Date: Sat, 17 Apr 2004 20:10:17 -0700 (PDT) From: Roger Marquis <marquis@roble.com> To: freebsd-security@freebsd.org Subject: Re: Is log_in_vain really good or really bad? Message-ID: <20040418031017.98ACEDAC11@mx7.roble.com> In-Reply-To: <20040417190059.06B0316A4F7@hub.freebsd.org> References: <20040417190059.06B0316A4F7@hub.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
z3l3zt@hackunite.net wrote: > Yesterday someone "attacked" by box by connection to several ports.. In > other words, a simple portscan.. yet, since my box has "log_in_vain" > enabled, so it tries to log everything to /var/log/messages, since the > logfile got full and the size went over 100K, it tried to rotate the log > to save diskspace. This is hardware problem. Any ATA/SATA disk will suck up CPU with every disk access. The solution is to switch to SCSI. Proper partitioning would also allow you to rotate log files every 10 or 20MB instead of at 100K. For reasons exactly like this I never partition a disk for anything other than swap. If filesystems need to be separated they're put on separate (SCSI) disks. Whether you need log_in_vain or not depend on what you do with the logs. Are you compiling statistics? Running Snort or another IDE? Separating facilities into different files (other than /var/log/messages)? Reading them regularly and often? If you answered no to two or more of these questions then there's probably little to lose by disabling log_in_vain. -- Roger Marquis Roble Systems Consulting http://www.roble.com/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040418031017.98ACEDAC11>