[Summary-Talk] Summary v.s. The Worm

[Jeff McCombs <jeffm@xxxxxxxxxx>]

Folks,

    Im wondering how everyone deals with the large character-length 
entries
in your log files that are the result of one of the worms running amok on
the 'net. 

    Our servers are hit quite frequently by a worm that generates 5 to 8
thousand character-length entries in our logs. Usually these are HTTP 
SEARCH
requests with HEX-encoded URIs (e.g. SEARCH \x90\x320\x215....). Seems 
that
when Summary encounters these I see errors about lines being clipped and
stats become unreliable or sub-reports stop getting generated.

    Right now, I'm pre-processing the logs with a Tcl script that checks
line-length and truncates anything over 1500 characters in length. I'm
wondering if anyone has a better solution?

    We're slow to upgrade here, so we're running 2.3.12, and not the 3.x
versions, so if 3.x handles this stuff better, then we'll just upgrade. :)

-Jeff
-------------
Go to <http://summary.net/list.html> to update subscription info.