How can you investigate a daily traffic drain?

Question

Running Amazon EC2 instance, t3.large tier. And observing interesting situation:

enter image description here

Every night (UTC+1 midnight) the same NetworkOut jump occurs. What are my options to investigate it?

The EC2 runs nginx and varnish only. Nginx access logs don't show anything like that. So it must be something different.

score 3 · Accepted Answer · edited May 23 '17 at 11:33

3

You can possibly make a script which periodically calls any tool like this (http://nethogs.sourceforge.net/) or similar others. Keep appending this output to a file with time info. Run this script as a daemon.

Next day you can see what is that "culprit" process.

This thread seems to have more such tools : Network usage top/htop on Linux

edited May 23 '17 at 11:33

Community

1

answered Feb 18 '14 at 12:54

Sony Kadavan

156
3

Thanks, among the tried ntop, ntopng, iftop nethogs was the most informative! – Aleksandr Makov Feb 18 '14 at 18:35
Now I wonder, what the heck is this: http://f.cl.ly/items/0d2I2k460S3Q3I2U1m3n/Screen%20Shot%202014-02-18%20at%2020.39.41.png – Aleksandr Makov Feb 18 '14 at 18:41

How can you investigate a daily traffic drain?

1 Answers1