Something strange with lightsail instance at 2AM
Has anyone else noticed frequent spikes in traffic with their lightsail instance at regular intervals (daily at 2am)? Is this due to auto updates or is something more nefarious going on? My instance keeps crashing/restarting when this happens. I have an EC2 loadbalancer pointing to this lightsail instance with the corresponding ipv4 firewall.
The instance is hosting a hashicorp vault for transit and secrets engine for other microservices. I checked my other services to make sure there are no cron jobs scheduled at 2am and daily snapshot is at 10pm. Is this evidence of a DDOS attack? What's the best way to find out what's happening during this time?
- 新しい順
- 投票が多い順
- コメントが多い順
Hello.
Can you confirm that abnormal access is occurring during that time in the application logs, etc.?
If DDoS is occurring, look at the network-related metrics of the Lightsail instance and you will see an increase in the numbers.
If an abnormality is found from this number and the application log, I think it can be determined that it is a DDoS.
https://docs.aws.amazon.com/lightsail/latest/userguide/amazon-lightsail-resource-health-metrics.html#available-metrics
Incoming network traffic (NetworkIn) — The number of bytes received on all network interfaces by the instance. This metric identifies the volume of incoming network traffic to the instance. The number reported is the number of bytes received during the period. Because this metric is reported in 5-minute intervals, divide the reported number by 300 to find Bytes/second.
Outgoing network traffic (NetworkOut) — The number of bytes sent out on all network interfaces by the instance. This metric identifies the volume of outgoing network traffic from the instance. The number reported is the number of bytes sent during the period. Because this metric is reported in 5-minute intervals, divide the reported number by 300 to find Bytes/second.
関連するコンテンツ
質問済み 9年前
