RE: [cobalt-security] Web.cache and web.cache.new

[Fred <journal@xxxxxxx>]

Hi Erwin

Thanks for the tips in order to decrease the size limit
I've made changes, is there something to do after I change logrotate file ?

BUT is there anyone who knows what's the web.cache and web.cache.new really
represents ??

because Daniel Neuhaus says that I can delete them or in the first line of
theses files
you can read :

  CACHE type 4 produced by analog 4.16/Unix. Do not modify or delete!


What's a dilemma !!

Now i'm sure that's not an denial of service attack but I want to know more
about these files !

Thanks for your advices

> Hi Fred,

> You could also decrease the size limit in the logrotate scripts and rotate
> the logs more often,

> Rotate 50 = the number of time to rotate log files before overwriting, you
> must add this line
> Missingok = Create log file if one does not exist
> Compress = Archive the log files
> Size = Max size of log file, this is 10% of the size allocated to the
> virtual site, so if your v-site has 100MB allocated to it, the log files,
> ftp, mail, and web will be 10MB each.

> I had to do this because my customers want archives of their older logs
> available.

> This is on a RAQ4 with all the latest patches installed, and it works fine
> for me.  You will have to modify the scripts in two places
> /etc/logrotate.d
> /etc/logrotate.onboot

> This method won't really do anything to the *.cache.new files unless you
> decrease the max size of the log file.

> file: /etc/logrotate.d/site#

> Example:

> /home/sites/site#/logs/mail.log {
>    rotate 50
>    missingok
>    compress
>    size 10M
> }

> /home/sites/site#/logs/ftp.log {
>    rotate 50
>    missingok
>    compress
>    size 10M
> }

> /home/sites/site#/logs/web.log {
>    rotate 50
>    missingok
>    compress
>    size 10M
> }

> HTH,
> Ervin

> -----Original Message-----
> From: cobalt-security-admin@xxxxxxxxxxxxxxx
> [mailto:cobalt-security-admin@xxxxxxxxxxxxxxx]On Behalf Of Fred
> Sent: Friday, September 14, 2001 6:12 AM
> To: cobalt-security@xxxxxxxxxxxxxxx
> Subject: [cobalt-security] Web.cache and web.cache.new

> hello

> I just recieved an alert from my cobalt . Non more place ...
> But when I look at my logs web.cache and web.cache.new is very very big
>  (25 M each)

> Is it normal ? not an attack ? denial of service ?
> Could I reset or delete these files ?

> Thanks for all

> Fred

> _______________________________________________
> cobalt-security mailing list
> cobalt-security@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-security

> _______________________________________________
> cobalt-security mailing list
> cobalt-security@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-security