How can I watch the current connections on my Apache webserver?

Question

I am hosting quite a lot of virtual hosts using Apache in a basic LAMP set up with the help of Webmin/Virtualmin. I am looking for a top-like tool in which I can monitor current connections. The virtual hosting part seems to be giving me trouble here. Here's what I've tried:

• netstat - I can see the connections, but they show me as if they're all using my primary domain, e.g. mydomain.com:www.
• iftop - I like it a lot, but similar downside as netstat: does not show the virtual host.
• apachetop - seems to be showing not information for all my virtual hosts. I'm logging to separate custom log files, which I'm suspecting is the cause for why it doesn't work.
• ntop, darkstat, MRTG, bwm-ng, IPTraf - not working either.

So, basically, I'm looking for something similar to the current output of netstat, but to include the virtual host the request is for, e.g.: avirtualsite.com:www.

Answer 1

Andrea Corbellini's answer explains you why it won't work with the tools you're using and how Virtual Hosting works. Here's the most simple way I can think of to get it done in Apache...

mod_status will help you out.

Disclaimer: I can't tell how this is done in Webmin - I use bare configuration files to set up servers. Here's just a basic overview of the steps.

It's a top-like tool, but represented as a web page. It lists the current state directly queried from Apache, so it's not depending on parsing log files like apachetop does.

1. Enable mod_status:

   sudo a2enmod status
   

2. Grant yourself access.

   • Open /etc/apache2/mods-enabled/status.conf and edit:
   • Set ExtendedStatus to On (optional, but more awesomeness and a little slower)

   • Within the <Location /server-status>, append your IP address to the line with the Allow directive. Example:

     Allow from 127.0.0.1 ::1 66.77.88.99
     

3. Restart Apache:

   sudo service apache2 restart
   

4. Enjoy the tool in your browser, for example: http://1.2.3.4/server-status

   It will look like this example screenshot.

5. Keep pressing F5 to get updates. Or get an awesome browser plugin and watch it being updated!

---

Webmin

addendum by the OP for future visitors

In Webmin, the basic steps about the Status module can be found here:

• Servers -> Apache Webserver -> Configure Apache Modules
• Select the Status module and click click Enable Selected Modules

Answer 2

Another way is to type

tail -f /var/log/apache2/access.log

in your terminal

Answer 3

All the tools you are trying will never give you the right answer. The reason is that the information you are requesting is lost when the connection is made.

Let's use an example: suppose your web server has one IP address (1.2.3.4) and two host names (a.mydomain.com and b.mydomain.com) that resolve to that IP address.

What happens when you use your favorite web browser when you visit a.mydomain.com?

1. The browser asks your DNS server the IP address a.mydomain.com corresponds to.
2. The DNS server tells the browser the address is 1.2.3.4.
3. The web browser connects to 1.2.3.4.

So netstat & co. only know that there's an incoming connection made to 1.2.3.4. The reason why you see a host name instead of an IP address is that the IP address has a rDNS record, so netstat prefers to show that instead of the IP, because it's nicer. Try netstat -n (or remove the rDNS record) and you'll see the IP address.

But that's not all: when I said that the information about the host name that was used to make the connection was lost, I wasn't fully right. From the point of view of the TCP/IP stack, that sentence is true. But if we see the things from the point of view of the HTTP protocol, things are different. In every HTTP request there's a Host: header that contains the host name that was used by the browser to make the request.

So, in short, you should look at the log files of your web server. The web server is the service that handles the HTTP requests and therefore the only service that knows about the "original" host name.

Answer 4

You can check all ips connected on port 80 with this bash

netstat -tn 2>/dev/null | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head

Note: if you want to see other port, change 80

OUTPUT:

 19 x.174.143.1
 13 x.175.135.1
  9 x.68.135.1
  8 x.144.87.1
  7 x.68.150.1
  6 x.92.4.1
  6 x.188.23.1
  5 x.190.164.1
  4 x.189.156.1

Answer 5

You can check this with:

netstat -na | grep 'ESTA'

Answer 6

If you want pid, user and command:

lsof  -i  tcp:443,80 | egrep 'PID|->' | sort -k9

Answer 7

You can also use GoAccess interactively to view your current visitors. It parses your Apache access log for this purpose and shows a bunch of statistics about your site.