Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running a micro instance on Amazon Cloud Services, and a recent spike made our web server unresponsive, I'm trying to do a little research to determine if this was a DOS attack, or which process was hogging down the server.

I checked the Apache Access Log and all I see are Internal Dummy Connections from local IP - - [18/Feb/2013:18:51:20 +0000] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"

that's an example, and I noticed when I tail the log file while refreshing the site, it adds a new record.

Why can't I see the remote IP that's connecting to the IP, and how can I better track down this issue?

share|improve this question
Do you have any other logs configured? By using the CustomLog directive for instance? – Ladadadada Feb 18 '13 at 23:58
No, I'm going to have to set them up to get the data I'm looking for. – Thomas Depole Feb 20 '13 at 18:08
up vote 0 down vote accepted

Those "dummy" connections are the way Apache tells its child processed that the have to die.

Have a look at:

share|improve this answer
Ok makes sense, is there a way for me to see which ips are connecting to the server, or making Apache requests? – Thomas Depole Feb 18 '13 at 19:53
I don't like using "default" logs. You can define a custom log on your virtual host configuration, like this: CustomLog /var/log/apache2/customlog.log common. – boris quiroz Feb 19 '13 at 11:02
Also, on the link I posted before there's a way to solve the problem. See "The Solution" part. That should fix your problem and you won't be DoS from localhost again – boris quiroz Feb 19 '13 at 11:03
Ok cool, I'm going to have to create a custom log to get the data I want, but I understand whats happening in the default logs, thanks for you help – Thomas Depole Feb 20 '13 at 18:11
not true. Could be from apache doing curl to itself. – sivann Jun 9 '15 at 8:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.