requests from non-local origins
in the three ten-second slices
Operational evidence notebook · November 2026
Three bursts.
A system that
kept responding.
The volume did not appear only on the dashboard. It left service records, repeated pages, and infrastructure operation. Here we separate what was observed from what still needs to be demonstrated.
Episodes from November 7 and 8 in UTC · local times also available.
with HTTP 200 response
in those same slices
routes present
in all three windows
01 / Three episodes, the same yardstick
The burst returned. And so did the routes.
Select an episode. Each comparison uses the window from four seconds before to five seconds after the collector time. We do not add auxiliary logs to the main log or count IPs as people.
Central ten-second window
2.671 requests
1.314 distinct routes
Brasília: 06/11, 21:40:38
UTC: 07/11, 00:40:38
- HTTP 200 response
- 2.644 · 98,99%
- HTTP 404 response
- 26
- HTTP 301 response
- 1
- HTTP 5xx errors
- 0 in this slice
Concentration per second
Main log · calendar seconds · includes local probes
The collector samples an accumulated counter; the graph counts lines in fixed seconds. These are different time slices, so their maxima do not need to coincide.
Download CSV seriesCentral ten-second window
2.583 requests
1.299 distinct routes
Brasília: 07/11, 21:26:18
UTC: 08/11, 00:26:18
- HTTP 200 response
- 2.555 · 98,92%
- HTTP 404 response
- 27
- HTTP 301 response
- 1
- HTTP 5xx errors
- 0 in this slice
Concentration per second
Main log · calendar seconds · includes local probes
The collector samples an accumulated counter; the graph counts lines in fixed seconds. These are different time slices, so their maxima do not need to coincide.
Download CSV seriesCentral ten-second window
2.606 requests
1.269 distinct routes
Brasília: 08/11, 20:34:00
UTC: 08/11, 23:34:00
- HTTP 200 response
- 2.584 · 99,16%
- HTTP 404 response
- 21
- HTTP 301 response
- 1
- HTTP 5xx errors
- 0 in this slice
Concentration per second
Main log · calendar seconds · includes local probes
The collector samples an accumulated counter; the graph counts lines in fixed seconds. These are different time slices, so their maxima do not need to coincide.
Download CSV series“0 5xx errors” applies to the central windows, not the entire day. In the expanded slice of the first episode there is one HTTP 502 record. The new-record window crosses the minute change; we do not use the isolated minute to compare its intensity.
02 / The repetition pattern
It was not an isolated page.
The three windows share 1.078 paths. Between pairs, the similarity of the route sets is between 81,61% and 84,93%. This shows broad repetition of the requested set; it does not prove that one person or company operated all three episodes.
HTML paths predominate, with few requests per route and none of the image, script, and stylesheet types examined in these ten seconds. The profile is compatible with distributed automated collection.
It does not prove reading, extraction for training, an attack, or human browsing. Resources may be cached or may have been requested outside the window.
| Route | 856 | 907 | 944 |
|---|---|---|---|
/mca.html | 4 | 4 | 4 |
/relatorio-mca8.html | 2 | 4 | 4 |
/matriz-global-mca10.html | 5 | 3 | 2 |
/estudo-axiomas.html | 4 | 4 | 4 |
/resultados-mca.html | 5 | 5 | 5 |
/medicina.html | 5 | 6 | 5 |
/aviacao.html | 6 | 6 | 5 |
/educacao-de.html | 6 | 6 | 6 |
/chairman.html | 5 | 4 | 5 |
/entretenimento-en.html | 5 | 6 | 5 |
/lab2-protecao-dados.html | 2 | 3 | 2 |
03 / The observed infrastructure
Positive signals. Without inventing what was not measured.
The records show predominantly HTTP 200 service in all three episodes. The Nginx snapshot is active, with a start before the bursts and no recorded restarts; its journal shows no restart in the new window.
Historical system samples show predominantly idle CPU in the intervals spanning the episodes and available memory in later snapshots. They are positive evidence of operation, not certification of maximum capacity or absence of brief interruptions.
CPU is an average over intervals of approximately ten minutes; memory is a snapshot at the indicated time. A brief peak may be diluted in that average.
| Episode | CPU interval | Idle CPU | Memory used |
|---|---|---|---|
| 856 | 00:40:00–00:50:00 | 95,19% | 8,07%at 00:50:00 |
| 907 | 00:20:09–00:30:02 | 97,77% | 8,51%at 00:30:02 |
| 944 | 23:30:02–23:40:01 | 86,90% | 8,21%at 23:40:01 |
04 / The value of the evidence
The operation has value. The cause requires another test.
Delimited conclusion of the audit
O sistema do Método registrou atendimento de milhares de requisições durante três rajadas repetidas, com predominância de respostas HTTP 200 e sinais positivos de funcionamento da infraestrutura.
This is not “nothing”. It is operational evidence that can be documented and examined. But it does not independently measure the role of the axioms, identify a neural change, or compare this infrastructure with an equivalent control.
Observed in the records
Volume, repetition, and service.
Concentrated requests, broad route overlap, response codes, and historical system samples.
Not yet demonstrated
Operator, intent, and cause.
Who initiated the collection, whether it was an engineering test, whether there was slowness, and what causal contribution came from the axioms or Guardian.
Observed result, unknown operator: two different questions.
Not identifying who initiated an operation does not erase the records that it occurred. Likewise, recording service delivery does not, by itself, reveal the operator's intent or the cause of the performance.
Does a bot rule out an engineer's participation?
No. Automation describes how the requests were executed; human participation describes who configured, commissioned, or initiated an operation. A person may direct an automation, but a recurring routine or an existing service may also produce the pattern. The logs do not distinguish these decision origins. A test engineer is a hypothesis, not an authenticated identity.
Why does repetition matter?
The three windows share 1.078 paths. This documents broad repetition of the requested set, consistent with automated scans. It is not a measurement of effective reading, intent, or identity: the overlap does not prove that the three episodes had the same operator.
What is it legitimate to conclude about the system?
Across the three central excerpts, there are 7.860 requests, 99,02% HTTP 200 responses, and no HTTP 5xx responses. This is positive evidence of recorded service delivery, not proof that there was no slowness or of sustained capacity. The HTTP 502 record in the expanded excerpt of the first episode remains acknowledged.
Does this prove the effect of the axioms?
It documents a result of the Método system in operation. It does not isolate the contribution of the axioms relative to Nginx, the cache, the configuration, or Guardian. An incremental effect requires comparison with a competent control under equivalent conditions. Lack of causal identification does not turn the observed data into a null result; nor does it authorize declaring causality.
05 / How this audit was conducted
Preserve before interpreting.
- 01
Fix the times
Convert UTC and Brasília and select expanded twenty-minute windows, including rotated logs.
- 02
Recount the events
Count the main log by second; separate local probes, HTTP codes, and paths, without adding duplicate auxiliary records.
- 03
Check infrastructure and measurement
Read service journals, historical samples, and collector code, without executing legacy code, generating load, or altering production.
- 04
Preserve sources and limitations
Store copies, receipts, and hashes in a reserved area. Copy integrity alone does not authenticate log authorship.
Two collector limitations that remain recorded
The number labeled RPS is the difference between two counters, without division by the effective time between readings. Therefore, the displayed value does not certify an exact rate. The same code version was observed before and after.
The operational snapshot displays record 944, but the file used for recovery still stores 887. The record in the capture was preserved; its automatic recovery after a restart is not assured by these two copies. No correction or restart was made in this audit.
The audit created no accounts or services and did not alter the VPS. This page publishes only aggregated data, without IPs, credentials, individual logs, axiomatic compositions, or reserved configurations.
06 / Sources and editorial status
A notebook to examine. Not a seal of infallibility.
Internal sources: preserved excerpts from access and error logs; metric snapshots and records; collector code; Nginx status and journals; historical sar samples. Text review is not an independent external certification.
This operational slice complements the laboratory's behavioral studies, but does not replace their controls or efficacy criteria.
- NGINX · requests and connections Definitions of the cumulative counter and active connections.
- NGINX · logs and times Access format, codes, and time per request.
- Método · MCA Public laboratory context, not a source of causality for this audit.