4 Jan 13:50
Re: large resource.pag (16GB)
Stelio Gouveia <stelio <at> skyrove.com>
2010-01-04 12:50:25 GMT
2010-01-04 12:50:25 GMT
Hi Folks
On Fri, Dec 11, 2009 at 8:00 PM, Brian Rectanus <Brian.Rectanus <at> breach.com> wrote:
Ryan Barnett wrote:
> On Friday 11 December 2009 03:49:05 am Stelio Gouveia wrote:
>> Hi All
>>
>> I've had disk utilization hovering around 100%, after stracing apache i
>> found that is frequently opens resource.pag, this makes sense so far as i
>> make use of modsecurity and apache uses this as some sort of swap file.
>>
> Did you create any custom rules that use the resource collection or is the
> only reference to it the initcol action at the end of the
> modsecurity_crs_10_global.conf file?
I make use of the resource collection to track requests to a given script.
How much RAM+swap is on the box? This huge file could be causing the>
>> But the file size is 16 GB, does this sound right?
>>
> No, that is huge which makes me think that perhaps your rules are adding data
> to the resource file.
>
>> Would i see apache performance degradation because of a large resource.pag?
>>
> Perhaps yes.
machine to swap heavily if much of it is loaded into RAM. Stop Apache,
remove the resource.* files (or move them out of the way), then restart
Apache.
The performance improved significantly after removing and recreating the the resource.* files. But this is just an interim solution.
I am curious how much and how fast it grows. As Ryan asked, are you
using the collection in custom rules? If so, you may need to be
expiring data at a more aggressive rate. How much traffic are you seeing?
From the 4th of Dec '09 to 4th Jan '10, i've seen this file grow to 395MB. Of course this growth rate would vary depending on my traffic volumes.
I create my resource counter on the first request and then make it deprecate itself by 1 each 600 seconds, then make sure the counter expires after 3600 seconds.
But i'm not so sure that the expiry is happening.
My sec rule which does the above looks like such:
SecRule ARGS:mac "!^$" phase:2,nolog,pass,setvar:resource.score=+1,deprecatevar:resource.score=1/600,expirevar:resource.score=3600
Any obvious problems with this line which could be causing the resource.pag to continue growing?
- Stelio
thanks,
-B
--
Brian Rectanus
Breach Security
------------------------------------------------------------------------------
Return on Information:
Google Enterprise Search pays you back
Get the facts.
http://p.sf.net/sfu/google-dev2dev
_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html
--
Regards
Stelio Gouveia
--
Skyrove Software Engineer,
Skyrove (Pty) Ltd
Technology Top 100 Award Winner (2006)
Mobile: +27 82 34 09 120
Tel: +27 861 ROVERS (0861 768 377)
Fax: +27 86 6204077
Email & Gtalk: stelio <at> skyrove.com
Web: www.skyrove.com
This message contains confidential information. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message.
------------------------------------------------------------------------------ This SF.Net email is sponsored by the Verizon Developer Community Take advantage of Verizon's best-in-class app development support A streamlined, 14 day to market process makes app distribution fast and easy Join now and get one step closer to millions of Verizon customers http://p.sf.net/sfu/verizon-dev2dev
_______________________________________________ mod-security-users mailing list mod-security-users <at> lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Appliances, Rule Sets and Support: http://www.modsecurity.org/breach/index.html
RSS Feed