Network usage per process & question about network usage

Elastic Stack Beats
1

Hi,

Is it possible to use metricbeat (or another beat) to monitor traffic per service/application on a host to quickly discover any strange data & which application is generating it?

Also, how does metricbeat record interface data usage? I'm seeing records on the same interface slowly increasing (29.1mb, 29.4mb etc) but in between I also see records containing 1GB. I know for a fact the host is generating almost 0 traffic.

The graphs appear to be correct but if for example I sum up all the traffic in a normal metric visualization I get some ridiculously high number.

2

Packetbeat is able to monitor network traffic: https://www.elastic.co/products/beats/packetbeat
You can find more info on how to configure it: https://www.elastic.co/guide/en/beats/packetbeat/current/configuration-processes.html

Metricbeat read interface data usage from /proc/net/dev on Linux systems. Which interface are you monitoring?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.