The problem is not that the log file consumes all disk space, it's that httpd terminates (the parent process, and all children) when the log file reaches 2GB. Supporting LARGEFILE would fix that.
You're right that a problem would remain about an attacker simply filling all disk space, but that's more manageable (disks are bigger than 2GB), and this condition doesn't kill httpd. Graham Wiseman [EMAIL PROTECTED] -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, August 13, 2002 2:18 PM To: [EMAIL PROTECTED] Cc: Graham Wiseman; Richard Reiner Subject: Re: Apache dies on large error_log (possible remote DoS) On Tue, Aug 13, 2002 at 11:54:14AM -0400, Cliff Woolley wrote: > This has always been the case for both Apache 2.0 and 1.3 and is a > well-known issue. It's up to the administrator to have appropriate log > rotation and monitoring in place, as there's not much we can really do > about this from within the server itself. We *could* teach httpd about LARGEFILE so if the OS supports it we can have large logs, but, the essential problem still remains - you can easily get the log file to eat up all disk space. -- justin
