[Dshield] Is DShield Dead?

Johannes B. Ullrich jullrich at sans.org
Mon Jun 20 11:50:38 GMT 2005


Joel Esler wrote:
> I received my first DShield report today in about a month.  WOO HOO!!
> 
> Joel

Good for you ;-)

The mian issue with the daily reports is large submitters. If someone 
submits a large number of reports (>100k or so), it can choke up the 
system if they ask for a daily report. I am working on finding a 
sensible threshold, and as a result the daily reports have been 
"spotty". Essentially what is happening:

Once a day the daily reports are compiled. However, if the script 
attempts to compile reports for a large submitter, it may "hang". If the 
script runs too long, it is killed so it doesn't block other things 
(e.g. new imports).

As a result, everyone up to the "kill point" will receive their daily 
report, but people later in the queue will not.

Now every couple of days, I adjust the upper limit for reports a user 
can submit and still get the daily reports.


-- 
---------
Johannes Ullrich                        jullrich at sans.org
Chief Research Officer                     (617) 639 5000
http://isc.sans.org
PGP Key: https://secure.dshield.org/PGPKEYS

"We use [isc.sans.org] every day to keep on top of
  security at our bank" Matt, Network Administrator.




More information about the list mailing list