Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I noticed in my Munin graphs for Apache that there was a large spike in traffic yesterday. However, I have been unable to correlate this with anything on the site.


Google Analytics does not show any traffic increase. It essentially only counts human users (those with Javascript enabled) so I'm guessing the spike could be from a scraper.

But I checked the Apache logs and the number of requests does not correlate with the Munin output. I ran a few commands to count the number of requests each hour from the logs and it just shows the regular increase, nothing like the spike shown in Munin.

I checked both other_vhosts_access.log (which counts the actual websites set up) and access.log (counts hits to the IP address, which seems to be mostly dummy connections or security polls).

Where might these extra hits be coming from?

share|improve this question
up vote 1 down vote accepted

Not sure if this is true, but possibly Apache only logs requests if they are valid http requests?

So if I were to create a whole bunch socket connections to your apache server it would cause new apache processes to spawn, which is what you are looking at in your graph, but if I never send a valid http request and disconnect - or apache times out the connection and it disconnects, possibly that is why you see nothing in the logs.

I wonder if it logs those to an error log.

share|improve this answer
Hmm, so does that imply some kind of DoS attack? – DisgruntledGoat Jul 18 '11 at 18:27
Seems like that could be the case. – Scott Szretter Jul 18 '11 at 23:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.