Is log_in_vain really good or really bad?

[Roger Marquis]

z3l3zt at hackunite.net wrote:
> Yesterday someone "attacked" by box by connection to several ports.. In
> other words, a simple portscan.. yet, since my box has "log_in_vain"
> enabled, so it tries to log everything to /var/log/messages, since the
> logfile got full and the size went over 100K, it tried to rotate the log
> to save diskspace.

This is hardware problem.  Any ATA/SATA disk will suck up CPU with
every disk access.  The solution is to switch to SCSI.

Proper partitioning would also allow you to rotate log files every
10 or 20MB instead of at 100K.  For reasons exactly like this I
never partition a disk for anything other than swap.  If filesystems
need to be separated they're put on separate (SCSI) disks.

Whether you need log_in_vain or not depend on what you do with the
logs.  Are you compiling statistics?  Running Snort or another IDE?
Separating facilities into different files (other than /var/log/messages)?
Reading them regularly and often?  If you answered no to two or
more of these questions then there's probably little to lose by
disabling log_in_vain.

-- 
Roger Marquis
Roble Systems Consulting
http://www.roble.com/