Add notes for 2019-01-27

content/posts/2019-01.md

@@ -908,4 +908,26 @@ identify: CorruptImageProfile `xmp' @ warning/profile.c/SetImageProfileInternal/
   - So now DSpace Test (linode19) is running Tomcat 7.0.92... w00t
   - Now we need to monitor it for a few weeks to see if there is anything we missed, and then I can change CGSpace (linode18) as well, and we're ready for Ubuntu 18.04 too!
 
+## 2019-01-27
+
+- Linode sent an email that the server was using a lot of CPU this morning, and these were the top IPs in the web server logs at the time:
+
+```
+# zcat --force /var/log/nginx/*.log /var/log/nginx/*.log.1 | grep -E "27/Jan/2019:0(6|7|8)" | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 10
+    189 40.77.167.108
+    191 157.55.39.2
+    263 34.218.226.147
+    283 45.5.184.2
+    332 45.5.184.72
+    608 5.9.6.51
+    679 66.249.66.223
+   1116 66.249.66.219
+   4644 205.186.128.185
+   4644 70.32.83.92
+```
+
+- I think it's the usual IPs:
+  - 70.32.83.92 is CCAFS
+  - 205.186.128.185 is CCAFS or perhaps another Macaroni Bros harvester (new ILRI website?)
+
 <!-- vim: set sw=2 ts=2: -->