I recently installed vnstat on my DigitalOcean Droplet (Ubuntu). After about a month I decided to check out the log and to my surprise saw "huge" amounts of bandwidth going in and out of the server. Pretty much 50-100MB a day! Which is a lot for this Droplet as it hosts just a single static page with no images through nginx.
How can I log bandwidth usage per process, so I can find what is causing this? I checked my nginx logs and it has barely any sent bytes, so it has to be something else...
I ran across nethogs and the like, but the problem with those tools is, unlike vnstat, they only gather live-data. Ideally I'd like something that works like vnstat (updating tats every 5 minutes), but also tells me which process/port/etc. is causing it.