{"id":510,"date":"2013-01-22T20:27:15","date_gmt":"2013-01-23T01:27:15","guid":{"rendered":"https:\/\/www.inmotionhosting.com\/support\/2013\/01\/22\/review-recent-website-requests\/"},"modified":"2021-08-16T23:23:48","modified_gmt":"2021-08-17T03:23:48","slug":"review-recent-website-requests","status":"publish","type":"post","link":"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/","title":{"rendered":"Review recent website requests"},"content":{"rendered":"

In this article I’m going to teach you how you can use the server status feature of WHM (Web Host Manager) from the command line on your VPS (Virtual Private Server) or dedicated server in order to review recent website requests that Apache is handling.<\/p>\n

If you’ve happened to have read my previous articles on either advanced server load monitoring<\/a>, or how to setup a server load monitoring script<\/a> to alert you via email when your server’s load is high. Then you might be curious about the current website requests that are happening on your server, as more than likely those requests could be leading to your server’s load average spiking.<\/p>\n

I already covered in my article on how to determine cause of server usage spike<\/a> tracking down Apache requests from a time period when your server’s load average was spiking in the past. Now I’ll be covering how you can view the most recent website requests, so that you can investigate a live load issue on your server.<\/p>\n

In order to follow along with these steps you’d need to have either a VPS or dedicated server, that way you can access the server via SSH to run the commands we’ll go over.<\/p>\n

View Apache requests with whm-server-status<\/h2>\n

Following the steps below you’ll be able to view the active website requests that Apache is handling on your server. This will allow you to hopefully pinpoint resource intensive portions of your site that could be leading to your server’s load average spiking.<\/p>\n

    \n
  1. Login to your server via SSH<\/a>.<\/li>\n
  2. Run the following command to see what domain currently has the most requests going to it:
    \nlynx -dump --width=500 localhost\/whm-server-status | egrep \"GET|POST\" | awk '{print $12}' |
    \nsort | uniq -c | sort -n<\/code>
    \nCode breakdown:<\/strong><\/p>\n\n\n\n\n\n\n
    lynx -dump –width=500 localhost\/whm-server-status<\/th>\nRun the text based lynx<\/strong> web browser with the -dump<\/strong> flag and set the –width<\/strong> to 500<\/strong> on the localhost\/whm-server-status<\/strong> URL which gives back the Apache requests.<\/td>\n<\/tr>\n
    egrep “GET|POST”<\/th>\nUse the egrep<\/strong> command to only show either GET<\/strong> or POST<\/strong> requests, as otherwise you would also get back some NULL<\/strong> requests as well.<\/td>\n<\/tr>\n
    awk ‘{print $12}’<\/th>\nUse the awk<\/strong> command to only print out the $12<\/strong>th column of data which is the domain name in the request.<\/td>\n<\/tr>\n
    sort | uniq -c | sort -n<\/th>\nSort the domain names, uniquely count them, and then sort them numerically from lowest to highest.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    You should get back something like this:
    \n12 test.example.com
    \n16 wordpress.example.com
    \n345 example.com
    \n<\/code>
    \nIn this case we can see that the example.com<\/strong> site is getting by far the most requests.<\/li>\n

  3. You can now adjust the previous command to view the requests for the one example.com<\/strong> domain that was getting the highest amount of requests:
    \nlynx -dump --width=500 localhost\/whm-server-status | egrep \"GET|POST\" | grep example.com |
    \nawk '{print $14}' | sort | uniq -c | sort -n<\/code>
    \nCode breakdown:<\/strong><\/p>\n\n\n\n\n\n\n
    lynx -dump –width=500 localhost\/whm-server-status<\/th>\nRun the text based lynx<\/strong> web browser with the -dump<\/strong> flag and set the –width<\/strong> to 500<\/strong> on the localhost\/whm-server-status<\/strong> URL which gives back the Apache requests.<\/td>\n<\/tr>\n
    egrep “GET|POST”<\/th>\nUse the egrep<\/strong> command to only show either GET<\/strong> or POST<\/strong> requests, as otherwise you would also get back some NULL<\/strong> requests as well.<\/td>\n<\/tr>\n
    grep example.com | awk ‘{print $14}’<\/th>\nUse the grep<\/strong> command to only show requests from the example.com<\/strong> domain. Then use the awk<\/strong> command to print out the $14<\/strong>th column which is the actual file being requested.<\/td>\n<\/tr>\n
    sort | uniq -c | sort -n<\/th>\nSort the requests, uniquely count them, and then sort them numerically from lowest to highest.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    You should get back something along theese lines:
    \n15 \/index.php
    \n25 \/blog\/index.php
    \n305 \/blog\/wp-comments-post.php
    \n<\/code>
    \nSo here we can see that the URL \/blog\/wp-comments-post.php<\/strong> is getting slammed with traffic.<\/li>\n

  4. Finally we can look for the IP addresses hitting the \/blog\/wp-comments-post.php<\/strong> script to see if the activity is malicious in nature:
    \nlynx -dump --width=500 localhost\/whm-server-status | egrep \"GET|POST\" | grep example.com |
    \ngrep wp-comments-post.php | awk '{print $11}' | sort -n | uniq -c | sort -n<\/code>
    \nCode breakdown:<\/strong><\/p>\n\n\n\n\n\n\n\n
    lynx -dump –width=500 localhost\/whm-server-status<\/th>\nRun the text based lynx<\/strong> web browser with the -dump<\/strong> flag and set the –width<\/strong> to 500<\/strong> on the localhost\/whm-server-status<\/strong> URL which gives back the Apache requests.<\/td>\n<\/tr>\n
    egrep “GET|POST”<\/th>\nUse the egrep<\/strong> command to only show either GET<\/strong> or POST<\/strong> requests, as otherwise you would also get back some NULL<\/strong> requests as well.<\/td>\n<\/tr>\n
    grep example.com | grep wp-comments-post.php<\/th>\nUse the grep<\/strong> command to only show requests from the example.com<\/strong> domain. Then use the grep<\/strong> command again to only look for requests of the wp-comments-post.php<\/strong> script.<\/td>\n<\/tr>\n
    awk ‘{print $11}’<\/th>\nUse the awk<\/strong> command to only print out the $11<\/strong>th column of data which is the IP address of the requests.<\/td>\n<\/tr>\n
    sort -n | uniq -c | sort -n<\/th>\nFinally sort the IP addresses numerically, uniquely count them, then sort them again numerical from lowest to highest amount of reqeusts..<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    You should get back something along these lines:
    \n1 123.123.123.124 304 123.123.123.123<\/code>
    \nIn this case we can tell that the IP address 123.123.123.123<\/strong> was responsible for just about every single one of the 305<\/strong> requests to wp-comments-post.php<\/strong>.<\/li>\n

  5. If you wanted to block that IP address from being able to access your server any longer, you can do this by blocking them at your server’s firewall with the following command:
    \napf -d 123.123.123.123 \"Spamming example.com\/blog\/wp-comments-post.php\"<\/code><\/li>\n<\/ol>\n

    You should now know how to investigate the current Apache requests that are happening on your server using the whm-server-status<\/strong> feature of WHM.<\/p>\n","protected":false},"excerpt":{"rendered":"

    In this article I’m going to teach you how you can use the server status feature of WHM (Web Host Manager) from the command line on your VPS (Virtual Private Server) or dedicated server in order to review recent website requests that Apache is handling. If you’ve happened to have read my previous articles on Read More ><\/a><\/p>\n","protected":false},"author":57014,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4288],"tags":[],"class_list":["post-510","post","type-post","status-publish","format-standard","hentry","category-website"],"acf":[],"yoast_head":"\nReview recent website requests | InMotion Hosting<\/title>\n<meta name=\"description\" content=\"In this article I'm going to teach you how you can use the server status feature of WHM (Web Host Manager) from the command line on your VPS (Virtual Private Server) or dedicated server in order to review recent website requests that Apache is handling.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Review recent website requests | InMotion Hosting\" \/>\n<meta property=\"og:description\" content=\"In this article I'm going to teach you how you can use the server status feature of WHM (Web Host Manager) from the command line on your VPS (Virtual Private Server) or dedicated server in order to review recent website requests that Apache is handling.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/\" \/>\n<meta property=\"og:site_name\" content=\"InMotion Hosting Support Center\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/inmotionhosting\/\" \/>\n<meta property=\"article:published_time\" content=\"2013-01-23T01:27:15+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-08-17T03:23:48+00:00\" \/>\n<meta name=\"author\" content=\"InMotion Hosting Contributor\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/twitter.com\/InMotionHosting\" \/>\n<meta name=\"twitter:site\" content=\"@InMotionHosting\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"InMotion Hosting Contributor\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/\"},\"author\":{\"name\":\"InMotion Hosting Contributor\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644\"},\"headline\":\"Review recent website requests\",\"datePublished\":\"2013-01-23T01:27:15+00:00\",\"dateModified\":\"2021-08-17T03:23:48+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/\"},\"wordCount\":843,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#organization\"},\"articleSection\":[\"Website\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/\",\"name\":\"Review recent website requests | InMotion Hosting\",\"isPartOf\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#website\"},\"datePublished\":\"2013-01-23T01:27:15+00:00\",\"dateModified\":\"2021-08-17T03:23:48+00:00\",\"description\":\"In this article I'm going to teach you how you can use the server status feature of WHM (Web Host Manager) from the command line on your VPS (Virtual Private Server) or dedicated server in order to review recent website requests that Apache is handling.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.inmotionhosting.com\/support\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Review recent website requests\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#website\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/\",\"name\":\"InMotion Hosting Support Center\",\"description\":\"Web Hosting Support & Tutorials\",\"publisher\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.inmotionhosting.com\/support\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#organization\",\"name\":\"InMotion Hosting\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg\",\"contentUrl\":\"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg\",\"width\":696,\"height\":696,\"caption\":\"InMotion Hosting\"},\"image\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/inmotionhosting\/\",\"https:\/\/x.com\/InMotionHosting\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644\",\"name\":\"InMotion Hosting Contributor\",\"description\":\"InMotion Hosting contributors are highly knowledgeable individuals who create relevant content on new trends and troubleshooting techniques to help you achieve your online goals!\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/inmotion-hosting\/\",\"https:\/\/x.com\/https:\/\/twitter.com\/InMotionHosting\"],\"url\":\"https:\/\/www.inmotionhosting.com\/support\/author\/inmotion-hosting-contributor\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Review recent website requests | InMotion Hosting","description":"In this article I'm going to teach you how you can use the server status feature of WHM (Web Host Manager) from the command line on your VPS (Virtual Private Server) or dedicated server in order to review recent website requests that Apache is handling.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/","og_locale":"en_US","og_type":"article","og_title":"Review recent website requests | InMotion Hosting","og_description":"In this article I'm going to teach you how you can use the server status feature of WHM (Web Host Manager) from the command line on your VPS (Virtual Private Server) or dedicated server in order to review recent website requests that Apache is handling.","og_url":"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/","og_site_name":"InMotion Hosting Support Center","article_publisher":"https:\/\/www.facebook.com\/inmotionhosting\/","article_published_time":"2013-01-23T01:27:15+00:00","article_modified_time":"2021-08-17T03:23:48+00:00","author":"InMotion Hosting Contributor","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/twitter.com\/InMotionHosting","twitter_site":"@InMotionHosting","twitter_misc":{"Written by":"InMotion Hosting Contributor","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/#article","isPartOf":{"@id":"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/"},"author":{"name":"InMotion Hosting Contributor","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644"},"headline":"Review recent website requests","datePublished":"2013-01-23T01:27:15+00:00","dateModified":"2021-08-17T03:23:48+00:00","mainEntityOfPage":{"@id":"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/"},"wordCount":843,"commentCount":0,"publisher":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#organization"},"articleSection":["Website"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/","url":"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/","name":"Review recent website requests | InMotion Hosting","isPartOf":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#website"},"datePublished":"2013-01-23T01:27:15+00:00","dateModified":"2021-08-17T03:23:48+00:00","description":"In this article I'm going to teach you how you can use the server status feature of WHM (Web Host Manager) from the command line on your VPS (Virtual Private Server) or dedicated server in order to review recent website requests that Apache is handling.","breadcrumb":{"@id":"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.inmotionhosting.com\/support\/website\/review-recent-website-requests\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.inmotionhosting.com\/support\/"},{"@type":"ListItem","position":2,"name":"Review recent website requests"}]},{"@type":"WebSite","@id":"https:\/\/www.inmotionhosting.com\/support\/#website","url":"https:\/\/www.inmotionhosting.com\/support\/","name":"InMotion Hosting Support Center","description":"Web Hosting Support & Tutorials","publisher":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.inmotionhosting.com\/support\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.inmotionhosting.com\/support\/#organization","name":"InMotion Hosting","url":"https:\/\/www.inmotionhosting.com\/support\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/","url":"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg","contentUrl":"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg","width":696,"height":696,"caption":"InMotion Hosting"},"image":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/inmotionhosting\/","https:\/\/x.com\/InMotionHosting"]},{"@type":"Person","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644","name":"InMotion Hosting Contributor","description":"InMotion Hosting contributors are highly knowledgeable individuals who create relevant content on new trends and troubleshooting techniques to help you achieve your online goals!","sameAs":["https:\/\/www.linkedin.com\/company\/inmotion-hosting\/","https:\/\/x.com\/https:\/\/twitter.com\/InMotionHosting"],"url":"https:\/\/www.inmotionhosting.com\/support\/author\/inmotion-hosting-contributor\/"}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"primary_category":null,"_links":{"self":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/510","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/users\/57014"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/comments?post=510"}],"version-history":[{"count":3,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/510\/revisions"}],"predecessor-version":[{"id":85038,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/510\/revisions\/85038"}],"wp:attachment":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/media?parent=510"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/categories?post=510"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/tags?post=510"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}