Re: [cobalt-users] [RaQ3] Tracking down unusually high use?

[Jeff Bilicki <jeff@xxxxxxxxxxx>]

Here is a little script use to see what network traffic
is happening when my load is above 1.00, every minute.
to use it, copy the following perl program to your raq and type:
nohup perl <filename> &

#!/usr/bin/perl
# Find out who is accessing my network when my load is above 1.00

use strict;
my $load = 1;
my $trace = "/bin/netstat -natu | grep -E \"(ESTABLISHED|TIME_WAIT|CLOSE_WAIT)\"";
my $log = "/var/log/stat";

while(1) {
    $_ = `cat /proc/loadavg`;
    /(\d+)\.(\d\d)\s.*/;
    if($1 >= $load) {
        open(FH, ">>$log") || die "Cannot open log file $log: $!\n";
        my $time = localtime();
        my $info = `$trace`;
        print FH $time, " load $1.$2\n", $info;
        close(FH);
    }
    sleep(60);
}

Jeff-



> Hi,

> Recently a RaQ3 has started to show really high incoming traffic during the
> night. The site usage facility on the GUI doesn't reflect this high amount
> of traffic. I suspect a possible lame DNS entry. Are there log files for DNS
> queries or errors.

> Maybe I'm barking up the wrong tree, anyone got any suggestions. The
> incoming traffic is between 18Mb and 30Mb per hour, reasonably constant and
> only at night, the outgoing is at it's normal level for this RaQ. The
> traffic stats are taken from my router.

> Can someone offer any advice please?

> Joe Quinn   joe@xxxxxxxxxx
> QITC Internet Solutions
> Cisco re-seller, Cobalt RaQ re-seller.
> Free Domain Name Registration, Web Site Hosting, Co-location.
> The Best Value Bar None!
> Tel:    44 141 577 6919
> Mobile:    44 776 737 1234



> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To Subscribe or Unsubscribe, please go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users