Add notes for 2018-12-29

content/posts/2018-12.md

@@ -485,4 +485,41 @@ UPDATE 1
 
 - After all that I started a full Discovery reindex to get the index name changes and rights updates
 
+## 2018-12-29
+
+- CGSpace went down today for a few minutes while I was at dinner and I quickly restarted Tomcat
+- The top IP addresses as of this evening are:
+
+```
+# zcat --force /var/log/nginx/*.log /var/log/nginx/*.log.1 | grep -E "29/Dec/2018" | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 10
+    963 40.77.167.152
+    987 35.237.175.180
+   1062 40.77.167.55
+   1464 66.249.66.223
+   1660 34.218.226.147
+   1801 70.32.83.92
+   2005 50.116.102.77
+   3218 66.249.66.219
+   4608 205.186.128.185
+   5585 54.70.40.11
+```
+
+- And just around the time of the alert:
+
+```
+# zcat --force /var/log/nginx/*.log.1 /var/log/nginx/*.log.2.gz | grep -E "29/Dec/2018:1(6|7|8)" | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 10
+    115 66.249.66.223
+    118 207.46.13.14
+    123 34.218.226.147
+    133 95.108.181.88
+    137 35.237.175.180
+    164 66.249.66.219
+    260 157.55.39.59
+    291 40.77.167.55
+    312 207.46.13.129
+   1253 54.70.40.11
+```
+
+- All these look ok (`54.70.40.11` is known to us from earlier this month and should be reusing its Tomcat sessions)
+
 <!-- vim: set sw=2 ts=2: -->