Odoo 16 Server – High Outbound Bandwidth, CPU 98%, Web Console & SSH Unresponsive

Question

Hello, My Odoo 16 server on DigitalOcean (Ubuntu 22.04) is experiencing critical issues: • Public outbound bandwidth: ~63 Mb/s (continuous) • CPU usage: 96.3% (user) • SSH is not working – connection times out • Web console shows: “Error: Timed out while waiting for handshake” • Bills: May $40 (1,866 GiB overage), June $57.14 (3,368 GiB overage) – normally ~$18.40/month • Odoo transactions are very slow I have custom modules: auto_backup (caused import errors) and advanced_session_management (disabled). The droplet is unresponsive. I have tried rebooting, but the issue returns. How can I diagnose and fix this? Any guidance would be greatly appreciated. Thank you.

Henry Collins · Answer

That combination of very high outbound traffic, maxed CPU, and an unresponsive SSH/Web Console makes me think of a compromised server or a runaway process rather than an Odoo issue. I’d power the droplet off, take a snapshot if possible, then boot it in recovery mode or attach the disk to another VM so you can inspect logs (auth.log, syslog, journalctl) and running services. If you confirm it’s compromised, it’s usually safer to rebuild from a clean image and restore only trusted Odoo data instead of trying to clean the existing server.

KFSys · Answer

Heya, I want to be straight with you: this doesn’t read like an Odoo performance problem — it reads like a compromised droplet . The combination of constant ~63 Mb/s outbound, CPU pinned at ~96%+, and thousands of GiB of overage on your bill is the textbook signature of a crypto-miner and/or an outbound botnet (DDoS or spam relay) running on your server. SSH and the web console timing out is just a side effect — the CPU is saturated, so there’s nothing left to service your login. That third-party auto_backup module throwing import errors is a very plausible entry point. If it were mine, I’d power the droplet off from the control panel first just to stop the bandwidth bleed and the bill climbing, take a snapshot, then boot into the Recovery Console to get in while the process isn’t eating the CPU. From there top, crontab -l, and ss -tunp usually make the culprit obvious. Once a box is compromised like this it’s hard to fully trust again, so the safest route is normally to spin up a fresh droplet, restore your Odoo DB from a backup taken before the overage started (looks like around May), and only reinstall modules you trust. Then lock it down with a Cloud Firewall + SSH keys only. For the overage charges themselves, that’s account-specific — open a ticket with DigitalOcean Support, explain it was compromised and what you’ve done to fix it. They’ll sometimes review overage from a compromise, but only they can make that call. https://www.digitalocean.com/support/ Hope that helps!- KFSys.

alexdo · Answer

HEya, @384d3f11289345379905a243f7b817 What jumps out at me is the constant 63 Mb/s of outbound traffic. That doesn’t sound like normal Odoo behavior, especially if your monthly transfer suddenly jumped from around $18 to over $50. My first thought would be that either a process has gone rogue or the server has been compromised, although it’s hard to say for certain without seeing what’s actually running. If you can get access after a reboot, even for a minute or two, I’d immediately check top or htop to see what’s eating the CPU, then run ps aux --sort=-%cpu | head and ss -tunap to find out which process owns the network connections. Those commands usually point you in the right direction pretty quickly. I also wouldn’t focus only on Odoo. Since SSH and even the Web Console eventually become inaccessible, it feels like the entire system is getting overwhelmed rather than just the application. If you can’t keep the droplet alive long enough to investigate, it may be worth attaching the disk to a temporary recovery droplet so you can inspect the logs safely. One question: is the 63 Mb/s outbound traffic there even when nobody is using Odoo? If it is, I’d be much more suspicious of a background process or a compromise than of Odoo itself.

Become a contributor for community

DigitalOcean Documentation

Resources for startups and AI-native businesses

The developer cloud

Start building today

Report this

Odoo 16 Server – High Outbound Bandwidth, CPU 98%, Web Console & SSH Unresponsive

Related questions

Prevent do-agent/dotty-agent from installing

GitHub Student Pack DigitalOcean benefit

GitHub Student Pack DigitalOcean benefit

Can only see "Looks like something went wrong..."

Request to unblock outbound SMTP ports 465 and 587

How do I disable AI?

Not able to see access control panel

Response not successful: Received status code 428

how do i connect my account to zoiper

How to request or enable SMTP access on a DigitalOcean Ubuntu droplet for transactional emails

I can't access my account dashboard.

Sorry, we had a problem turning your Droplet on. Please try again.

Report this

Odoo 16 Server – High Outbound Bandwidth, CPU 98%, Web Console & SSH Unresponsive

Related questions

Prevent do-agent/dotty-agent from installing

GitHub Student Pack DigitalOcean benefit

GitHub Student Pack DigitalOcean benefit

Can only see "Looks like something went wrong..."

Request to unblock outbound SMTP ports 465 and 587

How do I disable AI?

Not able to see access control panel

Response not successful: Received status code 428

how do i connect my account to zoiper

How to request or enable SMTP access on a DigitalOcean Ubuntu droplet for transactional emails

I can't access my account dashboard.

Sorry, we had a problem turning your Droplet on. Please try again.