Question: I am hosting quite a lot of virtual hosts using Apache in a basic LAMP set up with the help of Webmin/Virtualmin. I am looking for a top-like tool in which I can monitor current connections. The virtual hosting part seems to be giving me trouble here. Here's what I've tried:

* `netstat` - I can see the connections, but they show me as if they're all using my primary domain, e.g. `mydomain.com:www`.
* `iftop` - I like it a lot, but similar downside as `netstat`: does not show the virtual host.
* `apachetop` - seems to be showing not information for all my virtual hosts. I'm logging to separate custom log files, which I'm suspecting is the cause for why it doesn't work.
* `ntop`, `darkstat`, `MRTG`, `bwm-ng`, `IPTraf` - not working either.

So, basically, I'm looking for something similar to the current output of `netstat`, but to include the virtual host the request is for, e.g.: `avirtualsite.com:www`.

Answer: 
All the tools you are trying will never give you the right answer. The reason is that the information you are requesting is lost when the connection is made.

Let's use an example: suppose your web server has one IP address (**1.2.3.4**) and two host names (**a.mydomain.com** and **b.mydomain.com**) that resolve to that IP address.

What happens when you use your favorite web browser when you visit **a.mydomain.com**?

1. The browser asks your DNS server the IP address **a.mydomain.com** corresponds to.
2. The DNS server tells the browser the address is **1.2.3.4**.
3. The web browser connects to **1.2.3.4**.

So `netstat` & co. only know that there's an incoming connection made to **1.2.3.4**. The reason why you see a host name instead of an IP address is that the IP address has a rDNS record, so `netstat` prefers to show that instead of the IP, because it's nicer. Try `netstat -n` (or remove the rDNS record) and you'll see the IP address.

But that's not all: when I said that the information about the host name that was used to make the connection was lost, I wasn't fully right. From the point of view of the TCP/IP stack, that sentence is true. But if we see the things from the point of view of the HTTP protocol, things are different. In every HTTP request there's a `Host:` header that contains the host name that was used by the browser to make the request.

So, in short, you should look at the log files of your web server. The web server is the service that handles the HTTP requests and therefore the only service that knows about the "original" host name.
You can check this with:

```
netstat -na | grep 'ESTA'

```