too much outbound traffic

[weber]

guess some one hack the d/a

i check the bandwidth from my network port(supplied by server provide)

some time traffic is 100M full of my cable speed. last 5-20 mins, happens 2-4 times per day.
regular is only 2M.

well, when i check user bandwidth, nothing strange.

while the traffic rise to 100M full speed, I suspend all the users, traffic back to normal.

so, how should I know which user hide it's bandwidth, especiall outbound bandwidth.

 

[zEitEr]

You might be under a DDoS attacke, or somebody download anything from your server with several streams. Check server-status of Apache, apache logs, AwStats (with awstats there is one day delay, as it does not show real time data).

netstat, top.

 

[weber]

thanks

is there any apache logs, AwStats for the full server?

under the view log fo admin, the apache log file is blank

 

[zEitEr]

Nothing of the kind. You should do it on per domain bases in Directadmin and check logs in /var/log/httpd/domains/ in SSH.




p.s. Send me a PM for a quote, if you want a quick help with your issue. I'll need root access to your server