I don't known lot about your server configuration but I will try to help.
iptables and do not allow to attack your server
iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT
After that i think that
logrotate can help us to find site with highest impact.
sudo apt-get install logrotate
To verify that logrotate was successfully installed, run this in the command prompt.
Configurations and default options for the
logrotate utility are present in:
Some of the important configuration settings are : rotation-interval, log-file-size, rotation-count and compression.
Application-specific log file information (to override the defaults) are kept at:
My idea is to monitor http access file. Site with more access must have bigger access log.
cron will watch for us on this and send you mail about problem ...
logrotate.conf and add some code
sudo nano /etc/logrotate.conf
/usr/bin/killall -HUP httpd
ls -ltr /path_to_apache_logs/ | mail -s "$HOSTNAME: Apache restarted and log files rotated" firstname.lastname@example.org
You must customise
size - size of log file, change based on your needs
path_to_apache_logs - change path based on log path in
More about customization of
logrotate.conf you can find here
cron to run
logrotate on every 5 min
*/5 * * * * root /usr/sbin/logrotate /etc/logrotate.conf
When you are on "attack" you access log will growth fast.
Cron will run
logrotate to check log file size and if file size is XX will rotate log, restart atache and send you mail.
Because every virtual host have own access file you will known witch site is server "killer"