Nathan Lyle

Registered
Jul 9, 2018
3
0
1
Toledo, Ohio
cPanel Access Level
Reseller Owner
Hello! Is there some way of getting more detail in the cpanel Bandwidth tool to see exactly what the HTTP traffic breaks down into? I'm having trouble where small WordPress sites on my server are exceeding their limit, and I'm unable to track down why. (I've optimized them six ways from Sunday without making a difference.) They don't have large files, there doesn't appear to be high bot issues, etc., and there's a discrepancy between Awstats and the Bandwidth tools. My hardware provider says I should use the Bandwidth tool (as opposed to Awstats) and I'm assuming that's what's used by WHM to limit accounts? I see that it reports much higher numbers there than in Awstats. I've been trying to find answers online and have been going in circles. Any help would be very much appreciated. :)
 

cPanelLauren

Forums Analyst II
Staff member
Nov 14, 2017
8,012
648
263
Houston
cPanel Access Level
DataCenter Provider
Hi @Nathan Lyle

While you can click on the graph in the Bandwidth page to look further into the usage if you need information on the actual traffic that was hitting the sites you can check the domlogs. The graph should be able to pinpoint down to a time frame during the day, then you can check the raw access logs at cPanel>>Metrics>>Raw Access

Thanks!
 

Nathan Lyle

Registered
Jul 9, 2018
3
0
1
Toledo, Ohio
cPanel Access Level
Reseller Owner
The raw access just shows an address and date... is there something that shows the actual measurement of bandwidth used? I have a number of sites that show much different numbers in Awstats, and are smaller sites that shouldn't be using what the bandwidth tool is saying they're using. I've yet to find a good way of tracking down the actual issue.
 

Nathan Lyle

Registered
Jul 9, 2018
3
0
1
Toledo, Ohio
cPanel Access Level
Reseller Owner
Sorry, but it doesn't help - I've run across that page before. My problem is that the tool that's showing the most use and is used to measure when a plan exceeds it's set limits, doesn't really show how and why that happens. The closest I can get is a list of URLs and dates, but what I need to find out is whether or not there's a "bad actor" from a particular IP address or a particular file or set of files that's getting hammered, or something along those lines. Because the statistics I see in generic don't make sense based on the website in question - it's too small and has too few actual visits. Ideally the bandwidth tool would show more than just percentage by protocol, but would show a breakdown similar to what Awstats shows, to allow for tracking down the aggressive bandwidth requests.
 

cPanelLauren

Forums Analyst II
Staff member
Nov 14, 2017
8,012
648
263
Houston
cPanel Access Level
DataCenter Provider
The raw access logs won't give you that data but awastats gets its data for that from the domain.tld-bytes_log.

The bandwidth tool uses that as well as mail and FTP related logs to populate the bandwidth for HTTP, FTP, IMAP POP3 and SMTP

Any of the metrics tools will give you the most frequently visiting IP's and the amount of bandwidth they're consuming.

The bytes per request is noted in the RAW access log as well, for example:

Code:
54.36.X.X - - [18/Jun/2019:09:22:45 -0500] "GET /robots.txt HTTP/1.1" 301 248 "-" "Mozilla/5.0 (compatible; AhrefsBot/6.1; +http://ahrefs.com/robot/)"
IP AddressDate/TimeRequest Type/URLHTTP Response CodeBytesReferring URLUser-Agent
54.36.X.X[18/Jun/2019:09:22:45 -0500]"GET /robots.txt HTTP/1.1"301248"-" "Mozilla/5.0 (compatible; AhrefsBot/6.1; +AhrefsBot. Learn About the Ahrefs' Web Crawler)"


This is broken down in Visitors (within metrics) as well. You should be able to correlate a high number of bytes to the usage - screenshots of the discrepancy may help me give you some answers as well.