How to check what IP is DDOS the server

[viettechorg]

I got litespeed installed and server get DDOSed some time.

How can i check to find out what IP are they using to DDOS?

the access.log inside /opt/lsws/log/ is empty though

And i get alot error like this inside error.log

GET /dxxxxx/showthread.php?t=18625 HTTP/1.1
2007-10-30 11:15:47.411 [INFO] [58.186.202.153:1358-0#APVH_xxxx:80] HttpExtConnector state: 8, request body sent: 0, response body size: 0, response body sent:0, left in buffer: 0, attempts: 0.

 

[mistwang]

If those are from a few IPs, it means that they are trying to flood you server with junk requests, just block them with iptables. You can also reduce the "Max connections per IP" limit to ban them automatically if they try to establish 10+ concurrent connections to the server.