I have been using a EC2 Amazon linux micro instance as a development/small host server for the past 3 months.
I host a couple of domains for me and a friend. I installed the first month only my main domain (which is used as test so it gets almost no traffic from public at all) to test everything.
The original setup is as follows:
Amazon Linux on EC2 micro instance. Nginx with php-fpm all this connected to a MYSQL on a Amazon RDS instance.
Everything runs under the free tier so I would not get billed for a year.
I installed a basic Wordpress install and for the first month everything ran perfectly and got no extra costs related to the operation added. However after reviewing the bill I did get charged: 1,091,031 IOs over the free limit (so we can assume that I got 3million IOs)
The second month I started moving the other sites to the EC2 instance. and also pointing the other domains there. I moved large amount of data in these sites and after reviewing the bill I did go over the 2 million I/O requests under monthly free tier so I payed like a dollar. Still it was combined with other costs not related with this so it slip my mind. For this month I got 28,229,035 IOs over the 2 million limit.
The third month is when it got crazy. At the end of the month I got attacked heavily with spammers on the wp_login page. This sent my server to a cpu use of 100% for a couple of days. For that month I had 146,301,325 IOs.
This is the fourth Month, first I redirected all the domains to the single wordpress basic install. Then I implmented on nginx.conf measures to stop requests from any IP that is spamming. I managed to get everything under control and CPU use was down, however between all the measures I took something changed drastically on my server.
You can see this short graph here: http://figotech.com/serveruse.png
I can't remember what I did but as you can see the VOlumeReadOperations (Which were on the millions and my main concern) went straight to the bottom. However The WriteOperations which were just a couple went up to a couple thousand (watch out for the scale difference). Its not as high as what the readops was but it was something that had no activity at all.
Between 5/5 and 5/6 there is a gap where I took the instance down.
You will also notice between 5/10 and 5/13 WriteOps at almost zero. What I did in this period of time was remove the external access through port 80, only I could access it (which accounts for some minor activity there)
My assumption is that My domains are still under attack and as soon as I open port 80 they start hitting the server. However this constant activity is increasing my WriteOps instead of my ReadOps and while they are way lower than during the big attack I still think this server should be able to handle everything with minimal activity.
I turned off access logs and at least my error logs are only a couple of lines.
My question is:
How can I find out what process is creating all this WriteOperations?? clearly they can be lower since thats the way it was before the attack. I am close to buying the reserved instance but would like to avoid monthly fees related to this write operations