1

I have a shared server that had a Wordpress site that was compromised. I cleaned out all the wordpress sites on the server and everything seemed to be fine.

When I checked today I noticed a large volume of httpd request in htop.

Question: Is there an easy way to locate what site on the server is generating those requests?

Centos 6.5

  • For clarity: do you mean inbound or outbound http requests? – Wolfer Aug 1 '14 at 13:48
  • Sorry: Inbound traffic – brentwpeterson Aug 1 '14 at 13:49
1

(The following assumes Apache httpd.) If you have the handler configured, you can see status information at http://your.host/server-status, which includes the last request each thread/process handled. A snippet of example output from http://www.apache.org/server-status:

Srv PID Acc M   CPU SS  Req Conn    Child   Slot    Client  VHost   Request
0-3 14945   0/1516/44613    _   388.52  6   0   0.0 198.85  4925.35 200.23.10.34        
0-3 14945   0/1487/45982    _   388.22  9   0   0.0 36.54   5136.00 68.84.15.163        
0-3 14945   0/1499/47317    _   388.55  5   0   0.0 55.79   4677.07 190.245.218.189 www.apache.org:80   GET /proper/commons-bsf/images/external-classic.png HTTP/1.1
0-3 14945   0/1488/44601    _   388.58  0   0   0.0 51.48   5345.17 14.139.185.82       
0-3 14945   0/1245/47133    _   388.41  2   0   0.0 39.04   4884.93 95.91.249.186       
0-3 14945   0/1339/46175    R   388.07  0   1   0.0 220.24  4794.02 14.139.185.82       
0-3 14945   0/1474/47807    _   388.41  3   0   0.0 36.18   4933.90 95.91.249.186       
0-3 14945   0/1479/48044    _   388.45  9   0   0.0 37.67   5960.46 68.84.15.163    www.openoffice.org:80   GET /projects/update/aoo341/check.Update HTTP/1.1

Srv Child Server number - generation
PID OS process ID
Acc Number of accesses this connection / this child / this slot
M   Mode of operation
CPU CPU usage, number of seconds
SS  Seconds since beginning of most recent request
Req Milliseconds required to process most recent request
Conn    Kilobytes transferred this connection
Child   Megabytes transferred this child
Slot    Total megabytes transferred this slot

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.