Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running a CentOS 5 with plesk 10 and problems with slow website loading, now my provider tells me i'm excedding my bandwith.

I've been monitoring the bandwith with iftop and it showed me some connections consuming lots of bandwith.

Now how do i go on about checking what those requests were about? i've got the ip and they are HTTP request probably, should i just start wireshark before and then analize the ip's i found?

Or is there an easyer way?

Thank you.

share|improve this question
up vote 1 down vote accepted

Have a look through the access logs for each of your sites. If you know the IPs, grep through them and have a look for requests for large files.

By default, Apache uses the 'combined' log format (see - you can check if this is the case by looking at the configuration for your Apache install (and any virtual hosts) - the relevant line is this:-

CustomLog /path/to/access.log combined

If you are, each log entry in the access log has the amount of bytes transferred as the 7th field (excluding any HTTP headers), so in this example:- - - [05/Feb/2012:23:09:25 +0000] "GET /somefile HTTP/1.1" 200 128 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.77 Safari/535.7"

...the file /somefile was served up and the request transferred 128 bytes.

share|improve this answer
hmmm..the problem there is that the server has 150 websites at this server each with their access logs, Plesk stuff =| – GriffinHeart Feb 9 '12 at 21:58
If the directory format is the same for each site, you could do something like grep "^<ip-address>" /path/to/sites/*/logs/access.log or similar. – Andy Smith Feb 9 '12 at 21:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.