How to catch a bot loading a site at over 100%??

Question

Nginx

Hello.
In the last few weeks, some kind of barmaley began to visit our modest server with a couple of sites and load resources at the most do not indulge .. I
am attaching screenshots.
Visiting time is about 6 am Moscow time
Question: how to catch it in the logs where there is a lot of any information ??
On the server, Nginx pulls the entire load

Answer 1

how to catch it in logs where there is a lot of any information??

Analysis of these same logs.
Cut off unnecessary information
Here you can see when the load started and when it disappeared - you already have time.
See from what addresses there were requests, how many requests from the address, what requests.
Visualize if it is not clear, build graphs.

Answer 2

This is your flaw in optimization and protection from abuse.
For example, usually, to search the database, you either need to enter a captcha, or a ban for N seconds on a second search, and this unloads the site.
Ideally, the site should be able to live under constant ddos ​​(if the channel allows).
So look not for a bot, but for a weak spot in the site itself. If there Vasya made an informer that takes 2 seconds to create and is not cached, then scold Vasya. And even a Google bot or a Yandex bot can turn out to be a bot, which, by the way, lower you in the search results for low responsiveness.

Answer 3

clickhouse and group by logs

Answer 4

ngx_http_limit_req_module
and sysctl.conf will help you.