Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a webserver that runs a number of virtualhost websites.

Every once in a while there will be a situation where the server load goes really high, or the network response is very slow on the webserver, and I would like to have a way of viewing the current activity on my varions virtualhosts, to see if a particular domain is perhaps responsible (ie. DOS, etc.)

What tools exist that can show me this information?

(note, I have about 10 IP addresses on the webserver, but all of them are shared between many domains/virtualhosts)

share|improve this question
up vote 5 down vote accepted

mod_status is great for this, if you turn on ExtendedStatus it shows you the list of URLs currently being serviced. Turn ExtendedStatus off when you don't need it, though, as it does cause a (slightly noticeable, in extreme cases) reduction in performance.

share|improve this answer
Yes, that is almost what I want. The problem is that the list is long and not sorted in any useable way. Are there any frontend plugins that would consolidate this info so that, for instance, the most active VirtualHosts are listed at the top with a percentage? – Brent Nov 20 '09 at 17:31
If one vhost is getting the snot hammered out of it, it should be pretty obvious from a quick glance over the URL list. – womble Nov 20 '09 at 17:59
True. And for the specific case I mentioned, this would be a good solution. I guess I was hoping to have something more general purpose as well. – Brent Nov 20 '09 at 18:03

Have you tried Apachetop

(Larger article about it here:

share|improve this answer
This looks useful - but all of our access logs are separated per-domain (a couple hundred), and it looks like this tool wants to parse a single log file. I suppose I could somehow pipe *.access.log through sort to get a single stream, but the load that would put on the system would be pretty high. – Brent Nov 20 '09 at 17:08
You could limit the size of each log to N number of lines and then cat them together into a single larger log and let apachetop do its thing. – omouse Jan 19 '12 at 8:22

If you are using a particular monitoring technology already, you should mention it.

But in general, you can put the following directives in each virtualhost block to log that virtual host separately, and then just parse the logs with whatever you use:

ErrorLog /var/log/httpd/foo_vhost-error_log common
CustomLog /var/log/httpd/foo_vhost-access_log common

Then just adjust log rotate if you need to. Then, if you had daily logs, you could do something really simple to get the hits like looping over the logs and calling wc -l on each of them.

share|improve this answer
I am already logging these stats, and can use awstats to see the traffic domain-by-domain - for the previous day (since the reports are generated nightly). What I am looking for is something to graphically compare the live activity between domains (VirtualHosts) – Brent Nov 20 '09 at 17:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.