This is NOT on the ADMIN topic because I'm not sure what I'm seeing yet. In brief: yesterday from around 13:00 until late evening, Maelstrom was extremely sluggish due to WWW activity. The server kept up with Listserv mail in and out OK, but the WWW interface was slow, interactive commands took forever and the disks were run ragged. Once I had time to check the logs it appeared to me that around 60% of the WWW activity was being done by a single user (217.84.47.170 - pD9542FAA.dip.t-dialin.net), who was mostly pulling trasactions from a list with large archives. I'm *guessing* that this was an automaton pulling postings in non-chronological order, maybe by author or by topic. Whatever, stacking 30,000+ requests against a server is indistinguishable to me from any other denial of service attack and I'm not happy about it. I changed the access on that particular list from "Public" to "Private" (which immediately solved the performance issue) and a few hours later the automaton went away. Today I'm seeing similar behavior from 84.133.52.168 against another list, which I've also changed from "Public" to "Private". Meanwhile, 155.69.5.235 seems to be going through the lists alphabetically pulling the indexes and I'm assuming it will start hammering some list soon too. So... until someone tells me different, I'm under the impression that there is some utility circulating that resequences archives, and we are seeing the beginning of the end of the "Public" archive. Since a determined user can easily sign on to a list prior to doing this, I'm not optimistic about the future of "Private" archives either. Anybody else know what's really going on? -Kary