Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am new to server administration and have just setup a new quad core instance which hosts around 15 websites.

Over the past couple of days my server load has been averaging at around 15.00. I believe it is because of one (or maybe more) websites are getting spammed by spambots.

Typing 'top' at the command line shows many processes from user 'www-data' which indicates lots of web traffic. Is there an easy way identify which one of my sites is taking a hammering?

Reading the apache error logs is a very difficult tasks as most of the websites receive daily traffic of 10,000 + unique users.

Any help would be appreciated!

share|improve this question

4 Answers 4

Every vhost (domain) should write his own access.log

Then just compare the filesizes from the logfiles. For a more detailed statistic you should use a logfile analyzer like awstats ( http://awstats.sourceforge.net/ )

share|improve this answer
    
Theoretically, the most visited site may be not generating huge traffic. However, for example, in the nginx access logs there is a body_bytes_sent value. One may count it for every single virtual host and then compare the sums. –  slimsuperhero Jun 26 '13 at 14:09

You can enable the server-status module on apache. It's very good for seeing what's going on real time with your server.

(Make sure you restrict the access to the server-status module via .htaccess, don't make it public!)

share|improve this answer

Install and use the software command line utility called iftop or use can also use the tool wireshark for better analysis.

share|improve this answer
    
I installed iftop and found it quite useful to identify which hosts were sending my server requests. However, apachetop was a better tool to see which files were being requested on individual vhosts. It also tells me which ip address's are making the requests –  Bob Flemming Jul 1 '13 at 15:39
up vote 0 down vote accepted

I installed iftop and found it quite useful to identify which hosts were sending my server requests. However, apachetop was a better tool to see which files were being requested on individual vhosts. It also tells me which ip address's are making the requests

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.