Re: [Summary-Talk] Summary v.s. The Worm

[Jason Linhart <jason@xxxxxxxxxxx>]

On 5/11/04 12:13 PM Jeff McCombs (jeffm@nicusa.com) wrote:

>Seems that when Summary encounters these I see errors about lines
>being clipped and stats become unreliable or sub-reports stop getting
>generated.

I think that there might be something else going on, besides just having 
really long URLs in the log files.

There is a server attack going around that uses 32K long URLs to try and 
cause a buffer overflow (the attack targets some Microsoft IIS servers), 
and others that use shorter but still very long requests to attack other 
vulnerabilities on IIS.

These really log requests can cause occasional parse errors in Summary 
and they can cause the message "DataPutString: String too long, clipped" 
to be displayed on the Summary console, or in the summary.log file. But 
the worst that should happen is that Summary will ignore those specific 
requests. The parse errors and DataPutString errors are harmless.

>Right now, I'm pre-processing the logs with a Tcl script that checks
>line-length and truncates anything over 1500 characters in length.

Are you sure that this completely solves the problem? Almost all servers 
are getting hit by these really long requests, and yet the great majority 
of the users of Summary are not having any problems. Are you seeing any 
other messages on the Summary console or in the summary.log file 
(depending on which platform you are on)?

It seems most likely that you are running into some other problem, in 
addition to the long URLs. Whatever is happening I would like to try and 
duplicate it here. You wouldn't happen to have a log file that can 
reliably be used to get Summary to fail?

Jason

-----------------
Jason@Summary.Net
-----------------
Dr. Seuss books . . . can be read and enjoyed on several levels. For
example, 'One Fish Two Fish, Red Fish Blue Fish' can be deconstructed
as a searing indictment of the narrow-minded binary counting system.
  -- Peter van der Linden, Expert C Programming, Deep C Secrets
-------------
Go to <http://summary.net/list.html> to update subscription info.