We have one customer's site that's running on a, well, let's call it a not-so-very-good platform. If it gets too many hits, the database tends to get slow very quickly, which results in a severe congestion. I was looking for a way to easily check if a certain IP has been hitting the same site a lot, since that's usually the cause (someone who wants to download the entire site or something). Thanks to a tip on IRC, I finally found the tool for that and it turns out it was installed already!
The solution: apachetop. I tend to start it as follows:
apachetop -H 5000 -d 2 and when it has started, I press 'd' once, which will make it show me the source ip addresses. Nice!
PS. Another solution:
tail -10000 access.log | cut -d ' ' -f 1 | sort | uniq -c | sort -nr | head -n 10