Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When you go through your logs, what criteria do you use to determine if it's you (ie: you need to beef up your server/s) or them (ie: they're verging on a DoS)? How many connections/second would you consider reasonable, and why? Do you have some other rule (eg: weighted toward IPs who also referral spam?)

share|improve this question
up vote 4 down vote accepted

Ideally you shouldn't have to manually look at logs for these signs, they should be set as alert thresholds that generate automated SNMP/Mail traps, and in some circumstances initiate preemptive measures.

As for specific rules, connections/sec or similar will vary based on hardware but consistent high CPU utilisation (80%+) is usually cause for concern, same for memory and disk queue length.

share|improve this answer

At a previous employer we used a script to monitor growth in logfiles and alerted the sysadmin-team if the growth was unusual for that time of day. It gave a few false alarms until we managed to tune it (that is - found out what was usual for certain times of day/season), but after a while it ran smooth.

share|improve this answer

There are generally two types of changes to traffic patters. The gradual increase as you (hopefully) gain popularity and the sudden surge caused by some event.

The sudden surge is the one that normally keeps people up at night. This could be caused by your marketing department putting out some new promotion; getting picked up on or similar site; getting hit by some kind of general internet attack i.e. SQL Slammer [ ] ; or most scary of all a directed attack against you, your sites and servers.

Good internal communication will help with the first one, logging of referrers the second, keeping an ear to the ground the third and a comprehensive action plan the fourth.

Do log trending and anomaly detection. Graph your traffic patterns with a tool like MRTG, Cacti or Nagios (among others) -- preferably including port numbers and not just in/out bits. Look for 'under the radar' hack attempts that won't set off the normal set of alarm bells (read Extrusion Detection: and similar books).

Most of all start looking now while things are normal and start getting a feel for what 'normal' looks like. Knowr you business -- when is your busy time of the day/week/month/year? Start graphing and trending so you have a history to refer to - the longer the better.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.