Add notes for 2020-05-29

content/posts/2020-05.md

@@ -156,4 +156,21 @@ $ ./add-orcid-identifiers-csv.py -i 2020-05-25-add-orcids.csv -db dspace -u dspa
     - AReS Explorer currently only allows filtering by year, but will allow months soon
     - Atmire Listings and Reports only allows a "Timespan" of a year
 
+## 2020-05-29
+
+- Linode alerted to say that the CPU load on CGSpace (linode18) was high for a few hours this morning
+  - Looking at the nginx logs for this morning with goaccess:
+
+```
+# cat /var/log/nginx/*.log.1 | grep -E "29/May/2020:(02|03|04|05)" | goaccess --log-format=COMBINED -
+```
+
+- The top is 172.104.229.92, which is the AReS harvester (still not using a user agent, but it's tagged as a bot in the nginx mapping)
+- Second is 188.134.31.88, which is a Russian host that we also saw in the last few weeks, using a browser user agent and hitting the XMLUI (but it is tagged as a bot in nginx as well)
+- Another one is 51.158.106.4, which is some Scaleway IP making requests to XMLUI with different browser user agents that I am pretty sure I have seen before but never blocked
+  - According to Solr it has made about 800 requests this year, but still... it's a bot.
+- One I don't think I've seen before is 95.217.58.146, which is making requests to XMLUI with a Drupal user agent
+  - According to [viewdns.info](https://viewdns.info/reverseip/?host=95.217.58.146&t=1) it belongs to [landvoc.org](https://landvoc.org/)
+  - I should add Drupal to the list of bots...
+
 <!-- vim: set sw=2 ts=2: -->