One of my clients recently went way over her bw limit and was suspended. She did not believe me and told me to investigate further. Well, what I do know, based on the cpanel generated stats is that there was 6 gigs of HTTP traffic between 10 and 12.
Lo and behold, there is a load spike at that same time according to hotsanic. So, I believe it was some kind of web attack. However, Awstats shows only 4 megs of traffic. So the customer does not believe me or the cpanel bw stats. Alas, I cannot check the domlogs, because I have them set to delete after stats run.
So, my question is, does this type of traffic not appear in AWStats, or was it a fluke in the cpanel bw reader (which just happened to correspond with a spike in the server load)?
Lo and behold, there is a load spike at that same time according to hotsanic. So, I believe it was some kind of web attack. However, Awstats shows only 4 megs of traffic. So the customer does not believe me or the cpanel bw stats. Alas, I cannot check the domlogs, because I have them set to delete after stats run.
So, my question is, does this type of traffic not appear in AWStats, or was it a fluke in the cpanel bw reader (which just happened to correspond with a spike in the server load)?