I wrote this command on my shell to get the current requests to the server

ps aux | grep php | wc -l

result: 68

so this command returns that 68 currently browsing some sites on my server as i understand also i wrote

ps aux | grep httpd | wc -l

results 12

which one is the corrent number for the people currently requesting pages on my server? second question can i get the requested pages exactly ewhat they are ex. /home/user1/public_html/page.php thanks in advance


Your examples above are catching how many running processes of php and httpd which won't really show you connections. If you just want a rough idea of the connections you could try netstat -an | grep :80 | wc -l which will show you the total number of connections (in both active and wait status) for port 80.

To really get metrics on page requests, server load and user tracking you'd wnat to look at something like MRTG or Cacti.

Expanded Answer:

The command above shows all connections to whatever port your checking, but doesn't differentiate between active connections or the other different status like TIME_WAIT and CLOSE_WAIT, nor does it break it down by virtual host, it's simply all connections on this server to X port.

If you run the command without the wc -l pipe you'll see different status including ESTABLISHED, TIME_WAIT and CLOSE_WAIT.

CLOSE_WAIT indicates that the other side has closed the connection. TIME_WAIT indicates that the local side has closed the connection.

These connections are kept around for a few minutes to ensure that any delayed packets are matched and delivered properly.

When a client request comes in your webserver (apache, nginx, iis, lighthttp etc) handles the client request and loads the file. If it finds that it contains php code it hands it off to the php interpreter which then either connects to a database like postgres or mysql or hands it back to your webserver which delivers it to the client.

You'll find that your webserver and php are typically capable of handling hundreds of client requests so while you may have 100+ client connections you may only have 1-10 httpd processes as each worker process is handling multiple client requests.

The fact that you said netstat -an | grep :80 | wc -l returned 3500 results warrants investigation. Out of curiosity I checked our heaviest load production server currently pushing 1.1Mbit of traffic and found it only had 141 connections between the different ports we server content on, however if your site is high traffic and not session based it's entirely possible that's legitimate.

If you're really curious as to what's happening then only monitoring can tell you. Cacti will give you a good idea of bandwidth and server load, while something like Apache mod_status, MRTG or Awstats will give you a better idea of traffic to each virtual host with breakdowns on unique visitors and metrics on page traffic.

If you just want some cursory data you can pipe a status into the above, i.e. netstat -an | grep :80 | grep ESTABLISHED | wc -l will show you a count of ESTABLISHED connections to port 80, ignoring CLOSE_WAIT and TIME_WAIT. Even that only gives you a rough idea of how many people are connecting to your server, to understand how people are using your website(s) you need to go the external application route.

Hope this helps.

  • thanks for reply .. one last question .. i run your command it gives me 3500 so why that big diffrence between the three commands.. as i understand that every user request it will be processed by php so number should be identical !! so what is the idea exactly? – Macnux Mar 14 '15 at 12:19
  • @user2381778 I've expanded my original answer to address your follow up. – Jchieppa Mar 15 '15 at 2:06
  • i got almost of your answer but sorry one other thing .. my server is configured to use port 8081 for httpd but i found that there is port 80 on the results of netstat -an !!! how is that ? – Macnux Mar 15 '15 at 19:21
  • If you found results against port 80 something is running on it, mostly likely httpd. You can find out for sure by running sudo netstat -tulpn or if you have a busy server with lots of running processes sudo netstat -tulpn | grep :80 although that will find both 80, 8080, 8081 etc. – Jchieppa Mar 15 '15 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.