Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just checked bandwith usage on SolusVM and it was 250gb in 2 days, and I know it's one of my users through OpenVPN.

I think it is a torrent because it is upload + download 24/7.

I want to find out who is doing this by getting their username. I make accounts for every user on my VPN ( adduser name -s /bin/false/nologin ).

Is it possible to see who is uploading? I need to get the username or subnet ( like ).

share|improve this question

closed as off-topic by Ward, masegaloeh, Jenny D, Khaled, Katherine Villyard May 24 '15 at 22:49

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

No offense, but you probably should have figured this kind of thing out before starting a VPN business. – EEAA Jan 19 '13 at 19:46

Use tcpdump to identify the source IP of the traffic, then look through your OpenVPN logs to see who that IP address was given to.

share|improve this answer
There is a lot of connections from the torrents. I need to be able to filter it so that I can see who uploads the most. – Niel Jan 19 '13 at 18:50
So grab all of the source IPs and see which one is the most active. – EEAA Jan 19 '13 at 19:11

Check the (default) /etc/openvpn/openvpn-status file. If the user is connected you'll see the bytes_sent and bytes_received columns. These columns reset if an user (re)connects though.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.