Re: [LUG] Virus

[Simon Waters <Simon@xxxxxxxxxxxxxxxxxxxx>]

Neil Williams wrote:
> Can you re-direct the logs to another machine?

Some of the log rotation tools will take care of this - of
course you might lose some log data if the rubbish comes fast
enough - but it is probably better to rotate logs faster and
lose some http log data that stop serving web pages - or other
consequences of filling /var.

For what it is worth one of my UNIX boxes runs perfectly happily
with half it's filesystems 100% full. It ain't good but it
carries on doing it's job... Not sure what happens when the
partition with the Oracle alert log fills up it's partitions -
some filesystems are better left....

> > question:
> > As these viruses are requesting something from my web server, if my sever
> > served say a file called nimba.ida would I be right in saying that this
> > would be perfectly legal.

Grey area - if they are still running IIS - do you really think
your clue hammer is going to drum some sense into them?

> I've noticed favicon.ico making a similar dent and when the
> majority of the error.log is 404 favicon.ico, it's time to think about a
> dummy file.

What characteristics does this file need - surely we can find a
mini penguin?

--
The Mailing List for the Devon & Cornwall LUG
Mail majordomo@xxxxxxxxxxxx with "unsubscribe list" in the
message body to unsubscribe.