On Mon, May 23, 2022 at 12:18:41PM +0200, Marco Predicatori wrote:
the graph shows a marked difference between written bytes per second and read bytes per second om 2022-05-19 and 2022-05-20. In any other day the bytes are roughly the same. What might my node have "written" on those two days?
https://metrics.torproject.org/rs.html#details/A4E74410D83705EEFF24BC265DE2B...
A common answer here is that your relay is serving more directory information than usual -- directory answers count as "written" bytes but they don't have corresponding "read" bytes.
Indeed, that seems to be the case for you this time. Taking a look at your extrainfo descriptor from that time period (attached to this mail for posterity, but also you can find it on https://collector.torproject.org/ or via a query on your DirPort if you had one open):
published 2022-05-20 23:28:07 write-history 2022-05-20 13:47:42 (86400 s) 52641878016,29257544704,29532297216,34634562560,121750598656 read-history 2022-05-20 13:47:42 (86400 s) 52190178304,28933199872,29611094016,31570991104,33742606336 dirreq-write-history 2022-05-20 13:47:42 (86400 s) 258335744,326073344,385689600,3712866304,87401081856 dirreq-read-history 2022-05-20 13:47:42 (86400 s) 18748416,468201472,756950016,882057216,1235405824
So yes, it is just that one day, where you pushed 121GBytes but only received 33GBytes. And the dirreq lines explain why -- they show on that last day that your relay served 87 gigs of directory info, while only fetching about 1 gig of it.
More details on those extrainfo lines here: https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt#n1191
Now, this leads you to a new question, which is "ok but why was I serving so much directory information on that day?" -- and I don't know the answer. We've had a series of mysteries over the past years where a whole lot of Tor clients appear and each bootstrap. Your mystery is a pretty small one in scale compared to these others. I guess the summary is "some users, for some definition of users, did that."
--Roger