Why are the daily Sawmill stats suspiciously high all of a sudden?
One day a few months ago our daily Sawmill stats email showed a huge spike in downloads, pageviews and unique visitors. We certainly wouldn’t mind more traffic, but it was suspicious since we usually see pretty steady growth and there wasn’t any obvious one-time event. Our web team turned to Splunk and looked at web access log events by event type. Splunk classified hits from each browser as different event types. There was one that accounted for a lot of traffic and was an obvious bot. We checked Sawmill’s filters and found that this bot wasn’t being filtered out with the others. Splunk showed that this bot became active when the spike started. A Report Splunk by IP on a search for just that bot browser string showed this was coming from a lot of different IPs—a bot farm rather than one source.
