Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently installed Varnish to sit in front of Apache on a dedicated server running a single site. It appears to be working well, but the load on Apache is still very high. What doesn't make sense is that the Apache access log shows almost no traffic getting past Varnish. When I tail the apache log I see about 1-3 hits per second come through.

Here is what the load on Apache looks like :

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
apache   13834  8.1  1.0 107716 34164 ?        S    08:24   0:02 /usr/sbin/httpd
apache   13835  8.1  1.0 107716 33856 ?        S    08:24   0:02 /usr/sbin/httpd
apache   11483  7.9  0.9 105916 30788 ?        S    08:23   0:06 /usr/sbin/httpd
apache   12255  7.5  1.0 107476 33312 ?        S    08:24   0:04 /usr/sbin/httpd
apache    9340  7.2  1.1 107732 34916 ?        R    08:23   0:09 /usr/sbin/httpd
apache   12029  6.8  0.9 106908 30416 ?        S    08:24   0:04 /usr/sbin/httpd
apache   11577  6.7  1.0 107192 34180 ?        S    08:24   0:05 /usr/sbin/httpd
apache   11486  6.6  1.0 106176 33112 ?        S    08:23   0:05 /usr/sbin/httpd
apache   11796  6.4  1.0 106936 31916 ?        S    08:24   0:04 /usr/sbin/httpd
apache   13815  6.3  1.0 107988 34464 ?        S    08:24   0:02 /usr/sbin/httpd
apache   18089  6.3  1.3 107444 43212 ?        S    08:11   0:52 /usr/sbin/httpd
apache   11797  5.9  1.0 107716 34580 ?        S    08:24   0:04 /usr/sbin/httpd
apache    7655  5.9  0.0      0     0 ?        Z    08:22   0:09 [httpd] <defunct>
mysql     8033  5.9  6.2 318240 199512 ?       Sl   May14 352:34 /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-file=/va
apache   11488  5.8  0.9 106924 31632 ?        S    08:23   0:04 /usr/sbin/httpd
apache    9375  5.7  1.1 106956 35552 ?        S    08:23   0:07 /usr/sbin/httpd
apache    3551  5.6  1.1 106956 36140 ?        S    08:20   0:14 /usr/sbin/httpd
apache    7657  5.6  1.0 106968 32472 ?        S    08:22   0:09 /usr/sbin/httpd
apache   11433  5.6  1.0 107716 34396 ?        S    08:23   0:04 /usr/sbin/httpd
apache    5505  5.5  1.1 106944 34924 ?        S    08:21   0:12 /usr/sbin/httpd
apache    7172  5.3  1.1 106972 35368 ?        S    08:22   0:09 /usr/sbin/httpd
apache   10088  5.2  0.9 106160 31240 ?        S    08:23   0:04 /usr/sbin/httpd
apache    7656  5.1  1.0 106436 34388 ?        S    08:22   0:08 /usr/sbin/httpd
apache    3468  5.0  1.1 107716 35968 ?        S    08:20   0:13 /usr/sbin/httpd
apache   14242  4.8  1.0 107728 33032 ?        S    08:25   0:00 /usr/sbin/httpd
apache    3578  4.8  1.1 107988 35964 ?        S    08:20   0:12 /usr/sbin/httpd
apache   28192  4.8  1.2 106944 38060 ?        S    08:17   0:23 /usr/sbin/httpd
apache    3277  4.6  1.1 106956 35688 ?        S    08:20   0:13 /usr/sbin/httpd
apache   15434  3.7  0.7 106908 24684 ?        S    08:25   0:00 /usr/sbin/httpd

There is a default apache log and then one other VirtualHost log setup.

I'm concerned that Apache is handling some kind of traffic that is not being logged. Is that possible? And is there anything I can do to capture that traffic?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

I'd recommend mod_status to debug this issue. mod_status is great to provide information about server activity and performance.

share|improve this answer
    
+1 As long as you keep it protected, i agree. –  GruffTech May 18 '10 at 16:15
    
@GruffTech: definitely protected, no doubt about that :) –  Marco Ramos May 18 '10 at 17:08
    
yea. Absolutely scary how many servers you can get by googling 'intitle:”Apache::Status” (inurl:server-status | inurl:status.html | inurl:apache.html)' –  GruffTech May 18 '10 at 18:22
    
Thanks, I've never used mod_status before. –  user22872 May 19 '10 at 15:37
    
@nrambeck: don't forget to keep mod_status protected ;) –  Marco Ramos May 19 '10 at 15:44

You can capture the traffic using tcpdump. For example:

tcpdump port 80 or port 443

You can use tcpdump to capture traffic to a file and open it with Wireshark afterwards:

tcpdump -s 65535 -w <some-file> port 80 or port 443
share|improve this answer
    
This is a great tip as well. Thanks. –  user22872 May 19 '10 at 15:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.