[Xitami] some beginners questions ;-)

[Chris Olson]

"E. Egberts" wrote:

> These loggings are caused by infected ISS servers which are now trying to
> infect your server and many others. These attemps are of no harm for you

We process our server logs once per day with a logfile analyzer, then rotate
them via cron job.  Our servers are set up to do all logging on seperate
disk partitions or disks to prevent a locked server from an overflowed root
partition.  During the height of the NIMDA crisis last winter we were forced
to go to three times per day log file rotation to recover log partition
space from the log entries of zombied IIS webservers.  The problem is not as
pronounced now, and we have gone back to normal once per day rotation, but
there's still some zombied M$ servers out there.  I had one sys admin tell
me that they solved the problem by creating a fake directory and file
structure that matched what the NIMDA worm was looking for, which cut the
number of log file entries drastically.  I never tried this, but it did make
sense.

Regards,
-- 
Chris Olson
System Administrator
AST Communications    http://www.astcomm.net
Linux Support         http://linux.astcomm.net