Last night our AWS EC2 Linux Web Server started sending out CloudWatch notices due to high CPUUtilization. We had a normal number of users active, so I am struggling a bit to figure out where the issue is coming from.

I have been looking at the CloudWatch charts and see that there is a huge spike on the "NetworkIn" and "NetworkOut" charts. My assumption is that NetworkIn and NetworkOut represent requests made to the server and data sent out from the server.

Is there a way to see what these NetworkIn requests were? Or a better way to monitor this in the future?


NetworkIn is the amount of data coming into the instance. If the instance is only running a web server, than that traffic is probably web requests. Theres currently no AWS service that will let you see what that traffic was. You will need to set up monitoring on the instance. You can add more logging to your application, or turn on more verbose logging if that's an option in your application. You can also always just run tcpdump > file ;)

  • nast and tshark are other utilities that are probably worth looking into for capturing and examining what's coming in and going out over the wire. Heads up, though, by default, when running them on the console, they'll generate "infinite" traffic because they'll log your ssh session... over your ssh session... which generates network traffic... which they will log over your ssh session.. which... heh. – Michael - sqlbot Oct 2 '13 at 1:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.