Public bug reported:
In Ubuntu's default configuration, it is possible for the system log
files in /var/log to grow as large as they wish. This can consume all
free space in the root filesystem, breaking systems that rely on file
access such as gksu, or web browsers that download to /tmp. At the
moment, huge log files cannot be resolved via a graphical interface.
Thus, this is a huge issue for desktop experience and server security
alike.
I mention server security because it is possible to make a server spew
log messages, consuming its free space and ultimately breaking the
thing.
Possible fixes:
* Create /var/log in a different partition by default to enforce a
particular maximum size. This can happen downstream.
* Create /var/log inside an image, as opposed to a real partition, so
that the fix could be applied smoothly during the upgrade process and
the log size increased dynamically. The image could even be compressed,
which should work out well for text only content. Again, that could
happen downstream.
* The system log daemon could itself enforce a specific log size as a
percentage of free space, ensuring that it never runs out of space for
new messages and never consumes all of the free space on disk. For
server administrators who really need those logs, configuration could
specify a safe backup location for logs that are not actually old.
(Unless it already supports that?)
* The system log daemon could try to detect redundant log messages and
act accordingly, possibly adding just the timestamps for extra messages
all in the same line. This would help server administrators, for
example, since a 4GB system log is not easily read even though it may
need to be to find other issues. (Although I suppose there are log
reading tools which present information in a similar way).
* gnome-system-log could notify the user when the log exceeds a
particular size and offer to remove old entries. (Back them up?). A
small daemon could run within a desktop user's session to notify him of
the same event.
This issue appeared to me not from an attack, but a /bug/ involving Intel
wireless drivers (#286285). There is a meta-issue where the user has his entire
root filesystem consumed by logs, possibly with worse results than the bug
itself. Because a bug - particularly a driver bug - can produce a logging
rampage, the system runs very slowly and encounters issues. Even moreso for
users who have not put /home into a separate partition, which is also the
default behaviour.
** Affects: ubuntu
Importance: Undecided
Status: New
--
System logs can grow to unmanageable levels, consume entire root filesystem
https://bugs.launchpad.net/bugs/298140
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
