Web Hosting Talk : Web Hosting Main Forums : Web Hosting : Server DDoS'ed, but how to know which website?

[Uncle Mad]

Hi,

If my server is suffering an attack, how can i filter out and know which website exactly to isolate?

[servertechs]

check the apache logs

[UH-Bobby]

Originally Posted by servertechs

check the apache logs

Beat me to it

[Geekfer]

Originally Posted by UH-Bobby

Beat me to it

Could you please provide more details how to check Apache logs? I guess some of the users don't know how to do it.

[SSHocker]

Originally Posted by Geekfer

Could you please provide more details how to check Apache logs? I guess some of the users don't know how to do it.

Read the log file "access_log" normally located in the logs directory

[david510]

You can check the apache status page to get much details. If you do not have a control panel, you need to configure it on the apache.

[hostingdispatch]

Apache Status in your WHM. Dont you run any kind of firewall?

[rankris]

Do you use any control panel like cpanel? If so you might have some stats prograams enabled which will give you an exact idea for example awstats

[txitcs]

Thats one of the web hosts I'd be scared to use.

[HostLeet]

If you use cPanel, simply click on the Error Log link located in the Logs tab. This is your apache error logs and will usually display the last 300 errors for your site.

[MikeDVB]

Generally it's not going to matter what site is being attacked as any smart attacker is going to target an IP and not a domain. If your datacenter doesn't have good DDoS protection such as Tipping Point or Cisco Guard or some other means then you're pretty much going to be out of luck until the attack subsides.

Your datacenter is more likely to null-route the IPs to your server than to do anything else about the attack unless they have the equipment and the skills on hand to handle an attack.