Inbound network IO

February 1, 2014 1.3k views
Hi, I was looking over this morning's disk and network monitoring graphs and I saw an unusual amount of inbound network IO and disk write activity. Since I haven't uploaded anything (or even touched the droplet today) I was wondering what that might be. Do you have any idea? Should I be worried about suspicious or malicious software or any kind of hacker attack? I was looking in /var/log/syslog, but I haven't seen anything suspicious. Any ideas as to where should I look for clues of what might have happened? Here is a screenshot: Thanks.
1 Answer
Is it an Ubuntu server? If so, what are the contents of "/etc/apt/apt.conf.d/10periodic" ? By default on a 12.04 server, they'll be:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "0";
APT::Periodic::AutocleanInterval "0";

This will run "apt-get update" automatically every day. This just updates the packages list; it doesn't upgrade any packages. Set it to 0 to disable it.
Have another answer? Share your knowledge.