RE: [cobalt-users] CPU heavily loaded, low on memory, smtp server not responding

[Graeme Fowler <graeme.fowler@xxxxxxxxxxxxxx>]

Brian wrote:
<snip>
> I'm not sure what was going on at that time. The only 
> somewhat processor intensive thing running at that time
> is webalizer 2.
> 
> I checked my logcheck messages and the only thing I found 
> strange was tons of "lame server" and "bad referral" messages.
> I usually get a few of these every hour but this was hundreds
> of them right around the time I was getting memory, cpu and
> smtp messages.

To skip all the various replies which helpfully explained lame servers, bad
referrals etc. and go on to something which nobody else suggested:

You're running webalizer2. In its' normal setup, you want to do name
resolution of all those IP addresses in your logs, so at runtime - every day
- you'll get bagloads of these messages. You can at the very least reduce
them by using a common DNS cache file (see the excellent webalizer docs) to
cache lookup results.

But also note that if you have an exceedingly big logfile for a site - say
(like other suggestions) someone has been FormMail bombing you, so there's
many many thousands of hits for a specific day (or alternatively you have
had a Nimda or CodeRed or similar outbreak in the immediate network
vicinity), then Webalizer will (a) take a lot longer than usual and (b)
occupy a LOT of memory while running.
The same thing happens with the default Cobalt scripts; in my experience a
logfile over 100MB will easily cripple a RaQ4 with 256MB.

Make sure they're (a) getting rotated, and (b) that something/someone/some
site is not experiencing unusually high hitrates.

My Euro 0.02 :)

Graeme
-- 
Graeme Fowler
System Administrator
Host Europe Group PLC