5

I'm running a micro instance on Amazon Cloud Services, and a recent spike made our web server unresponsive, I'm trying to do a little research to determine if this was a DOS attack, or which process was hogging down the server.

I checked the Apache Access Log and all I see are Internal Dummy Connections from local IP

127.0.0.1 - - [18/Feb/2013:18:51:20 +0000] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.2.22 (Ubuntu) (internal dummy connection)"

that's an example, and I noticed when I tail the log file while refreshing the site, it adds a new record.

Why can't I see the remote IP that's connecting to the IP, and how can I better track down this issue?

Improve this question
2
  • Do you have any other logs configured? By using the CustomLog directive for instance? Commented Feb 18, 2013 at 23:58
  • No, I'm going to have to set them up to get the data I'm looking for. Commented Feb 20, 2013 at 18:08

1 Answer 1

Reset to default
3

Those "dummy" connections are the way Apache tells its child processed that the have to die.

Have a look at: http://www.thewebhelp.com/apache/internal-dummy-connection/

Improve this answer
5
  • Ok makes sense, is there a way for me to see which ips are connecting to the server, or making Apache requests? Commented Feb 18, 2013 at 19:53
  • I don't like using "default" logs. You can define a custom log on your virtual host configuration, like this: CustomLog /var/log/apache2/customlog.log common. Commented Feb 19, 2013 at 11:02
  • Also, on the link I posted before there's a way to solve the problem. See "The Solution" part. That should fix your problem and you won't be DoS from localhost again Commented Feb 19, 2013 at 11:03
  • Ok cool, I'm going to have to create a custom log to get the data I want, but I understand whats happening in the default logs, thanks for you help Commented Feb 20, 2013 at 18:11
  • not true. Could be from apache doing curl to itself. Commented Jun 9, 2015 at 8:58

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.