By craigstowers
I’m relatively new to web servers and linux. After looking at the monitoring graphs, my VPS has had very little disk activity (nor should it as there is nothing worth visiting on the webpage). However last night while I was sleeping I notice a very regular spike in disk activity - (every 15 minutes). Is this something to be worried about? Could hackers be up to no good? Or does it simply mean DenyHosts is doing it’s job properly and writing to the banned IP list?
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
It could be anything. It’s could be logrotate cleaning up and compressing old logs, iptables writing logs, denyhosts writing logs, and a ton of other stuff. If it’s a small spike, there’s probably nothing to worry about.
Oh I checked the auth.log and found all kinds of strange activity. Someone creating user accounts and settings etc. I just wish I knew how it was hacked. I disabled root ssh, changed ssh port, installed denyHost. guess I got a lot to learn ahead of me
<blockquote>Someone creating user accounts and settings etc</blockquote>Can you pastebin the lines from auth.log that show that? It could be bots trying to brute force into your droplet, denyhosts should help mitigate that.
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and SMBs
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Get started for free
Sign up and get $200 in credit for your first 60 days with DigitalOcean.*
*This promotional offer applies to new accounts only.