How can I read the Apache scoreboard to understand what is going on with the service?

Question

How can I read the Apache scoreboard to understand what is going on with the service?

Answer

Invoking the Apache scoreboard is simple simply by running the following command:

# apachectl status

The server's current connections will appear in a summary resembling the following:

CONFIG_TEXT:  ................................................................
................................................................
................................................................
..........................................................______
__________________________R______R_____________R________________
R_________R___R_________________________________R__R__RR___R_RR_
R_R_R__R_R____R___W___R______R______________R_R__R_RRR__R_______
__RR_R_W_____R___RRRRRR_R_R___R_________________R___............
................................................................
........................ 

Each of the characters in this output has a different meaning.

• _ — The server is waiting for the connection.
• S — The server is starting.
• R — The server is reading the request.
• W — The server is sending a reply.
• K — The server is in keep-alive (read) mode.
• D — The server received a DNS request.
• C — The server is closing the connection.
• I — Idle worker cleanup.
• . — Idle worker.

Understanding this will help you troubleshoot the issues that you may be experiencing. For example, a scoreboard that displays a large number of "W" statuses may indicate a poorly performing web application, such as a PHP website. Alternatively, if this coincides with a large number of traffic spikes, it may be a result of an attack (DoS).

Similarly, many requests stuck in "R" can be an indication of an attack known as Slowloris, in which many connections are opened and kept open for as long as possible. 

Warning: While cPanel software support staff is not equipped to help mitigate an attack, here is a document you may use for some suggestions:

How to Mitigate Slowloris Attacks

Note: If you suspect your server is undergoing an attack, it is recommended that you contact your service provider/data host for assistance in mitigating the effects.

How do I identify my hosting provider?