High session load of user elgg_user in mysql database servers every Friday at the same time

Every Friday at 7:00 p.m. there is a high increase in sessions of the user elgg_user in the elgg databases of each node of the Mysql galera cluster. It goes from 4-5 sessions to 700 in each node. The sessions come from the application servers, but the task causing the load cannot be found. I would like to be able to identify which process is causing the load on the database servers.

Sessions are found by running queries similar to this:

select entity_guid from elgg_metadata where name_id=11611746 and value_id=10 and entity_guid IN (select entity_guid from elgg_metadata where entity_guid IN (select guid from elgg_entities ee join elgg_metadata emt on (ee.guid = emt.entity_guid) where ee.select id=(select from elgg_entity_subtypes where subtype = 'ip_access_login') and emt.time_created>=1663344707 and emt.time_created<=1663345007) and name_id=18885 and value_id=(select id from elgg_metastrings where string like ''))

  • So no related additional activity in the access logs?

    Maybe it's a cron job (maybe a bit of a weird time, maybe the server has a different timezone). It looks like some kind of spam login detection.

    But from just the query alone it's very hard to tell (also because it's a Elgg <= 2.3 query).