Thank you very much for all the precious advice. I am running tor on linux.

I second the suggestion of applying 'iptables' to collecting traffic statistics. Lot of ways to go about it but here's something similar to the approach I'm using. By having separate entries for established and new connections on the input side, one can see both how much traffic is arriving and how many connection requests are arriving. Of if your node is attacked, the second new-connection catcher will show huge volumes of DOS traffic.

Also note the separate counters for ssh and OR port traffic, so you can distinguish maintenance and utilization activity.

Feel free to change all the port assignments as suits you, even the ssh one. The example uses defaults for illustration. Is recommended that the OR port be assigned randomly in order to make discovery via 'zmap' more difficult.

22 ssh 9001 OR 443 obfs3 80 fte 587 scramblesuit 993 obfs4

The 'iptables' file loses the .txt extension and CR characters (addded for easier MUA clicking) and generally goes in /etc/sysconfig/iptables.

Also attaching an example statistics display command and output, and a batch job for collecting the information automatically every day.