Inbound network IO

Posted February 1, 2014 3k views
Hi, I was looking over this morning's disk and network monitoring graphs and I saw an unusual amount of inbound network IO and disk write activity. Since I haven't uploaded anything (or even touched the droplet today) I was wondering what that might be. Do you have any idea? Should I be worried about suspicious or malicious software or any kind of hacker attack? I was looking in /var/log/syslog, but I haven't seen anything suspicious. Any ideas as to where should I look for clues of what might have happened? Here is a screenshot: Thanks.

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Submit an Answer
1 answer
Is it an Ubuntu server? If so, what are the contents of "/etc/apt/apt.conf.d/10periodic" ? By default on a 12.04 server, they'll be:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "0";
APT::Periodic::AutocleanInterval "0";

This will run "apt-get update" automatically every day. This just updates the packages list; it doesn't upgrade any packages. Set it to 0 to disable it.