/var partition overflow (due to spyware?) in FreeBSD default install

[Brett Glass]

At 06:01 PM 10/23/2003, Garance A Drosihn wrote:

>My /etc/newsyslog.conf indicates that /var/log/messages
>should be rotated whenever it gets over 100K.

Absolutely correct. And the default /etc/crontab doesn't
run newsyslog often enough to catch it before it overflows the 
entire disk -- at least when there's a storm of these messages.
(By the way, I've received a note via private e-mail suggesting
that the QHosts worm could be the cuplrit, but it doesn't have
these symptoms.)

>I'm sure that /var can fill up even if /var/log/messages is
>rotated every hour, if the error messages are coming in fast
>enough.  But the file should be getting rotated once per hour
>in the default install, not once per day.

Actually, you're correct. newsyslog runs once per hour in the
default install. This shows just how fast the messages can
accumulate. And when it DID finally run, it didn't have room to
compress the old file, so the log remained uncompressed and the
disk remained full. 

>I do not think that the correct solution is to rotate the
>files at an even faster rate.

Running newsyslog doesn't ALWAYS rotate the log. In the case
of /var/messages, it checks to see whether the log needs it.

>Just how large is /var on the
>machine where you're seeing this problem?

On the machine from which I took those messages, it's 256M.

--Brett