Network usage per process & question about network usage


Is it possible to use metricbeat (or another beat) to monitor traffic per service/application on a host to quickly discover any strange data & which application is generating it?

Also, how does metricbeat record interface data usage? I'm seeing records on the same interface slowly increasing (29.1mb, 29.4mb etc) but in between I also see records containing 1GB. I know for a fact the host is generating almost 0 traffic.

The graphs appear to be correct but if for example I sum up all the traffic in a normal metric visualization I get some ridiculously high number.

Packetbeat is able to monitor network traffic:
You can find more info on how to configure it:

Metricbeat read interface data usage from /proc/net/dev on Linux systems. Which interface are you monitoring?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.