The first inkling that I had a problem with a DDoS (Distributed Denial of Service) attack was a note sent to my inbox:
lfd on server1.myhostname.com: High 5 minute load average alert – 89.14
My initial thought was that a site on my server was getting Slashdotted or encountering the Digg or Reddit effect. I run Chartbeat on several sites where this occasionally happens and I will usually get an alert from them first. A quick look at the Extended status page from Apache showed that I had a much different kind of problem.
How to Stop an Apache DDoS Attack with mod_evasive
