Results 1 to 16 of 16
  1. #1
    Join Date
    Jul 2007
    Posts
    2,051

    Heavy data transfer from Cpanel server

    One of my Cpanel servers is showing heavy data transfer this month. In 6 days, it crossed 600 GB data transfer which is equal to what it did last month. Also, all the websites collectively have only consumed around 60 GB data transfer in 6 days. How do I find out what exactly is causing heavy data transfer?
    Prashant T.

    Don't run after Success. Run after Excellence and Success will soon follow.

  2. #2
    Join Date
    Apr 2005
    Location
    Cochin
    Posts
    2,452
    How does the bandwidth usage looks like for individual domains ? .

    Probably hostlinking or videos being used by external servers .

  3. #3
    Join Date
    Jul 2007
    Posts
    2,051
    As per the datacenter's monitoring system, the bandwidth usage is due to outgoing bandwidth and according to bandmin installed in the server, it is due to UDP.
    Prashant T.

    Don't run after Success. Run after Excellence and Success will soon follow.

  4. #4
    Join Date
    Jun 2008
    Location
    India
    Posts
    130
    Okay, but it is always advisable to going through the stats regularly...so that you may alert if any bot attack comes.



    http://ideamine.in/

  5. #5
    Join Date
    Jul 2007
    Posts
    2,051
    Can anybody help me with this?
    Prashant T.

    Don't run after Success. Run after Excellence and Success will soon follow.

  6. #6
    Join Date
    May 2009
    Location
    Ft. Lauderdale, Florida
    Posts
    1,783
    Does that server have a root domain? If so, check it as well as that is where the leeching could be.
    U.S.A. High Resource allocation global cloud hosting serving 310,000 clients since 2008 | Offering both cPanel & DirectAdmin
    WebsitePlex.com | Instant Activation | Alpha, Master, Reseller & Cloud Hosting
    Recurring Affiliate Program Pays 20% of total revenue for life | 30 Day Trial

  7. #7
    Join Date
    Jul 2007
    Posts
    2,051
    How do I find the root domain?
    Prashant T.

    Don't run after Success. Run after Excellence and Success will soon follow.

  8. #8
    Join Date
    May 2009
    Location
    Ft. Lauderdale, Florida
    Posts
    1,783
    Is your company website hosted on the affected server? If so then check your own account as it may be compromised. The root domain is the one associated to you with root access.
    U.S.A. High Resource allocation global cloud hosting serving 310,000 clients since 2008 | Offering both cPanel & DirectAdmin
    WebsitePlex.com | Instant Activation | Alpha, Master, Reseller & Cloud Hosting
    Recurring Affiliate Program Pays 20% of total revenue for life | 30 Day Trial

  9. #9
    Join Date
    Mar 2005
    Location
    Orlando, Florida
    Posts
    2,625
    Are you running cPanel FTP Backups or something similar?

    If a user has uploaded a significant amount of data, it's highly possible that it would be your nightly remote backups causing a massive jump in bandwidth usage.
    Matthew Rosenblatt, and I do lots of things.
    Used to be a full time server administrator, now I help build cruise ships and inspect homes.
    My company, Ferrell Solutions, specializes in home inspections and property management.
    RecallScan is a service for monitoring appliances and vehicles in your home for recalls.

  10. #10
    Join Date
    Nov 2009
    Posts
    44
    do you have awstats. what your stats software show you. you can check bots
    or some ddos attack?

  11. #11
    Join Date
    Apr 2003
    Location
    Los Angeles, CA
    Posts
    820
    Quote Originally Posted by prashant1979 View Post
    As per the datacenter's monitoring system, the bandwidth usage is due to outgoing bandwidth and according to bandmin installed in the server, it is due to UDP.
    So did you check what this UDP traffic is? What process is sending it? Maybe you have a compromised script that sends out UDP floods.
    Pings <1 ms, Unlimited Transfer, Lowest Price: http://localhost/

  12. #12
    Join Date
    Jul 2007
    Posts
    2,051
    I found /usr/share/zsh/4.2.6/functions/_bittorrent on my server. Is this normal?
    Prashant T.

    Don't run after Success. Run after Excellence and Success will soon follow.

  13. #13
    Join Date
    Oct 2007
    Location
    India
    Posts
    68
    Hey,

    Does any of your clients has shell access ? Does any of the site hosted
    has some sort of torrent sharing things ? Meanwhile what does bandwidth usage shows in WHM for each domain ?
    Regards,
    Alan John

  14. #14
    Join Date
    Jul 2007
    Posts
    2,051
    None of the websites shows enormous bandwidth usage. I have not given shell access too to any account.
    Prashant T.

    Don't run after Success. Run after Excellence and Success will soon follow.

  15. #15
    Join Date
    Jul 2007
    Posts
    2,051
    How can I find out what was the network activity at a specific time on the server? Is there some log for the network activity created somewhere in linux?
    Prashant T.

    Don't run after Success. Run after Excellence and Success will soon follow.

  16. #16
    Join Date
    Jul 2007
    Posts
    2,051
    I see a lot of lines in the /var/log/messages file which go like this

    pure-ftpd: (?@127.0.0.1) [INFO] __cpanel__service__auth__ftpd__glRjF4Ky1VWIWyfLfdkDVzAluTrPlo_SzRHzCePIUPDYAXmn9VuKpGiVrS_I0hmZ is now logged in
    pure-ftpd: (__cpanel__service__auth__ftpd__glRjF4Ky1VWIWyfLfdkDVzAluTrPlo_SzRHzCePIUPDYAXmn9VuKpGiVrS_I0hmZ@127.0.0.1) [INFO] Logout.

    Any idea what can it be?
    Prashant T.

    Don't run after Success. Run after Excellence and Success will soon follow.

Similar Threads

  1. Transfer data from DirectAdmin to Cpanel by WHM
    By Jwings in forum Hosting Software and Control Panels
    Replies: 4
    Last Post: 04-24-2008, 03:29 PM
  2. how to find the data transfer data in the server
    By koppan in forum Hosting Security and Technology
    Replies: 6
    Last Post: 02-20-2007, 12:16 PM
  3. Replies: 29
    Last Post: 08-08-2004, 03:39 PM
  4. Replies: 2
    Last Post: 11-21-2002, 11:12 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •