Determine data usage

Question

I need to determine exactly how much data is moving during a perticular process.

If I want find out how much data moved from Server A through the UTM to Server B in a certain time frame, how do I get that data?

This thread was automatically locked due to age.

DouglasFoster · Answer

It is possible. 
 Checking bandwidth: 
 The important issue with UTM is that each enabled proxy is mutually exclusive of the others, with firewall rules being the one used when nothing else activates. For printer traffic, I assume it is going through the firewall rules, unless it is using an IPP connection, in which case it might go through the web proxy. (I am no expert on IPP). 
 First, you need to create an "Allow" firewall rule that matches your traffic, and enable logging in that rule. This assumes that your default allow rule has logging disabled; an alternative is to enable logging of all allowed traffic. 
 Then use my code from this post to load the logs into a SQL database. 
 https://community.sophos.com/products/unified-threat-management/f/management-networking-logging-and-reporting/100770/how-to-using-a-sql-database-to-interpret-utm-log-files 
 Once the logs are in a database, just sum across the ItmLength column for traffic that matches your selection criteria. One easy way to do the selection is to select ItmFwRule=value, where the value corresponds to the sequence number assigned to the firewall rule by the GUI. Note that if you add and delete firewall rules, the sequence numbers will change, so Bob Alfson suggests creating some do-nothing rules to act as placeholders, so that you can insert new rules without changing the numbers. 
 Fragmentation: 
 Assuming that the link between buildings is a VPN tunnel, you have to worry about MTU. The inside packet needs to be smaller than the outside packet, so that the encryption overhead can be added to the packet without creating a packet split. I think the magic number is about 1380 for an external interface that behaves like Ethernet with 1512 MTU. If the MTU is changed at the UTM, your internal traffic will not be affected at all, and your Internet-bound traffic will adapt and use a few extra packets. Users will not notice the difference. But your VPN user can see a lot of improvement if the packet count is cut in half.