Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just checked bandwith usage on SolusVM and it was 250gb in 2 days, and I know it's one of my users through OpenVPN.

I think it is a torrent because it is upload + download 24/7.

I want to find out who is doing this by getting their username. I make accounts for every user on my VPN ( adduser name -s /bin/false/nologin ).

Is it possible to see who is uploading? I need to get the username or subnet ( like 10.8.1.1 ).

share|improve this question

closed as off-topic by Ward, masegaloeh, Jenny D, Khaled, Katherine Villyard May 24 '15 at 22:49

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

5  
No offense, but you probably should have figured this kind of thing out before starting a VPN business. – EEAA Jan 19 '13 at 19:46

Use tcpdump to identify the source IP of the traffic, then look through your OpenVPN logs to see who that IP address was given to.

share|improve this answer
    
There is a lot of connections from the torrents. I need to be able to filter it so that I can see who uploads the most. – Niel Jan 19 '13 at 18:50
    
So grab all of the source IPs and see which one is the most active. – EEAA Jan 19 '13 at 19:11

Check the (default) /etc/openvpn/openvpn-status file. If the user is connected you'll see the bytes_sent and bytes_received columns. These columns reset if an user (re)connects though.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.