Apache logs: checking a slowloris attack

Question

I’m simulating an attack slowloris to a Debian server running Apache.

The attacking machines are Debian as well.

In order to make sure that the attack slowloris was effective, would like to access the logs Apache and check if the denial of service occurred, that is, if he ever stopped accepting connections, the state of buffers and so on. The time of the attacks are known.

Does Apache provide such information? Where to check in Debian? Any suggestions what else to check?

Is it possible to "clean the logs" (after backing up) to restart the experiments? How to do this?

Answer 1

There are two relevant logs you might want to check:

• error.log, all errors that may have occurred in the service, usually in /var/log/apache2/error.log
• access.log, access logs (hours, source ip, HTTP method, url you accessed, User-Agent), usually at /var/log/apache2/access.log

To restart the logs (delete the contents), if you want to backup first:

cd /var/log/apache2
cp access.log access.backup1.log
cp error.log error.backup1.log

And to delete the content:

cd /var/log/apache2
sudo cp /dev/null access.log
sudo cp /dev/null error.log

Tip:
What I do mostly with the error.log is to follow you in real time in a terminal:

tailf -10 caminho/para/error.log

this means:
tailf: follow (follow) last file contents
-10: last 10 lines