From owner-freebsd-security@FreeBSD.ORG Mon Oct 27 06:08:39 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E632B16A4B3 for ; Mon, 27 Oct 2003 06:08:39 -0800 (PST) Received: from ucan.foad.org (ucan.foad.org [64.173.36.245]) by mx1.FreeBSD.org (Postfix) with ESMTP id 335D243F93 for ; Mon, 27 Oct 2003 06:08:39 -0800 (PST) (envelope-from pde@ucan.foad.org) Received: from ucan.foad.org (pde@localhost.stanford.edu [127.0.0.1]) by ucan.foad.org (8.12.10/HIGHWIRE2.0) with ESMTP id h9RE8cPc014583 for ; Mon, 27 Oct 2003 06:08:38 -0800 (PST) Received: (from pde@localhost) by ucan.foad.org (8.12.10/8.12.9/Submit) id h9RE8cHI007704 for security@freebsd.org; Mon, 27 Oct 2003 06:08:38 -0800 (PST) Date: Mon, 27 Oct 2003 06:08:38 -0800 From: Pete Ehlke To: security@freebsd.org Message-ID: <20031027140838.GA23841@ehlke.net> References: <6.0.0.22.2.20031023162326.04c1e008@localhost> <6.0.0.22.2.20031023183427.04e18d10@localhost> <20031023204646.A61063@cs.utah.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20031023204646.A61063@cs.utah.edu> User-Agent: Mutt/1.4.1i X-Mailman-Approved-At: Thu, 30 Oct 2003 05:59:06 -0800 Subject: Re: /var partition overflow (due to spyware?) in FreeBSD default install X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Oct 2003 14:08:40 -0000 On Thu, Oct 23, 2003 at 08:46:46PM -0600, David G. Andersen wrote: > Garance A Drosihn just mooed: > > newsyslog for the past year. I am pretty familiar with it. > > > > What I meant was that in circumstances where "once per hour" > > is not fast enough, then I do not believe the right solution > > is to rotate files every five minutes. Just MO. > > the problem is very obviously an excess of messages from bind. > This bug report should go to the ISC folks. No daemon should > be spewing out log messages at the _incredible_ rate that > bind does when it decides it doesn't like what it's getting > in this context. The same bug can be triggered by using a > forwarding nameserver that bind doesn't like. It logs messages at the rate that it sees errors. > The immediate question to ask is, "is this fixed in bind9?" > Well, no. The immediate question to ask is "why are you sending bind messages to syslogd in the first place?" see http://www.isc.org/products/BIND/docs/config/logging.html for how to configure bind to do sane logging, including size-based autorotation of log files. -Pete