0

I am new to server administration and have just setup a new quad core instance which hosts around 15 websites.

Over the past couple of days my server load has been averaging at around 15.00. I believe it is because of one (or maybe more) websites are getting spammed by spambots.

Typing 'top' at the command line shows many processes from user 'www-data' which indicates lots of web traffic. Is there an easy way identify which one of my sites is taking a hammering?

Reading the apache error logs is a very difficult tasks as most of the websites receive daily traffic of 10,000 + unique users.

Any help would be appreciated!

4 Answers 4

3

Every vhost (domain) should write his own access.log

Then just compare the filesizes from the logfiles. For a more detailed statistic you should use a logfile analyzer like awstats ( http://awstats.sourceforge.net/ )

1
  • Theoretically, the most visited site may be not generating huge traffic. However, for example, in the nginx access logs there is a body_bytes_sent value. One may count it for every single virtual host and then compare the sums.
    – gevial
    Jun 26, 2013 at 14:09
1

You can enable the server-status module on apache. It's very good for seeing what's going on real time with your server.

(Make sure you restrict the access to the server-status module via .htaccess, don't make it public!)

1

Install and use the software command line utility called iftop or use can also use the tool wireshark for better analysis.

1
  • I installed iftop and found it quite useful to identify which hosts were sending my server requests. However, apachetop was a better tool to see which files were being requested on individual vhosts. It also tells me which ip address's are making the requests Jul 1, 2013 at 15:39
0

I installed iftop and found it quite useful to identify which hosts were sending my server requests. However, apachetop was a better tool to see which files were being requested on individual vhosts. It also tells me which ip address's are making the requests

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .