[Xitami] Log file errors

[Thomas J. Hruska]

At 05:17 AM 11/9/2004 -0700, admin writeth:
>I have just noticed a weird event in the log file tracking on Xitami 2.5
>
>I am completely missing log files for all days between Oct. 17 through
Oct. 21
>Has this happened to anyone else and what caused it???
>
>Thanks.

Try checking Oct. 16th's or Oct. 22's logs.  I haven't seen Xitami fail to
log information, but I have seen it fail to roll over the logs to the next
day and accumulate 5-10 days worth before realizing it needs to roll over.
I'm pretty sure those logs should be somewhere...

My best guess (without looking at source code), the logs fail to roll over
when there is activity on the server at the exact moment the logs should
roll over - so the date never gets calculated to indicate a new file and
the current file just expands until the next day.  A DoS of sorts might be
able to be performed indirectly by forcibly expanding the logs every day
using a remote attack client.  When someone goes to open the logs with
something other than a 'tail'-like tool, it could drag RAM to a minimum and
CPU utilization to 100%.


Thomas J. Hruska
Shining Light Productions
http://www.slproweb.com/