Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a Linux server (2.6.28-11-generic #42-Ubuntu) that's misbehaving on a client site, gobbling up an entirely unacceptable percentage of the client's bandwidth, and we're trying to figure out what the heck it's doing. And the guy who had the sysadmin skillset has yet to be replaced.

We're at a loss for what could be causing all that network traffic, and need to figure it out SOON. What log files should I be looking at to find this information? What analysis tools would you recommend for this task?

Please note that I'm not looking for a tool that will allow me to analyze FUTURE traffic. The client is on the verge of shutting the machine off entirely; I need to figure out what it's been doing with the data I already have, if that's at all possible.

My thanks in advance for helping a development monkey play sysadmin.

share|improve this question
up vote 2 down vote accepted

If its moving alot of data quickly, i'd see if there's any heavy log activity in /var/log/*, namely httpd/ and maybe FTP. Otherwise check /var/log/security and /var/log/messages, those will contain a large portion of your system logs.

Warner recommended some good tools that i would suggest turning on and monitoring the traffic as it is happening. If you want the system down take it off the network and run the above tools with it disconnected from the primary network.

share|improve this answer
Thanks; that got me pointed in the right direction. – BlairHippo May 4 '10 at 22:13

If you have already isolated the server without a doubt..

iptraf is useful for bandwidth measurement on a local server.

ntop can be useful to breakdown on a higher level. If you install and start to running now, it can analyze past traffic.

Ultimately, tcpdump and wireshark should be all you need.

Otherwise, I would spend time on the network equipment to isolate and analyze the traffic. Netflow is something network admins like to pay a lot of money for but the OSS tools aforementioned can accomplish the same.

Ultimately, you're unlikely to have evidence specific to traffic in logs if you have not already configured something to do that. Depending on the protocol, you could analyze Apache logs and other application logs for historical patterns. If you have not isolated on any level, you are going to have a difficult time without enabling additional tools.

share|improve this answer
these dont really monitor past traffic though. – GruffTech May 4 '10 at 21:04
I'd upvote this if I could, so I'll have to settle for thanking you here in the comments. Thanks for the tips; we'll probably get one or more of these installed on the thing in case it starts misbehaving again. – BlairHippo May 4 '10 at 22:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.