Last night our AWS EC2 Linux Web Server started sending out CloudWatch notices due to high CPUUtilization. We had a normal number of users active, so I am struggling a bit to figure out where the issue is coming from.

I have been looking at the CloudWatch charts and see that there is a huge spike on the "NetworkIn" and "NetworkOut" charts. My assumption is that NetworkIn and NetworkOut represent requests made to the server and data sent out from the server.

Is there a way to see what these NetworkIn requests were? Or a better way to monitor this in the future?

  • heck the logs on the server? Commented Oct 1, 2013 at 13:37

1 Answer 1


NetworkIn is the amount of data coming into the instance. If the instance is only running a web server, than that traffic is probably web requests. Theres currently no AWS service that will let you see what that traffic was. You will need to set up monitoring on the instance. You can add more logging to your application, or turn on more verbose logging if that's an option in your application. You can also always just run tcpdump > file ;)

  • nast and tshark are other utilities that are probably worth looking into for capturing and examining what's coming in and going out over the wire. Heads up, though, by default, when running them on the console, they'll generate "infinite" traffic because they'll log your ssh session... over your ssh session... which generates network traffic... which they will log over your ssh session.. which... heh. Commented Oct 2, 2013 at 1:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .