Comments on: Which Apache virtual host is getting slammed?

Question: Which Apache virtual host is getting slammed?

xmutex — Mon, 08 Sep 2008 11:33:12 -0800

Apache 2 + N number of Virtual Hosts = where is the traffic coming from? (in real time!)

Have an Apache 2 cluster with about 70 virtual hosts, under heavier than normal traffic. Would like some real-time monitoring to figure out what host is being requested the most, without waiting for log information. Any ideas?

By: cschneid

cschneid — Mon, 08 Sep 2008 12:01:30 -0800

What's wrong with the logs? Apache should be writing them out in real time. When you say logs, do you really mean a log analyzer that is setup to run every night?

If that's the case, setup the analyzer to run every 10 minutes, or on demand, or whatever. That way you can get up-to-date analyzed logs when you want.

Otherwise, you can always do it manually and parse the logs using perl. Grab the last 5000 entries from the log file, and count the number of times each domain comes up. That works out to less than a page or two of code, and you can get the details in nearly real time.

By: tomierna

tomierna — Mon, 08 Sep 2008 12:21:07 -0800

Set up server-status:



<Location /admin/server-status>

    SetHandler server-status

    Order deny,allow

</Location>



ExtendedStatus On

This should give you a decent amount of info about which virtual domain is getting what requests and for how much data.

Be sure to put an .htaccess password on the admin directory so people can't look at your privates :)

By: moift

moift — Mon, 08 Sep 2008 14:03:35 -0800

If each vhosts has its own log you should be able to tell by their size roughly which hosts are getting the traffic, something like:

ls -la /var/log/httpd/*access?log

Although the path and the mask to match access logs vs error/other logs may vary.

If the access log is combined you can try grepping for the various vhosts in the combined file and getting counts. On my host it works out like this, but you'll doubtless have to change some parameters:

for vhost in `grep ServerName /etc/apache2/sites-available/default | awk '{ print $2 }'`;do
    echo $vhost: `grep $vhost /var/log/apache2/access.log | wc -l`;
done

The backtick-quoted part in the for loop just needs to result in a list of vhosts. In my case it's straightforward to just grep for the ServerName directory in Apache's config and print its argument. You could also just write them out in a file and replace that part with `cat thatfile`. /var/log/apache2/access.log should be the actual combined log.