Add notes for 2017-12-30

content/post/2017-12.md

@@ -699,3 +699,34 @@ DELETE 20
 ```
 
 - I need to figure out why we have records with language `in` because that's not a language!
+
+## 2017-12-30
+
+- Linode alerted that CGSpace was using 259% CPU from 4 to 6 AM
+- Uptime Robot noticed that the server went down for 1 minute a few hours later, around 9AM
+- Here's the XMLUI logs:
+
+```
+# cat /var/log/nginx/access.log /var/log/nginx/access.log.1 /var/log/nginx/library-access.log /var/log/nginx/library-access.log.1 | grep -E "30/Dec/2017" | awk '{print $1}' | sort -n | uniq -c | sort -h | tail
+    637 207.46.13.106
+    641 157.55.39.186
+    715 68.180.229.254
+    924 104.196.152.243
+   1012 66.249.64.95
+   1060 216.244.66.245
+   1120 54.175.208.220
+   1287 66.249.64.93
+   1586 66.249.64.78
+   3653 66.249.64.91
+```
+
+- Looks pretty normal actually, but I don't know who 54.175.208.220 is
+- They identify as "com.plumanalytics", which Google says is associated with Elsevier
+- They only seem to have used one Tomcat session so that's good, I guess I don't need to add them to the Tomcat Crawler Session Manager valve:
+
+```
+$ grep 54.175.208.220 dspace.log.2017-12-30 | grep -o -E 'session_id=[A-Z0-9]{32}' | sort -n | uniq | wc -l          
+1 
+```
+
+- 216.244.66.245 seems to be moz.com's DotBot