I am hosting quite a lot of virtual hosts using Apache in a basic LAMP set up with the help of Webmin/Virtualmin. I am looking for a top-like tool in which I can monitor current connections. The virtual hosting part seems to be giving me trouble here. Here's what I've tried:

  • netstat - I can see the connections, but they show me as if they're all using my primary domain, e.g. mydomain.com:www.
  • iftop - I like it a lot, but similar downside as netstat: does not show the virtual host.
  • apachetop - seems to be showing not information for all my virtual hosts. I'm logging to separate custom log files, which I'm suspecting is the cause for why it doesn't work.
  • ntop, darkstat, MRTG, bwm-ng, IPTraf - not working either.

So, basically, I'm looking for something similar to the current output of netstat, but to include the virtual host the request is for, e.g.: avirtualsite.com:www.

  • I am using Apache2 - Default LAMP installation to use with VirtualMin/ Webmin - I just found apachetop - but that only monitors the file i provide.. damnit- not all the servers... – Piotr Kula Jan 10 '13 at 17:29

Andrea Corbellini's answer explains you why it won't work with the tools you're using and how Virtual Hosting works. Here's the most simple way I can think of to get it done in Apache...

mod_status will help you out.

Disclaimer: I can't tell how this is done in Webmin - I use bare configuration files to set up servers. Here's just a basic overview of the steps.

It's a top-like tool, but represented as a web page. It lists the current state directly queried from Apache, so it's not depending on parsing log files like apachetop does.

  1. Enable mod_status:

    sudo a2enmod status
  2. Grant yourself access.

    • Open /etc/apache2/mods-enabled/status.conf and edit:
    • Set ExtendedStatus to On (optional, but more awesomeness and a little slower)
    • Within the <Location /server-status>, append your IP address to the line with the Allow directive. Example:

      Allow from ::1
  3. Restart Apache:

    sudo service apache2 restart
  4. Enjoy the tool in your browser, for example:

    It will look like this example screenshot.

  5. Keep pressing F5 to get updates. Or get an awesome browser plugin and watch it being updated!


addendum by the OP for future visitors

In Webmin, the basic steps about the Status module can be found here:

  • Servers -> Apache Webserver -> Configure Apache Modules
  • Select the Status module and click click Enable Selected Modules

enter image description here

  • interesting- but if i have 100 virtual websites - will it show me stats for ALL the websites? because the coonection log in /var/log/apache2/access.log is empty because we do not use the default website, each website has its own /log/access.log spread across – Piotr Kula Jan 10 '13 at 18:29
  • 2
    I like you very much now. Gimme a kiss :* +1 – Piotr Kula Jan 10 '13 at 18:35
  • Genius- That is what i needed. it is showing me vhost now! Thanks a million man! I do not know how to repay for your knowledge! – Piotr Kula Jan 10 '13 at 18:51
  • Seriously! I love this status tool sooo much! I have detected so many scripts thanks to this. It helped me to get the sites patched, upgraded and fixed up. Your help is soo appreciated I wish I could give you all my rep! – Piotr Kula Jan 16 '13 at 16:15
  • @ppumkin Don't exaggerate please. It's a very basic and common Apache module for these tasks. Any self-respecting book about Apache will mention it. I'm glad I was helpful in this, though. – gertvdijk Jan 16 '13 at 16:21

All the tools you are trying will never give you the right answer. The reason is that the information you are requesting is lost when the connection is made.

Let's use an example: suppose your web server has one IP address ( and two host names (a.mydomain.com and b.mydomain.com) that resolve to that IP address.

What happens when you use your favorite web browser when you visit a.mydomain.com?

  1. The browser asks your DNS server the IP address a.mydomain.com corresponds to.
  2. The DNS server tells the browser the address is
  3. The web browser connects to

So netstat & co. only know that there's an incoming connection made to The reason why you see a host name instead of an IP address is that the IP address has a rDNS record, so netstat prefers to show that instead of the IP, because it's nicer. Try netstat -n (or remove the rDNS record) and you'll see the IP address.

But that's not all: when I said that the information about the host name that was used to make the connection was lost, I wasn't fully right. From the point of view of the TCP/IP stack, that sentence is true. But if we see the things from the point of view of the HTTP protocol, things are different. In every HTTP request there's a Host: header that contains the host name that was used by the browser to make the request.

So, in short, you should look at the log files of your web server. The web server is the service that handles the HTTP requests and therefore the only service that knows about the "original" host name.

  • 1
    +1 Important networking background stories are underrated. Linked in my answer, this deserves upvotes too! – gertvdijk Jan 10 '13 at 20:15

Another way is to type

tail -f /var/log/apache2/access.log

in your terminal

  • 2
    Nice and simple; pretty straight forward, thanks! – Julian F. Weinert Nov 29 '14 at 13:11
  • I notice that in my cPanel installations (on CentOS machines, but I think cPanel on Ubuntu is probably the same), the access.log does not contain all requests. Instead, I look in /usr/local/apache/domlogs/ to see requests by virtualhost (split between SSL, non-SSL, and even FTP). The path might be different on Ubuntu cPanel. – Buttle Butkus Nov 21 '15 at 5:07
  • 2
    I found this from Google. This technique works in CentOS 7, except you need /var/log/httpd/access_log – mwfearnley Feb 26 '16 at 11:56

You can check all ips connected on port 80 with this bash

netstat -tn 2>/dev/null | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head

Note: if you want to see other port, change 80


 19 x.174.143.1
 13 x.175.135.1
  9 x.68.135.1
  8 x.144.87.1
  7 x.68.150.1
  6 x.92.4.1
  6 x.188.23.1
  5 x.190.164.1
  4 x.189.156.1
  • 1
    What are those values in the first column? Are these the number of connected instances from a single ip address? – lightning mcqueen Mar 7 at 16:54
  • Yes, it is the number of connected instances from an ip, @lightning mcqueen – DarckBlezzer Mar 11 at 23:59

You can check this with:

netstat -na | grep 'ESTA'

If you want pid, user and command:

lsof  -i  tcp:443,80 | egrep 'PID|->' | sort -k9

You can also use GoAccess interactively to view your current visitors. It parses your Apache access log for this purpose and shows a bunch of statistics about your site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.