Editing Bots (section)

== Analysing traffic ==
* if system logs are in an analysis platform e.g. splunk
* TODO (+ Thanks to members of the EP-Tech mailing list for some of the suggestions below. 

=== Apache logs ===
TODO (detail from tech-list)

=== Cachemap ===
When the internal EPrints search is used, a cache table is created in the database, and the details of the search are stored in the core <code>cachemap</code> table.

The pattern of 'swarm' activity can result in many identical searches being run. We can see these using the following query:
<source lang="sql">
SET @threshold = 30;
SELECT COUNT(*) c, searchexp FROM cachemap GROUP BY searchexp HAVING c > @threshold ORDER BY c;
</source>

Analysis of the web logs using search expressions returned from above may identify some attributes of the 'swarm'.

NB If EPrints is using Xapian to process searches, the majority of searches will ''not'' create a cache table.