real-time server connections monitor

Question

Is there any way to see in real-time the connections to my server and through which domains ?

Without having to inspect the access.log file, I would like to run a monitor in the shell instead.

Ubuntu 10 Webserver: lighttpd

thanks

Sample line from access.log

::ffff:000.00.00.000 www.domain.com - [10/Nov/2010:12:42:49 +0100] "GET / HTTP/1.1" 200 295 "-" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10"

Answer 1

There is a package called iptraf which will show you the connections to your Server.

You can install it by issueing sudo apt-get install iptraf

Access.log Method

You can also use the following command to extract the information from your access.log

tail -f access.log | awk '{print $1 "\t"  $2}'

In my instance this lists the remote IP and HTTP 1.1 Hostname provided by the UA.

Explanation of the command

So let's take a brief look at the command I have shown above:

Actually these are two commands named tail and awk. tail will normally output the last 10 lines of a file but with the -f parameter we ask it to keep looking at the file and print new lines as they are written to the file.

The Pipe (|) is a well known character as it uses the output of a program (i.e. tail) as another programs input (i.e. awk).

Finally the second command awk '{print $1 "\t" $2}' takes the input from tail and limits the output to the columns we need. ( In my example these were the first to columns so I used $1 and $2. If your access.log uses another column order you might want to change the numbers accordingly.

This will generate a real-time list similiar to this:

92.17.166.190--pacey.me
92.17.166.191--pacey.me
92.17.166.192--anotherdomain.com
92.17.166.193--anotherdomain.com

Regarding your problems

I tried to reproduce the error you're getting with the following command.

echo ::ffff:000.00.00.000 www.domain.com - [10/Nov/2010:12:42:49 +0100] "GET / HTTP/1.1" 200 295 "-" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10" |  awk '{print $1 "\t"  $2}'

But even than it worked for me:

::ffff:000.00.00.000    www.domain.com

Answer 2

try topvhost

http://freshmeat.net/projects/topvhost

Answer 3

Since the log format is pretty much the same than with Apache, apachetop might work for you.

It's available in Ubuntu package repositories, so sudo apt-get install apachetop should install it in no time.

Usage: apachetop -f /path/to/your/access.log