[squid-users] How to catch a big spender ?

[Heiler Bemerguy]

Thank you all for the replies but we actually need to get information 
about a transfer (generally UPLOADS) done in the past hours or days .. 
they're not active anymore.

Because we have some bandwidth usage graphs and sometimes we see a peak 
on upload bandwidth and my manager asks "who did that ???"......

We already have "squid analyzer" running but it doesn't seem to be 
useful for uploads or to get something using TIME as reference ... like 
"who used that much bandwidth at 3 AM ?"


Best Regards,

Heiler Bemerguy - CINBESA
Analista de Redes, Wi-Fi,
Virtualização e Serviços Internet
(55) 91 98151-4894

Em 26/03/2019 05:01, Amos Jeffries escreveu:
> On 26/03/19 9:10 am, Nicolas Kovacs wrote:
>> Le 25/03/2019 à 20:15, Heiler Bemerguy a écrit :
>>> We've seen some high upload bandwidth usage on our router graphs and
>>> we'd like to know what was happening at that time...
>>>
>>> Any tools or tricks to know that? I bet most of you have had this
>>> "curiosity" already too lol
>> Here's what I use to catch bandwidth hogs in our local network:
>>
>> https://www.microlinux.fr/squidanalyzer-centos-7/
>>
> Please be aware that tools based on log files only include completed
> transactions. They do not include information about still-active
> transactions, such as CONNECT tunnels for HTTPS traffic.
>
>
> To identify events where an ongoing transaction or tunnel is using
> excess bandwidth one needs to use the cache manager or SNMP interfaces
> of Squid. The earlier mentioned sqstat and similar tools do that.
>
> Amos
> _______________________________________________
> squid-users mailing list
> squid-users at lists.squid-cache.org
> http://lists.squid-cache.org/listinfo/squid-users