I have a user whois using a lot of bandwidth, 5gb, in last day, so his account goes suspended. However checking http trafic with webalizer here is nothing abnormal, it report only 600mb traffic instead of gb for same period...
How and where can I investigate for this? He is not using ftp or ssh.
How and where can I investigate for this? He is not using ftp or ssh.