Add notes for 2022-08-13

content/posts/2022-08.md

@@ -77,4 +77,16 @@ $ dspace import --add --eperson=aorth@mjanja.ch --source /tmp/SimpleArchiveForma
   - I do see 11,000 hits from that IP last month when I had the incorrect nginx configuration that was sending a literal `$http_user_agent` so I purged those
   - It is lucky that we have `harvest` in the DSpace spider agent example file so Solr doesn't log these hits, nothing needed to be done in nginx
 
+## 2022-08-13
+
+- I noticed there was high load on CGSpace, around 9 or 10
+  - Looking at the Munin graphs it seems to just be the last two hours or so, with a slight increase in PostgreSQL connections, firewall traffic, and a more noticeable increase in CPU
+  - DSpace sessions are normal
+  - The number of unique hosts making requests to nginx is pretty low, though it's only 6AM in the server's time
+- I see one IP in Sweden making a lot of requests with a normal user agent: 80.248.237.167
+  - This host is on Internet Vikings (INTERNETBOLAGET), and I see 140,000 requests from them in Solr
+  - I see reports of excessive scraping on AbuseIPDB.com
+  - I'm gonna add their 80.248.224.0/20 to the bot-networks.conf in nginx
+  - I will also purge all the hits from this IP in Solr statistics
+
 <!-- vim: set sw=2 ts=2: -->