[tor-relays] Weird spike in written bytes per second

[Roger Dingledine]

On Mon, May 23, 2022 at 12:18:41PM +0200, Marco Predicatori wrote:
> the graph shows a marked difference between written bytes per second and
> read bytes per second om 2022-05-19 and 2022-05-20. In any other day the
> bytes are roughly the same. What might my node have "written" on those two
> days?
> 
> https://metrics.torproject.org/rs.html#details/A4E74410D83705EEFF24BC265DE2B2FF39BDA56E

A common answer here is that your relay is serving more directory
information than usual -- directory answers count as "written" bytes
but they don't have corresponding "read" bytes.

Indeed, that seems to be the case for you this time. Taking a look at
your extrainfo descriptor from that time period (attached to this mail for
posterity, but also you can find it on https://collector.torproject.org/
or via a query on your DirPort if you had one open):

published 2022-05-20 23:28:07
write-history 2022-05-20 13:47:42 (86400 s) 52641878016,29257544704,29532297216,34634562560,121750598656
read-history 2022-05-20 13:47:42 (86400 s) 52190178304,28933199872,29611094016,31570991104,33742606336
dirreq-write-history 2022-05-20 13:47:42 (86400 s) 258335744,326073344,385689600,3712866304,87401081856
dirreq-read-history 2022-05-20 13:47:42 (86400 s) 18748416,468201472,756950016,882057216,1235405824

So yes, it is just that one day, where you pushed 121GBytes but only
received 33GBytes. And the dirreq lines explain why -- they show on that
last day that your relay served 87 gigs of directory info, while only
fetching about 1 gig of it.

More details on those extrainfo lines here:
https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt#n1191

Now, this leads you to a new question, which is "ok but why was I
serving so much directory information on that day?" -- and I don't know
the answer. We've had a series of mysteries over the past years where
a whole lot of Tor clients appear and each bootstrap. Your mystery is a
pretty small one in scale compared to these others. I guess the summary is
"some users, for some definition of users, did that."

--Roger

-------------- next part --------------
extra-info torototela A4E74410D83705EEFF24BC265DE2B2FF39BDA56E
identity-ed25519
-----BEGIN ED25519 CERT-----
AQQABwNkAYD1Yg2VlRjBGK4bFOTGfqriRvkja8Rx1w/uqTgMlUoEAQAgBACuWp4X
h6E17IAsn/CXO8M+VYMXov1JR1H1/qJPAqUeZK5INA19s4T1xqQETznM2jMR8o1E
oEoe+B9Shs9xfVUwKohcR2BHwxeW+K1CJj9jCCOn+Na71OQAdN5Z3Z0YMA4=
-----END ED25519 CERT-----
published 2022-05-20 23:28:07
write-history 2022-05-20 13:47:42 (86400 s) 52641878016,29257544704,29532297216,34634562560,121750598656
read-history 2022-05-20 13:47:42 (86400 s) 52190178304,28933199872,29611094016,31570991104,33742606336
dirreq-write-history 2022-05-20 13:47:42 (86400 s) 258335744,326073344,385689600,3712866304,87401081856
dirreq-read-history 2022-05-20 13:47:42 (86400 s) 18748416,468201472,756950016,882057216,1235405824
geoip-db-digest C4F1B5ECF1B07BBECBE06B93926E4D1E62882782
geoip6-db-digest 0E43B5C62033BFE47F32742D8C9F5B5F83180AA4
router-sig-ed25519 rVmmvDdFx01brpCeJJAUPnv9XPriigWEagJTaDmYR5YvvblbOs5wGsHQ/UdRC3RxbvTO1yX9vLIsGNChshC0CQ
router-signature
-----BEGIN SIGNATURE-----
yvnCkMR6MoNrorOhteUvtXcb4rg1yvbY+SY246SV3CE3Cj5Fm+mtUhaaQqmnubA2
hl3BkmBbIsT1HFGob/7wXa6R+U9VarxPsCw5Jy02EUZ1A+kSFE3sO7Wvcc3GfOam
cc7CUcs1m17i6FZWEsklCzqLkf46jx2oyLP02tasRkU=
-----END SIGNATURE-----
extra-info AmorousLibrarian D1DF0AE44E69E0614A77305B3A12D1A1C7715C0C