On 17 July 2018 at 15:48, David C. Rankin <drankinatty@xxxxxxxxxxxxxxxxxx> wrote: > It's like there is something between: > > 09:20:24 phoinix systemd[1]: Started Session c18 of user david. > and > 09:20:28 phoinix sshd[2654]: Received disconnect from 66.76.46.195 port > 59956:11: disconnected by user > > that isn't data transfer and isn't rsyc checking if files need updating. > > Also interestingly, the 5 boxes on my lan that are in the backup list do > not > show this type of delay. For example same connection and same box, but on > lang > and not internet. > Personally, I'd be leaning *heavily* into checking that the rsync & data transfer time really hasn't increased. I think it's extremely unlikely that any kind of deliberate delay has been added. It wouldn't be a particularly smart solution to the DDOS problem. Have you run the backup script manually on the remote machine, to check that it still completes in under a second? You could also do some tests such as "ssh remotehost echo hello" to test connection + shell spawn time. Paul
