Usually, we use the top command to check the server performance when facing a slowness in the web application, which is the first level troubleshooting step employed by every Linux admin.
Sometime web server response is very slow due to multiple concurrent connections to Apache. If so, you might want to check how many active connections are there, and which IP takes the maximum of connections from Apache.
Not every Apache connection is a real user, some of them are search engine spider like googlebot, yahoobot. These bad bots make several simultaneous requests to Apache from the same IP address.
The Apache Web server controls concurrent connections using the ‘MaxRequestWorkers’ directive and '256' is the default value of MaxRequestWorkers. Any connection attempt beyond the MaxRequestWorkers limit will normally be queued, up to a number based on the ListenBacklog directive.
You can adjust this value depending on your server configuration and other requirements, but you must also increase ‘ServerLimit’ value when changing the MaxRequestWorkers value.
Concurrent Apache connection can be found using ‘netstat’ and ‘ss’ commands, these commands are widely used by system administrators and security professionals.
What’s ss command?
ss stands for socket statistics. It is used to dump socket statistics about network/socket connections.
It shows information similar to netstat, but it works better and faster compared with netstat. It can display more TCP and state information than other tools.
It’s faster than netstat, because it gets all the information directly from kernel space (with single source).
What’s the netstat command?
netstat stands for network statistics. It displays network connections, routing tables, interface statistics, masquerade connections, multicast memberships and network protocol statistics.
The netstat command has been deprecated and replaced by the ss command in most of the Linux distributions.
It reads various ‘/proc’ files to gather information. It would take more time when there are lots of connections to display.
1) Checking the number of concurrent Apache connections
Run following ss command to find the total number of concurrent connections to Apache:
# ss -ant | grep -E ':80|:443' | wc -l 500
Alternatively, you can get Apache concurrent connection using netstat command as shown below:
# netstat -ant | grep -E ':80|:443' | wc -l 430
2) Checking concurrent connections of Apache in detail
Run the below ss command to see detailed information of Apache connections instead of counting it.
It shows the active internet connections on the server on port 80 & 443:
# ss -ant | grep -E ':80|:443' LISTEN 0 128 10.10.6.160:80 : 106.222.112.160:12650 TIME-WAIT 0 0 94.237.76.92:443 114.119.135.42:2366 TIME-WAIT 0 0 94.237.76.92:443 114.119.135.42:2406 TIME-WAIT 0 0 94.237.76.92:443 127.0.0.1:38400 ESTAB 0 0 127.0.0.1:38454 94.237.76.92:443 ESTAB 0 0 94.237.76.92:443 117.249.205.234:64685 ESTAB 0 0 94.237.76.92:443 192.99.9.25:33132 ESTAB 0 0 94.237.76.92:443 66.249.71.82:49611 ESTAB 0 0 94.237.76.92:443 106.222.112.160:12648 TIME-WAIT 0 0 94.237.76.92:443 127.0.0.1:38412 ESTAB 0 0 127.0.0.1:38402 94.237.76.92:443 TIME-WAIT 0 0 94.237.76.92:443 157.46.105.172:45656 TIME-WAIT 0 0 94.237.76.92:443 127.0.0.1:38340 ESTAB 0 151496 94.237.76.92:443 106.222.112.160:12656 TIME-WAIT 0 0 94.237.76.92:443 127.0.0.1:38332 TIME-WAIT 0 0 94.237.76.92:443 127.0.0.1:38396 ESTAB 0 0 127.0.0.1:38460 94.237.76.92:443 TIME-WAIT 0 0 94.237.76.92:443 127.0.0.1:38374 ESTAB 0 0 94.237.76.92:80 5.9.61.232:51082 ESTAB 0 0 94.237.76.92:443 60.8.123.152:64476 ESTAB 0 0 94.237.76.92:443 167.114.209.104:35758 ESTAB 0 0 94.237.76.92:80 106.222.112.160:12643 ESTAB 0 0 94.237.76.92:443 167.114.158.215:53270 ESTAB 0 0 94.237.76.92:443 66.249.71.147:56912 ESTAB 0 0 94.237.76.92:443 127.0.0.1:38454 ESTAB 0 0 94.237.76.92:443 127.0.0.1:38468 ESTAB 0 0 94.237.76.92:443 127.0.0.1:38402 TIME-WAIT 0 0 94.237.76.92:443 127.0.0.1:38366
Check the same information using the netstat command as shown below:
# netstat -ant | grep -E ':80|:443'
3) Listing Apache connections sort by IP
To count the number of connections currently active in Apache from each IP address and to sort them, use the following command:
# ss -ant |grep -E ':80|:443'|grep ESTAB| awk '{print $5}' | cut -d":" -f1 | sort | uniq -c | sort -nr
8 94.237.76.92
8 127.0.0.1
2 5.9.61.232
2 106.222.112.160
1 98.236.14.66
1 66.249.72.22
1 66.249.71.48
1 192.99.9.25
1 167.114.209.104
1 167.114.158.215
Similarly, you can find the same information using netstat command as shown below:
# netstat -ant |grep -E ':80|:443'|grep ESTAB | awk '{print $5}' | cut -d":" -f1 | sort | uniq -c | sort -nr
6 162.158.155.70
5 127.0.0.1
2 172.68.51.180
2 172.68.215.98
2 172.68.215.86
2 172.68.215.77
2 172.68.215.75
2 172.68.215.113
2 172.68.215.111
2 172.68.215.109
2 172.68.215.101
2 172.68.215.100
2 162.158.150.128
2 162.158.150.120
2 162.158.118.154
2 141.101.96.253
2 141.101.96.243
2 141.101.76.234
2 141.101.105.254
.
.
Bonus Tips: 1) Counting running Apache processes in Linux
ps command is used to display all running processes in Linux system. Use the following format, if you would like to count the running Apache processes in Linux:
# ps -auxw | grep httpd | grep -v grep | wc -l 12
1.a) Listing Apache processes with ps
Use the following command to see the running httpd processes in Linux:
# ps auxw | grep httpd | grep -v grep nobody 7988 0.0 0.5 253280 23252 ? S 14:32 0:00 /usr/sbin/httpd -k start nobody 8050 0.0 0.6 253412 24276 ? S 14:33 0:00 /usr/sbin/httpd -k start nobody 8054 0.0 0.6 253280 23288 ? S 14:33 0:00 /usr/sbin/httpd -k start nobody 8158 0.0 0.6 253280 23296 ? S 14:33 0:00 /usr/sbin/httpd -k start nobody 8159 0.0 0.5 253280 23176 ? S 14:33 0:00 /usr/sbin/httpd -k start daygeek 8202 0.0 0.6 253416 23304 ? S 14:34 0:00 /usr/sbin/httpd -k start nobody 8203 0.0 0.5 253280 23052 ? S 14:34 0:00 /usr/sbin/httpd -k start nobody 8207 0.0 0.5 253280 23044 ? S 14:34 0:00 /usr/sbin/httpd -k start nobody 8213 0.0 0.6 253280 23300 ? S 14:34 0:00 /usr/sbin/httpd -k start nobody 8216 0.0 0.5 253280 23052 ? S 14:34 0:00 /usr/sbin/httpd -k start nobody 8218 0.0 0.6 253416 23304 ? S 14:34 0:00 /usr/sbin/httpd -k start nobody 8266 0.0 0.5 253148 23052 ? S 14:35 0:00 /usr/sbin/httpd -k start nobody 8267 0.0 0.5 253144 22800 ? S 14:35 0:00 /usr/sbin/httpd -k start nobody 8391 0.3 0.5 253144 22800 ? S 14:35 0:00 /usr/sbin/httpd -k start nobody 8393 0.5 0.5 253012 21776 ? S 14:35 0:00 /usr/sbin/httpd -k start nobody 8394 1.0 0.5 253144 22800 ? S 14:35 0:00 /usr/sbin/httpd -k start root 30500 0.0 0.0 227356 3584 ? Ss Jul25 2:33 /usr/sbin/httpd -k start
Conclusion:
In this guide, you learnt how to find Apache concurrent connection using the ss and netstat commands in Linux.
If you found this article helpful, please do share with your friends and spread the knowledge. Please feel free to comment below if you have any queries/concerns. We will get back to you as soon as we can. Happy learning!
