How to set up a server to allow the root user to track down historical outgoing requests?

Asked May 06 '22 at 12:39

Active May 06 '22 at 13:00

Viewed 16 times

I woke up this morning and found an unexpected outgoing spike in traffic from my virtual server.

What commands/settings should I have been using to allow myself to track down the who/what initiated these requests, what was being sent and where it was being sent to?

Distributor ID: Ubuntu
Description:    Ubuntu 18.04.6 LTS
Release:        18.04

edited May 06 '22 at 13:00

asked May 06 '22 at 12:39

Tolure

1

If you weren't already logging these information at that point (and if you were, you wouldn't need to ask now) the answer is most probably "none". – Gerald Schneider May 06 '22 at 12:43
Noted. I'll updated my post accordingly – Tolure May 06 '22 at 12:45
Apart from that, product recommendations are off topic. – Gerald Schneider May 06 '22 at 12:47
Noted. I'll remove the request for tools and just leave a request of commands that would enable proper tracking. – Tolure May 06 '22 at 12:53
auditd, acct or both come to mind – A.B May 07 '22 at 15:58

How to set up a server to allow the root user to track down historical outgoing requests?

0 Answers0