apache2 http monitoring on Debian Lenny

Question

I am pretty new to the whole linux web servers so please bare with me.

Is it possible to know if a php file on my server is being accessed by a user?

Is there a command I can use through ssh that will list every IP addresses and which page they're requesting?

My ultimate goal is to run a cron job to exec a specific php file if it's not already being accessed by any user.

Thanks!

Answer 1

You can check the apache access log file. It shows the following fields: date/time, IP address, URL including the parameters, and others.

To view the file;

$ less /var/log/apache/access.log

To search the file:

$ grep keyword /var/log/apache/access.log

Be careful, seeing the PHP file name in the apache log does not guarantee that it is still running while you are executing your script.

EDIT: If you want to see the HTTP connections while they are establishing, you can use tcpdump like this:

$ sudo tcpdump -XX -vv -n -w /tmp/http_trace.pcap port 80

I am not sure 100% about the filter syntax "port 80", but this will capture only HTTP traffic destined for port 80. Also, you can use this command to see the established connections:

$ netstat -an | grep ESTABLISHED 

To watch this command continuously, you can use watch command:

$ watch -n1 netstat -an

-n1 means to run the command every one second.

Answer 2

To do this you will need to make sure that php is running in a mode that is under the user and not as the apache user.

ps aux | grep php 

That should work just fine...

Answer 3

in order to get more details about you apache statistic you can get report from access.log file using Request-log-analyzer ( https://github.com/wvanbergen/request-log-analyzer/wiki )

Report sample: https://github.com/wvanbergen/request-log-analyzer/wiki/Sample-output