Question

Unknown disk activity on 2 day old server

Posted February 13, 2014 1.4k views
I'm relatively new to web servers and linux. After looking at the monitoring graphs, my VPS has had very little disk activity (nor should it as there is nothing worth visiting on the webpage). However last night while I was sleeping I notice a very regular spike in disk activity - (every 15 minutes). Is this something to be worried about? Could hackers be up to no good? Or does it simply mean DenyHosts is doing it's job properly and writing to the banned IP list?
Add a comment
craig.stowers
By:
craig.stowers

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

×
Submit an Answer
3 answers
kamaln7 February 13, 2014
It could be anything. It's could be logrotate cleaning up and compressing old logs, iptables writing logs, denyhosts writing logs, and a ton of other stuff. If it's a small spike, there's probably nothing to worry about.
Reply Report
craig.stowers February 13, 2014
Oh I checked the auth.log and found all kinds of strange activity. Someone creating user accounts and settings etc. I just wish I knew how it was hacked. I disabled root ssh, changed ssh port, installed denyHost. guess I got a lot to learn ahead of me
Reply Report
kamaln7 February 14, 2014
Someone creating user accounts and settings etc
Can you pastebin the lines from auth.log that show that? It could be bots trying to brute force into your droplet, denyhosts should help mitigate that.
Reply Report

Looking for something else?

Ask a new question Search for more help