45.5.184.2
+    332 45.5.184.72
+    608 5.9.6.51
+    679 66.249.66.223
+   1116 66.249.66.219
+   4644 205.186.128.185
+   4644 70.32.83.92
+```
+
+- I think it's the usual IPs:
+  - 70.32.83.92 is CCAFS
+  - 205.186.128.185 is CCAFS or perhaps another Macaroni Bros harvester (new ILRI website?)
+
 <!-- vim: set sw=2 ts=2: -->
diff --git a/docs/2019-01/index.html b/docs/2019-01/index.html
index 92c4f4d52..90bcc0415 100644
--- a/docs/2019-01/index.html
+++ b/docs/2019-01/index.html
@@ -27,7 +27,7 @@ I don&rsquo;t see anything interesting in the web server logs around that time t
 " />
 <meta property="og:type" content="article" />
 <meta property="og:url" content="https://alanorth.github.io/cgspace-notes/2019-01/" /><meta property="article:published_time" content="2019-01-02T09:48:30&#43;02:00"/>
-<meta property="article:modified_time" content="2019-01-25T14:09:49&#43;02:00"/>
+<meta property="article:modified_time" content="2019-01-25T19:45:15&#43;02:00"/>
 
 <meta name="twitter:card" content="summary"/>
 <meta name="twitter:title" content="January, 2019"/>
@@ -60,9 +60,9 @@ I don&rsquo;t see anything interesting in the web server logs around that time t
   "@type": "BlogPosting",
   "headline": "January, 2019",
   "url": "https://alanorth.github.io/cgspace-notes/2019-01/",
-  "wordCount": "4770",
+  "wordCount": "4866",
   "datePublished": "2019-01-02T09:48:30&#43;02:00",
-  "dateModified": "2019-01-25T14:09:49&#43;02:00",
+  "dateModified": "2019-01-25T19:45:15&#43;02:00",
   "author": {
     "@type": "Person",
     "name": "Alan Orth"
@@ -1209,6 +1209,34 @@ identify: CorruptImageProfile `xmp' @ warning/profile.c/SetImageProfileInternal/
 </ul></li>
 </ul>
 
+<h2 id="2019-01-27">2019-01-27</h2>
+
+<ul>
+<li>Linode sent an email that the server was using a lot of CPU this morning, and these were the top IPs in the web server logs at the time:</li>
+</ul>
+
+<pre><code># zcat --force /var/log/nginx/*.log /var/log/nginx/*.log.1 | grep -E &quot;27/Jan/2019:0(6|7|8)&quot; | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 10
+    189 40.77.167.108
+    191 157.55.39.2
+    263 34.218.226.147
+    283 45.5.184.2
+    332 45.5.184.72
+    608 5.9.6.51
+    679 66.249.66.223
+   1116 66.249.66.219
+   4644 205.186.128.185
+   4644 70.32.83.92
+</code></pre>
+
+<ul>
+<li>I think it&rsquo;s the usual IPs:
+
+<ul>
+<li>70.32.83.92 is CCAFS</li>
+<li>205.186.128.185 is CCAFS or perhaps another Macaroni Bros harvester (new ILRI website?)</li>
+</ul></li>
+</ul>
+
 <!-- vim: set sw=2 ts=2: -->
 
   
diff --git a/docs/sitemap.xml b/docs/sitemap.xml
index 2ee65a74a..14b7fb5d7 100644
--- a/docs/sitemap.xml
+++ b/docs/sitemap.xml
@@ -4,7 +4,7 @@
   
   <url>
     <loc>https://alanorth.github.io/cgspace-notes/2019-01/</loc>
-    <lastmod>2019-01-25T14:09:49+02:00</lastmod>
+    <lastmod>2019-01-25T19:45:15+02:00</lastmod>
   </url>
   
   <url>
@@ -204,7 +204,7 @@
   
   <url>
     <loc>https://alanorth.github.io/cgspace-notes/</loc>
-    <lastmod>2019-01-25T14:09:49+02:00</lastmod>
+    <lastmod>2019-01-25T19:45:15+02:00</lastmod>
     <priority>0</priority>
   </url>
   
@@ -215,7 +215,7 @@
   
   <url>
     <loc>https://alanorth.github.io/cgspace-notes/tags/notes/</loc>
-    <lastmod>2019-01-25T14:09:49+02:00</lastmod>
+    <lastmod>2019-01-25T19:45:15+02:00</lastmod>
     <priority>0</priority>
   </url>
   
@@ -227,13 +227,13 @@
   
   <url>
     <loc>https://alanorth.github.io/cgspace-notes/posts/</loc>
-    <lastmod>2019-01-25T14:09:49+02:00</lastmod>
+    <lastmod>2019-01-25T19:45:15+02:00</lastmod>
     <priority>0</priority>
   </url>
   
   <url>
     <loc>https://alanorth.github.io/cgspace-notes/tags/</loc>
-    <lastmod>2019-01-25T14:09:49+02:00</lastmod>
+    <lastmod>2019-01-25T19:45:15+02:00</lastmod>
     <priority>0</priority>
   </url>