Hello,

my bash script detect excessive number of connections from an IP to port 80 and i would like my bash script to better decide whether this IP is contributing to the server overload (load average by "top" command or IOPS usage) so to consider if to ban this IP for some time.

On Linux (CentOS 6, 2.6.32 kernel) how can i discover load impact of a connections from some IP?

Thank You in advance.

Why don't you post your script, so we can all see what it's doing, and advise you from there? Again, as with most of your posts, you omit most of the details that would let anyone answer. You don't say what web engine you're using, bandwidth available, what kind of hardware its running on, what the websites DO (and are they PHP/Java/HTML/asp pages? Use DB backends? Database size? etc., etc., etc.) A single poorly-written web page can cause as much load an people hitting 100 properly written ones.

And since we don't know what you're doing in this bash script to determine what's going on, the only thing we can really tell you is "re-write your bash script to do whatever you'd like".

There are plenty of software packages (and stats-package macro sets) which can analyze an Apache log file.

First, be sure that your Apache has limits on the number of server-processes that it will spawn, so that any flood of requests will not result in a flood of workers, and/or actual "system overload."

Then, analysis of the situation is done by ordinary statistical analysis which considers not only "requests per second" or "simultaneous requests," but exactly what(!) those requests might be. A single-tier Apache system cannot discriminate between requests or place them into alternative queues for back-end processing, so you must either switch to a multi-tier workload processing system or throttle the system so that overload cannot occur (worst case) no matter what the incoming request pattern might be.