[email protected] wrote: > Yesterday someone "attacked" by box by connection to several ports.. In > other words, a simple portscan.. yet, since my box has "log_in_vain" > enabled, so it tries to log everything to /var/log/messages, since the > logfile got full and the size went over 100K, it tried to rotate the log > to save diskspace. This is hardware problem. Any ATA/SATA disk will suck up CPU with every disk access. The solution is to switch to SCSI. Proper partitioning would also allow you to rotate log files every 10 or 20MB instead of at 100K. For reasons exactly like this I never partition a disk for anything other than swap. If filesystems need to be separated they're put on separate (SCSI) disks. Whether you need log_in_vain or not depend on what you do with the logs. Are you compiling statistics? Running Snort or another IDE? Separating facilities into different files (other than /var/log/messages)? Reading them regularly and often? If you answered no to two or more of these questions then there's probably little to lose by disabling log_in_vain. -- Roger Marquis Roble Systems Consulting http://www.roble.com/ _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[email protected]"