0

Every day between exactly 4am and roughly 11-12am we're having this massive increase in bandwith which is causing a very high load on our server. I'm not able to pinpoint the exact cause and I was curious if you can point me in the right direction with how to identify the cause of this problem.

digital_ocean_droplet_bandwith_graph_screenshot

Improve this question
1
  • 1
    Check cronjobs, log entries around the time. If you can't find anything, log connections at intervals and check them for remote addresses that stand out.
    – Gerald Schneider
    Commented Oct 6, 2023 at 12:24

3 Answers 3

Reset to default
0

You could also create a cronjob that you log all outgoing traffic with iptables to a log file which you can review.

Improve this answer
1
  • 2
    flow-tools (or other netflow implementation) looks much more appropriate for this problem
    – Nikita Kipriyanov
    Commented Oct 7, 2023 at 9:09
0

Looks like the typical symptom for an automated backup. If you have scheduled backups configured, these will at least create a high I/O load and - if they use compression - also create a high cpu load.

Improve this answer
0

You're providing not near enough information for anyone to guess the actual reason for that traffic.

The general steps for analysis are:

  • Check server and firewall logs for traffic patterns (common source addresses, repeating URLs) and error messages.
  • Run network monitoring like netflow or sflow.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .