The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

How to track traffic spikes

Discussion in 'General Discussion' started by wookiee, Dec 17, 2006.

  1. wookiee

    wookiee Well-Known Member

    Joined:
    Feb 28, 2005
    Messages:
    48
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Las Vegas
    Apache on my brand new shiny dedicated managed server is shutting down every hour or so.

    From the managers...
    1)
    The problem appeared to be the http usage was running high and wasn't serving the pages
    2)
    The log I setup only tracks the number of connections, it doesn't track the domain getting the traffic. Since the traffic is spikes only, it's hard to see what sites are being hit when it does spike. When I look at it now, the traffic is normal, about 15 connections. But all of a sudden it may spike to 300+ connections then fail, and by the time it is seen, the stats showing which domains are being accessed are inaccessible.

    There must be some way log what is being hit to the last second before apache shut-down.

    I have about 150 domains with only 4-5 with any kind of activity.

    When the server was first activated I got a lot of...
    httpd failed @ Sun Dec 10 04:48:59 2006. A restart was attempted automagicly.
    notices

    They shut off the 'internal http restarts' to see what the problem was.
    I went to the Grand Canyon. Came back only to find the server not serving for 24 hours!!!

    For some reason they won't turn 'internal http restarts' back on, but they just put in System Integrity Monitor with a warning that it doesn't always restart apache!

    Any ideas will be appreciated.
     
  2. carock

    carock Well-Known Member

    Joined:
    Sep 25, 2002
    Messages:
    232
    Likes Received:
    1
    Trophy Points:
    18
    Location:
    St. Charles, MO
    I have used this line running from cron every 5 minutes. Don't forget to set up log rotate.

    */5 * * * * /root/scripts/apache-status.pl >> /var/log/apachestatuslog

    -------------------------
    apache-status.pl
    #!/usr/bin/perl

    @output = `lynx -width=190 -dump http://127.0.0.1/whm-server-status`;

    print @output;

    -------------------------
    I also created another two scripts to display that output in a way to count the number of times a specific IP is connected. For attacks, offline web browsers etc.

    apache-watch.pl
    -------------------------

    #!/usr/bin/perl

    @apachestatus = `/bin/bash formatted-status.sh`;

    %seen = ();
    foreach $item (@apachestatus) {
    $seen{$item}++;
    }
    @values = values %seen;
    @uniq = keys %seen;

    print "\nIP connections \n";
    $count=0;
    foreach $v (@values){
    $h = $uniq[$count];
    printf("\t%6.0f %s",$v,$h);
    $count++
    }
    print "\n";

    -----------------------------------

    formatted-status.sh
    -----------------------

    #!/bin/bash

    lynx -width=190 -dump http://127.0.0.1/whm-server-status | sed -n 55,204p | awk '{print $11}'
     
  3. gorilla

    gorilla Well-Known Member

    Joined:
    Feb 3, 2004
    Messages:
    699
    Likes Received:
    1
    Trophy Points:
    18
    Location:
    Sydney / Australia
    Nice one Carock , i have to give this a fiddle :D
     
Loading...

Share This Page