How to see what is causing high data traffic on server

[hendry]

My server is generating a lot of traffic. When logging in as the admin it shows the server generated 60 GB of data for the month of October. I only have one reseller account and that account only generated 2,5 GB of data for this month. Where can I find what is causing the other 57,5 GB of data? Server is running on Debian Etch. I really need to know this fast, otherwise my server will be cut of because of the hight volume of data!!!

[joximu]

Maybe you can find out what sort of traffic this is.
http://<ispcp-server>/admin/server_statistic.php

/Joximu

[hendry]

joximu Wrote:Maybe you can find out what sort of traffic this is.
http://<ispcp-server>/admin/server_statistic.php

/Joximu

It is the traffic other out, not standard email / www etc.

[joximu]

hendry Wrote:

joximu Wrote:Maybe you can find out what sort of traffic this is.
http://<ispcp-server>/admin/server_statistic.php

/Joximu

It is the traffic other out, not standard email / www etc.

So you have to see, if you can find this traffic.
If it is increasing every day (click on a day: you'll see the hours) then you might find it by listing the open network connections/ports:
lsof -i -P -T
Other means: not mail, not web. But this can be FTP, SSH (but you have to do alot to get 60GB SSH Traffic - even by listing all logfiles...), DNS, MySQL etc etc....

/Joxi

[Esni]

Hi hendry,

Hey, would you care to check how large(mb) is your ftp_traff.log in var/log?

[hendry]

It looks like it's empty and it also looks my traffic statistics are not run anymore as from 6-10? Can anybody tell me where to look for the reason for this?

[BeNe]

Take a look at your cron

Code:

/etc/cron.d/ispcp

Here you find the Traffic Scripts

Code:

# Traffic
0,30    *       *       *       *  root /var/www/ispcp/engine/traffic/ispcp-srv-traff &>/var/log/ispcp/ispcp-srv-traff.log
0,30    *       *       *       *  root /var/www/ispcp/engine/traffic/ispcp-vrl-traff &>/var/log/ispcp/ispcp-vrl-traff.log
15,45   *       *       *       *  root /var/www/ispcp/engine/traffic/ispcp-vrl-traff-correction &>/var/log/ispcp/ispcp-vrl-traff-correction.log
30         23   *       *       *  root /var/www/ispcp/engine/tools/ispcp-httpd-logs-mngr &>/var/log/ispcp/ispcp-httpd-logs-mngr.log

Take a look at the Logs. Maybe you can test to start them manuel.

Greez BeNe

[hendry]

Esni Wrote:Hi hendry,

Hey, would you care to check how large(mb) is your ftp_traff.log in var/log?

Stats are running again and I saw that in half an hour there was again 2.5 GB traffic between 19:00 en 19:30. The ftp_traff.log in /var/log/proftpd is about 3.5 mb large

What I also see is that none of the website are generating FTP traffic. This is strange because I just added a domain and I've send data to it by FTP. Anybody an idea?

[BeNe]

Install ntop on the Server and you will find it.

Greez BeNe

[hendry]

BeNe Wrote:Install ntop on the Server and you will find it.

Already did, but not finding the problem. Also changed the proftpd config as in the other forumthread. Still looking, but this is strange:

Kazaa 4,0 KB 36 0%
eDonkey 26,2 KB 146 0%
Messenger 6,3 KB 50 0%

Server is running on Debian Etch with RC2 on it installed