Loop hole in Cpanel Traffic reporting?

Hello everyone, I am currently working with my server admin on high transit usages. Last month for example, cPanel reported my only using 600GB's of transfer for example. The MRTG showed that the server ran at an average of 3mbps for the month for example. According to my admin, 3mbps is equal to about 850 - 900GB's of transfer. So question #1 was, where is the other 350 that is not being reported on cPanel going/coming from? Over the last week, we have suspended all users that had very high bandwidth over the last couple of weeks and hoped that would solve the problem. But being that the traffic is not showing up in cPanel I am lead to believe that the extra traffic is not being caused by normal processes used by clients but may be back-door traffic or spamming. Exim showed regular but that is another story.

After suspending those higher end media accounts today we saw another spike on the server. One client was running a backup in cPanel and it shot the server back up on the MRTG. My comment to my admin was, is it possible that 2 or more clients may have been running auto backups throughout the month causing the server to spike over the last month. The reply was no. I then asked if backups were tracked in cPanel as traffic and I got a no as well. So as it stands, I am at a no/no end of the road.

My questions here is,

1. Are the backup downloads clients use displayed or not displayed in cPanel stats?

2. Is there a way to disable clients from downloading backups all together or a way to limit it to once a month?

3. Is it usual for one client to be able to jack the server up to 3mbps's during one backup?

4. Is there a way to track, per client the extra traffic done on cPanel to make them accountable for it?

5. What are you guys all using to track the extra transit of your clients?

6. If you would be so kind to list all the ways you know of that people can send/receive traffic in a server. i.e. what ports they use, and what ways we may be missing the extra stuff.



Any help you guys can offer would be great. As it stands I have 8 poor clients seeing a suspended page because I cant prove that the traffic or high MBPS is from other things than regular traffic.


Please let me know.


Sincerely,

Chris

 

 

 

 

Top