(Please keep it on the list) On Monday 04 November 2002 01:58 pm, hpinson@indepthl.com wrote:

Hi Casey. That is possible, the server hosts a well publicized political site. What would I be looking for in my logs out of the ordinary? Lots of CGI requests? Why would such a thing increase the data.fs size?

Looking at Z2.py would tell you exactly what requests are being made. As Chris pointed out, it might be that a change in the software causes normal read requests to change the database, which would explain the sudden growth. However, if somebody outside was able to figure out a method they could call remotely (either as anonymous or using a sniffed password) that writes to the database, they could do the same thing. Its only a hypothesis, what Chris suggested is probably more likely.

I guess to most useful thing I could ask is what information can I provide that would help to get to the bottom of this? I have just run tranylyzer.py, but will not get to look at the output until this evening.

I'm sure the output of any logs would mean more to you (or somebody familiar with the application) then it would to use. Nonetheless, we might be able to theorize from some suspicious samples of the logs. I dunno. -Casey