Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am not sure if this is the correct forum to be posting to, but I thought someone might be able to help?

I have a client running Zen Garden on their site which was phished not too long ago. Ever since then, his bandwidth usage on the site has hit the roof and I was wondering if anyone know of a solution to this please?


share|improve this question
This is not a forum but a QA site and your question is too much vague – radius Jun 28 '10 at 22:29
It's not clear what you are asking. Maybe reword your question to say something like 'How do I measure the bandwidth on my site? I am using the operating system 'X' and the webserver 'foo', if that's what you want to know. – Stefan Lasiewski Jun 29 '10 at 0:32

If the site was compromised, nuke the server and start again. See also:

share|improve this answer
Also, remember to add in any security patches/processes that are needed to prevent the same thing happening again. – DrStalker Jun 29 '10 at 1:22
  1. If you determine you've been hacked, take your webserver off the network please. Your server may be serving malware, spamming people, functioning as part of a botnet and serving bad stuff for the bad guys.

If you are using Apache webserver, take a look at some of the other Log modules provided by Apache. These can help you track down if your webserver is doing anything strange. These two sound relevant:

Logging actual bytes sent and received

mod_logio adds in two additional LogFormat fields (%I and %O) that log the actual number of bytes received and sent on the network.

Forensic Logging

mod_log_forensic provides for forensic logging of client requests. Logging is done before and after processing a request, so the forensic log contains two log lines for each request. The forensic logger is very strict with no customizations. It can be an invaluable debugging and security tool.

share|improve this answer

If you have access to an upstream router look at the traffic that is making up the bandwidth; it could be anything from an open proxy to file sharing site full of illegal content.

share|improve this answer
Or run tcpdmp, set up SNMP monitoring from another host (using eg. Cacti), etc. – Andrew Jun 29 '10 at 1:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.