[Dshield] Daily Reports & db status

Peter Stendahl-Juvonen peter.stendahl-juvonen at welho.com
Sun Jun 19 10:28:45 GMT 2005



Robert, Deb, Johannes, Joel, Keith et al.

list-bounces at lists.dshield.org <mailto:list-bounces at lists.dshield.org>
wrote on Saturday, June 18, 2005 4:29 PM (EET) UTC+3 on behalf of
Robert Nelson  

| Hi Deb
| 
| Perhaps this info may help:
| 
| I had always received the Daily Report until the big server crash
| several months ago. The sporadic receipt started after the new server
| was up and running. 
| 
| Does this sound familiar to anyone else here?
| 
| Robert
| 
Deb Hale <mailto:haled at pionet.net> wrote on June 16, 2005 11:39 AM (EET)

| Mike, Aaron - all - I am going to try to work with Johannes to see if
| there is anything I can do to help him.  Please don't give up on
| submitting the data.  Let us see if we can work out whatever the
| problem is.  The data you submit to us has been very valuable in the
| past in helping us foresee problems and I for one don't want to lose
| your participation.  Johannes has had a lot on his plate lately and I
| am sure is overwhelmed.  Let me see if I can get a message to him and
| maybe there is something I can do to help.
| 
| 
| Deb
| 
| Volunteer Handler - SANS Internet Storm Center
| 

Emailed this info (copy below) to Johannes Wednesday, June 15 at 19:28
(7:28 PM) UTC+3, in response to his post (FW: [Dshield]  db status
update), but since have not heard anything, and especially since the
issues continue to exist will post the same info via the list if that
might be of further help in solving the persistent issues:    


Johannes,

list-bounces at lists.dshield.org <mailto:list-bounces at lists.dshield.org>
wrote on Friday, June 10, 2005 1:19 PM (EET) UTC+3 on behalf of
Johannes B. Ullrich  

| There are still some old logs
| that ended up on an overflow system while the disk was full. I need to
| copy them over manually.


| Once the locks where removed and parsing started again, it still took
| a day for reports and such to get back to normal. The system was
| running in 'catch up mode'.


Thanks and congratulations for solving the recent problems with DShield
Submission Confirmations and Daily DShield Reports as well as the time
stamp web page.  

1) Have now to report that the Daily DShield Reports have ceased again.

The most recent Daily DShield Report received reads in title Daily
DShield Report 2005-06-12, i.e. have not received reports the several
submissions for June 13 and 14.  

2) It also appears that the recovery from the latest issues was
incomplete. 

>From and after Sunday, May 29 (one record with time stamp 2005-05-29
19:56:41 +03:00 submitted at 20:18 hrs when I logged off for that day)
until today I have submitted 300 submissions. I have received 255
DShield Submission Confirmations for the 300 submissions. Hence, 45
confirmations are still missing.    

Modest research performed at this end would suggest that the
problematic days would be June the 3rd and the 5th. June the 3rd I have
submitted totally 117 lines in 21 submissions and June the 5th totally
138 lines in 22 submissions.   

The figures have shown 45 missing confirmations for some time, so you
managed to recover about 80 per cent of my input and some 20 per cent
was lost, or is still missing.  

Is the server still catching up, or shall I just flush the submissions
with pending confirmations. 

- Pete


   "You can never solve a problem on the level on which it was created."
      Albert Einstein (1879 - 1955) German born American Physicist.






More information about the list mailing list