Webserver is slow due to a large number of connections showing proxy-subdomains-vhost.localhost

Symptoms

Are you seeing your server appear to be running slower or showing a high amount of CPU usage along with a large number of connections to proxy-subdomains-vhost.localhost?

Description 

The proxy-subdomain-vhost.localhost is what is used for Service Subdomains (formerly known as Proxy Subdomains) that provide access to cPanel & WHM interfaces and services such as cPanel, WHM, and Webmail. More information can be obtained in the following article:

What are Service Subdomains?

To quickly check for which service subdomains are the most used, please review the following log file:

/etc/apache2/logs/domlogs/proxy-subdomains-vhost.localhost

Below is a command that may help isolate which domains are being used the most via the webmail service subdomains as an example. For the webmail service subdomain, this command will show the number of "accesses" for each domain, from the most to the least.

grep 'http://webmail.' /etc/apache2/logs/domlogs/proxy-subdomains-vhost.localhost |awk '{print $11}' | awk -F '/' '{print $3}' | sort | uniq -c | sort -k 1 -n | tac | less

To check the other service subdomains, replace webmail in the above command with any of the entries specified in the following online document:

Service and Proxy Subdomains

Usually, when a service subdomain is highly accessed then a bruteforce attack may be ongoing. The following article explains how to use cPHulk to stop such brute force attacks:

What is cPHulk?