[B]ตามหัวข้อเลยครับ[/B]
apache server-status ครับ (ถ้ายังเข้าได้น่ะนะ)
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8405 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8409 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8412 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8415 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8416 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8418 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8419 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8426 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8433 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8471 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8474 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8518 exit, attempting to continue anyway
[Sat Sep 15 14:29:55 2012] [notice] caught SIGTERM, shutting down
[Sat Sep 15 14:31:03 2012] [warn] RSA server certificate CommonName (CN) localhost' does NOT match server name!? [Sat Sep 15 14:31:03 2012] [warn] Init: SSL server IP/port conflict: www.newpatch.tk:443 (/usr/local/directadmin/data/users/newpatch/httpd.conf:63) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:31:03 2012] [warn] Init: SSL server IP/port conflict: www.crazy-pro.tk:443 (/usr/local/directadmin/data/users/crazypro/httpd.conf:63) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:31:03 2012] [warn] Init: SSL server IP/port conflict: www.login.sf-vzio.com:443 (/usr/local/directadmin/data/users/sfvziocom/httpd.conf:150) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:31:03 2012] [warn] Init: SSL server IP/port conflict: www.sf-vzio.com:443 (/usr/local/directadmin/data/users/sfvziocom/httpd.conf:61) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:31:03 2012] [warn] Init: SSL server IP/port conflict: www.newidsf.com:443 (/usr/local/directadmin/data/users/newidsf/httpd.conf:61) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:31:03 2012] [warn] Init: SSL server IP/port conflict: localhost:443 (/etc/httpd/conf/extra/httpd-vhosts.conf:38) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:31:03 2012] [warn] Init: You should not use name-based virtual hosts in conjunction with SSL!! [Sat Sep 15 14:31:03 2012] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec) [Sat Sep 15 14:31:04 2012] [warn] RSA server certificate CommonName (CN)localhost’ does NOT match server name!?
[Sat Sep 15 14:31:04 2012] [warn] Init: SSL server IP/port conflict: www.newpatch.tk:443 (/usr/local/directadmin/data/users/newpatch/httpd.conf:63) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:31:04 2012] [warn] Init: SSL server IP/port conflict: www.crazy-pro.tk:443 (/usr/local/directadmin/data/users/crazypro/httpd.conf:63) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:31:04 2012] [warn] Init: SSL server IP/port conflict: www.login.sf-vzio.com:443 (/usr/local/directadmin/data/users/sfvziocom/httpd.conf:150) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:31:04 2012] [warn] Init: SSL server IP/port conflict: www.sf-vzio.com:443 (/usr/local/directadmin/data/users/sfvziocom/httpd.conf:61) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:31:04 2012] [warn] Init: SSL server IP/port conflict: www.newidsf.com:443 (/usr/local/directadmin/data/users/newidsf/httpd.conf:61) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:31:04 2012] [warn] Init: SSL server IP/port conflict: localhost:443 (/etc/httpd/conf/extra/httpd-vhosts.conf:38) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:31:04 2012] [warn] Init: You should not use name-based virtual hosts in conjunction with SSL!!
[Sat Sep 15 14:31:04 2012] [notice] Apache/2.2.22 (Unix) mod_ssl/2.2.22 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.17 configured – resuming normal operations
[Sat Sep 15 14:32:26 2012] [notice] caught SIGTERM, shutting down
[Sat Sep 15 14:33:02 2012] [warn] RSA server certificate CommonName (CN) localhost' does NOT match server name!? [Sat Sep 15 14:33:02 2012] [warn] Init: SSL server IP/port conflict: www.newpatch.tk:443 (/usr/local/directadmin/data/users/newpatch/httpd.conf:63) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:33:02 2012] [warn] Init: SSL server IP/port conflict: www.crazy-pro.tk:443 (/usr/local/directadmin/data/users/crazypro/httpd.conf:63) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:33:02 2012] [warn] Init: SSL server IP/port conflict: www.login.sf-vzio.com:443 (/usr/local/directadmin/data/users/sfvziocom/httpd.conf:150) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:33:02 2012] [warn] Init: SSL server IP/port conflict: www.sf-vzio.com:443 (/usr/local/directadmin/data/users/sfvziocom/httpd.conf:61) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:33:02 2012] [warn] Init: SSL server IP/port conflict: www.newidsf.com:443 (/usr/local/directadmin/data/users/newidsf/httpd.conf:61) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:33:02 2012] [warn] Init: SSL server IP/port conflict: localhost:443 (/etc/httpd/conf/extra/httpd-vhosts.conf:38) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:33:02 2012] [warn] Init: You should not use name-based virtual hosts in conjunction with SSL!! [Sat Sep 15 14:33:02 2012] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec) [Sat Sep 15 14:33:03 2012] [warn] RSA server certificate CommonName (CN)localhost’ does NOT match server name!?
[Sat Sep 15 14:33:03 2012] [warn] Init: SSL server IP/port conflict: www.newpatch.tk:443 (/usr/local/directadmin/data/users/newpatch/httpd.conf:63) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:33:03 2012] [warn] Init: SSL server IP/port conflict: www.crazy-pro.tk:443 (/usr/local/directadmin/data/users/crazypro/httpd.conf:63) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:33:03 2012] [warn] Init: SSL server IP/port conflict: www.login.sf-vzio.com:443 (/usr/local/directadmin/data/users/sfvziocom/httpd.conf:150) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:33:03 2012] [warn] Init: SSL server IP/port conflict: www.sf-vzio.com:443 (/usr/local/directadmin/data/users/sfvziocom/httpd.conf:61) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:33:03 2012] [warn] Init: SSL server IP/port conflict: www.newidsf.com:443 (/usr/local/directadmin/data/users/newidsf/httpd.conf:61) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:33:03 2012] [warn] Init: SSL server IP/port conflict: localhost:443 (/etc/httpd/conf/extra/httpd-vhosts.conf:38) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:33:03 2012] [warn] Init: You should not use name-based virtual hosts in conjunction with SSL!!
[Sat Sep 15 14:33:03 2012] [notice] Apache/2.2.22 (Unix) mod_ssl/2.2.22 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.17 configured – resuming normal operations
[COLOR=#ff0000][B]มันแสดงแบบนี้อะครับ ดูไม่เป็น[/B][/COLOR]
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8405 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8409 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8412 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8415 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8416 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8418 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8419 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8426 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8433 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8471 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8474 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8518 exit, attempting to continue anyway
[Sat Sep 15 14:29:55 2012] [notice] caught SIGTERM, shutting down
[Sat Sep 15 14:31:03 2012] [warn] RSA server certificate CommonName (CN) localhost' does NOT match server name!? [Sat Sep 15 14:31:03 2012] [warn] Init: SSL server IP/port conflict: www.newpatch.tk:443 (/usr/local/directadmin/data/users/newpatch/httpd.conf:63) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:31:03 2012] [warn] Init: SSL server IP/port conflict: www.crazy-pro.tk:443 (/usr/local/directadmin/data/users/crazypro/httpd.conf:63) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:31:03 2012] [warn] Init: SSL server IP/port conflict: www.login.sf-vzio.com:443 (/usr/local/directadmin/data/users/sfvziocom/httpd.conf:150) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:31:03 2012] [warn] Init: SSL server IP/port conflict: www.sf-vzio.com:443 (/usr/local/directadmin/data/users/sfvziocom/httpd.conf:61) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:31:03 2012] [warn] Init: SSL server IP/port conflict: www.newidsf.com:443 (/usr/local/directadmin/data/users/newidsf/httpd.conf:61) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:31:03 2012] [warn] Init: SSL server IP/port conflict: localhost:443 (/etc/httpd/conf/extra/httpd-vhosts.conf:38) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:31:03 2012] [warn] Init: You should not use name-based virtual hosts in conjunction with SSL!! [Sat Sep 15 14:31:03 2012] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec) [Sat Sep 15 14:31:04 2012] [warn] RSA server certificate CommonName (CN)localhost’ does NOT match server name!?
[Sat Sep 15 14:31:04 2012] [warn] Init: SSL server IP/port conflict: www.newpatch.tk:443 (/usr/local/directadmin/data/users/newpatch/httpd.conf:63) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:31:04 2012] [warn] Init: SSL server IP/port conflict: www.crazy-pro.tk:443 (/usr/local/directadmin/data/users/crazypro/httpd.conf:63) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:31:04 2012] [warn] Init: SSL server IP/port conflict: www.login.sf-vzio.com:443 (/usr/local/directadmin/data/users/sfvziocom/httpd.conf:150) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:31:04 2012] [warn] Init: SSL server IP/port conflict: www.sf-vzio.com:443 (/usr/local/directadmin/data/users/sfvziocom/httpd.conf:61) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:31:04 2012] [warn] Init: SSL server IP/port conflict: www.newidsf.com:443 (/usr/local/directadmin/data/users/newidsf/httpd.conf:61) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:31:04 2012] [warn] Init: SSL server IP/port conflict: localhost:443 (/etc/httpd/conf/extra/httpd-vhosts.conf:38) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:31:04 2012] [warn] Init: You should not use name-based virtual hosts in conjunction with SSL!!
[Sat Sep 15 14:31:04 2012] [notice] Apache/2.2.22 (Unix) mod_ssl/2.2.22 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.17 configured – resuming normal operations
[Sat Sep 15 14:32:26 2012] [notice] caught SIGTERM, shutting down
[Sat Sep 15 14:33:02 2012] [warn] RSA server certificate CommonName (CN) localhost' does NOT match server name!? [Sat Sep 15 14:33:02 2012] [warn] Init: SSL server IP/port conflict: www.newpatch.tk:443 (/usr/local/directadmin/data/users/newpatch/httpd.conf:63) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:33:02 2012] [warn] Init: SSL server IP/port conflict: www.crazy-pro.tk:443 (/usr/local/directadmin/data/users/crazypro/httpd.conf:63) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:33:02 2012] [warn] Init: SSL server IP/port conflict: www.login.sf-vzio.com:443 (/usr/local/directadmin/data/users/sfvziocom/httpd.conf:150) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:33:02 2012] [warn] Init: SSL server IP/port conflict: www.sf-vzio.com:443 (/usr/local/directadmin/data/users/sfvziocom/httpd.conf:61) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:33:02 2012] [warn] Init: SSL server IP/port conflict: www.newidsf.com:443 (/usr/local/directadmin/data/users/newidsf/httpd.conf:61) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:33:02 2012] [warn] Init: SSL server IP/port conflict: localhost:443 (/etc/httpd/conf/extra/httpd-vhosts.conf:38) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61) [Sat Sep 15 14:33:02 2012] [warn] Init: You should not use name-based virtual hosts in conjunction with SSL!! [Sat Sep 15 14:33:02 2012] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec) [Sat Sep 15 14:33:03 2012] [warn] RSA server certificate CommonName (CN)localhost’ does NOT match server name!?
[Sat Sep 15 14:33:03 2012] [warn] Init: SSL server IP/port conflict: www.newpatch.tk:443 (/usr/local/directadmin/data/users/newpatch/httpd.conf:63) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:33:03 2012] [warn] Init: SSL server IP/port conflict: www.crazy-pro.tk:443 (/usr/local/directadmin/data/users/crazypro/httpd.conf:63) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:33:03 2012] [warn] Init: SSL server IP/port conflict: www.login.sf-vzio.com:443 (/usr/local/directadmin/data/users/sfvziocom/httpd.conf:150) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:33:03 2012] [warn] Init: SSL server IP/port conflict: www.sf-vzio.com:443 (/usr/local/directadmin/data/users/sfvziocom/httpd.conf:61) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:33:03 2012] [warn] Init: SSL server IP/port conflict: www.newidsf.com:443 (/usr/local/directadmin/data/users/newidsf/httpd.conf:61) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:33:03 2012] [warn] Init: SSL server IP/port conflict: localhost:443 (/etc/httpd/conf/extra/httpd-vhosts.conf:38) vs. www.boublepro.co.cc:443 (/usr/local/directadmin/data/users/boublepro/httpd.conf:61)
[Sat Sep 15 14:33:03 2012] [warn] Init: You should not use name-based virtual hosts in conjunction with SSL!!
[Sat Sep 15 14:33:03 2012] [notice] Apache/2.2.22 (Unix) mod_ssl/2.2.22 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.17 configured – resuming normal operations
[COLOR=#ff0000]มันแสดงแบบนี้อะครับ[/COLOR]
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8405 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8409 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8412 exit, attempting to continue anyway
[Sat Sep 15 14:29:53 2012] [error] could not make child process 8415 exit, attempting to continue anyway
แบบนี้ป่ะครับ
ดู connection ของ ip ที่เข้ามาทีครับ
netstat -ntu | grep ESTABLISHED | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -nr
โดยปกติผมว่ามันไม่น่าเกิจ 25 หล่ะน่ะ
– เพิ่ม SYN FLOOD ด้วยแหละกัน
netstat -ntu | grep SYN_RECV| awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -nr
ลองไปดู iptraf ด้วยก็ดีฮะ
แบบนี้ดูว่าโดเมนไหนโดนยิงไม่ได้ครับ
ต้องดู apache status ตามที่ icez บอก
หรือเข้าไปด๔ขนาด log file ที่ /var/log/httpd/domains ถ้าไฟล์ไหนใหญ่ก็ลองเข้าไปดูข้อมูลดูครับ
ใช่ฮะ แต่โดยปกติผมเช็คเท่านี้ล่ะถ้ามันไม่มีอะไรที่น่าสงสัย และก็ตามไปดูที่ server status อีกทีครับ
เพราะบางที เครื่องมันช้าเพราะสาเหตุอื่น แต่เราก็ชอบนึกไปว่ามันเป็นเพราะโดนยิง แต่มันไม่ใช่เสมอไปครับ
ปล. ดูจากพวก Monitoring Graph มาดูว่ามันมี connection เข้ามาผิดปกติจากวันก่อนๆหรือเปล่าด้วยก็ได้นะฮะ (คิดว่านะ)
ง่ายสุดคือดู apache server-status แต่ปัญหาคือตอนโดนยิง connection มันมักจะเต็มทำให้เข้าไม่ได้ เบื้องต้นให้พยายามเรียกดูหลายๆครั้ง หรือเปิดเรียกพร้อมกันหลายๆหน้าต่าง
ถ้าไม่สำเร็จก็ remote เข้าไปเรียกดู [COLOR=#008000]netstat[/COLOR] ว่ามี IP ใหน establish ที่ port 80 อยู่บ้าง ถ้าเป็นการยิงมาจาก IP เดียว ก็จะเห็น ip นั้นเชื่อมต่ออยู่จำนวนมาก แต่ถ้ามาจากหลาย IP ก็ยากหน่อย
เมื่อได้ IP แล้ว ก็เอาไปหาต่อว่า IP นั้นเรียกเข้ามาที่โดเมนอะไร โดย [COLOR=#ff0000]grep[/COLOR] หาจาก httpd log ของแต่ละโดเมน ถ้า IP มาไม่ซ้ำก็สุ่มๆดูซัก 4-5 ip ก็พอจะเจอว่ามาจาก domain ใหน
[COLOR=#008000]netstat -nt | grep ESTABLISHED | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -nr[/COLOR]
[COLOR=#ff0000]cd /var/log/httpd/domains
grep IP *.log[/COLOR]
หรืออีกทางก็คือ restart apache ใหม่ แล้วเรียก server-status ดูเรื่อยๆ ถ้าโดนยิงจริง แป๊บเดียวก็เต็มอีก
แต่การที่ apache เต็ม ไม่จำเป็นต้องมาจากโดนยิงเท่านั้น อาจจะมาจากปัญหาอื่นๆได้อีกหลายอย่าง เช่นโดน bot ถล่ม post เข้า webboard หรือ comment จนเวลาเรียกหน้านั้น mysql ทำงานหนักและใช้เวลานาน