External Address is Top Client for Bandwidth Usage

Any traffic that goes through Web Protection is recorded as downloading by the IP of "External (Address)" - was that your question?

If you're seeing mysterious high bandwidth on the External Interface, try (thanks to kerobra & AlanT):

zgrep 'deferred download status refresh timeout, removing' /var/log/http/2017/*/* |grep -oP 'url="https?://.*?/'|sort -n|uniq -c|sort -n

That will show you FQDNs that need to be in an Exception for antivirus or skipped altogether.

Cheers - Bob

EDIT 2017-05-05: Modified grep to look only at the FQDN

Although your version is 'universal' usable, the search function in the logs section is also working, especially for non-Linux-natives like me ;-)

The advantage of the line ending in |grep -oP 'url=^https?://.*?/'|sort -n|uniq -c|sort -n is that you don't have to dig through a lot of lines in the WebAdmin search result.  You get a list of the unique URLs/FQDNs that need attention, sorted in order of number of times they caused a problem.

Cheers - Bob

zgrep 'deferred download status refresh timeout, removing' /var/log/http/2017/*/* |grep -oP 'url="https?://.*?/'|sort -n|uniq -c|sort -n

The advantage of the line ending in |grep -oP 'url=^https?://.*?/'|sort -n|uniq -c|sort -n is that you don't have to dig through a lot of lines in the WebAdmin search result.  You get a list of the unique URLs/FQDNs that need attention, sorted in order of number of times they caused a problem.

Cheers - Bob

zgrep 'deferred download status refresh timeout, removing' /var/log/http/2017/*/* |grep -oP 'url="https?://.*?/'|sort -n|uniq -c|sort -n

Okay, understood. But why do you have to sort 2 times? Would there be empty lines in the output after the uniq -c filters all double entries out?

You're right, Kevin, all the second sort does is rearrange the list in order of least- to most-common errors as opposed to alphabetically by FQDN/URL.

Cheers - Bob