Data transfer | high bandwidth consumption

[smitjain-zabbix]

Guyz,

I am using Zabbix 2.4 for over a year now and in the month of October I had faced this weird problem for High Bandwidth Consumption.

The Zabbix server is running over AWS EC2 Instance. The current setup monitors instance in the private subnet and as well in the fewer instance which are public.

Strangely, last month there was a huge data transfer occurred from the Zabbix server around 3 TB . Can you guyz assist me on why this heavy data transfer is getting generated. I have also used "iftop" utililty to view the current on going session but didn't find anything good . Also, the current consumption is around 1-2 MB per minute.


eth0 Link encap:Ethernet HWaddr 0A:FE:62:48:8E:2F
inet6 addr: fe80::8fe:62ff:fe48:8e2f/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:9001 Metric:1
RX packets:1134496296 errors:0 dropped:0 overruns:0 frame:0
TX packets:8467913192 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:83226840430 (77.5 GiB) TX bytes:7107123475059 (6.4 TiB)
Interrupt:155

[nick0909]

Can you run iftop or something similar to see where the traffic is going to? It might not be Zabbix related, just something running on that server (possibly even unintentionally/maliciously).

[smitjain-zabbix]

Well I did ran iftop and bmon as well checked the network counter .it was around 1 - 2 Mbps of data getting transferred from clients and there was no entry between that shows if a traffic is coming from any unknown ip.
Can you guyZ check with your counter on the zabbix and share the results .

[nick0909]

Are you using active or passive agents? If you disable the agent and monitoring in Zabbix (depending on which you are using, or just do both), does the traffic stop?

If it is really traffic going to and from Zabbix agent to server, are you monitoring a lot of items with a very high update time?

For an example, my Zabbix server (575 hosts, 44300 items, 215nvps) averages 200k/s in and 125k/s out.