Lee B's questions

Can anyone recommend a config, or better yet point me to a full case study for this web setup?

Basically we have a php site getting about 100,000 hits per day. It's already getting connection timeouts etc. when trying to serve this load on a VPS, due to hitting CPU capacity. I'd like to spec something that will allow it to scale to about 250,000 hits per day.

Currently the server is:

• a single-core 1Ghz burstable VPS (from a 2.6Ghz dual core Xeon)
• 2GB burstable RAM (again, I find burstable very vague)
• 32MB per php process, running expression engine (as far as I know) or something similarly heavy
• quite image-intensive graphical pages
• occasional behind-the-scenes work on some pages, like xmlrpc to third-party servers
• plain apache with modphp (so static files like images also need full php processes -- this can't be changed for now)

So far, CPU seems to be the main bottle neck, with some apache process using around 30% CPU during requests. Some other apache processes seem much better at only 1% CPU; I assume these are requests for static files.

So. We want to get away from the VPS onto some sort of dedicated or virtual dedicated box with non-burst (measurable, guaranteed) performance. It has to be able to handle currnet traffic and at least double that in future.

Any recommendations or studies you can point me to?

Are there any tools around which can give you an estimated server spec based on parameters like memory per apache process, percentage of requests that are dynamic, whether PHP code is heavy CMS stuff or lightweight hello-world stuff, etc?

I'm looking at removing password-based logins for SSH. However, I don't want to allow passwordless ssh keys, as that would be even worse.

How can I make sure that only SSH keys which have passwords can connect?

If this can't be done, are there alternatives, like centrally managing SSH key generation, and preventing users from generating and/or using their own keys? Something like PKI, I suppose.

With iptables -L -n -v, you can get the number of times each firewall rule has been applied, which is very useful in debugging. I'd like to know if there's a similar way to find out how many times a network route has been used. I'm mostly asking about Linux and Windows solutions, but any platforms' solutions to this would be interesting.