I rent a server on Debian 6 running ISP Manager Lite.

Three days in a row the server was very hard. Suspicion of ddos ​​attack. On the server 30 sites under different users.

Tell me which way to dig, to track which site was such a load?

PS: provider and hoster are silent, they say that they have nothing to do with it.

    2 answers 2

    path to apache logs

    /var/log/apache2/access.log /var/log/apache2/error.log

    for site.name in file

    /etc/apache2/sites-available/site.name ErrorLog string contains the path to the site.name error file

    another point: maybe the server does not have enough resources to process all calls. in my experience it makes sense to talk with the developers of the site

      Look in the server logs: how many requests go exactly where. Your hoster is strange, they should have been the first to point you to the logs.

      • this is not a hoster. this is a data center, they provide paid advice. tell me where to watch the logs? Does the Apache have common logs? I only know where the logs for each site look. - neochar
      • there should be a common log, not just separate logs for each virtual host. usually in the directory ../var/log/ .. error_log, access_log files, and what shows in the logs that could be found? - condor
      • thank. Now look at the general and individual logs - neochar