Understanding the Apache scoreboard

Question

How can I read the Apache scoreboard to understand what is going on?

Answer

Invoking the Apache scoreboard is simple simply by running the following command:

apachectl status

The server's current connections will appear in a summary resembling the following:

 ................................................................
 ................................................................
 ................................................................
 ..........................................................______
 __________________________R______R_____________R________________
 R_________R___R_________________________________R__R__RR___R_RR_
 R_R_R__R_R____R___W___R______R______________R_R__R_RRR__R_______
 __RR_R_W_____R___RRRRRR_R_R___R_________________R___............
 ................................................................
 ........................ 

Each of the characters in this output has a different meaning.

• _ — The server is waiting for the connection.
• S — The server is starting.
• R — The server is reading the request.
• W — The server is sending a reply.
• K — The server is in keep-alive (read) mode.
• D — The server received a DNS request.
• C — The server is closing the connection.
• I — Idle worker cleanup.
• . — Idle worker.

Understanding this will help you troubleshoot the issues that you may be experiencing. For example, a scoreboard that displays a large amount of "W" status,  may indicate a poorly performing web application such as a PHP website. Alternatively, if this coincides with a large number of traffic spikes, it may be a result of an attack (DoS).

Similarly, many requests stuck in "R" can be an indication of an attack known as Slowloris, in which many connections are opened and kept open for as long as possible. While cPanel software support staff is not equipped to help mitigate an attack, here is a document you may use for some suggestions:

How to Mitigate Slowloris Attacks

If you suspect your server to be undergoing an attack it is recommended that you contact your service provider/data host for assistance in mitigating the effects.