How to figure out which web-site is active at the exactly moment
 

Server cpu is eaten by httpd processes, like

9712 apache 17 0 105m 73m 19m R 5.4 7.4 0:00.85 httpd

when I ngrep
#ngrep porn port 80

I see, that my server is sending and receiving materials containing this word

T 111.222.333.444:80 -> 194.8.74.35:4023 [A]
..<form action="profile.php" enctype="multipart/form-data" method="post">...<table class="forumline" width="100%" cellspacing="1" cellpadding="4" .... value="pornushka2342@tdremo

I don't know how to figure out which sites on my server are participating in such negotiations

Can someone help me in this?

Thanks

well just look at the access logs. easily the simplest way.