I'm running a micro instance on Amazon Cloud Services, and a recent spike made our web server unresponsive, I'm trying to do a little research to determine if this was a DOS attack, or which process was hogging down the server.
I checked the Apache Access Log and all I see are Internal Dummy Connections from local IP
127.0.0.1 - - [18/Feb/2013:18:51:20 +0000] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"
that's an example, and I noticed when I tail the log file while refreshing the site, it adds a new record.
Why can't I see the remote IP that's connecting to the IP, and how can I better track down this issue?