Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am hosting quite a lot of virtual hosts using Apache in a basic LAMP set up with the help of Webmin/Virtualmin. I am looking for a top-like tool in which I can monitor current connections. The virtual hosting part seems to be giving me trouble here. Here's what I've tried:

  • netstat - I can see the connections, but they show me as if they're all using my primary domain, e.g.
  • iftop - I like it a lot, but similar downside as netstat: does not show the virtual host.
  • apachetop - seems to be showing not information for all my virtual hosts. I'm logging to separate custom log files, which I'm suspecting is the cause for why it doesn't work.
  • ntop, darkstat, MRTG, bwm-ng, IPTraf - not working either.

So, basically, I'm looking for something similar to the current output of netstat, but to include the virtual host the request is for, e.g.:

share|improve this question
I am using Apache2 - Default LAMP installation to use with VirtualMin/ Webmin - I just found apachetop - but that only monitors the file i provide.. damnit- not all the servers... – ppumkin Jan 10 '13 at 17:29
up vote 19 down vote accepted

Andrea Corbellini's answer explains you why it won't work with the tools you're using and how Virtual Hosting works. Here's the most simple way I can think of to get it done in Apache...

mod_status will help you out.

Disclaimer: I can't tell how this is done in Webmin - I use bare configuration files to set up servers. Here's just a basic overview of the steps.

It's a top-like tool, but represented as a web page. It lists the current state directly queried from Apache, so it's not depending on parsing log files like apachetop does.

  1. Enable mod_status:

    sudo a2enmod status
  2. Grant yourself access.

    • Open /etc/apache2/mods-enabled/status.conf and edit:
    • Set ExtendedStatus to On (optional, but more awesomeness and a little slower)
    • Within the <Location /server-status>, append your IP address to the line with the Allow directive. Example:

      Allow from ::1
  3. Restart Apache:

    sudo service apache2 restart
  4. Enjoy the tool in your browser, for example:

    It will look like this example screenshot.

  5. Keep pressing F5 to get updates. Or get an awesome browser plugin and watch it being updated!


addendum by the OP for future visitors

In Webmin, the basic steps about the Status module can be found here:

  • Servers -> Apache Webserver -> Configure Apache Modules
  • Select the Status module and click click Enable Selected Modules

enter image description here

share|improve this answer
interesting- but if i have 100 virtual websites - will it show me stats for ALL the websites? because the coonection log in /var/log/apache2/access.log is empty because we do not use the default website, each website has its own /log/access.log spread across – ppumkin Jan 10 '13 at 18:29
I like you very much now. Gimme a kiss :* +1 – ppumkin Jan 10 '13 at 18:35
Genius- That is what i needed. it is showing me vhost now! Thanks a million man! I do not know how to repay for your knowledge! – ppumkin Jan 10 '13 at 18:51
Seriously! I love this status tool sooo much! I have detected so many scripts thanks to this. It helped me to get the sites patched, upgraded and fixed up. Your help is soo appreciated I wish I could give you all my rep! – ppumkin Jan 16 '13 at 16:15
@ppumkin Don't exaggerate please. It's a very basic and common Apache module for these tasks. Any self-respecting book about Apache will mention it. I'm glad I was helpful in this, though. – gertvdijk Jan 16 '13 at 16:21

All the tools you are trying will never give you the right answer. The reason is that the information you are requesting is lost when the connection is made.

Let's use an example: suppose your web server has one IP address ( and two host names ( and that resolve to that IP address.

What happens when you use your favorite web browser when you visit

  1. The browser (or the kernel, but this distinction is superfluous in this example) asks your DNS server the IP address corresponds to.
  2. The DNS server tells the browser the address is
  3. The web browser connects to

So netstat & co. only know that there's an incoming connection made to The reason why you see a host name instead of an IP address is that the IP address has a rDNS record, so netstat prefers to show that instead of the IP, because it's nicer. Try netstat -n (or remove the rDNS record) and you'll see the IP address.

But that's not all: when I said that the information about the host name that was used to make the connection was lost, I wasn't fully right. From the point of view of the TCP/IP stack, that sentence is true. But if we see the things from the point of view of the HTTP protocol, things are different. In every HTTP request there's a Host: header that contains the host name that was used by the browser to make the request.

So, in short, you should look at the log files of your web server. The web server is the service that handles the HTTP requests and therefore the only service that knows about the "original" host name.

share|improve this answer
+1 Important networking background stories are underrated. Linked in my answer, this deserves upvotes too! – gertvdijk Jan 10 '13 at 20:15
This is very educational. Thank you. – Buttle Butkus Nov 21 '15 at 5:01

Another way is to type

tail -f /var/log/apache2/access.log

in your terminal

share|improve this answer
Nice and simple; pretty straight forward, thanks! – Julian F. Weinert Nov 29 '14 at 13:11
I notice that in my cPanel installations (on CentOS machines, but I think cPanel on Ubuntu is probably the same), the access.log does not contain all requests. Instead, I look in /usr/local/apache/domlogs/ to see requests by virtualhost (split between SSL, non-SSL, and even FTP). The path might be different on Ubuntu cPanel. – Buttle Butkus Nov 21 '15 at 5:07
I found this from Google. This technique works in CentOS 7, except you need /var/log/httpd/access_log – mwfearnley Feb 26 at 11:56

You can check this with:

netstat -na | grep 'ESTA'
share|improve this answer

You can check all ips connected on port 80 with this bash

netstat -tn 2>/dev/null | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head

Note: if you want to see other port, change 80

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.