Monitor network traffic per client I'm investigating intermittent performance issues on a database running MariaDB 10.4 and I notice extraordinarily high network traffic.  Bytes_sent is about 20TB after running for 58 hours (379GB per hour).  There are only 8 clients, and typical traffic is expected to be about 2GB per hour.  Is there some way to monitor bytes_sent per client to help track down the issue?
MariaDB has a user statistics plugin that provides a breakdown per user.
It can be enabled dynamicly:
SET GLOBAL userstat=1;

And examined:
SELECT * FROM INFORMATION_SCHEMA.USER_STATISTICS\G

It seems like such a increase is potentially a brute force attempt or some abnormal use. I'd look at the SHOW PROCESSLIST and see if the queries being run are extraordinary and/or you'll probably see there a client with more connections than expected.