Date: Thu, 23 Oct 2003 18:41:12 -0600 From: Brett Glass <brett@lariat.org> To: Garance A Drosihn <drosih@rpi.edu>, security@freebsd.org Subject: Re: /var partition overflow (due to spyware?) in FreeBSD default install Message-ID: <6.0.0.22.2.20031023183427.04e18d10@localhost> In-Reply-To: <p0600201bbbbe19a62f97@[128.113.24.47]> References: <6.0.0.22.2.20031023162326.04c1e008@localhost> <p0600201bbbbe19a62f97@[128.113.24.47]>
next in thread | previous in thread | raw e-mail | index | archive | help
At 06:01 PM 10/23/2003, Garance A Drosihn wrote: >My /etc/newsyslog.conf indicates that /var/log/messages >should be rotated whenever it gets over 100K. Absolutely correct. And the default /etc/crontab doesn't run newsyslog often enough to catch it before it overflows the entire disk -- at least when there's a storm of these messages. (By the way, I've received a note via private e-mail suggesting that the QHosts worm could be the cuplrit, but it doesn't have these symptoms.) >I'm sure that /var can fill up even if /var/log/messages is >rotated every hour, if the error messages are coming in fast >enough. But the file should be getting rotated once per hour >in the default install, not once per day. Actually, you're correct. newsyslog runs once per hour in the default install. This shows just how fast the messages can accumulate. And when it DID finally run, it didn't have room to compress the old file, so the log remained uncompressed and the disk remained full. >I do not think that the correct solution is to rotate the >files at an even faster rate. Running newsyslog doesn't ALWAYS rotate the log. In the case of /var/messages, it checks to see whether the log needs it. >Just how large is /var on the >machine where you're seeing this problem? On the machine from which I took those messages, it's 256M. --Brett
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6.0.0.22.2.20031023183427.04e18d10>