[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [cobalt-users] NIMDA Worm

Harald Messinger wrote:

> >I've problems with the NIMDA-Worm and my Logfiles (Raq2), they got today a
> >very big file-size and my hdd get's nearly full. do you have ideas to stop
> >logging when the NIMDA-Worm ist trying to attack my server?
>
> I've added the following line to /etc/cron.quarter-daily/splitlogs.pl
>
>  next if ($_=~/\/winnt/)||($_=~/\/scripts/)||($_=~/default.ida/)||($_=~/\/MSADC/);
>
> right before the line:
>  print COMB;
>
> This shoukld prevent all entries regarding the worms "code red" an "nimda" from
> being inserted in the combined-access and the virtual hosts log files.
>
> Best regards,
>  Harald Messinger

Hi

Is  /etc/cron.quarter-daily/splitlogs.pl a standard script on a RAQ 4 .. there is
nothing in my folder

Dave

>
>
> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To Subscribe or Unsubscribe, please go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users