One can find the number of Apache workers an IP address is consuming at an instantaneous point in time by executing:
netstat -pantu | grep :80 |sort | uniq -c |grep <IP_HERE, eg: 192.168> | wc -l
This is useful during a DDoS attack, for example. From this one can determine if one's counter measures are being effective in reducing the number of Apache workers' being spawned to handle too much traffic, etc.
Recently I was faced with a situation where there was an attack on a shared IP address and I was not readily able to find which user was consuming the most Apache workers. How can one determine such a value?
It has been suggested I watch for traffic per user, but that does not seem to really give the answer I'm looking for when there are a large number of workers being spawned that are creating a deadlock and so I got to the point where I am trying to isolate the worker ownership on a per user basis.