[Wizardjv]

Ahh then you would want to do something like this. All the lines with code tags or the commands.

The main causes you will find are abuse from specific IPs or inefficient scripts. In the case where it is abuse you should be able to determine the cause if you specifically look at each of the access logs for your domains. Go to:

/home/user/logs/domain.com/http

where 'user' is your actual user and 'domain.com' is one of your domains - you'll want to do this for each of the domains under your user. Enter this command to see the IPs hitting the domain the most:

tail -10000 access.log| awk '{print $1}' | sort | uniq -c |sort -n

or for the whole log:

cat access.log| awk '{print $1}' | sort | uniq -c |sort -n

Which gives you something like this (I am just showing the bottom of the output):

364 65.214.44.72
436 64.172.17.3
657 204.74.126.70
1799 33.36.52.212
1847 66.249.66.167

If you find IPs that are connecting a lot first check to see who it is:

host ipaddy

replace ipaddy with says 66.249.66.167

so

host 66.249.66.167

Then you would block the ip addy connecting alot.

Maybe that will help if you can find the logs