Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Every morning (for about 2 weeks now), around 6:30 am, I get a large IO and incoming-traffic spike on my webserver. It didn't happen until a few days after I released my site. As I'm still a bit of a novice when it comes to server management, I was wondering how I would find out what causes it? It seems like a DoS attack but it seems odd that it happens at the same time every single day.

I'm using Ubuntu 12.04 Server, PHP, Apache2.

share|improve this question
If someone can upvote, I will add images. – TSL Jun 18 '12 at 19:17

If the spike at exactly same time I'd examine cron jobs (jobs run at specific time by server) as well as "pseudo cron jobs" - same as above, just implemented in software running the site and fired when handling user request around defined time.

share|improve this answer
It started about a week after the site was launched so I doubt it's a cron issue - but I will double check. – TSL Jun 18 '12 at 20:14

Check your Apache access log. Look at the User Agent, it's probably a spider (e.g. Googlebot) indexing your site.

share|improve this answer
Do you have any suggestions for filtering this? It's a horrifically long file. – TSL Jun 18 '12 at 20:14
I checked manually and there really aren't that many queries. – TSL Jun 18 '12 at 20:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.