How to track traffic spikes

[wookiee]

Apache on my brand new shiny dedicated managed server is shutting down every hour or so.

From the managers...
1)
The problem appeared to be the http usage was running high and wasn't serving the pages
2)
The log I setup only tracks the number of connections, it doesn't track the domain getting the traffic. Since the traffic is spikes only, it's hard to see what sites are being hit when it does spike. When I look at it now, the traffic is normal, about 15 connections. But all of a sudden it may spike to 300+ connections then fail, and by the time it is seen, the stats showing which domains are being accessed are inaccessible.

There must be some way log what is being hit to the last second before apache shut-down.

I have about 150 domains with only 4-5 with any kind of activity.

When the server was first activated I got a lot of...
httpd failed @ Sun Dec 10 04:48:59 2006. A restart was attempted automagicly.
notices

They shut off the 'internal http restarts' to see what the problem was.
I went to the Grand Canyon. Came back only to find the server not serving for 24 hours!!!

For some reason they won't turn 'internal http restarts' back on, but they just put in System Integrity Monitor with a warning that it doesn't always restart apache!

Any ideas will be appreciated.

 

[carock]

I have used this line running from cron every 5 minutes. Don't forget to set up log rotate.

*/5 * * * * /root/scripts/apache-status.pl >> /var/log/apachestatuslog

-------------------------
apache-status.pl
#!/usr/bin/perl

@output = `lynx -width=190 -dump http://127.0.0.1/whm-server-status`;

print @output;

-------------------------
I also created another two scripts to display that output in a way to count the number of times a specific IP is connected. For attacks, offline web browsers etc.

apache-watch.pl
-------------------------

#!/usr/bin/perl

@apachestatus = `/bin/bash formatted-status.sh`;

%seen = ();
foreach $item (@apachestatus) {
$seen{$item}++;
}
@values = values %seen;
@uniq = keys %seen;

print "\nIP connections \n";
$count=0;
foreach $v (@values){
$h = $uniq[$count];
printf("\t%6.0f %s",$v,$h);
$count++
}
print "\n";

-----------------------------------

formatted-status.sh
-----------------------

#!/bin/bash

lynx -width=190 -dump http://127.0.0.1/whm-server-status | sed -n 55,204p | awk '{print $11}'

 

[gorilla]

Nice one Carock , i have to give this a fiddle :D