you can modify the command with the most used attacking words like wget, etc
\nfind \/usr\/local\/apache\/domlogs\/ -exec egrep -H \u2018(wget|curl|lynx|wget)%20? {} \\;<\/p>\n
tail -100000 \/usr\/local\/apache\/logs\/access_log | awk ‘{print $1}’ | sort | uniq -c |sort -n
\nnetstat -tn 2>\/dev\/null | grep :80 | awk ‘{print $5}’ | cut -f1 -d: | sort | uniq -c | sort -rn | head
\nnetstat -anp | grep 80
\ntac \/usr\/local\/apache\/logs\/error_log |less
\nnetstat -tn 2>\/dev\/null | grep :80<\/p>\n
\/usr\/bin\/lynx -dump -width 500 http:\/\/127.0.0.1\/whm-server-status | awk ‘BEGIN { FS = ” ” } ; { print $12 }’ | sed ‘\/^$\/d’ | sort | uniq -c
\nsite connections
\n\/usr\/bin\/lynx -dump -width 500 http:\/\/127.0.0.1\/whm-server-status | grep GET | awk ‘{print $12}’ | sort | uniq -c | sort -rn | head
\nbusiest site
\n\/usr\/bin\/lynx -dump -width 500 http:\/\/127.0.0.1\/whm-server-status | grep GET | awk ‘{print $14}’ | sort | uniq -c | sort -rn | head
\nbusiest script<\/p>\n
rlog \/usr\/local\/apache\/conf\/httpd.conf | head -35
\nchanges made to httpd.conf<\/p>\n
\/usr\/local\/apache\/bin\/httpd -S
\ngives a listing of how the active vhosts are configured and in what order they are loaded, including IP addresses, domain names, port and other infos<\/p>\n
netstat -tn | grep :80 | wc -l
\nopen connections to your webserver<\/p>\n
netstat -an |grep :80 |wc -l
\nShow how many active connections there are to apache (httpd runs on port 80)<\/p>\n","protected":false},"excerpt":{"rendered":"
you can modify the command with the most used attacking words like wget, etc find \/usr\/local\/apache\/domlogs\/ -exec egrep -H \u2018(wget|curl|lynx|wget)%20? {} \\; tail -100000 \/usr\/local\/apache\/logs\/access_log | awk ‘{print $1}’ | sort | uniq -c |sort -n netstat -tn 2>\/dev\/null | grep :80 | awk ‘{print $5}’ | cut -f1 -d: | sort | uniq -c… <\/p>\n