Which Apache virtual host is getting slammed?

September 8, 2008 11:33 AM

Apache 2 + N number of Virtual Hosts = where is the traffic coming from? (in real time!)

Have an Apache 2 cluster with about 70 virtual hosts, under heavier than normal traffic. Would like some real-time monitoring to figure out what host is being requested the most, without waiting for log information. Any ideas?

posted by xmutex to technology (3 comments total)

What's wrong with the logs? Apache should be writing them out in real time. When you say logs, do you really mean a log analyzer that is setup to run every night?

If that's the case, setup the analyzer to run every 10 minutes, or on demand, or whatever. That way you can get up-to-date analyzed logs when you want.

Otherwise, you can always do it manually and parse the logs using perl. Grab the last 5000 entries from the log file, and count the number of times each domain comes up. That works out to less than a page or two of code, and you can get the details in nearly real time.
posted by cschneid at 12:01 PM on September 8, 2008

Set up server-status:


<Location /admin/server-status>
SetHandler server-status
Order deny,allow
</Location>

ExtendedStatus On

This should give you a decent amount of info about which virtual domain is getting what requests and for how much data.

Be sure to put an .htaccess password on the admin directory so people can't look at your privates :)
posted by tomierna at 12:21 PM on September 8, 2008

If each vhosts has its own log you should be able to tell by their size roughly which hosts are getting the traffic, something like:

ls -la /var/log/httpd/*access?log

Although the path and the mask to match access logs vs error/other logs may vary.

If the access log is combined you can try grepping for the various vhosts in the combined file and getting counts. On my host it works out like this, but you'll doubtless have to change some parameters:

for vhost in `grep ServerName /etc/apache2/sites-available/default | awk '{ print $2 }'`;do    echo $vhost: `grep $vhost /var/log/apache2/access.log | wc -l`;done

The backtick-quoted part in the for loop just needs to result in a list of vhosts. In my case it's straightforward to just grep for the ServerName directory in Apache's config and print its argument. You could also just write them out in a file and replace that part with `cat thatfile`. /var/log/apache2/access.log should be the actual combined log.
posted by moift at 2:03 PM on September 8, 2008