Is there a program to view live HTTP requests under the Apache server?

Question

I'm looking for a program or add on that will be able to show all live incoming requests to a server.

Answer 1

in your terminal, type

tail -f /var/www/log/apache2/other_vhosts.access.log 

this will view live requests.

Answer 2

As pointed out by @Maor H., the access log is usually the most convenient place to get "incoming" requests. These logs may be configured to go anywhere, but can usually be found somewhere under /var/log/apache2/ or /var/log/httpd/.

Their location is determined by the CustomLog directives in httpd.conf or an included file (such as a virtualhost). So, searching for that in your httpd.conf and similar *.conf files is generally a good start, if the logs can't be found in one of the /var/log/* directories mentioned above.

However, an important distinction is that that apache/httpd's logs are not written to until the request has completed. This is simple to note, as the log entries usually include things like the status code of the final request (%>s in the LogFormat directive) and how long the request took (%T in the LogFormat directive).

If you are interested in seeing requests "as they come in", the short answer is that there is no "good" way that I am aware of. However, a usually good-enough method is using Apache's mod_status, which is usually configured (when it is configured) to be accessible via http://127.0.0.1/server-status/ from the same machine as the server itself. With mod_status configured, you can usually see the output of the "scoreboard", as it is called, from the command-line using a command similar to apachectl fullstatus, or (depending on your distribution) service httpd fullstatus.

The server-status/fullstatus/"scoreboard" will show a summary of the active (and inactive) connections, a truncated copy of the request itself, and what is currently happening with regard to that request (eg: Is it being processed? Is the reply being sent? Is it idle? Is it just waiting for a new connection?)

The main downsides of the scoreboard are that it does not lend itself well towards being tailed or otherwise actively monitored. It is good for determining what might be causing undue load on the server, though even for that it has the downside of only being accessible when apache is capable of serving an extra connection (so it's no good for finding out what is blocking additional connections).

The main benefit of the scoreboard is, as mentioned above: it gives you the request details before the request has finished. With that in mind, it may better fit your request for a list of "incoming" requests.

If you want to get lower-level about things, and aren't talking about a production server, then of course WireShark can give you a live list of HTTP requests as they come in. This monitors the TCP connections themselves, and is too resource-intensive for production use. If you are trying to find out what is actually happening on the wire, as it happens, it is the best bet.