The server is up, but raid is rebuilding yet again.
I am going to start a restore process to copy files to a new node, hopefully we can get things resolved and this will not be needed, but should the need arise we will be a step ahead with a large amount of files copied at minimum, which is the slowest part of any move process.
I have blocked a couple IPs that were attributing themselves to 1000's of connections to the server, we are working to see if any more come. The symptoms of this were unlike normal DDOS/DOS attacks so until some of the connection reset/blank pages started being served up this was not on the radar as a major issue.