Resolved Anyway to identify which domain caused high volume traffic?

[raytracy]

I have recorded traffic spike at gateway sometime:



I knew that traffic was outbound from a specific IP address according to my netflow reporter. But this IP were used by a Plesk server which hosted tens sites.

Is there any semi-realtime report inside Plesk can help me identify which site caused the high volume traffic?

AWstat or Webalizer report are not useful since I can only see the report for last day, not today or several hours before.

 

[Bitpalast]

You can use the network bandwith monitor of Plesk health monitor for early warnings. But it is not possible to identify the culprit by a default Plesk monitoring tool.

My suggestion is to upload a custom configuraton file that sets the alarm for bandwith alerts to a low value so that it can get your attention asap, then run
# strace -p <pid>
on the PID of the httpd process with the highest CPU usage at the time when the peak occurs. Normally the output includes some hints on the domain that is causing it.

A more complicated way would be to write a watchdog script that is monitoring network traffic and automatically records strace-outputs in case the network traffic goes up. I am not aware that such a tool is available, at least not from within Plesk.