See the three examples below, for very different EL tables, which contain an implausibly low number of distinct client IP (hashes) in the EventLogging capsule:
- 37 IPs in 111004 events
- 37 IPs in 8630 events
- 41 IPs in 94218 events
As @ori pointed out to me, this may be suspiciously close to the number of Varnish IPs (around 40?). Indeed, the EL table for visits to the Wikimedia blog (which is not behind Varnish) shows a more normal ratio:
- 507 IPs in 3326 events
select COUNT(*) from log.MobileWebSectionUsage_14321266 WHERE timestamp LIKE '2015111800%'; +----------+ | COUNT(*) | +----------+ | 111004 | +----------+ mysql:research@analytics-store.eqiad.wmnet [(none)]> select COUNT(distinct clientIP) from log.MobileWebSectionUsage_14321266 WHERE timestamp LIKE '2015111800%'; +--------------------------+ | COUNT(distinct clientIP) | +--------------------------+ | 37 | +--------------------------+ mysql:research@analytics-store.eqiad.wmnet [(none)]> SELECT COUNT(DISTINCT(clientIP)) FROM log.MobileWikiAppDailyStats_12637385 WHERE timestamp LIKE '20151118%'; +---------------------------+ | COUNT(DISTINCT(clientIP)) | +---------------------------+ | 37 | +---------------------------+ mysql:research@analytics-store.eqiad.wmnet [(none)]> SELECT COUNT(*) FROM log.MobileWikiAppDailyStats_12637385 WHERE timestamp LIKE '20151118%';+----------+ | COUNT(*) | +----------+ | 8630 | +----------+ mysql:research@analytics-store.eqiad.wmnet [(none)]> SELECT COUNT(*) FROM log.UniversalLanguageSelector_7327441 WHERE timestamp LIKE '20151118%'; +----------+ | COUNT(*) | +----------+ | 94218 | +----------+ mysql:research@analytics-store.eqiad.wmnet [(none)]> SELECT COUNT(DISTINCT(clientIP)) FROM log.UniversalLanguageSelector_7327441 WHERE timestamp LIKE '20151118%'; +---------------------------+ | COUNT(DISTINCT(clientIP)) | +---------------------------+ | 41 | +---------------------------+ SELECT COUNT(*) FROM log.WikimediaBlogVisit_5308166 WHERE timestamp LIKE '20151118%'; +----------+ | COUNT(*) | +----------+ | 3326 | +----------+ SELECT COUNT(DISTINCT(clientIP)) FROM log.WikimediaBlogVisit_5308166 WHERE timestamp LIKE '20151118%'; +---------------------------+ | COUNT(DISTINCT(clientIP)) | +---------------------------+ | 507 | +---------------------------+