Question High traffic website, but from where?

[SalvadorS]

Hello,

I have a website with 20Gb of http traffic everyday. But I check the logs and all seems to be normal not such that traffic at all. I don´t see from where these stats comes. Also web-stats are active in this domain and numbers does not match at all.

Anybody can tell me how I can know from where that http traffic comes?

Thank you

 

[Fabian H]

Hi there,
if you want to find the ip addresses which are connected to the server right now, just run

ss -tan state established | grep ":80\|:443" | awk '{print $4}'| cut -d':' -f1 | sort -n | uniq -c | sort -nr

This output counts the connections to the whole server right now.

If you want to know the count for a special website in a special time range, just do this:

mkdir /root/datastats
cd /var/www/vhosts/system/<yourdomain>/logs
for i in *; do find $i -mtime -3 -type f -exec cp -a {} /root/datastats \;; done

To copy all logs from <yourdomain> in a temporary folder. Please replace <yourdomain> with your domain name.
You also can replace the -3 with any number you want, it represents the days you wanna check.

cd /root/datastats
for i in *; do [[ ${i:(-3)} == ".gz" ]] && gunzip $i ; done
for i in *; do grep -rh "\[19/Dec/2021" ./$i > $i.accessed; done
cut -f 1 -d ' ' *.accessed | sort -n | uniq -c | sort -nr | less

To check the files. Replace 19/Dec/2021 with the day you wanna check. The last command shows you the count and ip connected to the website.

 

[SalvadorS]

Dear Fabian,

Thanks a lot for this. It helped a lot. I checked all the IPs but I don´t find any "out of normal" ... most visits are from google... nothing strange found with the IPs, still don´t know why the traffic are so high...

 

[Fabian H]

Dear Fabian,

Thanks a lot for this. It helped a lot. I checked all the IPs but I don´t find any "out of normal" ... most visits are from google... nothing strange found with the IPs, still don´t know why the traffic are so high...

How do you measure the traffic from the website? Within Plesk itself?

 

[SalvadorS]

Yes, the traffic that plesk says...

 

[Fabian H]

So, the traffic is measured by month.
You checked above the log of one single day.
You could modify the commands above to the following:

mkdir /root/datastats
cd /var/www/vhosts/system/<yourdomain>/logs
for i in *; do find $i -mtime -30 -type f -exec cp -a {} /root/datastats \;; done
cd /root/datastats
for i in *; do [[ ${i:(-3)} == ".gz" ]] && gunzip $i ; done
cut -f 1 -d ' ' * | sort -n | uniq -c | sort -nr | less

Don't forget to delete the /root/datastats folder first.
With this commands, you will get the stats of the last 30 days (if stored).
Please note that the commands can last a little time running.