One of our servers ended up using about 20 GB of data yesterday because it was repeatedly requesting the packages.bz2 file from a mirror.
The requests began about 22:00 on Sunday night, and stopped about 21:00 on the Monday.
There is nothing in the apt history, unattended-upgrades, or the system log to indicate why.
All I can see is a bunch of blocked traffic in the UFW log from the mirror IP address - there are no rules to block this IP in the UFW setup, communication to the mirror is successful outside this period of unusual activity, so it looks like flood protection (though I've gone through the UFW configuration and couldn't find this explicitly set).
/var/log/apt/term.log
and /var/log/apt/term.log
have no entries after 6:45 last Friday (2 whole days before the event started).
/var/log/aptitude
is empty since its creation over a year ago.
auth.log
shows normal cron activity for an Ubuntu server - and not a lot else besides my logins and use of sudo
when trying to diagnose the problems on there.
There is nothing in cron.d calling apt or aptitude - and cron.daily has the same collection of scripts as other servers that are not misbehaving.
I've spoken with the sysadmin for the mirror - he was very helpful. This is how I found out that my server was requesting the packages.bz2 file repeatedly. He says that each request was fulfilled and closed correctly.
So - what could have happened to start this process? Why would it go on for so long, and why did it just stop?
And one week later, it started again - still nothing in the logs to indicate why.
/var/log/apt/term.log
/var/log/aptitude
iftop
,netstat
,atop
,tcpdump
to see more about it. As your question currently stands, this is a needle in a haystack. Remember we can't see your screen and we don't have access to your machine, so we rely on the information in your question. I suggest to get familiar with basic troubleshooting with the tools I mentioned. This site isn't really made for trial&error finding the needle in a haystack, I'm afraid.apt-get update
. Maybe theauth.log
and the cron scripts may be more relevant.