Bytes received and bytes sent are noticeably inaccurate

inventor96

We have OpenVPN server installed on a CentOS 7.9 virtual machine. The server's config is set to log the status with a status-version of 3. That file is then read into our centralized logging server. I'm trying to make a dashboard of data usage in the logging server using the lines from the OpenVPN status file, but the numbers from OpenVPN seem to be pretty inaccurate. My understanding is that the "Bytes Received" and the "Bytes Sent" columns are the number of bytes total for the session. In order to get data usage over time for a given user in a given direction (sent/received), I can subtract the value in the previous output of the status file from that same value in the current output. (e.g. The output says 500 bytes received for user A at 12:01, and 600 bytes received for user A at 12:02, so I can do 600 - 500 = 100 bytes received between 12:01 and 12:02)

The problem I'm running into is that I'm getting back crazy high numbers for data usage. For example, for the past 16 hours, I'm getting a total of 11.2 TB. For comparison, I've had iftop running on that server for the same about of time, and it's reporting a total of 66.4 GB. During this window, there was a max of 24 users on the VPN, with an average around 12 - 15, so the 66.4 GB seems much more reasonable.

I've done the math manually just to make sure the dashboard on the logging server is operating as expected, and it is. So it's just that OpenVPN is really reporting those numbers. So either it has some wildly inaccurate ways of counting network traffic, or I'm not understanding what those fields in the status file are supposed to mean.

Could someone enlighten me on this?

TinCanTech

OpenVPN sent/received data is correct. At least, it is for me ..

inventor96

Is there a chance my math logic is incorrect?

Or maybe it's a version thing? What version are you using?

TinCanTech

inventor96 wrote Is there a chance my math logic is incorrect?

Probably.

inventor96 wrote Or maybe it's a version thing? What version are you using?

2.4, 2.5, 2.6 etc .. they all work the same.

inventor96 wrote I'm getting a total of 11.2 TB

ELEVEN POINT TWO TERABYTES of data .. can your infra-structure even handle that ?