logwatch / webalizer

[Paul Howarth]

James Thorpe wrote:
> I've started getting these messages the same time as I get my daily 
> logwatch mail - I think it started happening the same time I started the 
> httpd service.  Any ideas on what's going wrong and if its anything to 
> worry about?
> 
> Thanks,
> 
> James.
> 
> /etc/cron.daily/00webalizer:
> 
> Error: Skipping oversized log record
> Error: Skipping oversized log record
> Error: Skipping oversized log record

It is some script kiddle trying (and failing, if your httpd is up to 
date) to provoke buffer overflows in your web server by asking it for a 
very long URL. I get a few of these a week. Look in your 
/var/log/httpd/access_log for the word "SEARCH" and you'll probably find it.

Paul.