I have a MySQL database server running on a VPS. The server is connected to a web server via a private network interface, and has no public services except SSH and a PHPMyAdmin installation.
Some time ago, I installed a Monit rule to check for abnormal traffic over the Public network interface (AKA, not the one that MySQL data goes over):
# Monitor network connection
check network public with interface eth1
if failed link then alert
if changed link then alert
if saturation > 90% then alert
if download > 10 MB/s then alert
if total upload > 1 GB in last hour then alert
A few months ago, I started getting flurries of Monit alerts triggered by this rule:
Upload bytes exceeded Service public
Date: Tue, 04 Apr 2017 13:11:55
Action: alert
Host: myhostname.com
Description: total upload 1.0 GB matches limit [upload rate < 1024.0 MB in last 1 hour]
Your faithful employee,
Monit
These alerts don't really correlate with any spike of usage on the server, and since there are no real public-facing services I can't imagine what could be responsible for this amount of upload bandwidth. Disk space doesn't seem to be being used either.
How can I find out what is causing 1GB+ of "something" to be uploaded, what is being uploaded, and from where?