links --dump 1 http://localhost/server-status|grep ^[0-9]|awk 'BEGIN {print "Seconds, PID, State, IP, Domain, TYPE, URL\n--"} $4 !~ /[GCRK_.]/ {print $6, $2, $4, $11, $12, $13 " " $14|"sort -n"}'

Summarize Apache Extended server-status to show longest running requests

Ever need to know why Apache is bogging down *right now*? Hate scanning Apache's Extended server-status for the longest running requests? Me, too. That's why I use this one liner to quickly find suspect web scripts that might need review. Assuming the Extended server-status is reachable at the target URL desired, this one-liner parses the output through elinks (rendering the HTML) and shows a list of active requests sorted by longest running request at the bottom of the list. I include the following fields (as noted in the header line): Seconds: How long the request is alive PID: Process ID of the request handler State: State of the request, limited to what I think are the relevant ones (GCRK_.) IP: Remote Host IP making the request Domain: Virtual Host target (HTTP/1.1 Host: header). Important for Virtual Hosting servers TYPE: HTTP verb URL: requested URL being served. Putting this in a script that runs when triggered by high load average can be quite revealing. Can also capture "forgotten" scripts being exploited such as "formmail.pl", etc.
Sample Output
Seconds, PID, State, IP, Domain, TYPE, URL
--
0 9683 W 127.0.0.1 web1.example.com GET /server-status
30228 11849 W 222.222.222.222 example.com POST /phpAds//adxmlrpc.php/xmlrpc.php
50251 1010 W 111.111.111.111 example.com POST /phpAds//adxmlrpc.php/xmlrpc.php

6
2009-02-19 13:06:44

These Might Interest You

  • -n 9000 : Number of requests to perform for the benchmarking session -c 900 : Number of multiple requests to perform at a time Show Sample Output


    10
    ab -n 9000 -c 900 localhost:8080/index.php
    amaymon · 2009-08-07 07:19:40 1
  • Useful when checking MySQL status. Show Sample Output


    3
    mysqladmin -u root -p extended-status
    rockon · 2012-05-27 11:38:11 1
  • This takes the stream created by apache requests containing jsp and funnels them to another server. I'm using this for simulating real time traffic. The nice command gives ssh maximum CPU cycles, awk & grep strip out everything served by apache. Putting parallel on curl is important because curl is synchronous and waits for the response. Yes, I thought about using wget but it didn't seem any easier. Also, if you figure out how to run this in the background let me know. Every time I background it it stops. If you have multiple front end servers just run multiple instances of this.


    3
    nice -n -20 ssh SOURCE_SERVER "tail -f /var/log/httpd/access.log " | awk '{print $7}' | grep jsp | parallel 'curl TARGET_SERVER{} 2>&1 /dev/null'
    dennisfaust · 2011-05-09 19:32:40 1
  • Show's per IP of how many requests they did to the Apache webserver


    1
    cat /var/log/apache2/access_logs | cut -d ' ' -f 1 | uniq -c | sort -n
    basvdburg · 2013-09-02 13:04:47 1
  • Depending on your Apache access log configuration you may have to change the sum+=$11 to previous or next awk token. Beware, usually in access log last token is time of response in microseconds, penultimate token is size of response in bytes. You may use this command line to calculate sum and average of responses sizes. You can also refine the egrep regexp to match specific HTTP requests. Show Sample Output


    0
    egrep '.*(("STATUS)|("HEAD)).*' http_access.2012.07.18.log | awk '{sum+=$11; ++n} END {print "Tot="sum"("n")";print "Avg="sum/n}'
    fanchok · 2012-07-27 12:18:29 0
  • the good: Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.4 with Suhosin-Patch the bad: Server: Microsoft-IIS/6.0 and the ugly: Server: Apache/2.2.10 (Win32) mod_ssl/2.2.10 OpenSSL/0.9.8i PHP/5.2.6


    8
    wget -S -O/dev/null "INSERT_URL_HERE" 2>&1 | grep Server
    asmoore82 · 2009-03-09 06:54:54 1

What Others Think

Very nice! Using this almost verbatim, but added CPU util back in.. FWIW, debian links does not like the --dump, just a single - is fine.
Guyverix · 425 weeks and 3 days ago
hm, getting back: Unknown option http://localhost/server-status but the apache2 module is on: a2enmod status Module status already enabled links -dump 1 http://localhost/server-status|grep ^[0-9]|awk 'BEGIN {print "Seconds, PID, State, IP, Domain, TYPE, URL\n--"} $4 !~ /[GCRK_.]/ {print $6, $2, $4, $11, $12, $13 " " $14|"sort -n"}' Seconds, PID, State, IP, Domain, TYPE, URL -- Unknown option http://localhost/server-status
Ovidiu · 367 weeks and 6 days ago

What do you think?

Any thoughts on this command? Does it work on your machine? Can you do the same thing with only 14 characters?

You must be signed in to comment.

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands



Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: